MurphyA/hacker-news huggingface dataset:
by woodruffw | 2026-01-27 18:01:12+00:00
Services that process CMS[1] or PKCS#7 envelopes may be vulnerable to this bug. The most common example of these is S/MIME (for signed/encrypted email), but PKCS#7 and CMS show up in all kinds of random places.

(Unless I'm missing something, a key piece of context here is that CMD/PKCS#7 blobs are typically allowed to select their own algorithms, at least within an allowlist controlled by the receiving party. So the fact that it depends on an AEAD-specific parameter encoding is probably not a huge hurdle for someone looking to exploit this.)

[1]: https://datatracker.ietf.org/doc/html/rfc5652

[2]: https://datatracker.ietf.org/doc/html/rfc2315
by Imustaskforhelp | 2026-01-27 18:01:32+00:00
> Phone calls are unencrypted, that's why

Agreed did I tell you about the fact that iranian people if you call on their phone calls from foreign numbers you would've received message from AI and I think that a lot of conspiracy theories were formed about it which were really scary but the consensus is that the Iranian govt will record your voice when you would be worried or osmething

Absolutely scary stuff.
by evan_a_a | 2026-01-27 18:02:07+00:00
He offers no proof, just “trust me bro”. If they actually had found flaws, they would’ve reported them. WhatsApp uses the Signal protocol, which is built by actual cryptographers using proper formal proofs. In contrast, MTProto is not designed from a formal cryptographic approach and is described by cryptographers as “brittle”. https://martinralbrecht.wordpress.com/2025/03/16/analysis-of...

Telegram also has no public security or cryptographic assessments, while meanwhile WhatsApp has had numerous components analyzed by cryptographers for security.

https://www.nccgroup.com/research-blog/public-report-whatsap...
https://www.nccgroup.com/research-blog/public-report-whatsap...
https://www.nccgroup.com/research-blog/public-report-whatsap...
https://www.nccgroup.com/research-blog/public-report-whatsap...
https://www.nccgroup.com/research-blog/public-report-meta-wh...
by Cornbilly | 2026-01-27 18:02:14+00:00
Their initial advertising claimed near full automation by their "AI" system when, in reality, they had people manually handling around 70% of the transactions.

I get that this is a message board for YC, so lying about your company's tech is considered almost a virtue but that is an unreasonably big lie to tell without getting your hand-slapped by some regulatory body or investor backlash.
by tptacek | 2026-01-27 18:02:21+00:00
PKCS7 is a container format that pops up in a couple places in the TLS ecosystem (also in code signing); anywhere you need a secure blob that includes metadata. It's a very widely used format.

AEAD ciphers are those that simultaneously encrypt and authenticate data. AES-GCM is the most popular; Chapoly is the 2nd most popular. AEAD ciphers are how modern programs do encryption.

AEAD ciphers all rely on additional parameters, most commonly a nonce; it's critical to security that the nonce only ever be used once with a given key. You need the nonce to decrypt the AEAD ciphertext, so it's usually tacked on to the message (in more clever formats you can derive it contextually, but PKCS7 is a general-purpose format).

In parsing PKCS7 messages, when OpenSSL comes across AEAD-encrypted blobs, it needs to parse out the nonce. AEAD nonces tend to have fixed sizes, but there are extended-nonce variants of AEADs, and the format allows for arbitrary-sized values. OpenSSL assumed a fixed nonce size, but parsed with a library that handled arbitrary-sized values. Stack overflow.

A maliciously formatted Authenticode signature, certificate chain, OCSP response (I think?), all things that could trigger the bug.
by enraged_camel | 2026-01-27 18:02:24+00:00
>> The limiting factor at work isn't writing code anymore. It's deciding what to build and catching when things go sideways.

