Hacker News Reader

greyface-on Who does Anubis actually stop?

Anubis is the penicillin of web hosting.

Every individual practitioner has a strong incentive to overuse it, because it's extremely effective for them individually. Every additional practitioner that uses it increases the selection pressure on their collective adversary to develop resistance. Eventually, it reaches a tipping point and becomes ineffective. But the ecosystem-level impact of its historical use remains, and makes things worse for everyone.

Recently, the baseline expectations of the Web have shifted, and I need to enable JavaScript to read a non-CloudFlare-proxied simple HTML site like LKML. I do not expect this shift will revert once Anubis outlives its effectiveness.

greyface-on Who does Anubis actually stop?

> Until scrapers start implementing it en masse

If it becomes widespread (as it has been doing), they will. Anubis' strategy only works while it remains a niche approach only adopted by a small number of sites.

greyface-on OpenNode – Bitcoin Payment Processor

I share your frustration with the sluggish uptake as everyday currency. This is, however, a social and political issue rather than a technical one. People don't see the problem with just using US government dollars; they buy the energy FUD; they see the IRS telling you that you need to track and pay capital gains on your 5000 sat coffee purchase, and they walk away. A new blockchain with a different monetary base and different technical properties isn't going to change this. Most people just do not yet understand why one would want an uncensorable, self-sovereign money. This will eventually change - maybe within our lifetimes - and when it does, Bitcoin will still be there.

greyface-on OpenNode – Bitcoin Payment Processor

What I'm saying is that your (and others') distaste for the amount of power currently allocated to it is an aesthetic preference, and has no bearing on the viability or utility of the Bitcoin network. It will consume exactly as much or as little energy as people throw at it. And it's not actually being allocated that much energy right now: global air conditioning power consumption is ~10x global bitcoin mining power consumption. Is air conditioning destroying the environment?

greyface-on Tell HN: Namecheap gave my account to an unverified third party

It boggles the mind that this is allowed by ICANN.

greyface-on OpenNode – Bitcoin Payment Processor

Bitcoin is designed to be unkillable; the network won't die just because some people dislike it. The difficulty adjustment will keep it going no matter how much or little hash power is spent on it. As long as it doesn't die, it will have stronger Lindy than any permissionless replacement. Permissioned alternatives (stablecoins, Taler, etc) may find some temporary success, but are bound to monetary authorities that have no choice but to self-sabotage in the long run. Its only real monetary competitor at this point in time is gold, which cannot be sent over the Internet without the aid of a trusted third party. Objections made from an aesthetic frame, such as this one, are understandable but have little to no impact on its long-term success.

greyface-on OpenAI Presence

Instead of throwing an LLM on top of it, just give me direct access to the levers that the agent is allowed to pull on my behalf. A sufficiently motivated attacker will be able to sweet talk the agent around whatever natural language "guardrails" were put in place, anyway.

greyface-on OpenNode – Bitcoin Payment Processor

Even if you're willing to operate fully in the "tradfi" system, your counterparty might not be, and you still want their business.

greyface-on That post never existed. Stop listening to that thing

GP was asking for a guarantee against emitting false decidable statements. We agree that this is impossible. You can slap layers upon layers of heuristics on top, yes, but you will not eliminate all hallucinations because Church and Turing proved it fundamentally impossible nearly a century ago.

greyface-on That post never existed. Stop listening to that thing

https://en.wikipedia.org/wiki/Entscheidungsproblem

greyface-on Firefox 153.0 Beta

<html contenteditable> has existed since IE 5.5, and was standardized in the first version of HTML5.

https://blog.whatwg.org/the-road-to-html-5-contenteditable

greyface-on The human-in-the-loop is tired

Clicks, views, attention. This blog is part of Pydantic's sales funnel.

greyface-on Who's running all those tiny RPKI servers?

It's still very early. RIPE and ARIN have only supported publishing them for a few months. ARIN made very little noise about it during the rollout, and many networks are probably still unaware. Give it a couple years, and I expect we'll see fairly good adoption among those already publishing ROAs. There will still be the never-RPKI holdouts, however.

HE publishes their full ASPA table here, if you're interested in digging in: https://routing.he.net/?cmd=display_aspa_table

greyface-on Who's running all those tiny RPKI servers?

RPKI addresses both.

Route Origin Authorizations (ROAs) enforce which ASes are allowed to originate a prefix. ROAs address origin hijacks, and have been around for longer.

Autonomous System Provider Authorizations (ASPAs) enforce which ASes are allowed to be adjacent to each other in an AS_PATH. ASPAs address path hijacks, and were introduced more recently. It used to be that you had to self-host (as in the article) in order to publish ASPAs, but RIRs are now starting to support them on their hosted RPKI offerings. I'm surprised the article didn't mention this as a reason to run your own RPKI.

