News for hackers. Stuff that matters.

Thorrez

This thread is about a locally running LLM, with an air gap.

How can a third party company harvest anything from that? Even if you didn't develop the LLM yourself, if you downloaded it and are running it locally with no internet access, I don't see how it'll leak info to a third party.

Re:The Utopia of the Family Computer on Saturday April 18, 2026 @02:12AM (#47813536)
One idea is 2 family computers next to each other. LAN party!
Re:NASA Force on Saturday April 18, 2026 @01:57AM (#47813496)
Yes, it's a subject without a predicate. So it's not a complete sentence.

That doesn't mean it doesn't make sense. Let's say there's an image with the caption "A man looking at a fish in a tank." That's similarly a subject without a predicate, but it still makes sense as a photo caption.

There are numbers in between 1.4 and 4.02. There's no reason Switzerland would need to swing to the complete opposite end.
What if the AI is configured to only do ephemeral conversations? Nothing stored.

What if there's no typed or visible text, and the entire chat is done via audio?

Interestingly, Ford received a Kennedy Award for pardoning Nixon.

https://www.nytimes.com/2001/05/22/us/ford-wins-kennedy-awar...

Re:Bring Back Idiomatic Design on Sunday April 12, 2026 @02:11PM (#47742596)
>using GMail is nothing like using GSuites is nothing like using Google Docs

G Suite (no s) was the old name for Google Workspace. Google Workspace includes GMail, Google Docs, Google Sheets, Google Calendar, etc., so it doesn't really make sense to say that Google Workspace has a different UX than Google Docs, if Google Docs is part of Google Workspace.

Disclosure: I work at Google, but not one of the listed products.

>The entire idea behind POW is that the total amount of work must be in direct relationship to the total value of the coins in the network, or else coordinated attacks become possible.

The total amount of work must be in direct relationship to the amount an attacker can gain from executing a 51% attack. It's not clear to me that if bitcoin doubles in price, an attacker can gain double the amount from a 51% attack. A 51% attack doesn't allow direct theft of other people's bitcoins. It allows double spend attacks, denial of service attacks, and through those, the ability to tank the price of bitcoin.

>Just think about how your "If it's using Europe levels of electricity at time X, then after a block reward decrease, it'll use Europe/2 amount of electricity" sentence doesn't make any sense, because eventually in 2140 or so there will be no block rewards, so according to your logic no electricity at all would be required to run the network.

It's possible for a block reward to be larger than necessary for security. In that case it can go through several halvings that purely improve efficiency without putting the network at risk. Yes, at some point, with a sufficiently large number of halvings, the network would be at risk, but that doesn't mean we can't have some efficiency gains before that happens. Your previous comment referred to bitcoin using more electricity than Argentina. That's a statement about how much electricity it's currently using, not a statement about how much electricity it needs to use to get the necessary amount of security. It might be possible to decrease the electricity usage while remaining sufficiently secure.

Re:CPU-Z and HWMonitor compromised on Saturday April 11, 2026 @07:16PM (#47734807)
Burning an identity? Instead of hacking the server that serves the binary, you have to hack the developer's machine and commit a malicious source change.

I wouldn't consider either of them to burn an identity.

I agree. My point is that this isn't an "obvious hole in the whole E2E encryption setup", because no network actor (e.g. Google, Apple, Signal servers) can read the data.

This "hole" in E2E is the same as any malware on the device. If the device cannot be trusted, no form of E2E will work. The E2E encryption is functioning properly. The problem here is completely unrelated to E2E encryption. E.g. you could have a personal notes app that makes no network traffic, but generates notifications occasionally regarding your notes, and it could have this same problem, even though no messages are sent over the network, and in fact the phone could have all networking capabilities disabled and still have this problem.

>This makes sense and there's really no way around it without a change from Apple.

There is a bit of a workaround: Signal has a setting to not put message content in the notification. That fixes this AIUI.

While I don't disagree in general, there are a couple gaps in your reasoning that weaken the argument:

Adoption doesn't necessarily correlate completely with price. Price can increase without much adoption, due to speculation. In theory, adoption could also increase without much price increase.

Electricity isn't the only requirement for mining. Hardware is also required. Miners can't simply use lots of additional electricity if the hardware isn't there. Yes, new hardware can be manufactured, but it takes time.

The block reward decreases over time. If it's using Europe levels of electricity at time X, then after a block reward decrease, it'll use Europe/2 amount of electricity. This decreasing also disincentivizes manufacturing new hardware.

Miners can have different efficiencies, due to different types of hardware, and different types of electricity generation. So while the least efficient miner will be operating at near breakeven, the most efficient miner will be making much more profit. So while the least efficient miner will use $1M of electricity to mine a $1M coin, the most efficient miner will use less dollars of electricity.

AIUI, Signal push notifications just saying a message was received. Signal then fetches the E2E encrypted message from the server and decrypts it locally. So Apple/Google cannot read the messages, nor can Signal servers.
Re:An AI Robot in My Home on Friday April 10, 2026 @11:23AM (#47719527)
One benefit is avoiding screen time. You can't get sucked into your phone/computer if you don't touch them. Looking up a piece of information using the smart speaker helps prevent distraction.