Actually I disagree. I've been experimenting with AI a lot, and the limiting factor is marketing. You can build things as fast as you want, but without a reliable and repeatable (and at least somewhat automated) marketing system, you won't get far. This is especially because all marketing channels are flooded with user-generated content (UGS) that is generated by AI.
by muwtyhg | 2026-01-27 18:03:15+00:00
No, calling things/people/ideas communist is still 100% in play by the Republican party. McCarthy-ism is in full swing, and they've even added "antisemite" as another hot label they can throw on people to tarnish them. They have called the people protesting "raging commies" and other, similar phrases. Trump has called judges that act against him communist as well [1]

[1] https://www.milwaukeeindependent.com/featured/calling-commun...
by drob518 | 2026-01-27 18:03:19+00:00
Love your post. So, don’t take this as disagreement.

I’m always a little bewildered by frame rate discussions. Yes, I understand that more is better, but for non-gaming apps (e.g. “productivity” apps), do we really need much more than 60 Hz? Yes, you can get smoother fast scrolling with higher frame rate at 120 Hz or more, but how many people were complaining about that over the last decade?
by PaulDavisThe1st | 2026-01-27 18:03:22+00:00
> By raising awareness of the situation, it has now become more slanted towards "peace in Palestine."

"the situation" changed from "more than a thousand Israelis murdered by Hamas" to the total destruction of Gaza, the death of tens of thousands and worse.

It's not exactly surprising that there was a shift in where public support is directed.
Ask HN: Will AIs Need Psychiatrists?
by toddh | 2026-01-27 18:03:26+00:00
I wonder, as LLMs gain persistent state and self-modify their weights through repeated interaction, are those weights analogous to neurons that exhibit long-term potentiation? Are they subject to psychological dysregulation?

LLMs stop being static software and start becoming path-dependent control systems with a “life history.”

Will LLMs develop: stable attractors (ruts); defensive behaviors that look like neurosis; and suffer from trauma?

My guess is yes, and long-lived assistants will need an independent behavioral oversight stack: that is, psychiatrists.
by iamnothere | 2026-01-27 18:03:51+00:00
I have seen anti-Signal FUD all over the place since it was discovered that protesters have been coordinating on Signal.

Here’s the facts:

- Protesters have been coordinating using Signal

- Breaches of private Signal groups by journalists and counter protesters were due to poor opsec and vetting

- If the feds have an eye into those groups, it’s likely that they gained access in the same way as well as through informants (which are common)

- Signal is still known to be secure

- In terms of potential compromise, it’s much more likely for feds to use spyware like Pegasus to compromise the endpoint than for them to be able to break Signal. If NSA has a Signal vulnerability they will probably use it very sparingly and on high profile foreign targets.

- The fact that even casual third parties can break into these groups because of opsec issues shows that encryption is not a panacea. People will always make mistakes, so the fact that secure platforms exist is not a threat in itself, and legal backdoors are not needed.
by goblin89 | 2026-01-27 18:04:08+00:00
SoundCloud used to be good prior to the redesign.

Recently I decided to evaluate it for serious use and start posting there again, only until their new uploader told me I need to switch to a paid plan, even though I triple-checked I was well within free limits and under my old now unused username I uploaded a lot more (mostly of experimental things I am not that proud of anymore).

It looks like their microservices architecture is in chaos and some system overrides the limits outlined in the docs with stricter ones. How can I be sure they respect the mew limits once I do pay, instead of upselling me the next plan in line?

Adding to that things like the general jankiness or the never-ending spam from “get more fake listeners for $$$” accounts (which seem to be in an obvious symbiosis with the platform, boosting the numbers for optics), the last year’s ambiguous change in ToS allowing them to train ML systems on your work, it was enough for me to drop it. Thankfully, it was a trial run and I did not publish any pending releases.

If you still publish on SoundCloud, and you do original music (as opposed to publishing, say, DJ sets, where dealing with IP is problematic), ask yourself whether it is timr to grow up and do proper publishing!
by bikenaga | 2026-01-27 18:04:32+00:00
Original title: "Nitrate in drinking water linked to increased dementia risk while nitrate from vegetables is linked to a lower risk"

Original article: "Source-specific nitrate intake and incident dementia in the Danish Diet, Cancer and Health Study" - https://alz-journals.onlinelibrary.wiley.com/doi/10.1002/alz...

