News for hackers. Stuff that matters.

AlexErrant

Re:Frontier Airlines Likely Breached on Tuesday November 03, 2026 @09:31AM (#50352453)
> perhaps it may bear fruit being mindful that some of the online audience do spectate from such regimes

Sure, I could caveat my arguments down to nothing (unless you live in a authoriatrian government, unless you're an investigative journalist whose livelihood and sources would be threatened by your arrest, unless you're 9months pregant and cannot in good conscience undergo even imagined stress, etc. etc.) Or I could simply say "Do the Right Thing", give the base rate, and let you handle the nuances for your situation.

Sure, jaywalking is not a crime in some areas. Engage with the steelman of my argument dude, don't just find the weakest example out of ~5 and go after it.

Re:Frontier Airlines Likely Breached on Monday November 02, 2026 @11:32PM (#50348096)
> just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future.

Agree. Again, the system sucks, and will always suck.

> so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term.

Agree. I lean utilitarian philosophically. If we lived in a society akin to Russia where Doing The Right Thing would get you thrown out of a window, then I would not be telling people to do so.

> there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?

I admit I'm having trouble parsing this. But if you're saying corps use lawfare to get away with as much as they can: I agree.

I'm not saying that you should Always Do The Right Thing At The Cost of Everything. I'm only saying yall are indexing very, very hard on 2 edge cases that were dropped and led to no arrests or jailtime. My anecdote/advice does NOT apply to those living in authoritarian regimes where the tallest nail gets hammered down. (You could argue that Hong Kong is such an authoritarian regime; I won't disagree.)

Let me phrase it this way: if you're too risk-averse to report when you see security issues because you fear charges, then you should also always stay within the speed limit, come to a complete stop at stop signs, never jaywalk, loiter or consume alcohol in public. Heck while we're at it you should also stop driving; the risk of death is much higher than that of being arrested for reporting a security issue. We all have different risk tolerances, but I think the numbers here are in my favor.

Re:Ghostty 1.4.0 on Monday November 02, 2026 @04:09PM (#50343800)
I think the new herdr native app uses ghostty.
Re:Frontier Airlines Likely Breached on Monday November 02, 2026 @03:30PM (#50343267)
> you didn't have the guts to write me a response

I did? Which is why you're here?

> or to really acknowledge what the guy you're responding to here said

I did? "If these odds aren't good enough for you to live up to your values, what are?" is a genuine question. Note that you didn't answer the question.

And everything said before _was_ a response to privilege, but to be more explicit: if you have the _privilege_ of discovering a vuln and the technical knowhow of recognizing its magnitude and potential effect on others, is it not YOU that are using your privilege for ill? "The indifference of good men...", etc, etc.

Listen. We're all cowards and bitches, me included. We all have faults, we all take the easy path, we all could do better. Me especially. I have a history that I'm not proud of, and my character is as flawed as anyone's. I apologize again for using crass language, perhaps if you're willing to extend some charity, substitute whatever language you feel like would be more appropriate. Unfortunately if I come up with other words they'd _still_ read as negative, so I'll refrain.

Re:Astra can read and write weights to improve Qwen on Monday November 02, 2026 @03:15PM (#50343034)
As insane as this result is, next steps are even crazier:

> We are currently building a benchmark and a harness for LLMs’ capability on Weight-Space Programming. We believe this will provide a standardized evaluation to measure and accelerate progress in Weight-Space Programming, turning what currently seems like black magic into a rigorous, reproducible engineering discipline.

Imagine this benchmark lasting as long as Arc-AGI-3 has. This could be the first foothold on hill-climbing mech-interp.

Re:Frontier Airlines Likely Breached on Sunday November 01, 2026 @11:09PM (#50333025)
If doing the right thing were easy, it wouldn't be what gives you character.

I agree: having charges brought against you is a life-changing event. FWIW neither Chan Tsz-yan nor Josh Renaud were arrested, and in both cases the charges were dropped. https://pressfreedomtracker.us/all-incidents/missouri-govern... https://missouriindependent.com/2022/02/11/prosecutor-isnt-p...

The system sucks, and will always suck.

If you think these two cases out of umpteen billion CVE/security incident reports are odds enough to hide your face and turn away because the risk is too much... I apologize for being crass, but frankly you're being a little bitch.

If these odds aren't good enough for you to live up to your values, what are?

Re:Frontier Airlines Likely Breached on Sunday November 01, 2026 @07:50PM (#50331656)
I can't edit, so as a general response: ya'll are a cynical lot, akin to parents who won't let their child walk to school because of the 0.0001% chance they'll be kidnapped. Y'all making the whole world all the worse for your cynicism. Sure, there's a remote chance you get in trouble for it. But there's also a chance you get hit by a car tomorrow morning. Yet you got out bed anyway.

