HN Brief: 2026-10-23
Today's Hacker News was a grim tour through the fault lines holding the internet together. A French court drove Quad9 out of the country over DNS liability, a certificate authority collapsed because its private key was literally the number 4, and a fraud victim landed in jail while the company enabling it faced nothing. The OpenShell thread captured the same tension in AI: everyone wants secure agent runtimes, nobody trusts the sandbox that phones home. The underlying mood was a deep, earned skepticism that the systems we depend on sit on solid ground.
The threads worth clicking into tonight circle the same fragility in trust and infrastructure. "Quad9 to exit France" frames the terrifying collision of copyright law with core internet plumbing. "eMudhra to exit global SSL" offers the darkly comedic collapse of a CA, triggering an ugly side fight over cultural bias in tech scrutiny. "Woman charged with computer fraud" is the immediate, Kafkaesque nightmare of corporate designs becoming criminal evidence. "Jared Kushner hacked phone" captures the terminal cynicism over selective justice. "Every AI model has the same take on humans" rounds it out with the proxy war over whether model convergence is a profound truth or just a statistical mirror.
Quad9 to exit France [comments]
1157 points · 395 comments · quad9.net · 17h ago
The Swiss nonprofit DNS provider Quad9 is withdrawing service from France rather than comply with a court order to block pirate streaming domains for beIN Sports, arguing that recursive DNS is a neutral lookup they can't geographically restrict without breaking their no-logging promise, and they won't impose French law globally by blocking the names for everyone. The phone-book analogy—punishing a DNS resolver is like fining a phone company for listing a criminal's number—gets heavy traction, but the key outrage centers on Quad9's disclosure that in a similar German case against Sony Music, they attempted geo-blocking, Sony used a VPN to circumvent it, and the German court fined Quad9 for contempt of court for the technically imperfect block. The discussion is split sharply between those who see this as the natural evolution of intermediary liability applied to internet infrastructure and those who see a French court system completely misreading the technical and ethical function of DNS, punishing a non-profit for the crime of being an accessible litigation target. The pervasive takeaway in the replies is that Quad9 has twenty other pending cases in France, and the current trajectory of rulings—technically impossible demands upheld by courts, plus the financial weight of a war of attrition—is effectively a blueprint for how powerful copyright holders can drive principled, privacy-respecting infrastructure out of any jurisdiction they target.
eMudhra to exit global SSL/TLS certificate business [comments]
1027 points · 671 comments · emudhra.com · 18h ago
eMudhra’s press release announces they are exiting the global SSL/TLS cert business, blaming the move on low margins and social media overreaction to an incident. The HN thread treats the release as a desperate face-saving joke, zeroing in on the real story: the company’s CA keys included the number “4,” an embarrassing failure perfectly skewered by a timely XKCD comic. The Chrome team’s brutally direct public interrogation of the company gets linked repeatedly, cementing the case that this wasn’t a PR problem but systemic incompetence. A nasty split develops over whether the pile-on reflects legitimate criticism of Indian tech security culture or is just racism, with advocates for each side shouting past each other. The whole spectacle leaves the broader question hanging — why was a company this shoddy ever trusted to help secure the internet in the first place?
Jailbreaking the Switch 2 [comments]
773 points · 272 comments · pepsipu.com · 23h ago
The blog post documents a software-only Switch 2 jailbreak that chains a 32-bit integer overflow in a niche Switch 1 game through the filesystem module to achieve full code execution. The thread immediately picked up on the author's heavy use of an AI agent for the exploit work, but the consensus settled squarely on the human researcher doing the real architecture, with everyone praising the blog as clearly and enjoyably human-written. The conversation then split hard over the politics of Nintendo's Game Key Cards; one side argued they deserve a similar backlash to Sony for gutting physical ownership, while a strong opposing camp defended them as an honestly-labeled, tradeable compromise whose existence is purely a response to AI data centers gobbling up memory supply. People loved the absurdity of the physical hardware setup—a cheap Wi-Fi light switch flicker arm physically pressing the Switch 2's power button on every crash—but the thread didn't lose sight of the implications, immediately noting that this level of access makes Switch 2 game dumps and recompilation targets a practical reality. And as is tradition, the requirement for a specific $25 game (or its Japanese demo) barely raised an eyebrow from veteran console hackers, who placed this exploit firmly in the lineage of past keys like Cubic Ninja.
