MurphyA/hacker-news huggingface dataset:
OpenAI Google Play billing flaw allows receipt replay attacks
by Agoodgirl3232 | 2026-02-04 09:15:10+00:00
I am writing to report a critical logical flaw in the payment verification flow between OpenAI and Google Play, which is currently being exploited at an industrial scale.

The Vulnerability: Receipt Replay / Lack of Binding Based on analysis of grey market operations, attackers have automated the following workflow:

Create fresh Google Play accounts to trigger introductory offers (Free Trials/Discounts).

Intercept the purchaseToken / receipt data returned by Google's Billing API.

The Exploit: The backend validation endpoint appears to accept valid Play Store receipts without strictly verifying if the obfuscatedAccountId (or internal user ID binding) matches the OpenAI account requesting the upgrade.

This allows attackers to "inject" or "transfer" a legitimate trial receipt onto unrelated OpenAI accounts, effectively cloning the subscription status.

Current Impact This is not a theoretical bug. It has spawned a massive reselling market. Telemetry from reseller communities suggests a throughput of 8,000 to 10,000 accounts per day.

Evidence / Attribution Several large-scale unauthorized resellers are openly utilizing this method. These platforms claim to have distributed hundreds of thousands of accounts. Examples of domains involved in this distribution include:

bewildcard . com (Widely known for virtual cards, now allegedly distributing these subs)

nf . video

Technical Mitigation If any OpenAI engineers are reading this: You must enforce strict 1:1 binding verification on the server side. The developerPayload in the purchase request must be cryptographically signed and matched against the user ID during the verifyPurchase callback.

This post is intended to bring attention to the flaw so it can be patched, as standard support channels have been unresponsive.
by OJFord | 2026-02-04 09:15:13+00:00
OpenEvidence does use an LLM. It's ChatGPT for doctors/medical research, tuned to give references in respected journals etc. Hospitals (at least US, Canada, UK) allow and even encourage (US) staff to use it as a quick lookup, the way they'd otherwise Google for a dosage say, it just does that better.

(My wife's a hospital doctor & author and introduced me to it; other family in other countries.)
by jonathanlydall | 2026-02-04 09:15:37+00:00
My anecdotal experience over the last 15 years of personal PCs.

I've had one case of Corsair memory which went faulty after a year (was replaced without question by the supplier) and around 3 PSU failures.

However, on the 3 times I've done upgrades (typically motherboard + RAM + CPU) in that time I've been able to keep my existing PSU without stability issues.

So I wouldn't say it's "insanity" to keep your current PSU when upgrading, but based on your experience if I had stability issues it may be the first thing I test.
by JPLeRouzic | 2026-02-04 09:15:38+00:00
Thank you for this insight.

Yet does your conclusion contradict your premises?

"It just sees frequency. It digests without tasting. And then you land on the page and it says: phenomenological convergence. That's a collision. Because phenomenology is the opposite operation. Husserl's whole move was to un-merge — to strip away exactly the habitual pairings"

"The form is the thesis."
by KaiserPro | 2026-02-04 09:16:10+00:00
Its not just cooling thats totally not worked out, its internal networking, its power management (what happens when its in darkness?) how do you certify servers for +/-10g vibration (https://www.ralspace.stfc.ac.uk/Pages/Dynamics-and-vibration...)

What about gamma rays? there is a reason why "space hardened" microcontrollers are MIPS chips from the 90s on massive dies with a huge wedge of metal on it. You can't just take a normal 4micron die and yeet it into space and have done with it.

Then there is the downlink. If you want low latency, then you need to be in Low earth orbit. That means that you'll spend >40% of your time in darkness. So not only do you need to have a MAssive heat exchanger and liquid cooling loop, which is space rated, you need to have ?20mwhr of battery as well (also cooled/heated because swinging +/- 140 C every 90 minutes is not going to make them happy)

Then there is data consistency, is this inference only? or are we expecting to have a mesh network that can do whole "datacentre" cache coherence? because I have bad news for you if you're going to try that.

