News for hackers. Stuff that matters.

behindsight

Re:Verisign .com Domain Name Registry Consumer Class Action on Monday October 19, 2026 @03:21AM (#50149364)
who's your registrar? that sounds like GoDaddy levels of pricing.

Cloudflare, porkbun and others can get you a .com for $10-$11/yr

Re: on Wednesday October 07, 2026 @03:51PM (#49997939)
additionally keep in mind the "durable" in durable objects is not the same "durable" in those three you mentioned.

Cloudflare's equivalent for that is instead called "workflows" [1] for those resumable/retryable multi-step functions for durable execution.

(naming is kinda confusing, I had to build out a redundancy system across all these providers)

1: https://www.cloudflare.com/products/workflows/

Re:Hugging Face is billing OpenAI $100M for hacking it on Tuesday September 15, 2026 @03:16PM (#49717432)
this is an article from July, I haven't heard any updates of what came out of this apart from the incident report that OpenAI released.

I presume the poster submitted this article in light of the recent AI safety discussions taking place, but as for this particular incident I haven't found an actual confirmation that $100M worth of inference was given out to the HuggingFace community.

This statement was also months prior to the acquisition by Nvidia, which again I was interested in seeing if they would still pursue this

Re:Hugging Face is billing OpenAI $100M for hacking it on Tuesday September 15, 2026 @03:08PM (#49717294)
and the actual tweet from the HuggingFace CEO back in July

> In the spirit of transparency, here’s what I asked @OpenAI:

> • Radical transparency: let’s release the traces from the “rogue” agents so the entire research community can study what happened.

> • More capabilities for defenders: let’s commit $100M in compute from OAI to help the Hugging Face community build powerful cyber defenses with the best open and closed models.

> The first autonomous agent cyberattack is an unprecedented event. It deserves an unprecedented response!

https://x.com/ClementDelangue/status/2081056675558195657

> Does it give a reason for the block?

Could it maybe be referencing their feud with Cloudflare not passing through EDNS?

I guess it would depend on if GP will mention what DNS they are using to resolve it.

Re:Blog about things you don't understand yet on Friday August 14, 2026 @12:38AM (#49294803)
I agree as long as you are very upfront about it being a learning/stream of conciousness blogpost, then it should be fine to watch how someone's learning journey progresses.

The author does outline the steps they take to make it clear

> Third, I try to make it clear on my blog who I am and what my credentials actually are. Even if it’s not explicitly described in the post, I have my real name and resume available on my /about page, so I don’t think a careful reader could be easily fooled into thinking I’m an expert on 19th-century England or space physics or LLM economics or anything like that.

If however that part is hidden and it is some confidently incorrect or pseudo guru type of post that is polluting the web with misinformation, then that is a different story.

Maintaining a high signal-to-noise ratio is important to some people, and they may completely disregard the musings of people outside their field of expertise.

Re:How Compaction Works in Pi on Thursday August 13, 2026 @11:05PM (#49294360)
OMP has this, it's called "/shake" where bloat from tool calls and such is turned into an artifact ref instead of remaining in the context.

There are other pruning or compaction strategies you can configure too.

You can also use "/btw" to have side tangent conversations with the current context but with the benefit that it will not bloat your current context after the tangent is done.

I wish other harnesses were prioritising this sort of flexibility with context management, but they're likely more incentivised on optimising their cache rates

https://github.com/can1357/oh-my-pi

Re:DeepSeek-V4-Flash Update on Friday July 31, 2026 @06:47PM (#49129403)
Wasn't it stated as being in "preview" prior to this?

If implementing non-trivial tasks on a preview model surely there is some anticipation of it not being the final stable release?

Unless you mean they should have appended a "preview" suffix on the endpoint for extra good measure?

Re:Bitchat Is Now on Radicle on Saturday July 25, 2026 @06:10PM (#49052166)
relevant xkcd: https://xkcd.com/2347/

but on a serious note it is a bit more than some guy's list, it's more of an initiative that was started by the Mozilla Foundation and is used by:

- browsers: Firefox, Chrome, Opera...

- password managers, Let's Encrypt, cURL

- Cloudflare

just to name a few.

Though yeah there have been privacy concerns and problems with projects that use outdated versions of the list outlined in Brave's paper (no affiliation):

> We present the first large-scale measurement study of how the public suffix list is used by open-source software on the Web and the privacy harm resulting from projects using outdated versions of the list.

https://brave.com/research/privacy-harms-of-public-suffix-li...

Re:Bitchat Is Now on Radicle on Saturday July 25, 2026 @01:40PM (#49049757)
the main reason they mentioned [1] for radicle.network is because their old domain radicle.xyz was blocked in some places by some lists that they think was because it may have hosted certain UGC that triggered some flags.

> Content about Radicle (explainers, guides, download links, blog posts) which is under control of the Radicle team. We will use radicle.dev for these purposes.

