Hacker News Reader

You can test this locally yourself with mitmproxy, opensnitch, or whatever.

You can try building the (supposedly) open-source apps you use from source.

Everyone opining here should MitM themselves every now and then. If not for your own security then maybe to make sure you're not participating in psyop when opining online and resharing hearsay or old truisms.

pamcakeon An OpenAI model has disproved a central conjecture in discrete geometry

> Obviously playing Kasparov on the board requires more planning ability than managing a McDonald's

Not obvious and in fact I think the opposite is way more likely. Chess is well-defined and self-contained in a way that managing a restaurant with fleshy customers never will be.

pamcakeon GitHub confirms breach of 3,800 repos via malicious VSCode extension

At what point did/does it start feeling naive to trust the integrity and output of Github Actions on general? Does it feel unlikely that an attacker would be able to get a foothold in that infrastructure?

pamcakeon GitHub confirms breach of 3,800 repos via malicious VSCode extension

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them.

Migrate off vscode already.

pamcakeon Iran starts Bitcoin-backed ship insurance for Hormuz strait

What of it?

You are not responding to the debunking of your "Value doesn't have anything to do with utility" claim.

The only relevant thing I can see here is that yes, the volume is too low to provide any sense of untracability for the scenario discussed. It might for paying your VPN subscription.

pamcakeon Show HN: Forge – Guardrails take an 8B model from 53% to 99% on agentic tasks

Guess: 30B MOA with 3B active

pamcakeon Iran starts Bitcoin-backed ship insurance for Hormuz strait

In this case it does. You can't funnel huge amounts through a coin with usually small volume and market cap and expect any sense of anonymity or privacy. The delta makes it obvious. It would probably be visible via movements on markets too.

For smaller amounts this is not a problem for the same coin and network.

Your volume might support $10k but not $10m.

pamcakeon Invisible_playwright: Stealth Firefox that passes every bot detection test

docs: https://github.com/feder-cr/invisible-firefox/blob/12b3a6d44...

pamcakeon The last six months in LLMs in five minutes

> I put together these annotated slides from my five minute lightning talk at PyCon US 2026

Is there a video or audio of this talk?

pamcakeon You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

This kind of post really shouldn't require client-side js — from third-party domain — to read...

static markdown version: https://raw.githubusercontent.com/ze3tar/ze3tar.github.io/9d...

pamcakeon Chrome removes claim of On-device Al not sending data to Google Servers

https://www.theregister.com/software/2026/04/30/mozilla-push...

Remember AMP?

pamcakeon Chrome removes claim of On-device Al not sending data to Google Servers

I don't understand this choice at all. What do you base your trust on here?

pamcakeon Linux Kernel 6.12.86 and 6.18.27 released

> I'm announcing the release of the 6.12.86 kernel.

> All users of the 6.12 kernel series must upgrade.

https://lwn.net/Articles/1071571/

pamcakeon The Boring Internet

Alternative readable rendering: https://www.terrygodier.com/the-boring-internet/ascii

pamcakeon They Called It LISP For A Reason (2005)

Another good introduction, full-nonsense: http://landoflisp.com/

pamcakeon Google Chrome silently installs a 4 GB AI model on your device without consent

Konform Browser

Mullvad Browser

Tor Browser for those occasions

pamcakeon Security through obscurity is not bad

Obscurity isn't security but it can support security. Until it doesn't.

pamcakeon A desktop made for one

I think I agree. But at the same time we have strength in numbers and people will find something close to what they want and fork off that.

So I think the same thesis holds for audiences of 10-100 and 100-1000.

A cambrian explosion of software.

pamcakeon Midori, the first browser to offer a VPN with Mesh technology

It transformed. Same name, different browser.

pamcakeon Midori, the first browser to offer a VPN with Mesh technology

Recently did a personal roundup of firefox forks and ended up with Mullvad Browser, with Tor Browser on the side. Main factors being security and release latencies. Since a month or so also running Konform on the side after seeing it on Show.

pamcakeon Systemd-manager-TUI: A TUI application for managing systemd services

Three months for a utility tool like this is nothing to panic in comments about.

pamcakeon The agent harness belongs outside the sandbox

The agent harness needs different sandbox(es) with different privileges. Nothing here supports not containing its access. It's a mistake to think and talk about "the sandbox" in the way the article does.

pamcakeon Roblox shares plummet 18% as child safety measures weigh on bookings

Video games is one thing. Roblox is something else.

pamcakeon For Linux kernel vulnerabilities, there is no heads-up to distributions

Look, if they namedrop specific distros in their announcement (marketing) blog post as affected, I think a heads-up before publishing that is appropriate and expected.

I don't think they would have gotten as much flame if it weren't for how the RHEL 14 mention and such were put.

This is a security company with a professional(?) communications department banking on pointing fingers at distro maintainers. We are not talking about solo security researchers or academics here.

pamcakeon Some secret management belongs in your HTTP proxy

s/your/a

You may not want to be doing this at the edge.

pamcakeon NSA is using Anthropic's Mythos despite blacklist

Hyped. Even little projects Mythos everywhere.

pamcakeon M 7.4 earthquake – 100 km ENE of Miyako, Japan

> Outsourcing critical infrastructure and emergency services to private parties is always a terrible idea.

That would include Apple and Google.

pamcakeon Dependency cooldowns turn you into a free-rider

Right.

Not to mention the (apparently not obvious?) option of detaching review- and release versions. We still look at the diff of latest versions of dependencies before they reach our codebase. That seems like the most responsible.

Besides, why stop there? Everyone installing packaged builds from NPM are already freeriding from those installing sources straight from Github releases. smh

pamcakeon Modifying FileZilla to Workaround Bambu 3D Printer's FTP Issue

`0.0.0.0`.

pamcakeon How the CIA Forgot the Art of Spying

On the one hand, convincing write-up and arguments.

On the other, I find it more plausible that CIA would cultivate this image than them actually having lost the art and game of spycraft.