If the first hop publishes a ROA, and all subsequent hops publish an ASPA, then the full path can be validated.

greyface-on Vint Cerf, “father of the Internet”, is retiring

> if he'd had the chance to have a second go of it

In a sense, he did. Take a look at RFC 4838.

greyface-on Remote Attestation

The path to compromise that you describe exists, of course. But it's not the only way. For example, a zero-day in SGX combined with privileged access to AWS infrastructure could compromise Signal's SGX setup without any knowledge or collusion by Signal or Intel. As you note, it is not unreasonable for a project of Signal's stature to expect to face adversaries with such capabilities.

greyface-on Remote Attestation

> running the expected payload

SGX does not cryptographically guarantee this. It cryptographically guarantees that the processor contains a legitimate provisioning key signed by Intel. Intel pinky promises that its processor will then only use this provisioning key in certain ways. This promise is essentially unauditable, and previous SGX bugs have shown that Intel isn't really in a position to make it anyway.

greyface-on Tenda firmware (multiple versions) contains hidden authentication backdoor

The article doesn't disclose the value of "sys.rzadmin.password", but this writeup from 2022 does:

https://boschko.ca/tenda_ac1200_router/

Spoiler: it's "rzadmin". And it looks like there are a bunch of other goodies in the firmware, too.

greyface-on GNU Parallel 20260622 ('Rape Gang Inquiry') Released

Edgy citation farming. Anyone using GNU Parallel in scientific research is "required" to cite it in their research using this name. https://cgit.git.savannah.gnu.org/cgit/parallel.git/tree/doc...

A few months ago, "Epstein files". https://news.ycombinator.com/item?id=47592372

greyface-on Odin, Wikipedia and engagement farming

> The point of Wikipedia is to be accurate, not complete

The point of Wikipedia is to be verifiable, not accurate.

https://en.wikipedia.org/wiki/Wikipedia:Verifiability,_not_t...

greyface-on Odin, Wikipedia and engagement farming

For reference, here's the article's content at the time of deletion: https://en.wikipedia.org/w/index.php?title=Draft:Odin_(progr...

greyface-on An American Privacy Emergency

There are infinity dollars in the Federal Reserve. Pay-for requirements are a concern troll bludgeon used against only politically disfavored spending. Taxation (on the federal level) does not pay for services, but merely counteracts the inflationary effect of their provision in an indirect way. It's indirect enough that those who disregard it are not politically punished.

greyface-on CarPlay Is Additive

> gives over most or all of the dash over to another company

The dash isn't the manufacturer's property. It's the car owner's.

greyface-on An American Privacy Emergency

Previous discussion: https://news.ycombinator.com/item?id=48517377

greyface-on Google's New reCAPTCHA Wants Your Camera Access and 21 Points of Your Hand

Then I would opt not to use the computer for this task, and instead call, visit, mail, or fax the government agency.

greyface-on .self: A new top-level domain designed to support self-hosting

Much of the cost here comes from compliance with the ICANN gTLD program structure, not from running the underlying technical infrastructure (which is not limited to DNS - you also need EPP/RDAP/etc). See https://www.icann.org/en/registry-agreements for (hundred+ page) documents outlining registry responsibilities. Registries can outsource some of this to an ICANN-accredited "registry service provider", but should expect to pay upwards of hundreds of thousands of dollars yearly for the privilege.

greyface-on .self: A new top-level domain designed to support self-hosting

https://hccf.onmy.cloud/wp-content/uploads/2026/06/dot-self....

> Everyone entitled to a subdomain at no cost

How are you going to pay for the (substantial) cost of running a TLD without registration fee revenue? Is this a loss leader for other services? Are you operating on a 100% donation model?

> No parking, squatting, or reselling

How do you plan to tell the difference between a parked/squatted domain and one in legitimate use but offering no public-facing services?

greyface-on U.S. government will decide who gets to use GPT-5.6

Oil isn't made out of information and cannot be transmitted via a speech act.

greyface-on Wikipedia Workers to Seek Union Recognition

> a valuable dataset

It's CC-BY-SA/GFDL, and the underlying copyright belongs to the editors that wrote it. There is no commercial value in reselling access, and WMF does not have the right to relicense it.

greyface-on Digital euro clears key hurdle as EU seeks to break free from U.S. credit cards

Financially, they're not equivalent. If you buy your bread on credit, you get an interest-free loan, and benefit from the time value of the money that you otherwise would have paid immediately. As you correctly point out, this value comes from those fleeced by the arrangement. If my comment attributed any moral valence to the two options, that was unintentional.