> Content on Radicle (repositories hosted on practically any node on the network) which the Radicle team has only very little control over, accessible via Radicle Explorer. Going forward, our deployment of Radicle Explorer will not be hosted on app.radicle.xyz anymore, but instead it will be hosted at radicle.network.

> The idea is of course that if there are complaints about or issues with radicle.network in the future, we hope that radicle.dev stays largely unaffected and people can continue to inform themselves about Radicle and learn how to set it up.

On a semi-related note, this is a good time to remind anyone that hasn't yet heard of the Public Suffix List (PSL) [2][3] to make sure you put your domains that may be hosting UGC in the form <usercontent>.<yourdomain>.<tld> (ie: eTLDs) on that list so browsers and other block lists are aware that the user provisioned subdomains are UGC and not from your site so it properly isolates cookies/site grouping and won't flag your entire domain as malicious.

1: https://radicle.dev/2026/04/23/domain-move

2: https://en.wikipedia.org/wiki/Public_Suffix_List

3: https://github.com/publicsuffix/list

Re:Re: Bye Bye Gravatar on Saturday July 25, 2026 @12:22AM (#49044506)
The blog's visual design is quite pleasant to read.

However I am a bit confused by the author's remarks

> I do NOT EVER consent to ANYTHING being done in regard to AI in my name.

> With newer sites like Bio Link and FediProfile I don't see the usefulness of Gravatar. If anything, I think it now has ANTI-features.

It's conflicting to mention Bio Link with the author's ideology since it quite prominently has:

- AI assistant to answer visitor questions based off of your "links, descriptions, posts, and a short knowledge base"

- AI site builder

Re:Ask HN: Add flag for AI-generated articles on Tuesday July 14, 2026 @01:20PM (#48910102)
thank you so much for the clarification!

Yes, you're correct. The vouch button doesn't appear when viewing the thread context containing the `[dead]` comment. It only appears when clicking the specific comment directly via its permalink (or comment ID). I may have misremembered being able to vouch with the context to the comment being visible.

Thanks as always dang ^_^

Re:Ask HN: Add flag for AI-generated articles on Monday July 13, 2026 @05:12AM (#48889844)
I have vouched a couple (~3-5) benign comments a while back and now I no longer have a vouch button for comments.

I don't know if the vouch threshold has increased or if the mods have removed my ability to vouch for other comments entirely.

Wondering if it was my good faith attempt to inform a user of their comments being auto-flagged [1] before I had any context that they were supposed to be persona non grata.

I can still vouch submissions though

1: https://news.ycombinator.com/item?id=46381180

very well said, and I have been rooting for the team big time!

if you have an alliance hub for discussions with those also building open infrastructure tooling, please let me know!

have already been in the Mozilla AI discord since last year and had a great time being one of the 2 external participants during the name brainstorming for renaming any-llm ^_^

Project Glasswing is already a thing, and the other labs have started their own initiatives too if they want to collaborate and work on securing closed-source software.

Still not addressed the moral clarity point being brought up, nor the ramifications of the Linux Foundation choosing which closed source projects to focus on and alienating their mission statement.

Again, your idea is noble but why should the Linux Foundation be saddled with it when those other options exist? OSS needs their focus as their mission outlines.

You make a fair point but OSS is a communal resource that would benefit from communal stewardship.

Also not sure about saddling this Linux Foundation project with the corporate politics of navigating which closed-source software they will bless with subsidised/free labour? Their mission has been about open technologies.

Also I believe Google Chrome would have its OSS Chromium variant covered, no?

edit: disappointed with the downvote without dialogue at all. Wish you would engage in a conversation about the implications of this Linux Foundation project deviating from its "open technologies" mission statement and starting to deal with which closed-source tech its supposed to choose to prioritise, seems like a distraction for them.

Re:Upcoming breaking changes for NPM v12 on Wednesday June 10, 2026 @01:56AM (#48472011)
if you go to the full changelog on the blog and click on the "retired" button, the url will have type=deprecations as the parameter.

It's a holdover from previous posts where there were more clearly defined deprecations.

but yes, in this case it's more of a behavioural change of defaults, so they just picked the closest vaguely mapped retired/deprecations tag.

1: https://github.blog/changelog/?type=deprecations

Re:Upcoming breaking changes for NPM v12 on Tuesday June 09, 2026 @07:52PM (#48469416)
> Retired? What does that even mean in this context

"retired" is probably a followup to functionality that was "deprecated".

I agree "breaking" would be clearer

Re:Cloudflare Flagship on Tuesday May 26, 2026 @10:56PM (#48288981)
the CTO of Cloudflare (hn: dknecht) said:

> It is in the works. The billing team has been sprinting to fix a lot of debt in this area. I don’t have a date.

https://x.com/dok2001/status/2051220429973389622

Re:The Prompt API on Tuesday April 28, 2026 @04:31AM (#47931845)
been cranking on this too but not just for snark but for spam/scam heuristics too.

it's something I feel is finally viable to combat at zero cost to the user.