Its just complete and total bollocks.

utter utter bollocks.
by globular-toast | 2026-02-04 09:17:55+00:00
There are two stages to becoming a decent programmer: first you learn to use abstraction, then you learn when not to use abstraction.

Trying to find the right level is the art. Once you learn the tools of the trade and can do abstraction, it's natural to want to abstract everything. Most programmers go through such a phase. But sometimes things really are distinct and trying to find an abstraction that does both will never be satisfactory.

When building a house there are generally a few distinct trades that do the work: bricklayers, joiners, plumbers, electricians etc. You could try to abstract them all: it's all just joining stuff together isn't it? But something would be lost. The dangers of working with electricity are completely different to working with bricks. On the other hand, if people were too specialised it wouldn't work either. You wouldn't expect a whole gang of electricians, one who can only do lighting, one who can only do sockets, one who can only do wiring etc. After centuries of experience we've found a few trades that work well together.

So, yes, it's all just abstraction, but you can go too far.
by littlecranky67 | 2026-02-04 09:17:58+00:00
It is not preemptive cynicism, it is also unprobable becaues the EUDI [0], tech specs and example source code are open source and available on GitHub for everyone to review [1]. The age verification is implemented in a pricacy-friendly way, you can't even obtain the exact age during the verification step. The are brackets (such as 13+, 18+) and all the verifier gets is a "yes" or "no". Not your name, not your age.

Please stop spreading FUD when the actual implementations behind the government initiative are actually open source and have been designed to allow anonymous verification.

[0]: https://ageverification.dev/
[1]: https://github.com/eu-digital-identity-wallet
by notrab | 2026-02-04 09:18:02+00:00
Jamie from bunny.net here. Apologies for the delay after announcing S3. Building this required deeper changes to our storage foundation than initially anticipated, while ensuring that existing storage customers remained unaffected.

For clarity, S3 compatibility for Bunny Storage is now live in closed preview (since Jan 2026) with a select set of users.

We’ll soon introduce a sign-up page where users can register their interest, and in the next phase we’ll grant access to invited users.
by ben_w | 2026-02-04 09:18:46+00:00
Any process for beaming power from *outside Earth's shadow* to a point on the ground within the shadow (i.e. local night), necessarily can also send power from somewhere else on the ground that is in sun, even though the planet is in the way (ground->space->ground).

I wouldn't be too surprised by beamed power being used on Mars, because that planet has global dust storms during which nowhere on the surface is getting much light, but it doesn't make as much sense here: because of the atmospheric window, you either use 0.4µm-to-10µm-wavelengths or 10cm-to-10m-wavelengths* with not much in between, µm means lasers and the mere possibility you may have included lasers powerful enough to be useful means everyone else will demand something similar to the IEA nuclear inspection program or will put similar lasers on the ground and shoot them upward to destroy those satellites, while cm-wavelengths means each ground station is a *contiguous* roughly 10km diameter oval.

Given the expensive part of large-scale PV has shifted from the PV itself to the support structures they're on, the ground station ends up about the same cost as a same-sized PV installation, and because that's just the ground station this remains true even if all the space-side components are zero cost. Normal ground-based PV also has the advantage that it doesn't need to be contiguous.

It is also possible to use a purely-ground-based method to transfer power from the other side of the world; a cable thick enough that the resistance is only 1 Ω the long way around is already within the industrial capacity of China, but the same geopolitical issues that would make people hostile to foreign beamed power satellites also makes such a cable a non-starter for non-technical reasons.

* https://en.wikipedia.org/wiki/File:Atmospheric_electromagnet...
by cess11 | 2026-02-04 09:19:44+00:00
"Data centers in space only make sense if they are cost effective"

The author forgot to add that this is only true from the perspective of their own bias.

To someone else it might make a lot of sense, e.g. someone who expects militant resistance to the "data centers" from the general public or some other actor that is highly unlikely to achieve space capabilities.
A Zero-Layer Approach to Memory Safety (1:1 IR, No Sandbox)
by pratyagatma | 2026-02-04 09:20:31+00:00
Hello there,

I'm here to share a project I've been working on for the past 4 days, though I've mulled over the core logic for years. I deeply share the values of this community, I’ve mostly stayed in the shadows.

