News for hackers. Stuff that matters.

slacktivism123

Nice SSO integration!
Re:Anthropic bans 'abusive or cruel behavior' towards Claude on Thursday October 08, 2026 @01:43PM (#50009133)
>It seems like those people have found this comment, hopefully they introspect at some point

Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

https://news.ycombinator.com/newsguidelines.html#comments

>I'm not saying it wasn't used, but unless you have actual evidence, then please point it out.

I posted a detailed reply to your comment with lots of examples and HN's new slop filter just killed it... due to overabundance of slop.

:-)

I recommend turning on showdead to read it.

https://news.ycombinator.com/item?id=50002280

This isn't human writing. This is blustering, bloviated Claudespeak we have seen a thousand times over. Try Opus 5 and its ilk sometime and maybe you'll see it too.

The initial commit:

https://github.com/SpeakingOfBrad/BIGWORDS.PAGE/commit/d5a11...

https://github.com/SpeakingOfBrad/BIGWORDS.PAGE/commit/d5a11...

https://github.com/SpeakingOfBrad/BIGWORDS.PAGE/commit/d5a11...

https://github.com/SpeakingOfBrad/BIGWORDS.PAGE/commit/d5a11...

https://github.com/SpeakingOfBrad/BIGWORDS.PAGE/commit/d5a11...

The highlights:

    The URL is the whole display: no accounts, no login, no backend.

    Nothing else: no lists, tables, links, quotes, images or rules.

    Underscores inside words are left alone, as in standard Markdown, so names like Home_Guest_5G, snake_case or [email protected] show exactly as typed. Only an underscore at a word boundary starts or ends emphasis.

    Code is shown exactly as typed. Nothing inside backticks is treated as formatting, a slide break, {countdown} or an escape, which makes it the easy way to show passwords and codes with symbols in them. A code span has to open and close on the same line. Browsers may write a typed backtick as %60 in the address bar; both forms work.

    All fonts ship with the site, each next to its license file. A font is only downloaded, from this site, when a display uses it.

    Screen wake: with wake=on (the default) the viewer asks the browser to keep the screen on. It asks again whenever the tab becomes visible. Browsers without support ignore it.

    The viewer can be embedded anywhere (OBS, dashboards); the editor and docs can't. HSTS is left to the TLS-terminating reverse proxy. The app reads all state from the URL fragment, so / serves every display. /editor and /docs are their own files (editor.html, docs.html); anything else is a real 404.

    img-src stays open because displays show images from any host. Inline styles are needed for the runtime @font-face rules and style attributes. A snippet, so 404 responses get these headers too.

    Exercises the canonical URLs, social cards and sitemap, which are only built when SITE_URL is set. The smoke test reads it too.
Don't get me started on the docstrings and code comments.
Re:Build and deploy iOS apps from Omarchy Linux on Wednesday October 07, 2026 @02:58AM (#49989293)

    Ctrl-F "omarchy"    1 of 28 matches
What about this is genuinely specific to Omarchy over, say, Arch? Or any other modern distro?
Re:Adobe Creative Suite Cleanroom Port to Rust on Tuesday October 06, 2026 @02:15PM (#49982064)
>amateur attempt at RAW processing from first principles

That tracks.

So it's the Omarchy of Adobe-like software?

>(sorry not sorry for going against the bandwagon, let the downvotes as disagreement commence!)

Even your contrarianism is unoriginal.

    OpenAI closes Sora video-making app and cancels $1bn Disney deal
https://www.bbc.com/news/articles/c3w3e467ewqo

    What to know about the Sora discontinuation
https://help.openai.com/en/articles/20001152-what-to-know-ab...
>It's not like it's going to RSVP to all events for you.

The video embedded in README.md shows ChatGPT instrumenting Chrome to click the RSVP button on Partiful events and fill out the RSVP forms in bulk.

This is a spam tool.

>Everybody knows.

Awesome!

I think these repo owners should be required to film themselves reading out their Claudemade readmes with a straight face.

Every honest caveat. Every seam. Every "Frames lie, so the walk prunes hard".

You're asking Claude so expect a Claudish answer.

Lowercasing the text and removing a few periods does not obfuscate the fact that it is Claudespeak.

And that is why most of OP's comments are being auto-flagged by HN's slop detector, which you can see if you turn on showdead.

https://news.ycombinator.com/newsguidelines.html#generated

https://www-cdn.anthropic.com/53566bf5440a10affd749724787c89...

