News for hackers. Stuff that matters.

za_creature

Re:Mathematics has changed. Let's act like it on Tuesday November 03, 2026 @10:55AM (#50353565)
I doubt he'd be interested in their souls though.

Automation is... coming for those jobs a well, soon it'll be a niche for those nostalgic enough to desire a human... touch. Damn, these puns write themselves.

But on the topic at hand, demand is capped by the intentionally rare elite status, but then so is supply. Luckily (for some), we've had great success in selective breeding over our 10k year run on this planet between discovering agriculture and the great filter.

It's a bit of bad luck tbh; they just made a point release a few days prior to the bug being announced, with kernel .112
Re:The SEC Should Block Anthropic's IPO to Protect the Public on Monday November 02, 2026 @08:47PM (#50346935)
b-but but then... who owns the bag?

do you know how expensive private jets are to operate?

Re:Mathematics has changed. Let's act like it on Monday November 02, 2026 @09:24AM (#50337232)
That's also how all genocides go. And right now there is a choice, we're not there _yet_.
Re:Mathematics has changed. Let's act like it on Monday November 02, 2026 @07:32AM (#50335971)
The 20th century did not even have machine guns at first and the nobles still had a need of a capable workforce back then.

Between those, biological, chemical and nuclear weapons, missiles and drones and the fact that using them against the civilian population has no impact on the economy, I think you may need to rethink your use of force.

Or do you actually think that they're building humanoid robots to automate blue collar work? More like automate the boys in blue, with unwavering loyalty.

Re:Mathematics has changed. Let's act like it on Monday November 02, 2026 @04:25AM (#50334681)
None, but nobody asked them.
Re:Mathematics has changed. Let's act like it on Monday November 02, 2026 @04:24AM (#50334677)
You can flip this backwards:

Everyone seems to wrap up their praise of AI by claiming that it will bring an era of abundance with UBI. Once we don't have UBI because why the fuck would we, you'll see most people's opinions of AI start to change from one of cooperation to adversarial.

The steam engine produced raw power but that still needed to be controlled and directed for a multitude of purposes, which required putting dirt farmers through education to turn them into factory workers. If machines now do both the thinking and the hard lifting, why exactly would their owners need us for? From where they're standing, they're now looking at a pragmatic solution to global warming: just reduce the "energy requirements" of the population.

Re:Mathematics has changed. Let's act like it on Sunday November 01, 2026 @05:04PM (#50330409)
Do male chicken have souls? Because female chicken have the skill to lay eggs, and that's what makes the latter valuable and the former bonemeal upon birth.

What benefit is a human soul to a feudal lord?

Re:Breaking the Open Web Won't Stop the Bad Bots on Sunday November 01, 2026 @04:58PM (#50330356)
> One wonders why anyone hires and pays for human CxOs

One does indeed.

> You're very confused

And you don't understand the meaning of "curation", otherwise...

> I very seriously don't see how this is a problem.

... you would

The point I'm trying to make is that this is bad...

[edit] ... and not because discovery is 90% of what a doctor does, but because treatment ultimately boils down to a judgement call with possibly irreversible consequences

I made a lot of sausage, including for US companies. My personal preference is smoked, not dried.
Most software development shops (both for-profit and non-profit) are terribly inefficient. They burn up programmer time on administrative tasks that could be automated or performed by cheaper office staff or not done at all. And employees often waste a lot of time just waiting around because no one has optimized workflows to shorten queues or eliminate bottlenecks. The incentives are structured in such a way that there's often little reason to improve.
> another symptom of the US healthcare system

You know the videos of those couriers eating your food and claiming that it was delivered?

see also: https://en.wikipedia.org/wiki/Hippocratic_Oath

Re:Breaking the Open Web Won't Stop the Bad Bots on Sunday November 01, 2026 @01:58PM (#50328533)
I avoided directly touching this subject in order to let you process, but while a browser is not heavy machinery, an LLM is by virtue of heat output alone.
Re:Breaking the Open Web Won't Stop the Bad Bots on Sunday November 01, 2026 @12:34PM (#50327723)
While I believe we agree on how shitty ad-tech is, there are plenty of ways to screen out outliers from a dataset.

For example, here [1] you stated here that:

> [the crawler operators'] own time to figure out how to get around the block is the biggest cost

This can be proven by applying the countermeasures, then checking which IP addresses (possibly grouped by their most significant bits / AS numbers) have caused a temporary dip in traffic. Rinse and repeat for as many nines as you need to send the motherfuckers to jail.