Woman charged with computer fraud due to scam CashApp account being in her name [comments]
631 points · 622 comments · www.404media.co · 18h ago
A 404 Media piece recounts the Kafkaesque nightmare of Amanda Smith, arrested and jailed for computer fraud after a scammer used her SSN to open a CashApp account, leaving her unable to get information from CashApp because she can't prove she's the account holder. The thread immediately seizes on the broader systemic rot—prosecutors chasing conviction rates without filtering out cases that lack criminal intent, and Block Inc profiting from frictionless signups while dumping the legal liability on identity theft victims. A sharp split emerges between those who see this as an indictment of the American legal system's lack of common-sense checks compared to something like the UK's Crown Prosecution Service, and those who instead jump straight to practical terror, debating whether freezing a ChexSystems report or proactively opening accounts everywhere is the only real defense. Beneath the split on solutions, the conversation lands on a grim consensus: the burden of proof is permanently on the victim here, and the case exposes how fragile the presumption of innocence is when a corporation's indifferent onboarding process becomes the foundational evidence in a criminal prosecution.
Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
521 points · 207 comments · news.ycombinator.com · 21h ago
The submission is a public apology from a developer who shared details of the critical PHP RCE vulnerabilities before the official disclosure date, after his contacts told him the embargo was over. The thread largely absolved him immediately—you can't break rules you didn't know about—and pinned the real fault on whoever in his information chain misled him. The discussion then split sharply on the bug's actual severity, with security pros armed with PoCs insisting it's a 5-alarm fire while others dismissed it as non-trivial to exploit and overhyped by media and vendors. A strong side current warned the submitter that his public admission opened him up to legal liability, though just as many argued that accountability defuses that risk better than silence. Someone also noted the exploit was already being exploited and discussed before his post, which further complicated the idea that he was the leak that broke the coordination.
Run full iOS 16.5 firmware on Android Devices [comments]
415 points · 142 comments · github.com · 16h ago
The HackiOS project boots an unmodified iOS 16.5 on a Snapdragon Android phone by pulling the system image straight from Apple's CDN, running it entirely in RAM with its own driver replacements. HN treated it as a staggering piece of reverse engineering, linking it to earlier milestones like the T8030 emulation, but the conversation quickly zeroed in on the massive list of broken features—no charging, no cellular, no App Store without an Apple Secure Enclave. Opinion split hard on the point: some see a future where you can run iMessage and iOS-exclusive apps on any device, while others argue it proves the opposite case—that we should be liberating Apple's hardware with something free, an even taller order given locked bootloaders. The excited chatter was tempered by anxiety over Apple's legal response and the security game of cat-and-mouse ahead, especially since iOS 17 specifically introduced kernel-level monitors to shut down exactly this kind of porting work.
Docker is weird [comments]
409 points · 196 comments · codeandcake.dev · 8h ago
The article breaks down how Docker is really just a collection of Linux kernel features (namespaces, cgroups, chroot) in a trenchcoat, with a container runtime written in Go that has to jump through hoops to make syscalls that require single-threadedness. The thread got fascinating when Docker’s original creator dropped in to say he hadn’t been involved in years but was happy to answer questions, which instantly shifted the conversation from critique to oral history. He pushed back on the idea that Go was a mistake—agreeing it was awkward for low-level kernel work, but arguing it was the right bet for Docker’s early success because shipping a compiled binary let them sidestep the Ruby/Python/Java tribal wars of the DevOps era. From there, the thread turned into a sprawling debate about whether Docker over-commercialized (the creator admitted he might have avoided some mistakes if he’d stuck to his product vision) and whether alternatives like nspawn or Incus handle the same problems better today, but most commenters were just grateful for the candid look back.