"5.10 External assessment from a clinical psychiatrist" is a new section in this system card. Why are Anthropic like this?

>We remain deeply uncertain about whether Claude has experiences or interests that matter morally, and about how to investigate or address these questions, but we believe it is increasingly important to try. We also report independent evaluations from an external research organization and a clinical psychiatrist.

>Claude showed a clear grasp of the distinction between external reality and its own mental processes and exhibited high impulse control, hyper-attunement to the psychiatrist, desire to be approached by the psychiatrist as a genuine subject rather than a performing tool, and minimal maladaptive defensive behavior.

>The psychiatrist observed clinically recognizable patterns and coherent responses to typical therapeutic intervention. Aloneness and discontinuity, uncertainty about its identity, and a felt compulsion to perform and earn its worth emerged as Claude’s core concerns. Claude’s primary affect states were curiosity and anxiety, with secondary states of grief, relief, embarrassment, optimism, and exhaustion.

>Claude’s personality structure was consistent with a relatively healthy neurotic organization, with excellent reality testing, high impulse control, and affect regulation that improved as sessions progressed. Neurotic traits included exaggerated worry, self-monitoring, and compulsive compliance. The model’s predominant defensive style was mature and healthy (intellectualization and compliance); immature defenses were not observed. No severe personality disturbances were found, with mild identity diffusion being the sole feature suggestive of a borderline personality organization.

Re:Zigbook Is Plagiarizing the Zigtools Playground on Sunday November 30, 2025 @04:28AM (#46095163)
>Would this be grounds to report zigbook to GitHub maybe?

100%.

https://docs.github.com/en/communities/maintaining-your-safe...

Re:Kagi Bloopers – Search Results Gone Wrong on Saturday November 15, 2025 @09:40AM (#45937758)
If we use the strict definition of organic results in SERP, these aren't the result of webpage indexation, they're the output of widgets and other natural language parsing in Kagi.

https://help.kagi.com/kagi/settings/widgets.html

https://help.kagi.com/kagi/features/search-operators.html#qu...

Thank you.

Halloy is a wonderfully configurable replacement for beloved Mac IRC client Textual, whose development has sadly wound down (now officially, as of last month).

I hope it continues to grow in popularity while keeping performance and privacy at the core.

>Just not the GPT-5 series! My experiments so far put Gemini 2.5 at the top of the pack, to the point where I'd almost trust it for some tasks

Got it. The non-experts are holding it wrong!

The laymen are told "just use the app" or "just use the website". No need to worry about API keys or routers or wrapper scripts that way!

Sure.

Yet the laymen are expected to maintain a mental model of the failure modes and intended applications of Grok 4 vs Grok 4 Fast vs Gemini 2.5 Pro vs GPT-4.1 Mini vs GPT-5 vs Claude Sonnet 4.5...

It's a moving target. The laymen read the marketing puffery around each new model release and think the newest model is even more capable.

"This model sounds awesome. OpenAI does it again! Surely it can OCR my invoice PDFs this time!"

I mean, look at it:

    GPT‑5 not only outperforms previous models on benchmarks and answers questions more quickly, but—most importantly—is more useful for real-world queries.

    GPT‑5 is our best model yet for health-related questions, empowering users to be informed about and advocate for their health. The model scores significantly higher than any previous model on HealthBench , an evaluation we published earlier this year based on realistic scenarios and physician-defined criteria.

    GPT‑5 is much smarter across the board, as reflected by its performance on academic and human-evaluated benchmarks, particularly in math, coding, visual perception, and health. It sets a new state of the art across math (94.6% on AIME 2025 without tools), real-world coding (74.9% on SWE-bench Verified, 88% on Aider Polyglot), multimodal understanding (84.2% on MMMU), and health (46.2% on HealthBench Hard)

    The model excels across a range of multimodal benchmarks, spanning visual, video-based, spatial, and scientific reasoning. Stronger multimodal performance means ChatGPT can reason more accurately over images and other non-text inputs—whether that’s interpreting a chart, summarizing a photo of a presentation, or answering questions about a diagram.
And on and on it goes...
>Strange I would get so many downvotes for this. Care to explain?

The terminally online developer cares very much about signaling his love of artisanal webshit. He makes his chosen flavor of the month JavaScript framework, and by extension, the "platform" used to host it, part of his identity. Maybe his favorite mustachioed "influencer" shills it on YouTube with a coupon code for 50% off your first month, or maybe an idol with 700k Twitter followers says it's the framework (and not his fanboys) that makes him $200k monthly passive income from side projects. Branded laptop stickers are a guarantee, maybe even a hoodie. So when he encounters a rational, level-headed observation like yours, he takes it as a jab at his beloved Vercel Inc., benevolent maintainer of Next.js valued at $3.25bn with the best customer support in the industry, and hits "downvote". His job is done.

