News for hackers. Stuff that matters.

alkonaut

>The company itself is incentivized to ignore the warnings to keep things on track.

If ignoring an alarm and keeping it on track "counts" as having kept things on track, there's the perverse incentive. Change incentive to mean a train kept on track after ignoring an false alarm was worse than a late train.

Now the company is as focused, or more, on fixing the bad alarms, than keeping trains on time.

Finding incorrect incentives is usually not that hard.

Re:StackOverflow now gets fewer than 1000 questions a month on Thursday October 29, 2026 @05:54AM (#50286626)
Same. For me it was basically that as a body of knowledge, it kind of stabilized. I didn't work in a rapidly developing field like the newest JS frameworks, so for what I knew, most stuff simply became answered.

Whenever I took the time to make a long answer on a question, I saw some mod close the question as a duplicate of an existing one - even though the question could have some minute detail that was different, or perhaps there was some recent change in the landscape that meant an answer in 2020 would be different from one in 2013. But no: aggressive marking as duplicate even though clearly as a _community_ it would be much better to have a more recent discussion, perhaps more alternative answers and just allowing the near-duplicates.

Here's where I like working with some employment security. If they want to fire me, they'll have to buy me out WHEN that happens. It's not like I need to face some dilemma between choosing a buyout or otherwise get nothing in case I'm fired.
Re:Anthropic S-1 on Monday October 26, 2026 @09:21AM (#50243181)
I'm just happy they aren't calling it "Super intelligence" in this document.
I like that. But that should be for the "cookie scenario" of using e.g. selling viewer habits. Not for wiretapping.

Wiretapping is just illegal and should be treated as such.

I mean most governments at least manage to get through most years without large scale violent protests like these. But France also has a tradition of violent protest...
These are kids who use messenger/whatsapp etc. No they won't be bothered to even switch messenger. The goal isn't to shut down some criminal network it's to just make word of mouth spread in 10 minutes instead of 1 I reckon.
> What drives people to burn shops

Simple:it's "If society doesn't work for me, then it's better that it works for no one"

> If you think the far left are beyond these types of comments

Who mentioned the far left? And why would it matter what other extremists do?

This sounds like "yes but what about..", and I see it in several comments here but I don't understand it. How does that matter? There could be a similar dump from another party or organization and people would (rightfully) be equally upset.

Of course if a party - even internally - emails really crude racism and antisemitism then people should know. Their "core" voters don't care. But for a party to get 20-25-30% of the vote, it needs a _lot_ of votes from people who are repulsed by this.

Re:DeepSeek just open-sourced its inference engine on Tuesday October 20, 2026 @07:16AM (#50164532)
How much are the Huawei cards compared to Nvidia cards now?
I try to understand WHAT all code does rather than exactly HOW it does it. Large scale design choices, how it is tested (and that it is) etc.

Even if you have a 20 file 5k line change set, it's still not impossible to just grok what's being done, what the purpose is, and what it works like on a high level.

LLMs don't change the fact that such a review is difficult, but I'm more confident that there are no hidden off-by-one issues in 5k lines of LLM code than in 5k lines my colleague (or myself) wrote. So it's a welcome change in reviewing to do it on a higher level.

They call themselves "left authoritarian" or "left conservative". They are basically the living proof of the horseshoe idea.
I'm sure BSW have equally disgusting mail conversations (But perhaps more Russia connectoins than just rabid racism and antisemitism). If you can find them, please publish. But don't do whataboutism.
Article text:

A vast archive of hacked emails from the AfD was published online on Monday: 281 GB containing 421,179 internal party emails. And, for anyone who might have grown confused about claims of antisemitism while it was plastered over the German news media in the weeks following the Berlin election: here you can see what it really looks like.

In email after email, party supporters use racist slurs and share antisemitic theories of Jewish world domination; there are jokes about turning refugees into handbags and boots, discussions of whether refugees should be shot at the border, a Christmas card sent with a swastika and “Heil Hitler”, and an email thread signed off with “Heil und Sieg”.

The entire archive is available online – though it may be a criminal offence in Germany to torrent the material or distribute it online. Yet the journalists who’ve been able to examine parts of the hack consider it authentic. The methodology behind the leak is also quite interesting: the vast archive has not been published directly on the site. Instead, it is available via a series of AI summaries, which have been filtered according to severity (CRITICAL, HIGH, MEDIUM, LOW) and type, with categories including “racism_xenophobia”, “corruption_money”, “leadership_feud”, “conspiracy”, “violence_threats” and “antisemitism_extremism”.

The party itself has confirmed the hack to Bild: “In September 2026, a hacker attack targeted one of our party’s hosting service providers, during which portions of a few email accounts – most of which had not been used for years – were apparently illicitly copied.”

Many of the summaries are the party’s own internal disciplinary proceedings, with emails sent to party boards to decide whether to open expulsion proceedings against members. Here, what is shocking (though perhaps not surprising) is the depth and breadth of racist feeling from party members: slurs, fantasies of violence, and antisemitic statements appear commonplace. One email from 2016 appears to show Weidel forwarding a member’s antisemitic material to the federal board as the party weighed his expulsion, while including a warning to her colleagues that the Verfassungsschutz – Germany’s domestic intelligence service – might be reading.

There are some cases which do not appear to have drawn the ire of the party, including one Bavarian official urging party leaders to chant “Merkel croak” every day, or another thread in which staff at the party’s federal office apparently discuss luring a photographer to a party event and removing him by force.

