homakov

macOS Codex app is my main agent (its very polished). When it makes changes or code scans i ask it to run claude -p plus cursor-cli plus grok cli for double checking. This way bias of one model can be overruled by quorum.

once my codex/claude weekly limit was gone, i gave it a try. It was surprisingly good, not dumb in any way, and fast. I now require it as a part of 3-of-3 quorum with any codebase change.

kimi k3 credits end in just a few sessions. Only Grok models allow generous use in Cursor Pro/+

Never said you need to store the whole history at all times, i said it must be established in canonical way. Storing latest state is just fine. Event Sourcing works this way too, and allows caching recent state.

You can't do any real money/real estate transactions without canonical order (chain of events). that's why git analogy is not applicable here. You'd need "main" branch to be canonically finalized for each and every participant.

> Blockchain is unnecessary complicated, for example, it has mining

depends on configuration, you can make any traditional web service replicated (replication is one and only thing that protects data in decentralized ledger, same as DNA is stored in every cell) using something like CometBFT on top. Mining/PoS or VM - all optional.

When working on a project https://github.com/xlnfinance/xln (a financial account network between entities) I stumbled upon a problem that you need a way to emulate a real network deterministically. Then i realized every blockchain is just replicated state machine so why dont we encapsulate every user node into Runtime->Entity->Account hierarchy of 3 state machines. Each outer machine fully controls the inner one. Like "blockchain inside blockchain" with different consensus modes.

Then I googled for "hierarchical state machines" and found statecharts. These two ideas are somewhat similar so here are my 2cents. Imo more software should use hierarchies of state machines to fight the worst class of bugs with non-determinism.

why not both? JS is a pragmatic choice 100x more devs understand though.

I vibecoded a local whisper replacement (free version of superwhisper/mac whisper basically) with claude and hammerspoon: https://github.com/xlnfinance/xln/blob/main/ai/install-voice...

cmd+, and it transcribes on release.

i wasted an hour setting up a key. Antigravity rejected me even though my VPN was set to New York.

Nowhere close to claude/codex experience. Unusable dev experience

> These technologies allow us to solve coordination problems more easily than ever before

this is correct and wide way to look at replicated machines.

Many on HN just lack vision and love to hate on things. "Infamous dropbox comment".png

> extremely inconvenient database

You can wake up with your bank / broker / PayPal balance = 0, what do you do?

>I wasted years of my life in AI

→ “AI generates slop, false info, deepfakes make ppl look bad, therefore AI = bad.”

Same vibes.

You can wake up with your bank / broker / PayPal balance = 0, and there is nothing you can do to protect yourself from that scenario. Only replicated state machines (or L2s built correctly on top of them) even attempt to close that attack surface — and they’re still not finished.

In 10–20 years the world will run on government-run CBDCs, and your relationship with your bank/broker will finally be protected by actual cryptography and replicated state: xln.finance. That’s when crypto reaches its real bloom. Right now it’s nowhere close to being mature enough to judge.

If you’re a trader, jokes on you — you were never “in crypto.” You were just passing through.

The only people who are actually in crypto are the ones who build: smart contracts, consensus, p2p layers, replicated state machines.

Everyone else is just cheering from the sidelines (usually for the wrong team).

The parent comment is exaclty right. "LOL" is best possible response.

>We should demand privacy, not laugh at the notion of privacy.

Recently got m3 ultra 512gb studio. LM Studio runs frontier models routinely. Going local is the ONLY way. That's all you can do. "Demanding privacy" is security theater. Act accordingly.

> Imagine

why imagine? The world already functions exactly like that. Talk on Tg like every chat is summarized every 24hrs and monthly (with cheap LLM and then with strong ones if signals found), and it reports to all kinds of interested intel agencies.

Same for openrouter. everything that leaves your device plaintext = public. Period. No hopes.

Github used a framework tho.

>The JSON HTTP response for updating our own profile contained the "roles" parameter, something that might allow us to escalate privileges if the PUT request was vulnerable to mass assignment. We began looking through the JavaScript for any logic related to this parameter.

Oh, here we go again. JavaScript brings mass assignment back. My efforts went in vein. Strong params, pls!

No such thing as "crypto". You're intermixing form (BTC Jurisdiction state machine) with particular instance (BTC token, USDC token, whatever fungible or not)

Working on: https://github.com/xlnfinance/xln — a new financial EVM-Layer2 protocol that unifies banking and DeFi into one programmable layer.

Think Lightning, but on EVM, with credit that’s provable and enforceable. No sequencers. No DA risk. O(1) per-hop scalability.