[1] https://news.ycombinator.com/item?id=50312681

Of course they failed <today>, but make it a supervised goal and tomorrow we'll have minecraft utopia*

Now we just need to end human civilization a few times before the reward function kicks in and we'll have actual utopia

* the utopia might be backed by anti-thermodynamic processes available to a simulated reality; if you are concerned about anti-thermodynamic processes not being available in your reality, consult your local physicist or snake oil salesperson for a second opinion

Re:Breaking the Open Web Won't Stop the Bad Bots on Sunday November 01, 2026 @09:47AM (#50326207)
There's this thing called netblocks and if blocking those doesn't get the job done, the netblocks themselves are assigned to autonomous systems.

Residential proxies are a whitewashed name for botnets, mr consultant.

Re:Breaking the Open Web Won't Stop the Bad Bots on Saturday October 31, 2026 @09:35AM (#50316061)
> How do you even implement an ua check?

For this purpose, it looks like this:

  if 'googlebot' in request.headers.get('user-agent', 'googlebot'):
      return 403
Re:Breaking the Open Web Won't Stop the Bad Bots on Saturday October 31, 2026 @08:32AM (#50315572)
Eh, it's not as clear cut as you make it to be.

For one, you can make PoW progressive based on the number of requests you've encountered from the same IP address. This does hurt users behind NAT so it's not ideal, but it might be time we moved past NAT.

Secondly, 5 seconds is a lot but not unheard of; you could start PoW in the first lines of your html and load the rest of the assets while you're otherwise busy burning cpu time. 20ms quickly adds up at the scale scrapers operate. Which, according to cloudflare is > 50% of web requests.

Re:Breaking the Open Web Won't Stop the Bad Bots on Saturday October 31, 2026 @06:42AM (#50314766)
All of the above fall under "very little". We're talking in the ballpark of 5% extra sales max, at the expense of double the infrastructure costs.

They're also stealing your curated dataset: if you take the time to correctly label your products, add specifications and manuals because you want this to be a competitive advantage, your work was just re-appropriated for the benefit of humanity. But primarily for your larger competitors willing to pay for it.

Re:Breaking the Open Web Won't Stop the Bad Bots on Saturday October 31, 2026 @05:47AM (#50314493)
> You cannot determine intent by looking at an HTTP request.

I believe this is the crux of our disagreement. Clearly you can't, which is why you must assume good faith and service all innocent-looking requests.

What you can do however is temporarily log and search for patterns in multiple HTTP requests. If you can then prove that these requests came from a bot via the plethora of fingerprinting measures already in use, you have grounds to make a complaint to the FTC, which would have the ability to subpoena the identity of the offending entity and, depending on their history, issue a warning, a fine or file a lawsuit.

The current status quo is that attackers have an advantage in that the worst thing that you can do to them is to temporarily block them, and you don't really want to do this because you're never 100% sure whether any _individual_ request is automated.

While I can't say that this law is good for this purpose, I am pointing out that the solution looks something like it. The goal is not blocking the individual, but doing something about infra-level abusers, at a volume where 95% accuracy is sufficient proof of wrongdoing. All of your arguments are valid and would be tried in court in response to this passing, hopefully for the better but ultimately it depends on how good the justice system is. This last thing is something no amount of technology can fix but in that case illegal scraping is the least of our problems.

Re:Breaking the Open Web Won't Stop the Bad Bots on Saturday October 31, 2026 @05:23AM (#50314396)
> you're proposing a law that says anybody with an inaccurate user agent string is in violation

No, I am proposing that if googlebot is not within that inaccurate query string, google is in violation.

> Sites could then try to either blacklist or whitelist user agents.

Yes, that is a desired outcome.

> If they do the first one, that doesn't work, because the scraping service can change it whenever they want.

That would put them in violation, and make them prosecutable. Of course you need to start collecting data to prove that it's automatic, but this is already happening today for the purpose of temporarily blocking an IP. Having this law means that you also have some punitive measures at the end of the rainbow.

> If they do the second one ...

Anyone pretending to be a common browser when they're not is in violation. In addition, under this law there's no incentive for anyone to pretend to be googlebot since _that_ can get them blocked. You are intentionally and repeatedly trying to obfuscate these facts.

Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @10:36PM (#50312712)
> If I have a browser extension that reloads a page every 5 minutes, so I can visually see if an update has happened, is that controlled by a human?

No, but nobody cares if you reload one page every 5 minutes

> What about 5 seconds?

