News for hackers. Stuff that matters.

rectang

Fun. I have a visceral dislike for the NYT, so the association is actually a negative, haha — but I could get over it.

The tradeoff of the design is increased information for each story but lower density of stories. The high-density design of the HN page is probably optimal for my purposes, even though some of the user-submitted headlines are opaque enough that I miss some things I would otherwise click on.

Re:Ask HN: Which TV do you recommend for privacy? on Monday November 02, 2026 @12:30AM (#50333446)
I was thinking about the places that repair phones, but was deliberately vague because I’m not sure what’s out there these days.
Re:Ask HN: Which TV do you recommend for privacy? on Sunday November 01, 2026 @07:36PM (#50331559)
Do local repair shops offer aftermarket “TV lobotomy” services these days?
Re:The Great American Rascal: Tom Sawyer at 150 on Saturday October 31, 2026 @02:03PM (#50318409)
It comes and goes in waves. The Thomas Bowdler from whom the term "Bowdlerization" is derived published his sex-sanitized Shakespeare editions in 1818.

https://en.wikipedia.org/wiki/Expurgation

You can definitely find censored versions in the modern marketplace. Here's censored Tom Sawyer:

https://www.amazon.com/Mark-Twains-Adventures-Tom-Sawyer/dp/...

As to what the odds are that any random copy would be censored, it's hard to say. For a work that's out of copyright, there's no copyright owner who can take legal action to thwart publication of modified versions. However in the US at least, such editions are typically advertised as modified because they are being marketed to schools and such as safe for children. If an edition is explicitly labeled as "unabridged", it's probably fine because otherwise there's the possibility of an ornery anti-censorship advocate pursuing a false advertising consumer protection claim.

Re:The Great American Rascal: Tom Sawyer at 150 on Thursday October 29, 2026 @08:32PM (#50298333)
The racial slurs are critical as Twain used them to indict the culture of the antebellum American South, and not to endorse its prejudices. When Huck Finn chooses "All right then, I'll go to Hell" by helping Jim, he goes against his ingrained social training as a white Southerner.

People who want to censor Twain misunderstand his message, either out of ignorance, or purposefully so as to take the sting out of Twain's social commentary and rewrite history.

Perhaps you can think of some works of literature set in India where characters utter analogous slurs, and the purpose of the author is to criticize the caste system?

I don't trust Maytag and GE. It's good that they have simple interfaces and lack surveillance tech, but their cheap machines are almost certainly built for price-driven consumers who don't consider that they are built to fall apart.

Household appliances have been around for a long time now. I wish that there were open-source hardware designs that a certification organization could evaluate.

Who can tell which Whirlpool appliances are actually quality? It's so hard to trust anybody. Between the short-time-horizon thinking of public companies driven by the share price and the brand cannibalism of Private Equity, the brand you thought was reliable a couple years ago is today dialing up short-term gains so that its current leadership can gut the company and retire.

Reviews are so easily gamed that it's hard to trust them. Only companies with small product lines can build and maintain a durable reputation for quality.

I'm about to buy a Speed Queen TR7 washing machine. It feels great to buy a dumb appliance that's built to last and serviceable.

No spyware and featuritis a la kings of user-hostilility LG and Samsung.

No planned obsolescence from built-to-disintegrate brands living off ancient reputations like Whirlpool and Maytag.

Just a machine that I won't have to worry about from a company that makes money by providing value rather than by victimizing their customers.

Re:Somebody please stop the spam texts on Monday October 26, 2026 @05:05PM (#50250943)
Has there ever been a "Stop political texts" ballot initiative?
When real income goes up 15% but rent goes up 75%, people are absorbing a cost, not flaunting their wealth.
That stability claim is an average for all American households, gathering together high-income households and long-tenure homeowners along with poor renters. But in a K-shaped economy where the wealthy do well and the rest do worse, averaging the two forks of the K hides the hardship of those on the lower fork.

From https://www.jchs.harvard.edu/blog/rental-housing-unaffordabi...

> The net effect of this longer history is that renters today spend much more of their incomes on rent than they did in previous generations. The median renter household in 1960 spent less than a fifth of their income on rent. By 2022, housing costs consumed 31 percent of the median renter’s income. And in inflation-adjusted terms, the median rent is up 75 percent over these six decades while the median renter income has risen by just under 15 percent.

To escape the "communist" critique, I think it's worthwhile to grapple with opposing all concentration of power, whether private or public, governmental or corporate.

For instance: marketplace competition requires some regulation, but recognizing that regulation is a necessary evil with many opportunities for abuse (e.g. regulatory capture) helps inoculate against socialism's worst excesses.

I agree, but I don't think many wealthy people are open to that perspective. Many seem to credit themselves with having created an environment where everyone's lot is improving in absolute terms, and don't see anything wrong with accumulating outsized relative power for themselves.

The reluctance to give up resources also an understandable aspect of human nature, but power concentration in the hands of the few is always problematic. I'm very much a capitalist but the last few decades have persuaded me that wealth taxes are a necessary and moral correction to capitalism's unfortunate spiraling acceleration of inequality.

Then can we agree on a government funded safety net for the sake of labor mobility? ;)

Typically the real disagreement here is over whether workers should get benefits at all.

