News for hackers. Stuff that matters.

vayup

OpenAI models prove ETH is false. BTC it is then!

</joke>

Agree with everything on your post. I have to say as a frontier lab employee, it hurts a little to be compared with McKinsey, even as an analogy. :-)
Re:eMudhra to Exit Global SSL/TLS Certificate Business on Thursday October 22, 2026 @01:50PM (#50198786)
> However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business

Translation: We are exiting this business because people are being mean, and we don't get paid enough.

WTF!

They also say: > We believe an organization's character is shown in how it responds when something goes wrong

I totally agree with this. I will judge their character based on this: No apology for wreaking havoc on the world, no admission of fault, whining about people getting pissed at the monumental incompetence, saying that they are exiting the business because "sour grapes" rather than admit they have lost the trust within the community. <sigh>

Re:Anthropic asks users to stop being mean to Claude on Saturday October 10, 2026 @10:38PM (#50039300)
For those who think this is about training data: If that is the concern, they would sanitize the training data, like they do for thousand other things. No chance in hell that they would rely on users meticulously following their usage policies for the quality of their traning data.

Frontier AI folks may be crazy, but not crazy enough to believe people read usage policies :-)

Re:How Delhi cut electricity loss from 50 to 5 percent on Tuesday September 29, 2026 @06:05PM (#49901387)
I bet much of the savings is from reducing theft. 50 percent is too much for transmission losses.

In the industry, transmission and distribution losses are called T&D losses. Pretty much all unaccounted losses will be written off as T&D losses. Often the right expansion for T&D losses is Theft and Decoity losses :-)

They also effectively said that military contractors and their subcontractors cannot use Anthropic - that's a significant part of the economy. I mean technically, they can use Anthropic for non-military work. But in practice, they will choose not use it at all, since it's a better approach to show compliance.
Makes sense. Thanks.
Hm... not normal in my experience. Not enabling a config is not a vulnerability in itself. If not enabling something means a security guarantee is broken (Eg: videos are accessible) then it is a vulnerability, and typically included in VDP, atleast VDPs that are in good faith.
It's reasonable to not have a VDP for the reasons you mentioned. But not reasonable to have a useless one just so it appears they have a VDP.
If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP.

They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact" with the device/service or download its data. Other than that TINY carveout, everything is okay.

Oh, if the vuln about configuration and hardening "preferences" like SSL/TSL - Sorry, not interested.

And also, infrastructure vulnerabilities like DNS config - no no, try harder.

I know what you're thinking..ha ha...but we are good guys. You can still report vulnerabilities in the above categories, but the onus is on you to convince us that we should care about them. It is only fair.

https://www.flocksafety.com/legal/vulnerability-disclosure-p...

Re:Nvidia is the central bank of AI on Saturday September 12, 2026 @10:37PM (#49679421)
I am a bit confused at people looking at this negatively. If Nvidia believes AI demand is extraordinarily high, and that it requires a large capital outlay to serve that capital, isn't this what they should be doing?
Nah, it is probably due to AI agents' love for Libre Office. Codex prefers Libre Office for docs. Other agents may do this as well.

People who have never known about Libre Office are now downloading and using Libre Office (often without realizing it).

https://news.ycombinator.com/item?id=49527396

MITM is a feature now.
Re:Costco Is the Anti-Amazon on Friday July 03, 2026 @05:27PM (#48780207)
And yet, Amazon Prime is inspired by Costco membership.
> They've got, ballpark, $5t to $10t to make back in the next 5 years, or the hardware buildouts will start getting written down.

Depreciation and write-offs are about accounting models. Hardware will still be running after five years and still be making money. They may not be as efficient as the new hardware, but they will still be making real money even though they are valued at $0 in the books.

gogcli is good for this purpose. You can use it with openclaw or with coding agents like Codex or Claude code.
Same happens to me, but I don't think it's the T-shirts that are shrinking.
Re:If AI replaces workers, should it also pay taxes? on Monday December 15, 2025 @01:03PM (#46278041)
We don't want a rebellion sparked by 'Taxation without representation'. Do we?
Re:NSA and IETF, part 3: Dodging the issues at hand on Thursday November 27, 2025 @12:11PM (#46071195)
The strongest arugument made is that hybrid is more complex, more work and therefore more risky.