I’ve reached a point where the results feel significant: ~3,200+ RPS sustained on bare metal with zero allocation and 1:1 IR-to-native mapping, yet with hardware-enforced memory safety. I’m moving the "Safety Tax" from the CPU's hot-path to a load-time formal verification step.

I’ve put together a README and some forensic artifacts (CBMB headers, SCEV audit traces, and 1:1 assembly mappings) to prove this isn't just theory.

Please go to https://github.com/pratyagatma/skl.git and review the artifacts, https://streamable.com/emxwvu for demo. Any feedback—especially from those who hate "abstraction bloat" as much as I do—is much appreciated.

10-40KB event loop sevaka implementation coming soon!

Thanks.
by Arun2009 | 2026-02-04 09:20:41+00:00
> Rich are "freer" but they definitely don't work fewer hours than poor on average. In USA the Rich became rich mostly by working.

> But that also does not mean that billionaires have more free time. It's usually not the case, simply because they are more invested in their ventures.

There is a difference between working because you want to, vs working because you have to. The rich have the choice to quit working if they want to and still pay no significant price - the poor don't have this choice. The rich also don't have to put up with disagreeable work, whereas the poor often do.

This is a question of human freedom and dignity - not just of material wealth.

I'd also challenge the notion that the poor don't "work hard". The food delivery guy who works 8 hours a day often in disagreeable weather is arguably working much harder than many rich people.

> I agree but this is a caveat against the fact that the rich and the poor consume equally.

If you consider purchase of political influence as consumption, then your statement doesn't hold. You are only counting the basic necessities of life as consumption - but there are many services that you can purchase as a rich person that poor people cannot.

> This buys into zero sum ideology of wealth.

I'd say that it’s a mistake to treat wealth as either purely zero-sum or purely positive-sum - a false dichotomy. It has both these natures, depending on the level of analysis and the time horizon.

Wealth can grow collectively over time through productivity gains, technological improvement, and better organization of labor. That is the positive-sum aspect, and I don't deny that.

However, at any given moment, wealth is only meaningful as long as it can be exchanged for real goods and services. At the bottom of all such goods and services lie two fundamental inputs: human labor and natural resources. Both are finite as a matter of physics and biology.

Hence while we do see the amount of goods and services ballooning (and hence total "wealth" growing) primarily due to better utilization of human labor and better extraction of natural resources, there is also a sense in which wealth has a zero-sum nature especially in the short term (i.e., several decades, which is relevant for humans).
by bodge5000 | 2026-02-04 09:21:34+00:00
"The muse visits during the act of creation, not before. Start alone."

That has actually been a major problem for me in the past where my core idea is too simple, and I don't give "the muse" enough time to visit because it doesn't take me long enough to build it. Anytime I have given the muse time to visit, they always have.
by 0xedd | 2026-02-04 09:21:36+00:00
None I know did. If you do your research, all the hype around Bambu is paid. Influencers pushed it. Tech deep dives show it is sub standard. Posted on HN.

Prusa is king. High quality. Open source. EU made and engineered. Slicer is a market leader (Bambu's a fork of it).
by ibestvina | 2026-02-04 09:21:38+00:00
This makes no sense to me. There are plenty of artists out there (e.g. El Anatsui), not to mention whole professions such as architects, who do not interact directly with what they are building, and yet can have profound relationship with the final product.

Discovering the right problem to solve is not necessarily coupled to being "hands on" with the "materials you're shaping".
by wizzwizz4 | 2026-02-04 09:21:56+00:00
If B's an inconsequential stopover, then explain every other rodent in a similar ecological niche. I picked rabbits because they're cute, not because they live unusually unpleasant lives. Sexual selection can produce far worse than A (e.g. ram horns can grow through their skulls, gradually impaling their brains and eventually killing them). And the category of "distasteful" is very, very large indeed.