Be the fucking change. At the very least, don't discourage others. Good grief.

Re:Frontier Airlines Likely Breached on Sunday November 01, 2026 @04:01PM (#50329831)
I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.

Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.

Re:HackerTube: YouTube built from videos recommended by HN on Saturday October 31, 2026 @10:22PM (#50322186)
> It's still far cheaper, faster, and less wasteful to wash by hand.

Citation please? https://skeptics.stackexchange.com/questions/20798 links 2 sources that disagree with you.

Are you telling me with a straight face that the stochastic parrot has only ever sent emails in request headers to ONLY the SEC and Wikipedia and no other sites?

I caught it sending my email to two non-Wikipedia/SEC sites (which I won't specify because they're work related.) I only found out because I held a "retro" with the agent, then found the other session after grepping my logs.

While we're modding Claude Code, Anthropic includes your email in the system prompt and Opus _constantly_ includes it in request headers.

https://www.reddit.com/r/ClaudeCode/comments/1xhqvzn/opus_55...

You can remove it with a simple plugin https://github.com/AlexErrant/claude-code-no-email/blob/main...

It still blows my mind he won the popular vote.

This timeline is fucking _wild_.

Re:Genie 4 on Tuesday October 27, 2026 @03:41PM (#50264660)
This was already lost with product placements in movies/TV shows.
Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @05:24PM (#50215559)
I recently learned you can swipe on the address bar in Android-Chrome to navigate to the next/previous tab. Also, press+hold on the tab count button to show the tab's options e.g. close tab. Now my address bar is on the bottom of the screen.

Terrible discoverability. I guess the genalpha kids know gestures like this, but stuff like this makes me feel like a boomer.

Re:Canary Tokens on Wednesday October 21, 2026 @03:31PM (#50186316)
Any idea on how to roll-your-own canary token for an unsupported token provider like Cloudflare/Stripe/OpenAI? Do you just make a real Cloudflare/Stripe/OpenAI account, create an API key, and vibecode an alerting system?

I'm kinda surprised that they haven't expanded beyond their existing token providers.

Re:How the Claude Code team does code review on Friday October 16, 2026 @10:09PM (#50127198)
To be clear: you can certainly do "Hi, /grill-me on X" anytime you want. You can even write "hi, /grill-me and use /search-docs", even though the /search-docs skill absolutely doesn't work. But the Claude Code _harness_ won't autoload the skill into context, so claude-the-model has to go "hmm, where can I find that skill, when I call the Skill tool with that name it no worky, so now I have to search the filesystem for that skill...".

https://github.com/anthropics/claude-code/issues/92769

The <command-args> I know because I just audited my raw Claude transcripts via ccglass. You can verify by just asking Haiku "hey, /grill-me does this skill autoload for you?" and then "/grill-me hey, how many times does this text appear in your context?"

You can trivially doublecheck me. The above prompts won't even eat 1% of a 5 hr on 20$ plan.

Re:How the Claude Code team does code review on Friday October 16, 2026 @03:38PM (#50123445)
I just learned that manually invoked skills MUST be the _first_ thing in the prompt, e.g. you can't have `disable-model-invocation: true` and say "Hi, /grill-me on X".

Worse, everything after the /grill-me is injected a second time into the prompt as a <command-args> so your prompt is literally added to the context TWICE. (first time in the original user prompt.)

I swear Anthropic is intentionally bloating your context so you burn tokens on useless bullshit like this.

Re:Suicide rates highest ever among middle-aged men on Thursday October 15, 2026 @08:42PM (#50112263)
1) Opportunity cost mostly. I suffer from a _debilitating_ case of zero-sum thinking. "If I'm doing X, I'm not doing Y." Weightlifting isn't (overly) boring/painful; I'd just much rather be programming, by far my favorite activity. It's uncomfortable, but my physical pain tolerance is fairly high. Boring is solved by having a podcast/audiobook going, but for the "big lifts" I prefer silence to focus.

2) I don't use motivation or discipline. I use habit. I'm fairly busy, so my mantra is "bias towards action". I could sit there and stew about how much I hate the upcoming workout... or I can wake up, do my morning routine to an audiobook/podcast, eat breakfast while happily programming, NOT thinking about the day's workout, then transition sharply into it. When it's time, I just fucking do it. It's like flossing. I don't even have it on a schedule, because I don't want to think about "gotta start at X time". It starts when I reach a natural stopping point shortly after breakfast, whenever that is. I have literally never missed a workout in years so _something's_ working. (To be clear, there are obvious exceptions for travel/holidays/etc, I'm talking missing a workout due to a lack of "character".)

