HN user

surround

3,165 karma
Posts40
Comments462
View on HN
web.archive.org 4mo ago

Story of a Failed Pentest (2018)

surround
2pts0
www.cultofmac.com 11mo ago

How a 25-year-old dev made 600 apps without being able to code (2015)

surround
3pts0
security.stackexchange.com 4y ago

Can a rogue .wmv file “hijack” Windows Media Player?

surround
3pts0
phillipecantin.blogspot.com 4y ago

Lego's magic number is 37,112

surround
4pts1
www.bbc.com 5y ago

Why Japan Celebrates Christmas with KFC (2016)

surround
87pts100
web.archive.org 5y ago

No-Prizes (1986)

surround
2pts0
en.wikipedia.org 5y ago

Polar Bear Jail

surround
6pts0
github.com 5y ago

Libreddit – Private front-end for Reddit written in Rust

surround
4pts0
www.mike-gualtieri.com 5y ago

Stealing Data with CSS (2018)

surround
1pts0
duckduckgo.com 5y ago

make me a sandwich

surround
5pts2
developer.mozilla.org 5y ago

Firefox 3D View

surround
1pts1
dumps.wikimedia.org 5y ago

Download the Entire Wikimedia Database

surround
151pts74
github.com 5y ago

Firefox sponsored topsites proxy – Weak/Misleading Anonymity Claims

surround
3pts0
jtra.cz 5y ago

Self Referential Formula in Math (2011)

surround
33pts4
universalsplitscreen.github.io 5y ago

Universal Split Screen

surround
486pts61
www.instructure.com 5y ago

Canvas: Open-Source Learning Platform

surround
3pts0
www.archiveteam.org 5y ago

Deathwatch

surround
2pts0
innersloth.itch.io 5y ago

Among Us 2

surround
1pts0
opendyslexic.org 5y ago

OpenDyslexic: A Typeface for Dyslexia

surround
90pts76
github.com 6y ago

Hacker Scripts

surround
2pts0
addons.mozilla.org 6y ago

Firefox Extensions – Most Users

surround
1pts0
mondaypunday.com 6y ago

Monday Punday

surround
2pts0
github.com 6y ago

uBlock Origin on Firefox Preview

surround
330pts96
your.mom 6y ago

Your Mom

surround
2pts0
https4all.org 6y ago

HTTPS4All – unofficial port of HTTPS Everywhere for iOS

surround
3pts0
cypherpunks.venona.com 6y ago

A Parable. (1993)

surround
1pts0
www.mentalfloss.com 6y ago

The Worst Industrial Disaster in U.S. History

surround
1pts0
git.jami.net 6y ago

Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

surround
286pts75
twitter.com 6y ago

Adblocker Ultimate shouldn't be recommended by Firefox

surround
2pts0
www.cultofmac.com 6y ago

How a 25-year-old dev made 600 apps without being able to code (2015)

surround
3pts0

Minecraft gained popularity super fast in its early days, probably because it was a free-to-play game that worked in the browser (thanks to Java). Notch had no reputation or marketing at the time.

GPT‑Live 14 days ago

How does the voice model delegate requests to GPT-5.5? Can the voice model generate text?

in sensitive situations, law enforcement and border agents in many countries can compel a biometric unlock in ways they cannot with a password.

If the threat model includes state-level actors, then disabling biometrics won't prevent data from being retrieved from physical memory. It would probably be wiser to enable disk encryption and have a panic button that powers down/hibernates the computer so that no unencrypted data remains on RAM.

The website says shutdown "takes time" and "kills your session" but a hibernation button would take effect just as fast and would preserve the session.

It seems like Google's policy is unconcerned with the intent of the practice. If a website JS redirect ruins the user experience by breaking the back button, it will be demoted in search results. It doesn't matter whether or not the redirect was meant to be deceptive or malicious, websites shouldn't be ruining the user experience.

There was an incendiary article about me a few days ago. Someone said to me yesterday they thought it was coming at a time of great anxiety about AI and that it made things more dangerous for me.

For context his blog post seems to be a response to this deep-dive New Yorker article:

"Sam Altman May Control Our Future—Can He Be Trusted?"

https://www.newyorker.com/magazine/2026/04/13/sam-altman-may...

https://news.ycombinator.com/item?id=47659135

Try asking an LLM a question like "H o w T o P r o g r a m I n R u s t ?" - each letter, separated by spaces, will be its own token, and the model will understand just fine. The issue is that computational cost scales quadratically with the number of tokens, so processing "h e l l o" is much more expensive than "hello". "hello" has meaning, "h" has no meaning by itself. The model has to waste a lot of computation forming words from the letters.

Our brains also process text entire words at a time, not letter-by-letter. The difference is that our brains are much more flexible than a tokenizer, and we can easily switch to letter-by-letter reading when needed, such as when we encounter an unfamiliar word.

But for lisp, a more complex solution is needed. It's easy for a human lisp programmer to keep track of which closing parentheses corresponds to which opening parentheses because the editor highlights parentheses pairs as they are typed. How can we give an LLM that kind of feedback as it generates code?

I think you're right. Try asking GPT-5 this:

Are the parentheses in ((((()))))) balanced?

There was a thread about this the other day [1]. It's the same issue as "count the r's in strawberry." Tokenization makes it hard to count characters. If you put that string into OpenAI's tokenizer, [2] this is how they are grouped:

Token 1: ((((

Token 2: ()))

Token 3: )))

Which of course isn't at all how our minds would group them together in order to keep track of them.

[1] https://news.ycombinator.com/item?id=47615876 [2] https://platform.openai.com/tokenizer

Is BGP safe yet? 4 months ago

Wow I'm surprised, you're right, and it has happened before:

the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate.

https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...

Is BGP safe yet? 4 months ago

The graphic that shows that a hijacker can route traffic to their malicious website is a little misleading. Since the SSL certificate would be invalid, browsers would block the connection and show a warning.

I guess the attack could still be used for denial of service.

Trust your own style, even if you aren't a native English speaker. Here's an example where a non-native speaker used an LLM to polish his post. The general consensus was that his own writing was preferable to the LLM's edited version.

https://news.ycombinator.com/item?id=45591707

For dyslexia, use a spell-checker. For grammar, use a basic grammar checker, like the kind of grammar checker that has come with MS word since the 1990s. But don't let a style-checker or an LLM rob you of your own voice.

What You Can Do To Protect Yourself

1. Disable your mobile advertising ID

2. Review apps you’ve granted location permissions to.

I'm surprised they missed the most important step, which is blocking the advertisers from collecting your data in the first place. This is easily done in the browser with uBlock Origin and system-wide with DNS filtering.

Wikipedia says

  Ek's initial pitch to Lorentzon was not initially related to music, but rather a way for streaming content such as video, digital films, images or music to drive advertising revenue.
So yes, they were always intending to get revenue from ads. And yes, the initial pitch included other types of media too. But I don't think we can call Spotify "an ad platform" that "never actually cared about music" any more than we could call Ars Technica "an ad platform that never actually cared about tech news."