Nature is red in tooth and claw: trusting evolution to shape a better humanity in the absence of medical treatment is playing "look, ma, no hands!" with eugenics, retroactively justifying every tin-pot dictator's killing spree as a rightful bestowal of the Darwin Award. Medical care to prevent avoidable injury and death is good, actually.
by shane_kerns | 2026-02-04 09:22:35+00:00
This is a great piece of software, with much thought put into nitty gritty details. Aside from the gripes around the mobile experience that some have outlined here, I would say you've put much thought into this piece of software. Your wife is lucky that she has a talented software developer for a husband. AI or no AI, I think this is a very clean and beautiful piece of software. This doesn't seem like its Vibe coded, because AI doesn't write such clean code but maybe AI is improving and I'm just bad at telling which is which. Nonetheless, keep up the great work and thanks for sharing. I'm downloading it just to learn from your codebase. Its not like before AI came around talented devs didn't create working side projects to help their loved ones out.
by vjk800 | 2026-02-04 09:22:56+00:00
Western individualistic thinking struggles with the concept of biological limits. Our genes influence nearly everything we do or are, and there's nothing we can do about it.

Years ago, I read the book "The Sports Gene" by David Epstein. I was particularly struck by how sled racing dogs are now bred for motivation to train, rather than just their physical running ability. That is, breeders select for genes that make it so fun for the dogs to run that they keep going, while the dogs not bred this way just give up when they feel a little tired.

The story made me really think to what extent is my motivation to exercise, or do anything for that matter, affected by my genes? And if this sort of stuff is genetic, is there any more point to punishing myself for laziness than to feeling bad for being too short?
by spacedcowboy | 2026-02-04 09:24:29+00:00
I don't often run things full-screen. I like windows, they give you virtual screen real-estate at the click of a mouse.

Example: Right now I have a project with a main application, a launch agent, and a framework. I can fit 3 columns of text with the font at a size I can easily read across one window in Xcode. I generally work for a period of time in one of the app/agent/framework areas, so I have 3 Xcode windows open on the same project, each having ~90% of the screen with a little overlap.

Sometimes I'll have another similar window, for out-of-context work. If I'm creating a class, and suddenly realise I want to re-factor some other class to make it work, I'll open another window (again with the 3 columns) for the re-factor work, leaving the state of where I was ready to come back to at the click of a mouse.

I personally find it easier to mouse-click to change context than any other way, so keeping the screen 'mostly' used works better for me.
by KaiserPro | 2026-02-04 09:24:29+00:00
Right, but you are confusing a _conspiracy_ with staff training.

I didn't work anywhere near the level, or anything thats dicey where I needed to have a "oh shit delete everything the Feds are here" plan. Which is a conspiracy to pervert the course of justice (I'm not sure what the common law/legal code name for that is)

The stuff I worked on was legal and in the spirit of the law, along with a paper trail (that I also still have) proving that.
by Arch-TK | 2026-02-04 09:24:39+00:00
EURion marks are a feature you must include on your banknote for it to even be considered real. And it's _one_ feature. It's relatively trivial to make a chip which can detect their presence.

On the other hand, if I need a replacement part for something, it's unlikely I will find the manufacturer giving me models for it. And if a manufacturer is giving me models for it, they probably do so with the explicit expectation that I might end up using them to manufacture a replacement.

In most cases either me or some other volunteer will need to measure the existing part, write down all the critical measurements, and then design a new part from scratch in CAD.

Even if somehow you are able to fingerprint on those critical measurements, that's just _one_ part.

The only way this kind of nonsense law could work is if you mandate that 3D printers must not accept commands from an untrusted source (signature verification) and then you must have software which uses a database to check for such critical measurements, ideally _before_ slicing.

Except that still doesn't work because I can always post-process a part to fit.

And it doesn't work even more because the software will need to contain a signing key. Unless the signing key is on a remote server somewhere to which you must send your model for validation.

This is never going to work, or scale.

There are even more hurdles... I can design and build a 3D printer from scratch and manufacture it using non-CNC machined parts at home. A working, high quality 3D printer.