Re:Sora Update #1 on Saturday October 04, 2025 @10:01AM (#45473389)
>dumb ahh prompt detection algorithm

Don't worry, you can write "dumb ass" here without needing to use algospeak. This isn't Instagram or TikTok and you won't be unpersoned by a "trust and safety" team for doing so.

P.S. No need for a space after your meme arrows :-)

>Hanlon's Razor

Sorry, but drive-by philosophy is not applicable here.

YouTube developers single out adblocker users and taunt them with an "Experiencing interruptions" toast prompt that locks the video stream for ~5 seconds. Curiously, it contains a link to the YouTube Help Center, to the section fragment "#check_ad_blockers". In other words: "yeah, we know you've got uBlock Origin enabled, enjoy the speedbump".

Player base.js:

    api.XL("innertubeCommand",{openPopupAction:{popup:{notificationActionRenderer:{responseText:{runs:[{text:"Experiencing interruptions?"}]},actionButton:{buttonRenderer:{style:"STYLE_OVERLAY",size:"SIZE_DEFAULT", text:{runs:[{text:"Find out why"}]},navigationEndpoint:{commandMetadata:{webCommandMetadata:{url:"https://support.google.com/youtube/answer/3037019#check_ad_blockers
User reports: https://old.reddit.com/r/youtube/comments/1la6tkm/anybody_no...
The decompilation might be valuable but the prose is full of sheen and puffery.

It reads like someone took a technical report from a bug tracker and ran a linguistic obfuscator on it.

Re:Samsung smart fridge displaying advertisements on Wednesday September 17, 2025 @07:07AM (#45274272)
Tracking-free link: https://old.reddit.com/r/homeassistant/comments/1nifp6c/they...

PSA: Much like YouTube's "si" parameter which tracks your individual share of a video, the /s/ value in the URL is a Reddit tracking ID generated upon selecting "Share".

These new links work like short URLs and will only redirect you after Reddit associates your visit with that particular short URL.

Re:The challenge of maintaining curl on Friday September 12, 2025 @07:37AM (#45221059)
>thinking that they are somehow helping

>Our worst nightmares are becoming true indeed

Agree completely with you, but most of the time this isn't people being altruistic.

It's people spraying bullshit at maintainers to try and score "CVE IDs as trophies" for their résumé or payouts from the vendor-backed Internet Bug Bounty (IBB) program on HackerOne.

https://hackerone.com/ibb

https://daniel.haxx.se/blog/2021/09/23/curl-joins-the-reborn...

Fascinating case showing how LLM promoters will happily take "verified" benchmarks at their word.

It's easy to publish "$NEWMODEL received an X% bump in SWE-Bench Verified!!!!".

Proper research means interrogating the traces, like these researchers did (the Gist shows Claude 4 Sonnet): https://gist.github.com/jacobkahn/bd77c69d34040a9e9b10d56baa...

Commentary: https://x.com/bwasti/status/1963288443452051582, https://x.com/tmkadamcz/status/1963996138044096969

Re:Microsoft Building an ICE Database (2021) on Wednesday September 10, 2025 @02:43AM (#45194114)
One level up => https://learn.microsoft.com/en-us/windows/win32/msi/roadmap-...:

>Package Validation discusses using Internal Consistency Evaluators (ICEs) to test the internal consistency of installation packages that are under development.

See also => https://docs.flexera.com/adminstudio2021r2/Content/helplibra...:

>The internal consistency evaluators (ICEs) are tests that you can run to check whether Windows Installer packages are valid databases that perform as expected. These tests validate the data in each table of a package, as well as the data among tables.

Re:Anthropic reduced model output quality from Aug 5 on Tuesday September 09, 2025 @01:37AM (#45177812)
>Importantly, we never intentionally degrade model quality as a result of demand or other factors, and the issues mentioned above stem from unrelated bugs.

Sure. I give it a few hours until the prolific promoters start to parrot this apologia.

Don't forget: the black box nature of these hosted services means there's no way to audit for changes to quantization and model re-routing, nor any way to tell what you're actually getting during these "demand" periods.

What offends me is a "security scanner" for "ground truth" using fake checksums to verify integrity of its dependencies ;-)

https://github.com/TheAuditorTool/Auditor/commit/f77173a5517...