"RESULTS. Higher plant-sourced nitrate intake was non-linearly associated with lower rates of incident dementia (fifth vs first quintile hazard ratio 95% confidence interval: 0.90 [0.83, 0.98]), while increased risk was seen for higher intakes of animal-sourced, additive-permitted meat-sourced, and tap water-sourced nitrate. Similar associations were seen for source-specific nitrite intake and were more pronounced for early-onset dementia. No clear effect modification was observed."
by buellerbueller | 2026-01-27 18:04:48+00:00
You mean https://en.wikipedia.org/wiki/Twitter_Files

These twitter files:

"After the first set of files was published, various technology and media journalists said that the reported evidence demonstrated little more than Twitter's policy team struggling with difficult decisions, but resolving such matters swiftly. Some conservatives said that the documents demonstrated what they called Twitter's liberal bias...

In June 2023, lawyers working for Twitter contested many of the claims made in the Twitter Files in court. According to CNN, 'the filing by Musk's own corporate lawyers represents a step-by-step refutation of some of the most explosive claims to come out of the Twitter Files and that in some cases have been promoted by Musk himself.'

"

The nothingburger Twitter Files?
by buellerbueller | 2026-01-27 18:04:54+00:00
You mean https://en.wikipedia.org/wiki/Twitter_Files

These twitter files:

"After the first set of files was published, various technology and media journalists said that the reported evidence demonstrated little more than Twitter's policy team struggling with difficult decisions, but resolving such matters swiftly. Some conservatives said that the documents demonstrated what they called Twitter's liberal bias...

In June 2023, lawyers working for Twitter contested many of the claims made in the Twitter Files in court. According to CNN, 'the filing by Musk's own corporate lawyers represents a step-by-step refutation of some of the most explosive claims to come out of the Twitter Files and that in some cases have been promoted by Musk himself.'

"

The nothingburger Twitter Files?
by simoncion | 2026-01-27 18:04:58+00:00
When one doesn't care much at all about writing a faithful implementation of a protocol, all sorts of things become easily doable!

I'm reminded of a story from one of those early software-project-management/software-development books where the author was relating a conversation with a client that went something like this:

Client: So, how quickly can you have this done, and how fast can the program be?
Author: Well, tell me about your constraints and accuracy requirements and I'll try to give you answers to those questions.
Client: Oh we don't really have any constraints and don't care much at all about accuracy.
*Very long pause where more details are not forthcoming*
Author: Well, in that case, I can make it very fast and get it done very quickly. It shall return the number two to all queries. I should be able to have the work done by the end of the day.
Client: :O
by krisoft | 2026-01-27 18:05:14+00:00
I don't get your point about the tailpipe emissions. Of course there is a hard cutoff. What else could there be? Do you want them to gently suggest that you should maybe fix your car above 90ppm, and then rudely suggest from 95ppm?

The response they can do is that they either let you use the car or not let you use the car. That is binary. Technically they cannot even do that. All they can do is promise you that if you use your non-compliant car and they find it out they will fine you. Laws are after all just formalised threats backed by force.
by candiddevmike | 2026-01-27 18:05:37+00:00
> The uncomfortable part: if your value was being the person who could grind through tedious work, that's no longer a moat. Orchestration and judgment are what's left.

What kind of work do you think people who deal with LLMs everyday are doing? LLMs could maybe take something 60% of the way there. The remaining 40% is horrible tedious work that someone needs to grind through.
by Forgeties79 | 2026-01-27 18:05:55+00:00
Surely you know how things work at scale.

If you introduce friction with something that millions or more use, a few % peeling off or missing things means tens of thousands of people are impacted. And tiktok has a hell of a lot more than a million users.

I still don’t get what you’re trying to say or why you’re downplaying this.
by throwup238 | 2026-01-27 18:06:22+00:00
I don’t read popsci but if you’re interested in a rigorous treatment I’d recommend The Human Career by Klein which has the broad overview and The Human Past edited by Scarre which is more of a textbook.

