HN user
Σ I am not for everyone. To ignore me in uBlock Origin, add to "My filters":
news.ycombinator.com##tr.athing.comtr:has(a.hnuser):has-text(/\bBender\b/)
- For HN usage questions see [1] for HN tips not my repo
- Suggested Firefox add-on to replace or restore inflammatory words and phrases: Foxreplace [2]
[1] - https://github.com/minimaxir/hacker-news-undocumented
[2] - https://addons.mozilla.org/en-US/firefox/addon/foxreplace/
(\_/)
(='.'=)
(")_(")Too many found out it was a ponzi scheme [1a][1b] and it fizzled out.
[1a] - https://www.youtube.com/watch?v=d_o3nZHzCwA [video][4 mins]
[1b] - https://www.youtube.com/watch?v=ZpqreZlmHGU [video][7 mins]
Thanks for catching that. HN often changes titles on submission and I don't always catch it. [fixed]
You may find the newpoll [1] option useful for this. Requires 500 karma to start one which you have.
I think you bring up a good point about privacy. Companies probably should not be handing over intellectual property to cloud AI third party vendors. Perhaps all of that should stay on-prem and then the cloud vendors could be used to fill in the gaps.
I suppose I was thinking in terms of companies that already had a slew of hardware and are just missing external GPU's, FPGA's or whatever people are using these days. A company might have a $50MM budget for tokens but could save a chunk of that using their existing hardware with some modifications.
I think the idea or methodology is something along the line of one starts with the local models then when they hit a wall then continue with their current results in a frontier model, thus the other half is those last bits one could not compute locally.
I am not a proper developer and only use AI for faster research of topics so please forgive my ignorance. Could one not save a lot of money on tokens by using the 80/20 or 90/10 rule in that 90% of AI usage is on local models and save that last 10% or less for the frontier models where the local model did not meet the needs? Did they cover this and I misunderstood?
"Movie Hacker" should perhaps include nmap and sshnuke [1] despite being a real command and a real skiddie exploit [2]. When that that first played in the movies (The Matrix) people in the bay area theaters were standing up and cheering. People not familiar with the tools were very confused as to what was going on.
[2] https://blog.doyensec.com/2025/03/04/exploitable-sshd.html
The dates should be the same if we are looking at the same cert regardless of openssl version. Your output does not contain IP addresses. I suspect mjmas may be correct in that someone or something is performing a man in the middle attack.
Do you have a security proxy or a corporate VPN? Some corporate IT setups will route people through a stack of security devices that may or may not decrypt your traffic. In the past there have also be anti-virus applications that have acted as a man in the middle proxy.
Or worst case there could be malware on your machine. Either way you should figure that out before putting anything sensitive on that machine or logging into anything sensitive. Make a physical note of all the sites you have logged into and find a clean secure machine to change all the passwords starting with your email provider(s) as attackers can prevent password changes if your email access is locked out. If this is a corporate laptop call your security operations center.
The certificate transparency site keeps timing out for me but maybe it will eventually respond for you or your team. [1]
If you add this [1] function to your shell and do
fp www.texasattorneygeneral.gov
Testing via IPv4:
texasattorneygeneral.gov.
104.18.152.79
104.18.94.91
sha1 Fingerprint=D7:6B:D1:D8:58:5B:16:4A:0B:D8:41:5F:FF:4E:DA:2F:FA:90:4F:4D
sha256 Fingerprint=94:4F:66:36:A5:AA:AF:17:3A:FD:9C:B6:F0:79:95:17:62:1C:8A:B8:B3:44:61:DD:61:BB:C1:26:C6:77:4F:0F
notBefore=Jul 4 12:45:24 2026 GMT
notAfter=Oct 2 13:45:15 2026 GMT
Testing via IPv6:
texasattorneygeneral.gov.
# ( no IPv6 here )
What does all of this give you?
Good question. A playground to test things. A place for bots and their kin to report themselves to me so that I can use this information for sites I actually want to protect a little bit. A place to share some ideas with a small handful of like minded people. I do not consider power savings for a device unless I have it running on one of my inverters or if I am doing that to constrain a potentially malicious node.