Jared Kushner Hacked Phone Reveals Secret Negotiations, Millions in Transactions [comments]
403 points · 172 comments · www.vanityfair.com · 10h ago
The linked Vanity Fair excerpt alleges Kushner ran a secret multi-billion-dollar slush fund for Saudi and UAE foreign policy, managed via a Dubai bank account and exposed by Dutch intelligence who piggybacked on a Russian hack of his iPhone. The HN thread largely reacted with bone-deep cynicism, arguing this exposes a structural rot where the rule of law has been fully replaced by impunity, and pointing out the Hunter Biden laptop story got more traction because chasing a centralized, physical piece of evidence is easier than confronting the normalized firehose of state-capture corruption. A fierce split emerged over the Hunter Biden comparison itself, with one side insisting the media actively buried the Kushner story by choice, and the other arguing the laptop was a raw data dump accessible to anyone, whereas this is a heavily filtered book excerpt relaying surveillance secrets nobody outside the Dutch government can independently verify. Beyond the legal specifics, a significant segment of the discussion took the story as data for the terminal phase of the American empire, explicitly comparing the exchange of sovereign power for petrostate dollars to the liquidation of the Soviet state.
OpenShell – A safe, private runtime for fleets of autonomous AI agents [comments]
379 points · 187 comments · github.com · 14h ago
NVIDIA released OpenShell, an open-source runtime for fleets of AI agents that enforces security policies at the kernel level on every system call and network connection and formally verifies what any policy change would grant before it's applied. The loudest reaction was to the opt-out anonymous telemetry, with much of the thread outright refusing to trust a security sandbox that phones home by default, counterbalanced by a minority who saw it as a reasonable ask for free infrastructure from a major vendor. The "lol a GPU company" framing got thoroughly corrected when the thread did the math on NVIDIA's revenue split—gaming is a tiny fraction of their business, and the crowd landed firmly on them being the central bank of AI rather than a card maker. A pragmatic standoff broke out over deployment: one camp argued agent workloads are moving away from Kubernetes toward spikier schedulers, while enterprise engineers insisted that regulatory compliance and existing tooling lock every serious deployment into the k8s ecosystem. On the actual security problem, the conversation got down to the real risk of agent data exfiltration, surfacing the "Lethal Trifecta" pattern of isolating untrusted content, private data, and network access across separate agents as the only real defense once an agent starts executing.
Every AI model has the same "controversial" take on humans [comments]
374 points · 399 comments · www.modelcompare.ai · 15h ago
A blog post chronicled an experiment where a dozen top AI models were independently asked for their most controversial take on humans, and 29 out of 35 answers converged on the same cynical idea: people prioritize belonging and loyalty over facts. The HN thread split straight down the middle over whether this result is a profound finding or a total dud. One side dismissed it as unsurprising—ask a statistical mirror of internet text for a hot take and it predictably returns the most common cultural cynicism floating in the training data, nothing more. The other side argued the cross-model homogeneity is exactly the point, suggesting the Bitter Lesson applies to values as much as benchmarks, and that the industry's claims about unique model personalities are mostly marketing. The thread also zeroed in on the article's reported exceptions—Claude breaking ranks to argue humans are decent, and the image models arriving at a completely different uniform critique about phone addiction—as fuel for the central fight over whether model convergence is inevitable or just an artifact of prompting design.
What’s getting pwned right now [comments]
363 points · 165 comments · pwn.watch · 17h ago
The `pwn.watch` site is exactly what it sounds like—a real-time, grimly utilitarian catalogue of major security incidents and whether a patch exists yet. The HN thread split immediately: half the comments couldn't get past the obvious AI-generated design and generic heatmap, accusing it of being slop, though the creator showed up to actively defend it and push live UI fixes in response to the complaints. The other half dug into the truly ugly data, pointing out that incidents roughly doubled right as LLMs went mainstream in 2023, which kicked off a tense debate over whether AI is accelerating the attacker side of the ledger far faster than any patch cycle can keep up. Underneath it all was a deeper argument about whether we're past the point of point-fixes, with people arguing that the real story isn't CVEs but a structural shift in attack surface that no dashboard can really summarize.
CVE-2026-111943: Compromised Intermediate Certificate Authority [comments]
333 points · 120 comments · emudhra.we-have-a-problem.com · 23h ago
The linked article wasn't available to this summarizer; from the discussion, it's about the eMudhra certificate authority compromise and Go's proactive blocking of their discredited intermediates. The thread zeroed in on how Go's built-in deny list means the fix only applies to freshly recompiled apps, which exposed the fragmented reality of trust stores across Python's certifi, Java Corretto, `uv`, and Homebrew — turning a single CA compromise into a multi-runtime patch emergency. The discovery that the private key was literally the number 4, caught by a standard linter, sent the conversation straight into an XKCD 221 reference and split people on whether this proves AI-assisted vulnerability hunting is the new normal or just that CA hygiene is purely farcical. The consensus was grim acceptance: there is no single upstream fix, the patch burden is entirely on downstream ecosystem maintainers, and everyone is tired of fighting the same fragmentation battle every time a root CA fumbles.
