News for hackers. Stuff that matters.

morningsam

Re:Backdoors in official Claude Code extensions on Friday October 30, 2026 @08:41AM (#50303104)
EDIT: This comment is probably nonsense, cf. the reply.

dang should change the title and/or merge this submission with the other one. [1] This is causing needless panic for a typosquatting-style "attack" unrelated to official Anthropic extensions.

[1]: https://news.ycombinator.com/item?id=50301983

It's very obviously LLM-generated if you've been reading some of the many other LLM-generated comments you'll find at the bottom of the comments on almost all other submissions to this website. Pangram says 100% LLM, too, but you don't need Pangram to see this, just compare the way it's written to all the other ones.
Re:eMudhra to Exit Global SSL/TLS Certificate Business on Friday October 23, 2026 @07:12AM (#50207203)
>not every global .com website owner wants to use only have the choice of US-run CAs

.com wouldn't be covered by the proposal made in the post I replied to, because it isn't a ccTLD.

I also disagree with the post author's clarification in a sibling comment, saying that there should be a few major (US) CAs that can sign everything: As I originally understood it, the idea would really be to restrict signing of certs for ccTLD domains to CAs in the country in question, and only to those. There would not be a US CA that can sign certs for French domains and vice versa.

>most Rust projects (foo.rs) would probably not trust the Serbian CAs

Such domains are misuses of ccTLDs as originally envisioned anyway, and AFAIK the relevant standards bodies still see it that way, too.

>it seems possible that Chinese website owners might prefer to use non-Chinese CAs

For what reason? If it's a matter of resistance to government interference, it doesn't help, because ccTLD DNS records are ultimately under the control of that country's government anyway. It might make sense for very small countries in which operating a CA full-time isn't worth it for anyone; perhaps it should be possible for those to be grouped together, sure.

Re:eMudhra to Exit Global SSL/TLS Certificate Business on Thursday October 22, 2026 @01:28PM (#50198436)
I came here looking for a comment suggesting just that. But surely there is some massive issue with this idea we are overlooking? Otherwise I don't see why it hasn't already been implemented long ago, it seems so obvious as a mitigation.
Re:Claude Duet on Thursday October 22, 2026 @07:47AM (#50194043)
So is this the new Anthropic "model" that was supposed to be able to read users' minds, about which there were all sorts of rumors [1] this week? And whoever leaked it misunderstood that it wasn't a new model at all, just a new product using Opus 5.5?

[1]: https://www.theinformation.com/newsletters/ai-agenda/anthrop...

Re:Fable Took My Job on Monday October 12, 2026 @06:48AM (#50054429)
>but for the rest of us we will live in a mix of medieval life style assisted by robotic and low tech

Awfully optimistic. Why would they let you do that?

Re:Mistral Large 4 on Wednesday October 07, 2026 @09:50AM (#49992891)
I take that back, actually: I didn't realize they release them under a modified MIT license requiring large corporate users to enter into commercial agreements. So it is in fact proprietary. Sorry for spreading misinformation.
Re:Mistral Large 4 on Tuesday October 06, 2026 @05:25PM (#49984375)
It's proprietary only until the end of the month, when its weights will be released.
Re:Mistral Large 4 on Tuesday October 06, 2026 @04:41PM (#49983784)
I wonder if the other models were worse than usual for that particular video because they "dislike" making an advertisement for another company's model. A test with a generic video might be more meaningful.
Re:OpenAI Feared "Optics" of what might appear on Hacker News on Sunday September 27, 2026 @10:45AM (#49867069)
>"it's fine if you're an individual but not if you're large"

That's not what the GP said, they were referring to someone who "builds their own moat where they solely can profit and excludes others from the freedoms they themselves enjoyed".

I don't want to speak for them but I guess that LLM companies which release exclusively open weights models, or better yet, open weights plus training pipeline sources, would not fall into this category.

Re:The internet discovers TLA+. Now what? on Sunday September 27, 2026 @10:13AM (#49866816)
Currently-working-Nitter-instance URL for Cherny's tweet: https://shitter.thepixora.com/bcherny/status/210254334910233...
Re:How to keep enjoying programming in a world of LLMs on Saturday September 26, 2026 @12:00PM (#49857771)
>I feel like coding will be dead soon, and what will be left are project management / team lead / product owner kind of jobs where you craft specs and steer AI agents on very high level.

And these will be gone, too, a couple months later. Or possibly even at the same time.

Re:XCancel Taken Down Again on Monday September 14, 2026 @06:29AM (#49694604)
I've been wondering why ~everyone hasn't already been doing this, so my guess is that Twitter's API doesn't allow it.
Re:Bodily Oddities on Friday September 11, 2026 @05:33PM (#49665688)
I once met a guy who said the same thing and was convinced that this was the usual case, whereas me still getting them as an adult was very unusual (this came up when I got them, apparently his first time seeing an adult do so).
Re:Larger Pacific Striped Octopus on Thursday September 10, 2026 @10:14AM (#49644065)
Not really, because you need a reputable source. The popular science article they linked is good enough for HN but WP would remove it.
Re:D2 Is Non-Profit on Tuesday September 08, 2026 @06:57AM (#49608586)
>do LLMs generate D2 code as easily as Mermaid

Yes

>and do tools like Github and Confluence render them?