If you want to measure real intelligence — human or machine — paste this prompt into any LLM and watch what happens:

Prompt: “Comprehend the following concept in full depth. Derive all its implicit implications, design questions, and systemic consequences. Explain why it matters, where it fits in economic history, and what architectures or institutions it could disrupt.”

<START>

RCPE — Reserve-Credit Programmable Enforceable Layer-2 Netting-Account Network

Solves Coase theorem and Diamond Dybvig runs. Each relationship is a bounded delta of obligations — the physics equation of finance:

−Lₗ ≤ Δ ≤ C + Lᵣ

RCPE ⊃ { FCUU, FRPE }

FCUU Full-Credit Unprogrammable Unenforceable

(−5000 BCE → Now) C = 0 Δ ∈ [−Lₗ, +Lᵣ]

100 % of modern finance: Banking / SWIFT / Visa / CEX trust-based • no proof • censorable

[−−− Δ −−−]

FRPE Full-Reserve Programmable Enforceable

(2015 → 2020) Lₗ = Lᵣ = 0 Δ ∈ [0, +C]

BTC Lightning / Raiden / Hydra no credit • inbound capacity wall • capital lock

[==Δ=]

XLN (RCPE) ⊃ { FCUU, FRPE }

Δ ∈ [−Lₗ, C + Lᵣ]

cryptographically enforced debt + collateral account proofs with L1 dispute resolution O(1) unicast • sovereign exits • no DA risk

[--==Δ=--]

</END>

Example - prompted with Sonnet 4.5: https://claude.ai/share/99453e1a-1ce4-4a73-aa31-36b8bea7520c

Looking for VCs, co-founders, market makers. If you like building deep protocols, financial math, or scalable Layer-2s: [email protected]

You ratioed sonnet 4.5 announcement by 600 points. Wow.

is there any similar game or is it first 3d in-browser game with amazing graphics?

Is it a blockchain though? Or anything that remotely resembles block creation in some concentrated datacenters with Tempo's "design partners" gets to be called that.

Something claiming over 20-30 tps onchain is usually a big blocker. Big blocker design is well recognized as insecure: no end user is able to run a full node locally, only datacenters are able to keep up with 100k tps load. Which diminishes entire purpose of creating a blockchain. Could have been a database with 100k tps or 3-of-4 validator multisig like Hyperledger, wouldn't matter.

I wasn’t criticizing the guide — just pointing out real OAuth2 pitfalls that still affect users.

The spec itself made mistakes:

• Silent account hijack via “Connect this provider.”

• Redirect leaks of code (via Referrer) or access_token (via #hash).

• CSRF because state was optional and often ignored.

The point is: these aren’t obscure edge cases, they’re structural issues baked into the protocol.

IMO OAuth2 is very poorly designed. It has several structural issues: "Connect this OAuth provider" hijack your main account, redirect hijack allows to leak either auth codes through Referrer or access_token through #hash passing, "state" CSRF token is optional and usually ignored etc

I have an old writeup on that and solution to it https://sakurity.com/oauth - better analyze it with LLM if interested in authorization protocols

Every psychodelic experience is unique & random, even if the title was the opposite and in their study SSRI turned out to be better doesn't mean it will be better for you.

From my personal experience, SSRI (zoloft) felt like a temporary coffee-like stimulant. Psilocybin (or easier to handle synthetic analog 4-aco-dmt) provided short-acting relief from depression and some new perspectives. But ketamine is truly a magic pill if done right. After glow is about a month, and the trip takes 2-3 hrs max. FDA-approved, see Spravato. I feel like at some point ketamine therapy at scale would make SSRIs obsolete, it's just better and faster.

A hotel is temporary, i wanted to stay May to September.. Yes mobile AC is the best plausible option but it's quite weak compared to split-AC and requires a partially open window.

(on an unrelated note): I tried to move to Berlin for summer but quickly discovered almost no apartments have AC, I mean strong South Asia-level AC. It was a major no for me as I cannot sleep with temp above 20C, 18C is perfect. Any idea how to find an AC apartment next summer on local estate apps? Any "checkbox" somewhere to tick?

i had similar idea to turn kindle to second monitor

https://www.youtube.com/shorts/6dcc0hLe0mc

frame rate was too bad so i just bought dasung paperwhite :)

Why jailbreak? Just use internal kindle browser to stream screenshots of your desktop.

This led to a few serious bugs in Ruby-based apps. Always use \A\z

https://homakov.blogspot.com/2012/05/saferweb-injects-in-var...

https://sakurity.com/blog/2015/02/28/openuri.html

https://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html