The anonymous hackers claimed their motive behind the leak was to show the “degeneracy and hypocrisy” of the AfD. Among the countless acts of hate speech, there are also allegations of embezzlement and financial misconduct, according to DDoSecrets, a transparency collective which republished the archive: the site’s software flagged 34 documents for misuse of funds, 23 for off-the-books payments, 14 for undisclosed donations and seven for embezzlement.

The AfD party is currently polling at 29% nationally – even while they fight a designation by the Verfassungsschutz as a “confirmed right-wing extremist” party in court. That designation has already been made by state intelligence offices for some state branches, such as Sachsen-Anhalt — though it did not seem to hurt their electoral success. The party achieved 43.8% of the vote there in September.

Re:Why I Wrote PGP (1991, revised 1999) on Friday October 16, 2026 @10:22AM (#50118727)
> You just type "gpg -e -r [email protected] filename.txt".

I assure you it is not that simple. For example, I'm a HN user, developer since 30 years. I know that you referred to what's known as a "terminal" or "shell" here, but that's already way WAY too difficult for 99.9% of users.

And even in my terminal I can assure you it won't work: "'gpg' is not recognized as an internal or external command, operable program or batch file."

I could install it. It would be a right pain though. and it doesn't help if the recipient of my email can't install it without me sending a long list of instructions!

Meanwhile my dad had zero problems installing signal. There's a difference to how easy it gets.

Re:Why I Wrote PGP (1991, revised 1999) on Friday October 16, 2026 @05:59AM (#50116411)
It's still extremely difficult.

If we assume that the threshold of what is "difficult" is for example 1) installing a desktop application, or even running a deskop OS.

2) Running an email provider other than what you are already doing (gmail, hotmail, yahoo mail, ...), or switching email providers

3) Copying and pasting text or using files.

This was perhaps a viable thing to do for users in 2005 because if you were on the internet, chances are you at least had a desktop computer, and if you used email chances are you already had to struggle with an email client.

But now? Anything that isn't as easy as installing an app on your device (a device that isn't a full computer) is "difficult".

It's not that it's harder today, it's that everything else is easier (Like telegram/signal and other privacy-minded services), and that there are now 6 billion internet users and most never used a computer and never will.

My layman understanding (as someone who isn't a lawyer but has been tasked with some reimplementations), is that it at least is governed by different sections of law. For me it's the European Software Directive where Article 5 is pretty generous and governs basically "observing" software for reverse engineering. Article 6 is less generous and is about decompilation. There you basically can only to it to ensure interoperability.

So depending on what the goal is (making an interoperable piece of software, or making a clone?), you might want to stay under Article 5, and steer clear of Article 6.

https://vidstromlabs.com/blog/the-legal-boundaries-of-revers...

Obscurity is kept by banning decompilation in EULAs. Can’t block black box reimplementation though (At least in EU), and that’s often good enough.

Obfuscation is no obstacle at all in my experience.

Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @09:45AM (#50056398)
I think "proof of humanity" is going to be an increasingly important thing, but I think we need to forego the age-verification and make some sort of zero-proof/integrity-preserving age/humanity verification.
Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @06:59AM (#50054523)
So long as it's once per API and site, it seems it doesn't need to be too bad?

If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).

We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.

Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @06:55AM (#50054489)
You could accept things once per API and site. It doesn't feel that terrible. We do it for camera and clipboard already.
Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @06:54AM (#50054482)
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @05:54AM (#50053953)
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @05:53AM (#50053943)
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @05:01AM (#50053455)
I still don't understand why the highest entropy APIs aren't gated behind browser consent.

A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?

Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.

The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.

It's glorious isn't it. We get free work done through subsidies. At the same time, this is what threatens my job, and the money for the subsidy is basically my own invested pensions.
What I'm saying is the quiet part out loud: A majority of coders and a majority of really IS bad. And now a lot of that code is actually better (big win).

Basically: the code was so bad before, that un-reviewed LLM-code is now better than the average contribution. That means, that at least short term, the vibe coding can increase quality.

The problem is that it also increases code volume (bad) and rapidly decreases understanding (even worse).

> If mediocre code is better quality than what you wrote by hand

Most code I have seen and reviewed over my 25+ year programmer life has been no worse than mediocre LLM code.

It's not a massive sample, but to me it suggests, most code programmers write, is somewhere between bad and mediocre.

And here's the appeal of the models: if what you used to produced was bad-to-mediocre, and you can now do slightly better for much cheaper, that's a huge win.

The thing is: people quickly discover that even mediocre LLM-code with a mediocre LLM-review, is still better quality than what they hand wrote and hand-reviewed.

So it's already an improvement. Should it be manually read, comprehended, reviewed? Probably. But they can get to an improvement over what they did 2 years ago, with basically no effort. And then they can get a little bit further, with massive effort?

The "LLM-yolo" is a big knee in the cost/benefit curve. It's an improvement over their "old code". The only drawback is: it's still containing bugs, and now no one understands them. But that's not hitting them until that code has aged somewhat, so a year or two down the line.

Re:Denmark Data Breach Exposes 8.8M People's Personal Data on Monday October 05, 2026 @09:31AM (#49964653)
These services were just the natural extension of the phonebook. At the exact same time as the phonebooks stopped being circulated, these services popped up online.

And since everyone's name, address and phone number was in the phone book (At least for their city) people didn't find it weird when it popped up online. Sure, to do the same thing for the whole country you'd need dozens of phonebooks for different areas, but it was just the same information.

Which makes me wonder: weren't there phonebooks in US cities and in other countries before? Were they incomplete/opt-in?

The key thing about the Swedish phonebooks were that they were opt-out, so people were basically all in the phone book. So even before the internet, it was just very natural that your name, address and phone number was public. "Getting someone's number" as in moves and TV wasn't a thing. You could just call anyone if you knew their name.

Older »