Blogs are throw away for me. After some time I delete the VM and edit articles offline for 6 to 18 months and then put them back up on another domain when there may be a need to share some old articles. This method disjoints the archive sites and breaks any filters botters have set up to ignore me. That also allows me to change the CSS. I try to make it smaller each time.
I also find it easier to put long form content on a blog of sorts instead of HN comments in the unlikely chance that YC removes HN due to future ID/Age verification constrains or other unforeseen reasons that we hope never happens.
I get what you mean. It happens all the time when some clown trashes an IP's reputation and Cloudflare or Google will send the next lease of that IP into crosswalk fire-hydrant bus traffic light purgatory.
That's why I eventually let those go usually after a kernel update and the git repo for FireHOL gets updated often. The kernels get updated often. I only perma-ban the data-centers which is fine for my silly blog and probably for some peoples hobby sites. People can chose which methods to apply, how to apply them or which ones to skip entirely.
Excellent username btw. Those SNL Celebrity Jeopardy episodes are unforgettable. [1]
In Memory of Fredrick Brennan (1994-2026). [1]
How do you decide when to add/remove a range?
The only IP's that come and go are the Tor 30 day blocklist and a couple FireHOL attackers from a repo though I will sometimes leave the last entries live until reboot. I do not really need to block tor but I use this silly blog as a testing ground. Tor and some known abusers come from a git repo I refresh periodically.
The data-centers, VPS providers, CDNs, known botnets are perma-banned. For my hobby nodes I personally find this acceptable. I would not do this in a professionally managed data-center. There are better methods for those cases especially for B2B corporate arrangements. Regardless of what daemons I run I never have external dependencies that need to be accessed from my node or from the client with exception of stratum-1 time servers.
I do have to periodically update the CIDR blocks for given ASN's. I have not automated this but I probably should some day. It's not hard to automate, I am just excessively "efficient". I was told to stop calling myself lazy, but I am.
Methods 2, 3 and 5 are the ones I talk about here. [1]
[1] https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...
My personal preference is to 'ip route add blackhole ${net}' as it has the lowest CPU overhead and I can add hundreds of thousands of CIDR blocks with no noticeable impact. The only downside is that it won't stop UDP packets from getting to a UDP listener. There will not be a response but the application will still see it. For my TCP daemons it's great.
grep -m1 -E ^Tot /proc/net/fib_triestat ;ip route | grep -Fc blackhole
Total size: 56735 kB
426951
I also use a couple generalized rules in nftables raw table that keeps a lot of beyond poorly written bots away including hping3 tcp floods and masscan. My rules to port 443 are stateless. One must not taunt the state table.
Not sure if it counts but I point many DNS records to 169.254.169.254 so that skiddies will scan the cloud init management interface of their VPS in hopes to draw attention. The result was the skiddies on Amazon AWS and DigitalOcean filtered my domains from their scan target lists.
Indeed. They also have an article about a neighbor from hell picking someone elses flowers.
Absolutely. Quite a bit of work one time by one person willing to document the steps or even better create automation scripts for Ansible, Docker, Podman, Systemd, etc... and then automation for everyone using agents. As to success I would suggest it may be better than zero visibility or trusting what the agent says it did. Due diligence and a repeatable standard as apposed to running with scissors.
This is probably most important for anyone operating agents on corporate systems. I would suggest corporate security should take interest in this idea so they have a good answer for auditors, insurance companies, investors and customers. A full audit trail of what every agent had access to and ingested.
A bot will do what a bot can do whether malicious or accidental. One should assume they are giving DOGE shell access on their computer and adapt accordingly. I am trying to imagine the SELinux rules required to make a bot play nice and the more I think about it such rule complexity may even befuddle the NSA. Alternate methodology:
- Give the bot it's own machine and only copy to it that which one would want DOGE having access to. Not a virtual machine, the bot will eventually escape. This applies to all bots or agents of all LLM's. Name the node DOGE to remind anyone using it not to share their crown jewels. Come up with a silly name for the agent. Elonious?