EDIT: can we get another `vouch` or two for groundzeros2015's currently [dead] reply? It's well-argued and an olive branch and deserves to be visible.

Since the 1980s, the wealthy have done fantastic while the rest have not done nearly as well. The argument from CATO and others is that we should be content with the majority of households taking home a shrinking share of an increasing pie so long as their absolute purchasing power isn’t decreasing, but that argument feels wrong in part because it’s human nature to measure status relative to others rather than in absolute terms.

Furthermore, wealth applies more pressure against certain costs like housing[1] than against others like food or durable goods. Cheap toasters only go so far in making people feel like they aren’t falling behind.

[1] https://www.jchs.harvard.edu/blog/home-prices-surge-five-tim...

> the average number of hours worked per worker have fallen

Hooray for just-in-time scheduling where workers have to be available full time but rarely get scheduled full time. It’s an innovation that has been great for capital and terrible for labor.

Everyone in your filter bubble is not "everyone else".

The specific legal arguments made in this video are hedged and sober. For example, Stone doesn't play to popular sentiments about expansive EULAs — he notes that the liability for listening devices like LG TVs is limited to guests and others who haven't consented to being recorded by clicking on the EULA agreement.

Channel founder Devin Stone is a licensed lawyer who seems busy enough with his media business that he's likely not spending a lot of time with legal clients... so he's both.

Is it bad to have political activists investigating corporate spyware? Any consumer advocate could be characterized as a political activist.

Lawyer Devin:

> I want a dumb TV

If it’s not just tech people asking for dumb TVs, might the demand rise high enough that they actually appear on the market?

By encouraging prosecutors to punish the innocent, you ensure that the guilty go free to commit more crimes.
American voters care about conviction rate above all else for their prosecutors.
Because the AI vendors do not acknowledge the contributions of those who created the knowledge they trained on. The fruits of everyone's collective efforts flow exclusively to them.
Re:Railway Security Disclosure on Wednesday October 21, 2026 @09:56PM (#50190201)
But UTF-8 is also extremely well-studied.

We can have an LLM enumerate all those edge cases, and we can assemble them into a spec. Then we can integrate that spec into a proof.

And because the spec is functional rather than expressive, we can produce copyright-free, provably correct reference implementations whose correctness is as strong as our spec and our proof process.

This reference implementation would then be available for use by a language like PHP, or perhaps an LLM generating a vibe-coded dependency.

Over time, then, the accumulation of such proven reference works grows. We'll never prove all the application code out there correct, but incremental progress is possible.

Re:There isn't an easy exploit for this PHP vulnerability on Wednesday October 21, 2026 @09:31PM (#50190002)
According to "Today's PHP Security Release, and How We're Strengthening PHP Security" discussed at https://news.ycombinator.com/item?id=50182987

* Regarding one CVE, "Remote code execution was also confirmed on PHP-FPM through application-level code paths."

* Regarding the other CVE, "A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php."

Since those exploits exist, I expect that LLMs will duplicate them soon.

Re:Railway Security Disclosure on Wednesday October 21, 2026 @08:54PM (#50189730)
Vibe coding deps is security through obscurity, with all of its weaknesses (and strengths). It's not that such deps have fewer security bugs than the open source reference implementations from which they are derived, it's just that those bugs are currently less discoverable.

In the near to medium term, the current open source regime has issues because bugs have become extremely discoverable and easy to exploit. But I am skeptical that obscurity will provide vibe coded deps sufficient protection over the long term. As soon as the source code for those vibe-coded deps leaks, you are screwed.

Re:Railway Security Disclosure on Wednesday October 21, 2026 @08:43PM (#50189619)
I just gave this prompt to duck.ai (5.6 Terra under the hood): "How would one go about writing a provably correct algorithm to count UTF-8 code points?"

It gave me something which looked pretty legit. Of course, the generated output very likely to be subtly wrong, but as starting input to a formal checked specification/proof process it seemed like a good start.

I wrote some UTF-8 based string handling software back in the day. It doesn't seem unreasonable to write up a set of requirements and edge cases and then have a formal mechanism prove correctness for common UTF-8 string manipulation operations.

[PEAK HN ON] Now if we could just write provably correct exception handling, we could solve one of the two PHP vulns from today. [PEAK HN OFF]

Re:Railway Security Disclosure on Wednesday October 21, 2026 @07:48PM (#50189216)
It's funny, that's true although I personally can't relate — I enjoy having built something robust, but the act of building isn't something I love.

I can imagine prompting an LLM to build provably correct software. Aren't we already doing something similar already when we remind it to write unit tests and account for all edge cases?

Actually writing provably correct software from scratch sounds terribly tedious, which is why I've never explored it. But maybe an LLM could make that task more approachable.

Re:Railway Security Disclosure on Wednesday October 21, 2026 @07:21PM (#50189018)
Could open source activity transition towards provably correct software, with far more modest feature sets?

I don't have experience with proof based tools, so I'm not sure what's feasible.

Re:Railway Security Disclosure on Wednesday October 21, 2026 @06:41PM (#50188713)
The issue is where to direct the LLM's attention.

Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't.

Older »