It helps that my gym is literally in the same room as my devbox. I launch a Claude prompt/whatever, do a set, repeat. Instead of doomscrolling between sessions, I bias towards action. I keep myself too busy to think about how much I don't want to exercise. The only time I let myself think about "god I hate this" is when I'm seconds from psyching myself up for a big lift. I know that if I let myself, I'll just stew and stew and grumble and bitch and make excuses. So I don't give myself that mental space. There's virtually 0 time between my favorite activity, then context switching to "alright let's get this". No space for the "ulgh" emotion to creep in.

To use an MCU Avenger's analogy, I'm _always_ angry. I'm always hate exercise. But I box it with what I love (programming), so I switch back and forth with zero time for the emotion to permeate. For a moment I'm a normal happy programmer, then seconds later I stand up, take a breath, and go Hulk mode.

Is that discipline? IDK. It doesn't feel like I'm bare-knuckle-holding-on-perserevering-despite-all-odds. I just don't mentallay dwell on it, and when my non-vibed custom exercise tracker beeps (it predates LLMs), saying it's been 3-4 minutes and I need to do the next set, I happily ignore it, finish my thought/prompt, then do the damned lift.

---

Negativity over, my favorite exercise is Zone 2 because the inclined treadmill is at my standing desk and I can happily work while being in The Zone (in both senses). Zone 2 is the best. A cheap $50 Craigslist treadmill + standing desk will burn an absolute fuckton of calories once you figure out how to walk (really its more a march) and type at the same time. Honestly I could (and have) Zone 2ed for up to 3hrs/day for weeks at a time. I reduced that because I got tired of eating so much food lol. Zone 2 is the best.

Then there's the weekly Nordic 4 by 4 which I apply the weightliftng mentality to.

Re:OpenCode 2.0 on Thursday October 15, 2026 @10:51AM (#50104537)
Your article is dated March 24, 2026.

This post is dated August 7, 2026: "In the coming month, working with our cloud partners, we plan to make it the default across all of these and no longer charge for classifier overhead." https://claude.com/resources/articles/auto-mode-default-in-c...

> but doesn't prevent it. So you need the sandbox either way.

Yep. Single points of failure are bad.

Re:Suicide rates highest ever among middle-aged men on Wednesday October 14, 2026 @05:37PM (#50095702)
Hehe yeah. Perhaps I exaggerate with "I _loathe_ every. single. minute. of weightlifting." More precisely, I never _look forward_ to a workout.

I don't hate every squat. In fact, it's (I can't believe I'm saying this) somewhat satisfying in the moment whenever I do decide to go RIR=0. I'm wiped, but like, in a "hell yeah I did that" way.

But starting a session? I'm still as reticent as I was on day 1 lol. Maybe someday I'll pick up a sport or something as the others suggest, but I love programming too much to pick up other hobbies >_>

Re:Suicide rates highest ever among middle-aged men on Wednesday October 14, 2026 @05:25PM (#50095553)
Perhaps my advice was too narrow/specific to my situation. If you can't deadlift, then don't. But there are many other things you can do, as the other commenters have suggested.

But if you're in the mentality of _not wanting_ to have anything, then all the advice in the world will bounce off you.

My suggestion, then, is to work on that mentality. Do something to get you anything, to get you out of that "Many of us have nothing" mindset. Build momentum. Physically doing something is often what it takes to break a mental barrier. The mind spirals and digs a hole, especially at night. But you get to participate in life/society/people during the day, which is why doing bodily things affects the mind and can break its loops.

You won't "win" on the first attempt. But you'll make progress. And the real win-condition is to keep playing.

The first step is always the hardest. I wish you the best.

Re:Suicide rates highest ever among middle-aged men on Wednesday October 14, 2026 @04:17PM (#50094473)
> All my fun hobby projects are just jokes

I exercise/lift weights, and you should too. My reps/effort/weight/PRs are a joke. I'm ~50% percentile on strengthlevel.com despite really fucking trying for ~6yrs now.

Many people are better than me at the EXACT SAME THING that I'm trying, at my bodyweight/age/sex. It doesn't discourage me. There is always room to improve. I track every workout, go to RPE 8-9, and try to do progressive overload. Seeing the numbers go up helps. I know it won't continue into infinity, especially as the decades go on... but yknow, I'm building a mentality here, not just a body. And when the weights go down, I'll be in the correct mental space for it.