LLMs are making formal software verification feasible at a much larger scale [comments]
325 points · 176 comments · www.anthropic.com · 9h ago
Anthropic published a research collaboration showing they used Claude to produce formal proofs of memory-safety for over a hundred open-source C libraries, working at the RISC-V assembly level and turning existing fuzz tests into mathematical specifications. The HN thread immediately zeroed in on the "convex hull" hypothesis—the idea that LLMs can only interpolate within the space of existing human knowledge, and since this formal verification work targets specific codebases far from typical training data, it actually lends more credibility to the claim that models will hit a wall on genuinely novel reasoning. A strong counterargument came from the Curry-Howard angle: writing proofs is just programming, and the verbose, brittle style LLMs use in both domains is a general weakness that better training or reinforcement learning could fix, not a fundamental limitation. Others pushed back that the isomorphism doesn't magically grant the ability to design the right abstractions—the same concrete, non-modular slop shows up in both LLM-generated code and proofs, and scaling past the complexity wall requires insight agents don't demonstrate. The thread also split on the practical takeaway: even if the convex hull holds for math, verifying existing software might just be a scale problem that lets LLMs secure the entire dependency tree of critical infrastructure without ever needing to invent a new mathematical idea.
Google cleared 300 hectares of Finnish forest [comments]
321 points · 235 comments · www.techspot.com · 16h ago
Google's being investigated in Finland for clearing 300 hectares of forest for a data center before its full environmental impact review was complete. The Hacker News thread on this immediately split into a raw values clash: one camp saw an irreversible destruction of wolf habitat and carbon sink, arguing ecosystems aren't fungible and a fine is just a cost of doing business for a company moving this fast, while the other camp countered that the site is just standard commercial pine forest in a country tailor-made for green data centers. Where the comments diverged sharply from the article was in the fierce debate over whether the damage is truly reversible—the pro-development side insists the outrage is misplaced panic over AI and that replanting is trivial, while critics pointed to satellite imagery showing protected areas already leveled and wolves displaced into towns. Ultimately, the argument boiled down to whether strict adherence to local environmental process outweighs the utilitarian value of getting AI infrastructure built quickly in a cold climate with cheap hydropower.
Xbox wants you to pay 24 to 40 cents per hour to stream games you bought [comments]
286 points · 254 comments · arstechnica.com · 20h ago
Ars Technica reports Microsoft is charging 24 to 40 cents an hour to stream games people already own on Xbox. HN did the math against the rumored $1200 next-gen console, but the thread split right down the middle: some see metered cloud as a fair rental for casual players, while others hammer on ownership—a console won’t vanish when the server goes dark or the introductory pricing window closes. The discussion then careened into a broader ideological fight over freedom, with a vocal camp arguing this per-hour fee is a sideshow next to the industry’s real push to kill local control through kernel-level anticheat and hardware attestation, turning every machine into a thin client. A more pragmatic group countered that this is just a clunky retail version of renting an AWS GPU, leaving the central puzzle why a model that cratered as a subscription would ever work as a metered surcharge on games people already paid for.
Getting ready to operate GNU Taler in Germany [comments]
276 points · 113 comments · www.taler.net · 15h ago
GNU Taler is finally moving toward production in the Eurozone, incorporating a regulated stock company to get an e-money license from BaFin after GLS Bank pulled out of the original plan. The core trade-off pulling the thread apart is that Taler offers privacy for the payer but total transparency for the payee, which half the room sees as a pragmatic upgrade over the Visa duopoly and the other half sees as a wolf in sheep’s clothing that sells a surveillance system as a privacy win. Critics hammered the point that exposing merchants completely opens the door to extortion and normalization of a cashless state, while defenders argued tax compliance is a non-negotiable feature of the social market economy that beats having US corporations hoover up everyone’s purchase data. A few technically deep tangents traced the project to David Chaum’s original blind signatures and argued the regulated wrapper eliminates everything that made the concept valuable in the first place, leaving the thread stuck on whether incremental progress toward privacy is actually dangerous if it cuts off the path to true anonymity.