As someone who has been implementing such systems for 20 years, I don't buy this. In my mind, it's equivalent to saying "Seatbelts add complexity to the safety system, and it's more work. So let's get rid of it."

In this argument, the benefits of hybrid/seatbelts are not factored in adequately.

Especially when anyone can buy the product off the shelf, remove the casing to see what they are trying to redact in these images.
You are absolutely right that it is easy to rule out obviously bad choices, such as 3 of 3. However, determining the actual quorum to use is a qualitative risk analysis exercise.

Considering that this is an election for a professional organization with thousands of members, I am going to go out on a limb and say that it should be easily possible to assemble a group of 5 people that the community/board trusts woudn't largely collude to break their privacy. If I were in the room, I would have advocated for 3 of 5 quorum.

But the lifecycle of the key is only a few months. That limits the availability risk a little bit, so I can be convinced to support a 2 of 3 quorum, if others feel strongly that the incremental privacy risk introduced by 3 of 5 quorum is unacceptable.

Few lessons to relearn here:

- Availability is a security requirement. "Availability" of critical assets just as important as "Confidentiality". While this seems like a truism, it is not uncommon to come across system designs, or even NSA/NIST specifications/points-of-view, that contradict this principle.

- Security is more than cryptography. Most secure systems fail or get compromised, not due to cryptanalytic attacks, but due to implementation and OPSEC issues.

Lastly, I am disappointed that IACR is publicly framing the root cause as an "unfortunate human mistake", and thereby throwing a distinguished member of the community under the bus. This is a system design issue; no critical system should have 3 of 3 quorum requirement. Devices die. Backups fail. People quit. People forget. People die. Anyone who has worked with computers or people know that this is what they do sometimes.

IACR's system design should have accounted for this. I wish IACR took accountability for the system design failure. I am glad that IACR is addressing this "human mistake" by making a "system design change" to 2 of 3 quorum.

Re:Free software scares normal people on Thursday October 30, 2025 @03:27PM (#45764215)
Spot on. Defending simplicity takes a lot of energy and commitment. It is not sexy. It is a thankless job. But doing it well takes a lot of skill, skill that is often disparaged by many communities as "political non sense"[1]. It is not a surprise that free software world has this problem.

But it is not a uniquely free software world problem. It is there in the industry as well. But the marketplace serves as a reality check, and kills egregious cases.

[1] Granted, "Political non sense" is a dual-purpose skill. In our context, it can be used both for "defending simplicity", as well as "resisting meaningful progress". It's not easy to tell the difference.

Re:A Definition of AGI on Sunday October 26, 2025 @09:29PM (#45716489)
Precisely defining what "Intelligence" is will get us 95% of the way in defining "Artificial General Intelligence". I don't think we are there yet.
Something along these lines, as part of the prompt, has worked for me.

               # User-Defined Dictionary
                Always use the following exact terms if they sound similar in the audio:

                ```json
                {{jsonDictionary}}
                ```
I read the title as "massage me", and was very confused for a few seconds.
Re:Claude Memory on Thursday October 23, 2025 @06:11PM (#45688012)
I agree. I use this approach in my coding agent, and it works wonderfully to keep context across sessions: https://docs.cline.bot/prompting/cline-memory-bank

Even though the above link is from Cline, you can use this approach with any coding agent.

No, it is a known problem. It will get fixed in time.
Quantum is a known threat. There is enough time to fix it. Folks are working on the fixes.

Cryptocurrencies would be the last thing I worry about w.r.t Quantum crypto attacks. Everything would be broken. Think banks, brokerage accounts, email, text messages - everything.

Older »