No

Re:AI Policy on Wednesday September 02, 2026 @08:42PM (#49544561)
Finally someone says it. I read it like that every time and briefly imagine a Daily WTF style blog about the pitfalls and shortcomings of everyone's favorite IPC system, only to be sorely disappointed.
Re:Marx, Keynes, and A.I on Monday August 31, 2026 @03:32PM (#49513924)
Why would any of this be a problem from the perspective of those who will own the remaining companies? They won't sell anything to normal humans who have no income anymore, true; but they don't need to, because their machines can produce for them whatever normal humans had been producing previously.

The preprint is interesting in that it predicts that on the way there, one can run into some kind of vicious cycle that leads to suboptimal outcomes even for the company owners. Navigating around this would certainly slow this process down, but I personally don't see it changing the ultimate outcome.

I would much prefer for a doctor who isn't sure to signal that fact somehow. It was annoying enough for LLMs to confidently lead you down wrong paths most of the time (they've gotten much better by now), we don't need humans doing it too. For lawyers it makes sense, of course.
Re:Future euro banknote design proposals on Saturday July 25, 2026 @10:19AM (#49047772)
Thank you. I wish they had used a pairwise comparison system like the one built by pil0u [1] for this. If I hadn't looked at all of them in advance, I would've had to go back to "normalize" my previous answers after seeing one that I especially like/hate.

[1]: https://news.ycombinator.com/item?id=49041625

Maybe this will lead to more business for tailors doing alterations, assuming the clothes people end up buying are expensive enough to justify it.
Re:What AI did to stackoverflow in a graph on Saturday July 18, 2026 @08:46AM (#48957672)
That basic idea is what made SO attractive in the first place, compared to forums where you had to scroll through pages and pages of in-jokes and tangents and animated-GIF signatures just to try and see if there is an answer.

Where they went wrong, in my opinion, is in the implementation details.

It's mostly death by a thousand cuts: Requiring reputation to gain the ability to post comments, then having one's answers deleted as "this should've been a comment". Overeager marking of questions as duplicates, e.g. despite the equivalence between two situations being non-obvious (e.g. someone asks about data type A, and it turns out that it's a subtype of B for which an answer that applies to both exists; that should not be a duplicate, the fact that it's a subtype is the answer!). Endless other decisions like that, which wouldn't have taken any extra effort to implement correctly.

One feature they could've built that would have taken effort but also greatly helped against the common newbie complaint of "hostility" would've been a "newcomer track", which would've been more forum-like and guided them towards either formulating a good question or seeing that's it's already answered. In the latter case, some of the keywords that came up during this process should've been fed back into SEO so that future newbies would become more likely find the answer via a search engine despite using clumsy terms. I think they tried a simpler and worse version of this idea towards the end with "staging ground" but by then it was too late.

Re:My Thoughts on the Bun Rust Rewrite on Thursday July 09, 2026 @07:41AM (#48844274)
And literally 3 sentences later he goes back to insulting him ("productivity fantasy fever dream"). Even if that is true, it's still an unwise post to publish in this form IMHO. If the goal was to defend Zig, that could've been done in a less personal manner.
Re:Leanstral 1.5: Proof Abundance for All on Saturday July 04, 2026 @06:49AM (#48784421)
This is how it's often done, but personally, I'd prefer if the information "With this comment I want to promote something I made" came first, so that people who aren't interested can skip it.
Re:AI Is Slowing Down on Tuesday June 09, 2026 @01:33PM (#48464409)
>but as soon as you approach ~$400/month they ask that you get a Claude/Codex Max subscription instead

While this seems to be allowed because the current ToS don't seem to explicitly forbid it, I'd be surprised if this loophole stayed open for long... Why would they even distinguish between business and (much cheaper) individual plans if companies can work around it by telling employees to just pay for the latter themselves?

Re:Magnifica Humanitas (Encyclical Letter) on Monday May 25, 2026 @10:11AM (#48267099)
Someone did an analysis and concluded that it appear to be at least partly (~10-15%) LLM-generated, or at least LLM-translated (see comments): https://www.lesswrong.com/posts/s58hDHX2GkFDbpGKD/linch-s-sh...
>some don't really seem to make sense.

This one stood out to me:

>Machine-scale infrastructure. [...] Git itself wasn't designed for that load, and bolting AI onto platforms not built for agents is the biggest mistake of this era. [...] Git itself is being reengineered for machine scale.

Git itself is so far down the list of bottlenecks that do or could hamper LLM-driven development, even projecting years into the future...

To be fair, any LLM project gets a lot of stupid tickets, by virtue of a) marketing to users who aren't really developers and b) bad developers being more likely to use LLMs. Both of these groups are more likely to write bogus or non-reproducible bug tickets, as well as feature requests that don't make any sense. My guess is 10% of those 10,000 open issues are actual bugs or sensible requests.

On the other hand, LLMs seem perfect for triage and finding duplicates, so it's still surprising that they've let it get this bad.

Re:If AI writes your code, why use Python? on Tuesday May 12, 2026 @04:21AM (#48105624)
>the LLM constantly guesses arguments or dictionary formats wrong [...] it's better to avoid that whole class of runtime errors altogether.

Use Mypy in strict mode and run it in the post-turn hook of your LLM harness so the LLM has no choice but to obey it. And don't use overly general dictionary types when the keys are known at development time; use TypedDicts for annotations if you must use dicts at runtime.

Older »