This plus webmcp would allow it to serve as a form of automod too on websites that you authenticate with (imagine a world where your social media profile has an automod of its own powered locally. can use this to steer your feed or to mute/block/moderate as needbe). Even without WebMCP I have been working on making it autodetect html elements and extract UGC (comments/threads..etc) automatically to moderate (since my initial tests with a small group found some websites with frequent UI changes would break if hardcoded or if they did a lot of AB testing)

Even better, the concept would allow you to also use it to hide certain spoilers (imagine sports or new movies that just came out and you want to not have to hide away from all socials).

didn't find any contacts on your new HN account, but in a few weeks will be able to reach out to you with it fleshed out. :)

We have a community of nearly 14k that we will distribute this to

Re:WebMCP Proposal on Monday February 16, 2026 @02:14PM (#47039017)
I'm building this. Initially it was to do codegen for tools/sdks/docs but will incorporate webmcp as part of it.

I wanted to make FOSS codegen that was not locked behind paywalls + had wasm plugins to extend it.

Re:Thought-Terminating Cliché on Monday February 09, 2026 @08:42AM (#46945099)
On a similar vein is the "argument from fallacy" aka fallacist's fallacy. [1]

Essentially if you dismiss someone's argument as false just because it may have had a fallacy within it, that reasoning is itself a fallacy.

Some fallacy-seeking people ironically ignore this and just dismiss anything when they have the "gotcha, you made a fallacy therefore everything you said can be concluded as false" moment.

1: https://en.wikipedia.org/wiki/Argument_from_fallacy

Re:Speed up responses with fast mode on Saturday February 07, 2026 @02:57PM (#46927184)
It's explicitly called out as excluded in the blue info bubble they have there.

> Fast mode usage is billed directly to extra usage, even if you have remaining usage on your plan. This means fast mode tokens do not count against your plan’s included usage and are charged at the fast mode rate from the first token.

https://code.claude.com/docs/en/fast-mode#requirements

Re:Ask HN: Is it time for HN to implement a form of captcha? on Thursday January 08, 2026 @06:50PM (#46548197)
While it's commendable, the reality is they should have already "figured out" how to play the system and just farmed the reward points from credit cards and immediately pay them off without incurring any interest.

You get a good credit score and still live within your means while also getting additional points + bank covering any fraudulent activity if the card got stolen.

Of course this method probably won't work for people that feel they would rather just cut themselves off from temptation fully or those without access to banking systems, which I sympathise with.

Out of curiosity, do you have watch history enabled/disabled?

I found the feed with it enabled is much better than disabled and I have it finetuned to be more in line with the niches I care about.

I am also very proactive with marking channels or content I don't prefer with the "Not interested" or "Don't recommend channel" as well as going through and pruning any content I don't want from my watch history directly.

It's not perfect but it's orders of magnitude better than my logged out or watch history disabled account (though not sure if they have since updated it to not show anything at all)

Re:Go-boot: bare metal Go UEFI boot manager on Wednesday December 24, 2025 @08:24PM (#46381252)
ah thank you for the context
Re:Go-boot: bare metal Go UEFI boot manager on Wednesday December 24, 2025 @08:12PM (#46381180)
sidenote: just a heads up that I tried emailing you recently to let you know that you might want to contact the HN mods to find out why all your comments get set to dead/hidden automatically.

Your account might have triggered some flag sometime back and relies on users vouching for your comments so they can become visible again.

Re:Rue: Higher level than Rust, lower level than Go on Sunday December 21, 2025 @08:14PM (#46350331)
> You can also do some inbetween systems programming in C# if you don’t care about a VM or msft.

C# Native AOT gets rid of the JIT and gives you a pretty good perf+memory profile compared to the past.

It's mostly the stigma of .NET Framework legacy systems that put people off, but modern C# projects are a breeze.

Re:Jailbreaking AI Models to Phish Elderly Victims on Thursday November 20, 2025 @02:35PM (#45996685)
oh this is very cool!

I've been building in my spare time a spam/scam blocking extension and was also playing around with the experimental in-browser LLM feature for this (alongside Aho–Corasick, Naive Bayes and other classifiers)

It's great to see more people tackling this head on, kudos

Re:My friends and I accidentally faked the Ryzen 7 9700X3D leaks on Saturday November 08, 2025 @06:08PM (#45860887)
> The Gell-Mann amnesia effect is a cognitive bias describing the tendency of individuals to critically assess media reports in a domain they are knowledgeable about, yet continue to trust reporting in other areas despite recognizing similar potential inaccuracies.

https://en.wikipedia.org/wiki/Gell-Mann_amnesia_effect

Older »