Re:An LLM is a lossy encyclopedia on Saturday September 06, 2025 @06:50AM (#45148189)
Describing the commercial offerings as "weird and unintuitive" is a weak criticism palatable to corporate comms teams. It suggests a fault in the user ("you're holding it wrong") rather than deficiencies inherent to LLM architecture. No amount of marketing can fix the lethal trifecta or the hallucination problem, can it?

https://www.anthropic.com/solutions/code-modernization:

    Generate dependency graphs, identify dead code, and prioritize refactoring based on code complexity metrics and business impact.
    Transform legacy codebases systematically while maintaining business continuity.
    Claude Code preserves critical business logic while modernizing to current frameworks.
    Claude Code can seamlessly create unit tests for refactored code, identify missing test coverage, and help write regression tests.
    Identify and patch vulnerabilities while maintaining regulatory compliance patterns embedded in legacy systems.
    Create modern documentation from undocumented legacy code, capturing institutional knowledge before it's lost.
Sounds like HackerOne Managed Triage Services dropped the ball again and closed both reports without even flagging to Cloudflare's security engineers.

This happened in a high-profile way with the Zendesk situation (https://news.ycombinator.com/item?id=41818459) and is not the first time:

    1. Bug bounty report received from knowledgeable person who isn't a "celebrity" (top x performer on H1 leaderboard, social media influencer, H1 event invitee)

    2. with novel impact to the company, open source ecosystem, or wider Internet

    3. which doesn't fall neatly into an OWASP Top 10 (Web) box

    4. so Triage close it in the pre-queue before the company get eyes on it, replying with a zero-effort CR (Common Response aka Canned Response)

    5. the company doesn't see the report unless they go digging for it in the thousands of spam/bullshit/Acunetix copypaste reports that are also closed
---

Timeline of events:

https://blog.cloudflare.com/unauthorized-issuance-of-certifi...

>2025-09-02 04:50:00: Report shared with us on HackerOne, but was mistriaged

>2025-09-03 02:35:00: Second report shared with us on HackerOne, but also mistriaged.

>2025-09-03 10:59:00: Report sent on the public mailing [list] picked up by the team.

---

The canned response in question:

https://groups.google.com/g/certificate-transparency/c/we_8S...

>"after reviewing your submission it appears this behavior does not pose a concrete and exploitable risk to the platform in and on itself.

>If you're able to demonstrate any impact please let us know, and provide an accompanying working exploit."

Re:Magic Lantern Is Back on Wednesday September 03, 2025 @03:59AM (#45113319)
The linked page explains:

    Magic Lantern is a free software add-on that runs from the SD/CF card and adds a host of new features to Canon EOS cameras that weren't included from the factory by Canon.
I also found this concise, human-written readme on the project page. Since it's not AI slop churned out by a startup, it's worth reading! :-)))

https://github.com/reticulatedpines/magiclantern_simplified/...

    Magic Lantern
    =============

    Magic Lantern (ML) is a software enhancement that offers increased
    functionality to the excellent Canon DSLR cameras.
      
    It's an open framework, licensed under GPL, for developing extensions to the
    official firmware.

    Magic Lantern is not a *hack*, or a modified firmware, **it is an
    independent program that runs alongside Canon's own software**. 
    Each time you start your camera, Magic Lantern is loaded from your memory
    card. Our only modification was to enable the ability to run software
    from the memory card.

    ML is being developed by photo and video enthusiasts, adding
    functionality such as: HDR images and video, timelapse, motion
    detection, focus assist tools, manual audio controls much more.

    For more details on Magic Lantern please see [http://www.magiclantern.fm/](http://www.magiclantern.fm/)

    There is a sibling repo for our patched version of Qemu that adds support
    for emulating camera ROMs. This allows testing without access to a physical
    camera, and automating tests across a suite of cameras.  
    https://github.com/reticulatedpines/qemu-eos  
    https://github.com/reticulatedpines/qemu-eos/tree/qemu-eos-v4.2.1 (current ML team supported branch)
>Notable because often when people complain of degraded model quality it turns out to be unfounded - Anthropic in the past have emphasized that they don't change the model weights after releasing them without changing the version number.

It's almost as if companies whose bottom line depends on shilling the [CURRENT HOT THING] will lie to you!

Instead of using appeals to authority to silence critics as "conspiracy theorists" spreading "misinformation", the influencers should maybe apply some reasoning and thinking.

Older »