HNHacker News
TopNewBestAskShowJobs

pona-a

1,181 karma · joined January 1, 2024

submissionscomments
pona-a··on Security through obscurity is not bad
Which is a the power of not relying on obscurity. The server not sending you its complete source code is not any more obscure than a secret key.

Security through obscurity is about obfuscating easy-to-recover trivia thinking it buys you any margin, like the client-side anti-cheat handing attackers everything they need to defeat it while trying to then obfuscate that code.

pona-a··on Tell HN: An update from the new Tindie team
Also:

* fish shaped volatile organic compounds

* sediment shaped sediment

* a 20-foot thick impermeable clay layer

pona-a··on AI should elevate your thinking, not replace it
It feels like an addiction. Normal coding requires sustained attention, you can sense how deep you are in the progress and when you're too tired to continue, but with LLMs the next feature always feels like another prompt away, having sessions go well into the early morning/late-night. You rationalize you can quit, that you've been reading the source and each diff enough to "understand" the codebase. But the truth is when the rate limit runs out, you'll be absolutely helpless, crawling back for extra-usage, until you finally see the total bill at the end of the month.
pona-a··on Meta to start capturing employee mouse movements, keystrokes for AI training
> When Palantir helps USG spy on the planet the primary purpose is defeat enemies + protect assets.

I think it takes about the same amount of suspended disbelief to say that, as it takes a Facebook employee to believe the primary purpose of targeted ads is to connect customers and businesses.

pona-a··on Hyperscalers have already outspent most famous US megaprojects
There's a video by Siliconversations [0] about it. Medicine is first and foremost limited by high-quality data, not intelligence. If OpenAI built a superhuman AGI tomorrow, it would not change a thing about the state of cancer treatment, at least not for a while.

Trying to design a cancer cure by setting a trillion alight on AI is like trying to achieve UBI by funneling citizen's taxes into Polymarket, so they may operate their free supermarket.

[0] https://www.youtube.com/watch?v=ijTxAfFUHkY

pona-a··on Slop Cop
See RFC 5322:

  From: "John Doe" <support@domain.com>
pona-a··on NASA Force
I partially agree, but my problem is it's visibly vacuous. It's not hard to design a web page like this, and with a proper workflow, design system/components, and staff it's trivial for an organization to assemble as is without resorting to AI slop.

That just feels disrespectful to the reader when what you expect me to read may or may not have been a single prompt.

pona-a··on Measuring Claude 4.7's tokenizer costs
I think the word you're looking for is contractors. But yes, you still have to treat those with _some_ human decency.
pona-a··on NASA Force
If you want to me to care about what you have to say, I'd prefer if you cared enough to write it yourself. Especially on on taxpayer money. If I can spot it as slop, you have a problem.
pona-a··on If you started a company two years ago, many assumptions are no longer true
I don't know if this idea is generally useful.

Most of what makes writing a medium worth engaging with is how its presentation is causally insulated from its creation. Well, that is true of other media: film has a whole history of production that you, the viewer, don't witness - being its main difference from theater. But with writing said production cost is trivial, and so is editing: the author doesn't need to commit to a sentence like a director must commit to a shot. This is integral to the identity of the medium, and is what allows writing to be what speech is to cinema: considerably more polished, high-budget, and well-edited conversation with an assumed reader.

When you take that away, or make the writer conscious of how their each edit is being surveilled, you do lose that ability to freely revise your thoughts, degrading it back into a form of lightly edited monologue. Whether it is a good or bad thing is irrelevant, but it does result in a much different kind of writing. All the while, the collected writing history itself offers very low SNR: it does contain certain some divergent possibilities, but so does orders more meaningless mistakes, attention lapses, and runaway sentences - all that writing is defined by omitting.

But assuming most writers use the keyboard just as some use the cursor to follow their gaze, it does at least impart a cognitive fingerprint, useful for light authenticity detection (unless the author is just rewriting a finished thought they plagiarized from memory) but also profiling.

I wrote this, not AI: https://seeitwritten.com/v/ye2p6fgs

pona-a··on Ask HN: What are you building that's not AI related?
As someone interested in cryptography, I'd also recommend a VDF. A Wesolowski VDF isn't that hard to hand-roll [0] [1] and will make parallel attacks much harder while penalizing low-power devices less.

[0] https://reading.supply/@whyrusleeping/a-vdf-explainer-5S6Ect [1] https://eprint.iacr.org/2018/623

pona-a··on The Universal Standard Book Number
I feel like normalization would be a nightmare. Consider all the mistranscriptions, OCR errors, and different names in the libraries (case, parentheticals, etc).

If we assume there's no reliable way to define a book, maybe locally sensitive hashing could help find probably same books.

The idea is pretty cool though.

pona-a··on German implementation of eIDAS will require an Apple/Google account to function
If your app needs to be protected from harm, it cannot protect the user from said harm. I hoped software engineering culture was lucky to not have the same precepts that make lockpicking a crime in the real world, that we successfully make it into common knowledge that you can't grant any trust to the client, but it seems "trusted computing" is making some of us unlearn that lesson.
pona-a··on Cursor 3
Then do you think this new data entry position is going to be smas well paying as your current one?
pona-a··on Anatomy of the .claude/ folder
The problems are not visual but epistemic. If the author didn't specify enough to produce a useful chart, then it's going to be the diagram equivalent of stock images thrown on a finished presentation by a lazy intern. You can't rejection-sample away this kind of systemic fault.

