bsamuels

This isn't a problem that is isolated to Git Annex. There are many maintainers out there taking anti-LLM stances, and you don't have to look very far to find OSS projects drowning from the wave of bugs.

https://daniel.haxx.se/blog/2026/05/26/the-pressure/

and how do you propose fixing the hundreds, if not thousands, of valid, impactful security bugs that frontier models will find?

they buy it from research peptide vendors

thinking tokens, output tokens, etc. Being more clever about file reads/tool calling.

dont unzip an untrusted payload

welcome, you're well along the path of realizing that most of the people on this site don't know what they're talking about

IP rate limiting hasn't been a serious misuse prevention tool for 15-20 years

as soon as you publish a benchmark like this, it becomes worthless because it can be included in the training corpus

In addition to what Will posted, published reports for blockchain projects tend to be skewed compared to our other groups.

Blockchain clients tend to want to publish the report, but that isn't true for our business lines/projects/clients that are more interesting to HN's audience.

the exact details of the attack were still evolving when we pushed the blog post out, so we kept it to what we did know and what could be extrapolated from it

had the same thing coincide with covid, but much harder to fall asleep once disrupted. Melatonin only seems to last for an hour or so, so I would take one to go back to sleep after a disruption

3. is a romance scam. pig butchering/romance scams take place over multiple months, not one texting session

I love these threads because nobody in them ever knows what entrapment is

At my previous job we used GCP and went through so much effort/tooling to try to fix IAM. We definitely would have given this tool a spin. Ignore the HN flashmob.

Another use case you might run in to as you talk with more clients is figuring out what developer IAM roles need to be. This was the far bigger problem for us as we had a ToS that restricted employees from viewing/accessing user data.

> largely on account of the victims being unsympathetic.

the crass bullshit that people on HN say astounds me every day. the victims here are literally the people who need protecting the most

This is as meta as it gets, but I learned what it sounds like when smart sounding, but closed minded people try to shut down an idea.

Looking over all the old YC projects that ended up being wildly successful, but their HN threads were full of naysayers who are better at sounding smart on the internet than providing actual feedback. Learning to differentiate between that kind of poster and people who have genuine feedback that reflects what users actually want is invaluable.

do you feel the same way about Tor?

If 99% of Tor's volume is helping laundering international drug trade money, distributing CSAM, etc, should it be demonized as well?

Bankruptcy and the ability to flush bad management out of the economic system is the single most redeeming feature of capitalism.

If apologists like you ran the world, I would probably have to pay Apple 30% premium on the value of my entire house if I tried to sign mortgage paperwork on an iphone

what you're referring to is an earlier way the merge was designed. there is no PoW mining anymore.

Seriously. I don't think the researcher realizes how many people try to bypass hackerone because H1 would have flagged their finding as invalid.

Using h1 isn't about bug bounties, it's about not having to spend a 1-2 of your team's full time engineers triaging security researcher reports.

RE the first point: you don't have to store/host 100% of the data, content can be blocklisted based on hash or other attributes so your node doesn't replicate or retransmit it. The censorship resistant claim assumes there's at least 1 node on the network willing to host your content.

RE the second point: highly recommend taking a look at the arweave white paper. They use an interesting pricing mechanism that tries to account for the cost of the next 200 years of storage (dunno where 1000 came from, the spec plans for 200).

Many people confuse the account ledger model with "account abstraction".

Ethereum has the first, the second is wip.

Hasn't been mentioned in the thread yet, but the Phoenix Project is also excellent for senior engineers/managers.

I read it once when I was a junior engineer and didn't get much out of it, then again 6 years later and it was _excellent_.

optimal running temperatures for gpus during mining is way lower than what most games will pull.

memory has to stay as cool as possible or else the overclock will be unstable.

Vitalik was not part of the DAO, and the Ethereum Foundation took an extremely hands-off approach to the DAO hack.

This is pretty well documented in the Cryptopians book; the DAO hard fork was driven almost exclusively by people outside the EF.

afaik coinbase is just an exchange, so hopefully they didn't speculate on crypto derivatives with 0 risk management like 3AC did

They explain the risks, while excluding the risk of, you know, the stablecoin depegging.

This is like the 10th algo stablecoin to eat shit. You would think by now, a risk person could adequately describe these existential risks.

Stablegains was a rent collecting middleman. The risks are not characterized adequately on this page, and there ought to be some level of liability.

You have no idea what you're talking about. Botnets are almost entirely ISP router/modem combo devices.

Hashcat was proposed over 20 years ago. You really think out of all the tens of thousands of security engineers working on this problem, nobody has ever considered it? Get a grip.

I hate how this website incentivizes people to try to make posts that sound smart instead of posting stuff they're actually knowledgeable about.

Attacks coming from the same IP address are literally kids just running port scanners.

Blocking individual IP addresses has never been a valid mitigation against professional attackers. Attackers will just pivot to renting a different botnet from different geographies/ip ranges.

If your service has any level of scale, there can be double digit percentages of users who are sharing an IP address with a hacked device. Blocking attacker IP addresses will block users of your service.