- Give it a little RasPi or mini-PC with maximum power savings enabled and no default network gateway.
- Install a self signed CA cert on the DOGE node and force it's traffic through a Squid SSL Bump MitM proxy on the same private LAN to another node with bandwidth limits enabled so that one can monitor what URL's it goes to and what data it is transferring. Configure Squid Access Control Lists to only permit specific domains and optionally URL's, mime-types, sizes, etc...
- Enable custom AuditD rules to watch anything it touches outside of it's sandbox. Send these events to a remote syslog daemon on the Squid server.
- Install Unbound DNS on the squid proxy and enable the DoH (DNS over HTTPS) listener and force all bot DNS queries to use Unbound with query logging enabled.
When the bot attempts to misbehave there will be forensic data to share with the world.
from an Aortic Rupture due to hardening of the arteries
I documented some crude methods that can stop most of that without a CDN. [1] There will be some false positives so I guess it depends on ones priorities which methods if any to implement or test on a throw-away test site. Not perfect, nothing is. I am watching hundreds of bots sending SYN's and the daemons are oblivious to them. The only method I have not played around with yet is #7 ssl fingerprinting.
There are additional methods I chose not to document such as limiting access to logged in accounts that require double-opting-in to acceptable use policies and terms of use, not that most scrapers would give a toss. That it too much whack-a-mole for me personally. That method requires progressively adding friction to account creation and that comes with some pros and cons.
[1] https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...
Test2 [1] if that was too easy. Give your LLM the URL and have it tell you what the file says.
This is just a static HTML file created by the program Toilet [1] not my repo, and compressed with Brotli [2] also not my repo.
I am just curious if LLM's can:
- reach and parse the file,
- comprehend what it says.
Browsers can parse it because they will accept the most abhorrent HTML. Humans can understand it because they are intelligent. I am curious if AI bots are also this tolerant. I know, it's a silly and stupid test. I am just curious which LLM bots are able to cope and if this is a way humans could communicate a short message without bots snooping.
Why does it have to be under gov.ua?
That is just a wikipedia page. Russia could have easily set that up. But now that we discussed it people can choose what to verify and what to believe. You know what they say, "Chem men'she znaesh,' tem loocheh"
Unmanned system forces
Who is that? What is their official page under gov.ua?
To mitigate the LLM's learning how to decode the Ghost Font perhaps it could change each time for each client in a way that makes learning difficult to adapt to. Variable noise, variable directions, variable angles, variable blur, variable colors, variable pixel sizes. Seed the variability with the first two octets or hextets of their IP and the time of day to increase difficulty in learning through brute force. assuming this will not mess with people that have sensitivity to seizure inducing patterns.
Out of curiosity can any of the LLM's:
- reach this [1] directly
- and decode it?
If so, which LLM's can reach it and which ones can decode it? It's just a static HTML file, nothing fancy. If any of them can reach it directly then I have homework to do. Created using:
echo -en '\nA I\n\nT e s t\n\n' | toilet --metal -f pagga --html | brotli --best -fncv > /dev/shm/test.html.br
When you browse a site what Accept-Language header is your browser sending? [1] If sending en or en-US or en-GB then I don't know why they would not just that by default. If sending multiple languages then I guess they would have to offer the alphabetically sorted options. It's just a guess. They have never asked me to pick a language. All of the languages they offer are real languages. I would be impressed if they offered fictional or dead languages.
Not dang and not the person you are asking but there is no CDN. HN is just two servers running BSD one active and one standby. HN is all text so there is not much bandwidth usage.
I did an experiment and linked from HN to my lame blog site and disabled all my anti-scraping measures. Even with all the bots I did not see that much traffic. I suspect some people are specifically being targeted by very poorly configured or very poorly written archiving scripts. Just one example thread discussing this with someone on HN [1]. Each case of being targeted will require looking at generalized characteristics but most are easy to stop in my opinion and experience.
I think the planet will do just fine without us but we will likely hit one of many great filters long before we colonize anything outside of Earth. The list of dumb things we do as a civilization are too long to list on HN. I am honestly very surprised we still exist and can still reproduce.