The simple truth we're about to realize is there is no free lunch: a tool cannot inject more intent into a piece than its author put in. It might smooth out some blemishes or highlight some alternative choices, but it can't transform the input "make me a video game" into something greater than a statistical mix-mash of the concept. And traditional tools of automation give you a much better, more precise interface for intent than natural language, which allows these vagaries.

pona-a··on Personal Encyclopedias
I agree. I do admire the concept as a framing device to engage with your family history, but the "AI" part strikes me in a wrong way.

There's a comment by bonoboTP in a sibling thread about the emotional complexity of a project like this. There are many ways to narrate a life story: many traumatic episodes and feuds better left forgotten, different framings, and all that emotional labor of trying to choose what and how you want to remember.

The use of LLMs for creating a shared view for some information isn't inherently morally dubious-processing and storing data is what computers have been doing for generations-except for the privacy implications, but letting this projection of a mega-corporation usurp the role of narrator for such a deeply personal story feels wrong on an instinctual level.

pona-a··on Ubuntu wants to strip some of GRUB features in 26.10 for security purposes
I don't know if FIPS standards have improved, but combining my priors about products boasting FIPS and manufacturer code quality in general, I would actively not trust it with any data, full expecting it either leaks them, corrupts them, or somehow both.
pona-a··on The Diminished Art of Coding
This is a continuation of the previous post, "We mourn our craft" [0] many including me dismissed as critihype. Your reaction to the previous article will predict your response to this one.

I believe holding funerals for a still living craft is a waste of breath. It's a shame current AI discourse is represented mostly by mindless acceptance-trying to equivocate becoming a Q&A tester/manager for a forever intern with an straightforward abstraction layer like the compiler-or these calls to abandon ship and reorient your life away from the entire intellectual pursuit.

I would like to see a reaction not unlike the author's position on AI writing: a rejection of this pull towards mediocrity the LLM embodies, writing perfect masterpieces with obscure tooling, armed with nothing but the reference pages and a meatspace community of peers learning alongside you. Manifesting this idea of "artisan software" beyond even the pre-AI days standards of conduct through discipline and community.

[0] https://nolanlawson.com/2026/02/07/we-mourn-our-craft/

pona-a··on Our commitment to Windows quality
That's iMacs.
pona-a··on Ask HN: What is it like being in a CS major program these days?
Many universities used to have basic skills without the rigorous academic culture of top universities. They're being completely decimated by AI: professors downskilling themselves by openly using it in the course, often even responding to questions with suggestion to prompt it yourself. Some will prognosticate themselves about how everything outside the tiniest subset of their subject will be replaced soon enough. Students themselves seem to either understand AI as academically dishonest or believed the propaganda, thinking they HAVE to "learn" it to have a chance at a career, even at the expense of actual subjects. If you remotely suspect that, don't rely on prior evidence, run.

Meanwhile other unis are still majority high class faculty members holding the bar, but are suffering a decline in the quality of new students. You can absolutely learn in those places, but you're likely to to find many capable peers.

I don't have the data what's going on at global top CS programs, presumably much better than this. I do predict we're gonna suffer a multi-generational loss of skilled talent, with three generations of mediocre programmers converted to AI zombies incapable of performing their job, with or without it.

pona-a··on Grief and the AI split
When one side of the discussion makes their ignorance a point of pride, defining themselves entirely based on what they now need not know, I believe you've inadvertently insulted yourself.
pona-a··on Agents that run while I sleep
And yet it's on the front-page... HN is rabidly descending into actual SEO spam, on par with bought-out game journalism outlets firing everyone to put up a thousand casino ads from non-existent people with fake degrees. Is it the AI bros so desperate for validation of their new methodology they'd take it from a second-rate source?
pona-a··on Add Age Verification Signal Specification · Merge requests · xdg / xdg-specs
In my home country, there exists a law banning the use of encryption without a special government license issued to businesses. Did Chromium instantly add a popup asking if you possessed said license when you first connected to any SSL site? No...

Americans need to realize stupid laws are not to be reasoned with. They are a hammer the powers give themselves to exercise as they please, and you are usually not the target despite being technically in their violation.

You better use that energy to fight these stupid laws with whatever remains of your democratic levers, before those are gone too.

pona-a··on Ask HN: Please restrict new accounts from posting
Is it because do I feel about 'i think my comment' that you came to me?
pona-a··on System76 on Age Verification Laws
It is a common tactic among abusive parents to convince their child without them, they'd be unable to survive in the wider world. Any mistakes will become irrefutable proof thereof, and any attempts to break this control and do things on their own will be treated as ingratitude, often prompting the abuser to instantly abandon all parental duties to "teach a lesson".
pona-a··on California's Digital Age Assurance Act, and FOSS
So a torrent tracker isn't in-scope because it doesn't distribute and only facilitates peer discovery?
pona-a··on California's Digital Age Assurance Act, and FOSS
The difference is a bartender has a handy thing called a human brain that can integrate every evidence and prior without explicit handling. Which a computer program can not. Now we have another "legitimate interest", potentially _forcing_ us to collect biometric and behavioural data we definitely wouldn't monetize to just cover its cost.
pona-a··on California's Digital Age Assurance Act, and FOSS
Agreed. And if the same legislation was designed under the supervision of domain experts, it would be an HTTP header or envvar to indicate one of specified brackets, with recommended integration with applicable parental control system.

Instead it was drafted by people not understanding the difference between browser, app, and "OS", explaining the result.

pona-a··on An interactive intro to Elliptic Curve Cryptography
Yeah, that's usually what happens. But many of those errors are TLS protocol errors, not expired certs.
pona-a··on An interactive intro to Elliptic Curve Cryptography
My pet (conspiracy) theory is ISP middle boxes toying with degrading/MITMing SSL.
← PreviousPage 4 of 15Next →