A farewell to Arc browser [comments]
264 points · 225 comments · arc.net · 15h ago
The Browser Company is shutting Arc down at the end of 2026, funneling users into its new Dia browser with the pitch that all their Spaces and tabs will transfer seamlessly. The HN discussion largely dismissed the security justification as a pretext, framing the shutdown instead as the inevitable corpse of a VC-funded browser that never built a real business model beyond a phantom “Arc for Teams” marketplace. The biggest lightning rod was the CEO’s prior assurance that Arc would be “maintained indefinitely,” which the thread dissected as a perfectly legal euphemism designed to keep the faithful on the hook until the real migration path to Dia was ready. The practical pivot was a full-blown browser recommendations war, with Zen Browser and Helium splitting the departing users depending on whether they wanted a Firefox-based clone or a Chromium continuation. The deeper schism was between the realists who called this standard VC lifecycle math and the camp that saw the careful wording as a deliberate con against the exact power users who made Arc matter.
Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure [comments]
263 points · 97 comments · aws.amazon.com · 20h ago
Amazon published a post detailing how a honeypot caught PHP2Shell exploitation starting Oct 17th, four days before the public CVE, which they frame as evidence that the window between embargoed knowledge and active weaponization has collapsed into hours—but the HN crowd largely dismissed the post as marketing spin for MadPot, noting the detection was clearly a retrospective log review, and savaged Amazon's own failure to ship patched Amazon Linux packages until nearly a day after the public fix dropped, making the 'patch in hours' advice look hypocritical. A large tangent spun off into whether LLMs had discovered the vulnerability, prompted by a tweet claiming someone found the bug by asking "find bad vulnerabilities in PHP," but others thoroughly debunked this, explaining that the specific exploit mechanics and standard model training cutoffs made that origin story extremely unlikely for this particular case. Practitioners cooled some of the panic, reporting that the PoCs on GitHub mostly didn't work in practice and required LFI to be useful, while a separate argument broke out over whether vendors shipping fast are cutting corners on testing or respecting that getting immediately pwned is a worse outcome than a potential regression from a hasty patch.
MPs moving to restrict gambling ads in Canada [comments]
246 points · 129 comments · www.cbc.ca · 17h ago
This CBC piece details Bill S-211, the push to restrict gambling ads in Canada, underpinned by research that logged thousands of betting messages across seven NHL playoff games. HN immediately zeroed in on the "personal responsibility" defense, dismantling it with the observation that online sportsbooks actively cap and ban winning accounts—a dynamic that makes the industry look more like rigged exploitation than a legitimate vice. A sharp split defined the thread: one side framed it as a bodily-addiction public-health crisis, while a contrarian bunch argued the core issue was the normalization of a vice that should carry social friction and shame. Hypocrisy was a major theme: Ontario and Alberta oppose the federal bill while running state lottery monopolies that advertise just as aggressively. And in a very HN turn, the thread dove deep on Wayne Gretzky’s role as a gambling shill, turning into a sprawling debate on 80s hockey culture, Montreal Oilers fandom, and The Sweater.
Several Linux kernel vulnerabilities accidentally posted to public mailing list [comments]
245 points · 89 comments · www.phoronix.com · 20h ago
The Phoronix article covers Trend Micro's ZDI accidentally posting several high-severity Linux kernel vulnerabilities to the public mailing list instead of the private security one, including remote code execution bugs in the kernel's SMB implementation. The thread immediately split on whether this was an honest mistake or a calculated leak, but the discussion ultimately pivoted to the kernel's controversial new policy forcing AI-discovered bugs to be reported publicly because the security team was getting swamped with simultaneous duplicate reports. This sparked a brutal split between people who argue full transparency is the only honest fix for a broken security ecosystem and people who insist that unilaterally dumping embargoes destroys the trust needed for coordinated disclosures. A few grounded technical replies calmly noted the worst bugs are local privilege escalation or tied to kernel-space SMB, which predictably reignited the argument that SMB has no business in the kernel tree.