Another benefit is if your hands are full. For example if you're cooking or driving.

Another benefit can be speed. If you're doing something in your house near the smart speaker, it's probably faster to ask it a question than to pull your phone out of your pocket, unlock it (I only have a password, not fingerprint/face ID), and type in the query. For people who are slow at typing, this benefit is larger.

If the top offer is 15 GB, then 15GB is competitive, even if multiple providers offer it.

Disclosure: I work at Google, but not on anything related to this.

Re:Many African families spend fortunes burying their dead on Thursday April 09, 2026 @08:20PM (#47712039)
Yes, we spend a lot on weddings, but not as much (adjusted for income) as they do on funerals. In Ghana they spend 2.3x-9x the yearly median income[1] on a funeral. The median income in the US is $45,140[2], so if we were to spend the same amount relative to income on weddings as they do on funerals, that would mean our weddings would be $103k-$406k.

[1] https://remotepeople.com/countries/ghana/average-salary/

[2] https://fred.stlouisfed.org/series/MEPAINUSA672N

I replied to those options here: https://news.ycombinator.com/item?id=47711594
The receiver will immediately move the bitcoin. So it has the same downside.

If the receiver doesn't immediately move the bitcoin, the receiver is at risk of Satoshi stealing them by retaining the private key and moving them later.

Even if the receiver trusts Satoshi, if the receiver wants to spend the bitcoin on anything, there's the same problem again.

Why is being dead a convincing idea? How old do you think he is/was, and why would it be likely that he would die? When do you think he died? The idea that he died doesn't explain how he came out of hiding twice.

Losing access by intentionally deleting the keys? That agrees with my point that he knows it would cause problems to spend them, and decided not to spend them.

Losing access by accidentally deleting the keys? Would Satoshi really be that careless?

This [1][2][3] seems to have a methodology for identifying Satoshi's coins, mined from 2009 to May 2010. But yes, for coins mined after May 2010, he likely can spend without scrutiny.

>The idea that if his coins move everyone would panic is a post-2015 idea

Here are 2 people in 2013 expressing that idea: [4][5].

[1] https://bitslog.com/2013/04/17/the-well-deserved-fortune-of-...

[2] https://bitslog.com/2013/04/17/more-on-block-mining-history-...

[3] https://bitslog.com/2013/04/24/satoshi-s-fortune-a-more-accu...

[4] https://news.ycombinator.com/item?id=5569077

[5] https://news.ycombinator.com/item?id=5569346

Re:I Ported Mac OS X to the Nintendo Wii on Thursday April 09, 2026 @05:10AM (#47701087)
In one of the pictures, the laptop is on his tray, and the wii is on the tray of the seat next to him, and that seat looks empty. So the wii got its own airplane seat?
What's the much more plausible reason?
Satoshi cannot spend his fortune. If he did, it would be visible on the blockchain and bitcoin's price would collapse.
>why would you do that if you were rich?

Satoshi can't spend any of his bitcoins without tanking bitcoin's price. So Satoshi needs to find some other way to support himself. Creating bitcoin related companies is one way.

Bottle rockets I assume. I had a lot of fun with them as a kid. Thankfully no one involved with those got hurt.

https://www.nhpyro.com/black-cat-bottle-rockets.html

Re:Veracrypt Project Update on Wednesday April 08, 2026 @07:23PM (#47697471)
> single-use plastic that is involved in biological research

The samples were not contaminated by plastic in the gloves. Latex gloves don't contain plastic, they're made from natural rubber. Nitrile gloves also don't contain plastic, although they're very similar to plastic.

The contamination that this study found wasn't microplastic contamination. The gloves weren't adding microplastics. The gloves were adding stearates, which aren't plastic, but look like microplastic in many of the methods for measuring microplastics.

Re:Nine observations from carbon dioxide monitoring on Sunday March 29, 2026 @04:24PM (#47566899)
>So, seems you have a choice, higher energy bills or higher indoors C02.

An HRV or ERV can help with that.

https://en.wikipedia.org/wiki/Heat_recovery_ventilation

Re:The "Vibe Coding" Wall of Shame on Sunday March 29, 2026 @04:12PM (#47566778)
For CVE-2026-0755, that's a vulnerability in gemini-mcp-tool. gemini-mcp-tool's Github repo says "This is an unofficial, third-party tool and is not affiliated with, endorsed, or sponsored by Google." but this list shows the Google logo next to the vulnerability.

Also, it's not entirely obvious to me that the vulnerability was introduced by vibe coding.

https://github.com/jamubc/gemini-mcp-tool

Disclosure: I work at Google, but not on anything related to this.

Re:Roblox Is Minting Teen Millionaires on Wednesday March 11, 2026 @11:33AM (#47336961)
>Founded in 2004, Roblox paid out $1.5 billion to game creators last year. On average, the top 1,000 developers — individuals or companies — earned $1.3 million, according to the company.

So 87% of payouts go to the top 1000 developers.

Older »