Where are you going to force me to put the locks? Are you going to require me to show my ID when buying stepper motors and stepper motor drivers?

What about other kinds of manufacturing (that these laws, at least the Washington State ones, also cover)?

Will you ban old hardware?

What about a milling machine? Are you going to ban non-CNC mills?

These are the most ignorant laws made by the most ignorant people. The easiest way to ban people from manufacturing their own guns is to ban manufacture of your own guns. But again, this is a complete non-issue in the US where you can probably get a gun illegally more easily than you can 3D print something half as reliable.
by jjav | 2026-02-04 09:24:43+00:00
> It's also a mistake to say that a lot of land gets evaluated in isolation, because that's not even true with a the current property tax.

Sorry, my sentence may have been confusingly worded. I don't mean for tax computation (which certainly uses neighborhood comparables), but I mean that every lot owner will evaluate the maximum profit for their own pocket only, without any regard to greater good of the town. So every lot owner will sell to the developer who'll make a highrise building. Let "someone else" sell a lot to build a library or a tennis court! But there is no "someone else", everyone will seek to maximize personal profit which means no nice places will exist, only tightly packed concrete highrises.

> To your point though, would you say that an apartment building next to a park (or even within several blocks of a park) is worth more than an apartment building with no park in proximity?

Absolutely! But to actually sacrifice short-term tax revenue for longer-term benefit would require forward-thinking politicians. You mention being in Canada so those might exist there, but here in the US, there are none.

> homelessness, it would seem to me like a large group of people without housing would benefit from a system that incentivizes building more housing

I hesitated to mention homeless because my comment has nothing to do with the homeless issue per se. Only using it as a very real example where we can see that town governments are completely willing to ruin quality of life for everyone (fencing off parks, etc) just to save a few dollars short term. Even though it would be immensely better to spend a bit more upfront, to raise the quality of life for the whole town, which will bring in more prosperity and more property value and more tax later on.
by petepete | 2026-02-04 09:25:14+00:00
It's still a craze but the people who want a nice keyboard to use daily found theirs and drifted away from the novelty/modding, I think.

I've used a HHKB Pro 2 since 2010 and it's still going strong. I have a replacement ready if/when it dies, but other than a shiny space bar it looks and feels like new.
by tonyedgecombe | 2026-02-04 09:25:40+00:00
>I instead just fill my house/apartment with stuff already made and still feel like it's mine.

I'm starting to wonder if we lose something in all this convenience. Perhaps my life is better because I cook my own food, wash my own dishes, chop my own firewood, drive my own car, write my own software. Outwardly the results look better the more I outsource but inwardly I'm not so sure.

On the subject of furnishing your house the IKEA effect seems to confirm this.

https://en.wikipedia.org/wiki/IKEA_effect
by yason | 2026-02-04 09:26:36+00:00
The creative process is not dependent on the abstraction.

> For me, lots of programming is the same. I just want to assemble the pieces

How did those pieces came to be? By someone assembling other pieces or by someone crafting them together out of nowhere because nobody else had written them by the time?

Of course you reuse other parts and abstractions to do whatever things that you're not working on but each time you do something that hasn't been done before you can't but engage the creative process, even if you're sitting on top of 50 years worth of abstractions.

In other words, what a programmer essentially has is a playfield. And whether the playfield is a stack of transistors or coding agents, when you program you create something new even if it's defined and built in terms of the playfield.
by larodi | 2026-02-04 09:27:05+00:00
> You do realize that making software by developer for his wife means for random business is hiring a third party dev to build custom software?

No, this is not true. There are so many non-technical users of Microsoft Access that run their won businesses without hiring anyone. A friend of mine had a business with an yearly turnover shy of $3M (which is small, alright) and it was running wired spreadsheets and google forms. 20 people. He never ever bought any software, and existed for more than 10 years, until his wife (yes his waifu) decided to divorce and bring the company down.

Business Architecture is not so much about writing the software, sorry, we as IT professionals would love to think it is, but this is a super weak bias.