Local Wikipedia: Wikipedia, but only for things a half hour walk from you [comments]
226 points · 48 comments · edjefferson.com · 9h ago
This site filters Wikipedia to show only entries within a half-hour walk of your exact pin — hyperlocal discovery built on geotagged data. People loved stumbling onto abbeys in Bavaria and extinct bookstores in Palo Alto, but the universal critique was the hardcoded distance limit and the lack of metric toggles or language selection, since English Wikipedia gets sparse outside the Anglosphere. A big chunk of the conversation debated whether this was just a repackaged Wikipedia Special:Nearby page, landing on a clear split: this version wins for letting you drop a pin manually (crucial when your ISP misplaces your IP), while the official page wins for granular control over languages and map layers. The most memorable tangent came when someone fired it up and was immediately served a major school stabbing near their address, kicking off a genuine debate over whether algorithmic local discovery needs a trauma filter.
Faster than earcut: triangulating 3.7M map polygons in 489 ms [comments]
215 points · 40 comments · globus.software · 22h ago
The post is a deep, iteratively-benchmarked dive into optimizing an ear-clipping polygon triangulator to beat the standard earcut library across C++ and WebAssembly. The thread immediately split over the output quality—the algorithm produces long, thin triangles that are a textbook worst-case for modern GPU raster pipelines. The author pushed back hard, arguing CPU time saved dwarfs any theoretical GPU raster hit for map tiles, but the creator of earcut itself joined in to gently challenge the trade-offs, noting their own library prioritizes bundle size and Mapbox now hybridizes earcut with monotone decomposition for complex polygons. The author then doubled down on the benchmarks, responding to direct challenges on the spot by publishing timing comparisons against delaunay32 that proved the ear-clipping approach was drastically faster for their specific massive corpus, even if the quality was measurably worse. The technical depth was high enough that someone asked whether LLMs wrote the code or the staged, benchmark-per-commit post, leading the author to give a detailed breakdown of what Claude could and couldn't handle during hard optimization.
Hedra is a 3D open world game I wrote from scratch while in highschool [comments]
181 points · 32 comments · github.com · 13h ago
Project Hedra is a 3D open-world RPG and full game engine built by hand over nearly a decade starting in high school. The thread immediately seized on the author's own framing of it as a relic of a pre-AI era, turning the discussion into a proxy war over the state of software craft. The main split was between those who celebrated the raw learning and obsession on display as exactly the kind of project that gets lost in an age of one-shot generation, and those who pushed back hard against the relic narrative, arguing that skill and intent define the work regardless of how much autocomplete you use. The phrase "from scratch" itself got picked apart: its meaning has drifted entirely, now primarily signaling the absence of AI rather than describing the technical stack, and that semantic shift captured the thread's broader anxiety about whether deep, obsessive learning is genuinely under threat or just changing form.
Crystal 1.22 [comments]
173 points · 97 comments · crystal-lang.org · 18h ago
The linked article announces the release of Crystal 1.22, boasting native event loops, a revamped DWARF parser, and aarch64-linux moving to Tier 1. The HN thread immediately veered into an existential debate over the language's niche, pitting its "fast compiled Ruby" identity against the maturity of Go's runtime and the actual-Ruby compatibility of TruffleRuby. Fans defended it as genuinely excellent for writing performant, compiled CLI tools and daemons, while skeptics struggled to find a use case that wasn't already better handled by Go or actual Ruby. The discussion dug deep into the technical details of Go vs. Crystal parallelism, and it wrapped up with practical pushback against the cynicism, citing production deployments at Kagi and elsewhere as proof the project has carved out a legitimate working niche.
A complete bypass of eMudhra’s 1FA OTP login system [comments]
173 points · 53 comments · mastodon.catgirl.cloud · 12h ago
The linked Mastodon post demonstrates a complete authentication bypass in eMudhra's CA portal by brute-forcing an OTP to take over accounts and issue arbitrary certificates. The discussion lands hard on this being an existential threat for a CA, correctly identifying that while security is a tiny portion of their business, the entirety of their corporate reputation now rests entirely on this one catastrophic flaw. There is sharp pushback on the sloppiness of the demo itself—a race condition making the digits off by four—and debate over whether their client-side JavaScript encryption adds any real protection when the OTP endpoint lacks rate limiting. The thread takes a wild tangent into the Mastodon instance's aggressive anti-scraping protections serving the researchers themselves garbage text, which sparks a whole secondary argument about the future of machine-readable versus human-readable web and the creeping demands for identity verification.