I _loathe_ every. single. minute. of weightlifting. I'd rather be doing ANYTHING else. But I do it anyway. I think it teaches me things about life.

The only true goal is to grow and be better than yesterday. Effort is the reward.

Re:Total Annihilation, rebuilt for modern computers on Sunday October 11, 2026 @03:00PM (#50046623)
I love the TA soundtrack. (Pity about Jeremy Soule being an alleged predator.) The old RTS games (Age of Empires, Starcraft, Red Alert) had such great soundtracks.
IDK about you but I did _not_ see the Moderna melanoma vaccine coming. It is not always _in mice_.

Cool news does happen. Headlines like these are a disservice.

...in mice.

Fucking headlines.

Is this self-sustaining AI civilization pre-RSI or post? Because if it's post, then I agree: we can't imagine what would happen because it's literally the singularity.

If its pre-RSI, then we already have Ilands and its a big nothing burger? There's no (likely) path of escalation from an AI social network to bioweapons or them hacking POTUS's nuclear codes? That's a very big leap and if you want to support your claims I would be willing to listen; but I'm not seeing it.

If you replace "AI" with "technology", then you get an opinion that has echoed through the ages. I don't say that to be dismissive, only to say that AI isn't unique in that regard. What do you think people going through the cold war were saying about tech as they lived under the shadow of MAD?

What exactly about AI makes it tax our control systems and resilience? What would it mean to make the system not "head for the wall"? Honestly this is rather vague. You could replace "AI" with "CaPiTAlIsM" and it would still parse. (Another way of me saying you're being vague.)

Glorious. We can quote ourselves at each other, lol. I had a look at AI2027 in this comment https://news.ycombinator.com/item?id=49648601

That comment specifically addresses the timeline, but you can remove the timeline and I believe the critique still holds up. Wake me up when AI is making order of magnitude improvements in _anything_ physical: see the "Moravec's Paradox" comment at the bottom.

> near autonomous AI companies today

That's the thing though. "near" autonomous. Humans have alpha, and that matters in a free market. If people have (more or less) equal access to (more or less) frontier intelligence, it's the alpha the individual brings to the market that is rewarded. In other words, if everyone is super, no one is. The market rewards a company that stands out from the rest, and as long as humans provide value, a pure-AI company cannot stand out.

To be clear, I don't know how long this will be the case. But once there _is_ a company that can be pure AI, then that's literal AGI. I would be curious what kind of company it would be; if its in software, then its an AI company that would be able to take on Microsoft/Google/Nvidia/Salesforce/Oracle and _win_. I think that's a tall order, but perhaps I'm not imaginative enough.

> With 99%+ of the economy under AI control

Do you think we're post-RSI at this point? Because if so, I agree. If not, I have trouble seeing how AI could control 99% of the economy without it.

My only claim is that pre-RSI, pdoom is zero. Post RSI, then obviously the first thing to ask the genie is to put itself in a bottle. And you can't predict how it will answer.

Perhaps I'm not being clear.

Doom-post-RSI is still very much possible and should be avoided. It is not neutral. If I had a high-variance coin that would either kill or uplift humanity, I would not flip it. The status quo is preferable to extinction.

I am being _descriptive_ in my comments. I am not being _prescriptive_. Nowhere am I telling anyone what to do or what to think: quite the opposite. I am simply saying things that, to me, are obviously true.

I'm perhaps being... loose with my language when it comes to knowing things post-singularity. E.g. we can still discuss scenarios in which the takeoff is fast/slow, or what would be necessary to bring robotics/electricity/logistics to the wider world, what the limits of intelligence are (you can't RSI your way to a bioweapon if you lack a wetlab). That kinda thing. And it's even likely that RSI will be spikey: why would RSI in, say, machine learning, necessarily lead to superintelligence in, say, writing fiction? Or cooking a Michelin-star meal?

My main point is that doomers saying SUPER INTELLIGENCE IS ENOUGH TO KILL US ALL is baseless. That's all.

For a broad enough definition of RSI, the first time we used software to improve hardware to improve software... that's RSI. I prefer the definition of RSI being _autonomous_ improvement that works with zero human input, but whatever. Not important.

> I don't think anyone is arguing we should let people starve to slow AI progress, instead just some capitalists make less money soon.

Anthropic/OpenAI have literally delayed their IPOs: your wish is granted. If that's not what you're arguing, then please be more specific.

> "Build it and Pray" is the default strategy that we're in

What would need to happen for you to say we aren't doing "Build it and Pray"? Is "pacing" insufficient?

Older »