Definitely no, people will start caring after you do this for an hour or so.

> Does it matter if it the extension opens the page in a new tab every 5 weeks at my direction?

No, if you don't press a button to make it happen every time, it's automated. Also, nobody cares, you are not the intended target here.

> Does it matter if the page is on Reddit, and I prefer entertainment through comment trolling?

No, but being entertained at others' expense suggests some emotional issues you may want to check on.

> Does it matter if the page is on Ticketmaster and I might be reselling concert tickets?

Yes. Scalpers are bad for everyone but themselves.

> What changes if I write my own browser?

Nothing.

> What if I name that Diff Browser (not "Diff Bhot") and it compares against the prior version to email me (erm, better say "display" because of this new law) only if there are differences?

It's still automated, thus a bot. There might be a fair use case if you could've refreshed the pages manually, but what you are describing is RSS.

> What if I'm blind and it does indeed email me after running through an AI to convert to output that's easier for me to read?

I've addressed it here: https://news.ycombinator.com/item?id=50311855

You are unhappy with my response, though I have reason to believe you are biased given your recent loss. I'm sorry for that, though your argument there is the same but with less mass behind the wrecking ball.

> What changes if the app is primarily intended to be on a "normal" screen, but is "minimized" and not displayed, though could be recalled whenever I want?

Are you recalling it manually or automatically?

> What changes if it could be recalled but I never decide to do so?

Then no crawling happens so you don't have to worry about anything?

> What if the screen is a 1x1 black/white pixel that indicates HTTP 200 vs anything else?

This would be automation, since a browser does not behave that way for a normal user.

> What changes if I download this program from someone else and use it other than how they intended?

This is not about programs, it's about websites being crawled against the wishes of their authors.

> You may believe you have clear definitions, but you don't.

Once again, I'm sorry for your loss and any grief my message may have caused you.

Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @09:46PM (#50312460)
There is, this entire thread is peanuts in the grand scheme of things. The real problem is whether it'll be possible to write to the web without some form of ID, and there's some good news there too:

There's also always going to be an anonymous unmoderated "dark web" where everyone and their LLM can shitpost all day long, it's just questionable how many humans are involved in it. It's also broadly irrelevant since the important messages will eventually be reposted by "legitimate" users on their moderated channels for the "normies" to read.

You can get pretty far with messages signed by certificates issued by authorities that check one-another. You can go further with a gossip protocol on how many bytes have been signed by each certificate on each website.

Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @08:12PM (#50311855)
It's just an unfortunate reality that people with disabilities live with.

Some of them are already prevented from operating heavy machinery because doing so would put everyone at risk, so there is precedent here. I'm in favor of making concessions to the very unfortunate, though at some point you have to look at percentages, expected impact and decide what is reasonable and what isn't.

To your other question, in the last week there have been entire CPUs embedded within weights. Clearly it's possible to publish "open models" with an agenda so then what assurances you have that the enhancements provided by local ai would be more focused on the plot than what the big browsers do?

Specifically how would a person with disabilities be able to tell the difference between improved instrumentation and conditional access to information, as we have in other media? Consider this in the context of "compared to superintelligence, we all have an intelectual disability"

Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @06:21PM (#50310896)
As a human being,

"stealth" means that it's not trivial for other people to block you from crawling their shit and

"damage, impair or burden" is in the eye of the beholder, the above person trying to block you from crawling their shit

Yes there will be patent-trolls attempting to squeeze this. Which is why it would be in the crawling entities' best interest to provide electronic means to opt-out and abide by them.

Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @06:05PM (#50310756)
> this would necessarily target the people who pay for election campaigns, so it will never happen.

statesmen (and women) do the right thing in the end, but only after trying every other option

Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @05:52PM (#50310638)
User agent strings are a sad consequence of websites incorrectly parsing them to enable functionality, resulting in a "every bug becomes a contract" type of situation.

That being said, if you include GOOGLEBOT in your 1k long query string, alongside a very long page describing your crawlers, how to identify them, how to block them and how to set limits, no judge will find you guilty of concealing your purpose.

As for why the law is written as is instead of banning more specific functionality, it's so assholes don't get any ideas on how to bypass it.

Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @05:35PM (#50310455)
> All of the code in a browser is "automation"

I don't think you are interpreting what I said in good faith, but here goes:

If you use an API to control a browser into navigating to a certain webpage, as opposed to using human interface devices to assert said control.

And no, AI is not a human interface device.

Older »