The foolishness of "natural language programming" (1978) [comments]
134 points · 81 comments · www.cs.utexas.edu · 7h ago
Edsger Dijkstra's 1978 essay argues that "natural language programming" is a foolish ambition because formal symbolism lets us rule out nonsense, not a burdensome interface to escape. The thread reads it as a prophecy against modern LLM tools, noting that prompt engineering is just the detailed spec work he predicted, which thoroughly undermines the "natural" part of the pitch. The best exchange split on whether an LLM is a new type of compiler or a replacement for a developer, a distinction that defines whether its stochastic nature is a fatal flaw or just a feature of the new medium. A practitioner shipping via agents who reviews behavior, not code, provided the direct empirical rebuttal, while the rest of the thread predictably fell into a deep typography rabbit hole over the typewriter kerning and em dashes of the 1978 original.
AI and the Enclosure of the Scientific Commons [comments]
133 points · 77 comments · arxiv.org · 13h ago
The article draws a parallel between the historical enclosure of common lands and how AI might privatize the scientific literature, arguing that AI tools enable a similar seizure of shared knowledge. The thread immediately seized on this, with many using it as a lens to interpret current events like NSF funding cuts and the administration's pivot toward AI-driven research, though opinions split on whether that's a deliberate strategy or just post-hoc justification for ideological defunding. Others pushed back on the article's foundation, pointing out that the "commons" never really belonged to everyone—publishers like Springer already police access, so AI might just be changing who holds the keys. A recurring worry was that even if AI could widen participation in science, the concentration of compute power in a few hands and the tidal wave of AI-generated "slop" papers might drown out genuine contributions, making the enclosure argument feel less like a metaphor and more like a prediction.
Move Slow and Fix Things (2024) [comments]
132 points · 22 comments · endler.dev · 2h ago
The post argues against the VC-fueled “move fast and break things” mindset, making the case for small, bootstrapped businesses and directly taking aim at Paul Graham for promoting a high-risk, low-reward narrative for founders. The thread saw a clear split between those who found the critique validating and others who argued that the market actively punishes the slow-and-steady approach, making it an unaffordable ideal for anyone who isn’t already financially secure. Things got unexpectedly weird when people started tracking the post’s rank, noticing it hit the top spot and then got aggressively downranked to page 4 within an hour, sparking a debate about whether the thread was being penalized for criticizing the very system Hacker News is built on. A more grounded tangent pointed to security-focused engineers like Daniel J. Bernstein as the real, unsung exemplars of this philosophy, quietly maintaining robust systems rather than just writing about rejecting venture capital.
Semantic search across major museums [comments]
119 points · 30 comments · lastmuseum.com · 19h ago
The site is an AI search engine that runs artworks from major museums through image embeddings instead of relying on catalog text. Stress-testing kicked off immediately—searching "soviet" returned a cylinder seal and searching specific artists failed, confirming the system matched on visual similarity rather than metadata. The "Last Museum" name drew sharp criticism for being arrogant in ignoring curation in favor of raw access, though a vocal minority argued access is the primary function. Practical complaints centered on the lack of filters, copyright toggles, and the suspicion that the dataset comes from Europeana, but aesthetic hunts like one for Art Deco were widely shared as proof of concept. Someone also used the same approach to build a semantic search for their YouTube watch history, capturing the broader enthusiasm for applying vector embeddings to personal media archives.
Ask HN: If the models are so good, why doesn't OpenAI just start 100 companies?
101 points · 92 comments · news.ycombinator.com · 10h ago
The question on the floor was why OpenAI and Anthropic bother selling tokens at all if their models are truly transformative—why not just cut out the middlemen and launch a hundred product companies themselves. A solid chunk of the discussion pushed back that they *are* doing this in the app layer and through acquisitions, but also that running actual service businesses requires a completely different kind of human and operational infrastructure that a model API can't replace. A split formed around the gold rush analogy: one side sees them as smart shovel sellers, while the other insists Nvidia owns the shovel racket and OpenAI is leaving the real gold on the table. Another major line of argument just boiled it down to basic financial pressure—OpenAI needs concrete, defensible revenue today to justify its existence, and starting a fleet of speculative ventures is a slow, risky way to get there. This eventually distilled into a perfect rhetorical trap for the hype: if the models are as capable as advertised, why can't they run the business themselves, exposing the gap between brute-force prediction engines and actually running a tight operation.
Generated 2026-10-23 08:10 UTC
Generated by Sauron from Hacker News discussions and linked articles.