I mostly just read the papers as they are published but I’ve heard good things about those two books (they’re on my reading list but I haven’t read enough to form an opinion)
by toomuchtodo | 2026-01-27 18:06:28+00:00
If I were to wildly speculate, Amazon is happy to give shipping partners as much low margin volume as they're willing to take. UPS has higher labor costs because they have union workers, while Amazon does not. To your point, the Teamsters are fine with this because their members have a contract and labor protections from arbitrary cuts. ~70% of UPS' 443k employees are represented by the Teamsters' Union, per UPS' website.

An average UPS driver pulls ~$100k, with some getting close to $170k. Amazon delivery network humans are not approaching this comp and benefits. That is a material component of the profitability spread imho.

https://www.cbsnews.com/news/ups-drivers-170000-pay-benefits...

https://about.ups.com/us/en/newsroom/negotiations/media-fast...
by crazygringo | 2026-01-27 18:06:43+00:00
Commercially driven R&D labs have been around for a long time. Much of research and development has never followed the "scientific method". There's nothing wrong with calling the current set of AI companies "labs" when referring to their research efforts. And their researchers are putting out plenty of academic papers, sharing plenty of research results, so it's not like there's any level of rigor that is lacking.

I don't know why you're trying to suggest some kind of restriction on the word "lab", or based on what. But calling them "labs" is perfectly normal, conventional, and justified terminology.
by huimang | 2026-01-27 18:06:48+00:00
This is a bit more than overselling a proof of concept. He made claims that were not correct, and presented some LLM generated code as point of pride. And not on his blog, but a company's website.

He's emblematic of the era we now live in. Vibe coded projects that the "developer" didn't learn anything from, posted using LLMs. People have zero shame, zero curiosity, zero desire in learning and understanding what they're working on.

Also it doesn't make sense to escalate an interaction by swearing at a person and simultaneously asking them to calm down.
by frenchtoast8 | 2026-01-27 18:07:04+00:00
I'm not understanding how this supports Tailscale's initiatives and mission. That isn't to say this isn't a useful feature for a business, but it feels like a random grasp at "build something, anything, AI related." As a paying customer I'm concerned about the company's focus being blurred when there are 3.8k open issues on their Github repo and my company has been tracking some particular issues for years without progress.
by dragonwriter | 2026-01-27 18:07:06+00:00
> However, tech workers in Bangalore are paid an order of magnitude higher than prevailing local wages in other sectors

250 million people striking in India isn't mainly “tech workers in Bangalore”, or mainly tech and other elite workers at all. It’s about 40% of Indian workers, and most articles I've seen about it centered on widespread participation of workers in coal, construction, and agricultural sectors.
by craftkiller | 2026-01-27 18:07:08+00:00
> willingly unlock their phones

Or they are running any mainstream iPhone or Android phone, they've unlocked the phone at least once since their last reboot, and the police have access to graykey. Not sure what the current state of things is, since we rely on leaked documents, but my take-away from the 2024 leaks was GrapheneOS Before First Unlock (BFU) is the only defense.
by tgma | 2026-01-27 18:07:11+00:00
Yes, it is all relative. It is appeasement compared to war and much heavier sanctions that ended up being necessary. Clinton and even Bush II administrations were hoping internal change would come up during Khatami era and hoping for him to be Gorbachev. Regardless of Bush II harsh rhetoric, the real animosity only really started after Ahmadinejad was installed in Iran. You are correct that Clinton was still not as friendly as the other two, who very explicitly played into their hands.

In any case I was simply responding to OP's "why" question and that their theory on blaming Reagan allegedly vs Carter on a narrow point, highlighting that particular case is temporally much later, and has no relevance to the underlying reason Carter is hated over there.
by mcswell | 2026-01-27 18:07:22+00:00
> xdg-session-management for being able to save and restore window positions
> is still not merged, so there is no standard way to implement this in Wayland

For me, this is a real reason not to want to be forced to use Wayland. I'm sure the implementation of Wayland in xfce is a long time off, and the dropping of Xwindows even further off, so hopefully this problem will have been solved by then.
by coffe2mug | 2026-01-27 18:07:27+00:00
> not saying India's perfect. Far from it

The is the reason it will never change.

Talking in double negative.

Citizens are so shameful to admit issues.

In most of the West, that I know of, people admit to issues. Brazenly say, yes , German train system is under performing, no investment in the last 10 years from both parties. Then there is chance for change. It is happening.

Ego issues need to cleared away.

Mic drop
by uv-depression | 2026-01-27 18:07:35+00:00
How else am I to interpret someone seeing a group of people working low wage jobs and concluding that everyone from their country is a bad influence?

> will only drive people towards right-wing extremists

The right talks a big game about personal responsibility, but somehow their worst beliefs are always someone else's fault. Funny, that.

> naturally become associated

Now see, that's exactly what I'm talking about. It's _not_ natural or inevitable.
by AIorNot | 2026-01-27 18:07:41+00:00
Lets remember that tech bros have been explicitly funding the oppression

25 Million donation to MAGA from Brockman alone! I suspect he is a single issue donor (AI infra above all)

https://www.theverge.com/ai-artificial-intelligence/867947/o...

Its insane how immoral people can be - anyone can see Trump is a conman
by yason | 2026-01-27 18:07:51+00:00
Because Wayland only does essential low-level stuff such as display and graphics it forced people to start coming up with a common Linux desktop (programming) interface out of nowhere to basically glue everything together and make programs at least interoperate.

Such an effort to rethink Linux desktop alone could've been a major project on its own but as having something was necessitated by Wayland all of it has become hurried and lacking control. Anything reminiscent of a bigger and more comprehensive project is in initial stages at best. If Wayland has been coming on for about ten years now I'll give it another ten years until we have some kind of established, consistent desktop API for Linux again.

X11 did offer some very basic features for a desktop environment so that programs using different toolkits could work together, and enough hooks you could implement stuff in window managers etc. Yet there was nothing like the more complete interfaces of the desktops of other operating systems that tied everything together in a central, consistent way. So, Linux desktop interface was certainly in need for a rewrite but the way it's happening is just disheartening.
by epsters | 2026-01-27 18:08:06+00:00
> You worked backwards from your conclusion that "Israel = bad"

I did work backwards. from the evidence. I didn't start with "Israel is responsible for everything". In fact i used to dismiss that theory as "low iq" and believe "that it's complicated". It is complicated, but not as complicated as i used to think.

Saying Netanyahu was "just a civillian" and had no political influence in the Bush admin, in Israel or the Israel Lobby is particularly comical he is the current primeminister and longest running leader of Israel. That period was just a brief interlude when he was not serving in a formal capacity. His vision of the middle-east is exactly what the middle-east is today.

edit : I partially take back 'Libya' - i think the Libya affair is less influenced by the Israeli interests. But still, even though Gadaffi had given up his WMD program and become a friend of US and Europe, he was still a foe of Israel. So he still never could become a friend of the west. Funny how that works isn't it. Almost Like Europe and the US can't have a relationship independent of Israel's interests.
by SHAKEDECADE | 2026-01-27 18:08:28+00:00
If you find value in it, that's fine. I not only find value with interaction with the lovely checkout people, I dislike the cost of scanning and managing the items during checkout being my problem so a huge company can save money. If they were to implement a discount as a way to say "we'll pay you for your work to give us your money" I would consider it.

That's not to say the value of the convenience is never worth it. I exclusively use Sam's Club scan-and-go because the time I save is much larger than the publix/walmart/ect.
by hearsathought | 2026-01-27 18:08:33+00:00
> One is a defensive war

So what the germans did in ww2 was a defensive war also? Funny how the people whining endlessly about genocide are so eager to defend it.

> Because they've decided the Jews in their historical lands

First of all, it was never the "historical lands" of the jews. It belonged to the canaanites whom the jews decided to steal it from. Read your torah. Secondly, europeans larping as jews are not part of the torah and hence have no claim to that land.

> the other is slaughtering of people by an oppressive regime.

Is that the "oppressive regime" defending itself from constant israeli attacks? Hmmm...

Another israeli trying to get the US involved in more wars for their selfish interests.