- Quoted phrase in the opening sentence
- Opening quote: “how are you going to block French users”
There is an understandable focus on "how are you going to block French users" when we have also claimed that geoIP blocking is insufficient for selectively denying resolution for certain names - we understand this conflict, but we think it is energy spent in the wrong place.
It is probable that we will use geoIP filters to block French users from our services after November 24. We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we've been told to make unavailable. But this would corrupt our core premise, which is that the DNS is not the right place for this to happen, and if we comply within France to meet the requirement then we accept the worst eventual outcome for users and we still do not have legally perfect coverage. We wish to first remain consistent with our core mission, and secondarily we must remain as close to compliance as we can to the legal constraints put upon us. By accepting the demands for blocking, we would admit that such demands are permissible within our mission - that we will act on behalf of companies (or others) to create ineffective and mis-directed regimes of content constraint.
We would be admitting that we think this solves the problem - it does not. We would be admitting that we will do this for an ever-increasing number of names - we will not. We would be permitting these methods to be applied for more areas of filtering such as moral, religious, social, or political reasons - we must not.
So we accept that there is the possibility that we will have errors in our blockade, but in this case (blocking French users) we maintain consistency with our stated mission of integrity of the DNS. We would rather there be a clear distinction made for users of our services: you get the DNS as you (the user) expects, or if Quad9 is forced to pollute the service with unexpected and arbitrary number of fragmentation demands, then we will not offer the services at all.
The underlying issue is not ONLY that geoIP blocking is ineffective, but that the entire premise of any of these demands is inappropriately applied to DNS recursive resolution providers. We would hope that this discussion continues to be on the most fundamental of the disagreement we have with the outcome in this court case, not on the details of the technical implementation which have yet to be entirely decided and which can be tuned over time.
- Quoted phrase in the opening sentence
- Opening quote: “bad”
Isnt this what gets all tech companies into trouble all the time. Something objectionable happens (ChatGPT helping someone bulid a bomb for instance) and we go like "Do better".
An editing pass to make the prose less "punchy" would be great.
- Ordinary term used more than once in the same comment
- “enhanched” appears 2 times
The call to action says "Copy prompt", not "Unlock prompt", "Sign in to copy", or "Get Creative to access prompts". I didn't even go past the signup to see if the prompts themselves are actually free and work without a subscription to your hosted MCP server. There's a GitHub link in the header suggesting an OSS tier, at the least. That repo may include "prompts" folders, but no prompts are there. The README doesn't even hint that this is a paid library of assets/prompts until the very end, with the misspelled "enhanched" sentence under the "Pro" header. The only prompts that appear to be in the repo (other than those that configure an agent how to use the paid and hosted MCP) are basic design guidelines.
Getting back to the website: your hero text directly invites users to "Try each example and copy its implementation prompt." Which immediately demands the aforementioned signup flow that I didn't bother completing.
All of that just turned me right off.
Your examples are nice, if a bit generic. But if you intended this to be a loss-leader for the more "enhanched" UI/UX skills, it isn't doing that job.
I think we need to keep pushing back against this idea that "now it's the AI coding era, everything gets coded with AI." Let's keep building things, especially passion projects carefully by hand and normalizing this. Lots of us are still coding without AI.
It would be like me practicing surgery 1 hour a week and saying "well surgery only has a very small place in my 80-hour work week" in response to flagrant failure of medical care.
If they go to the trouble of wrapping them, use real keys. Or don't do it.
Also, it's a big "human error" to not notice this for a year and a half.
On Mozilla’s tracker, eMudhra said the keys were created on 30 April 2025 in a key generation ceremony, a recorded procedure in which keys are produced inside hardware security modules (HSMs), tamper-resistant devices built to hold keys. The keys were meant to be moved to data centres in the United States and Europe for customers needing data stored in those regions. To move them, the company added a step to ‘wrap’ each key, or encrypt it for transfer, and ‘unwrap’ it at the other end. eMudhra said a flaw in the software script created a second, weaker set of keys during this step, and because the two sets had similar names, staff used the weaker ones by mistake. It said human errors occurred at multiple steps.
source:
What's the eMudhra security scare that has rattled the internet?
https://theprint.in/tech/whats-the-emudhra-security-scare-th...
- Quoted phrase in the opening sentence
- Opening quote: “and we would have gotten away with it, if it wasn't for those meddling kids”
As I am writing, my iPhone 15 Pro is still accepting certificates signed by these compromised CAs. The device is "up to date", yet is still running Trust Store Version 2026073000. When I check at [2], certificates issued by 3 eMudhra Intermediate CAs are still being trusted!
Google Chrome revoked these certificates in 1 hour 40 minutes, Mozilla in just under 4 hours.
I am so astonished by how much Apple has failed here. There are potentially huge swathes of people completely oblivious that their phones are susceptible right now to being man-in-the-middle attacked.
Why does the iPhone not utilise a CRL list? Why does it take Apple 5+ days to do what Chrome did in under 2 hours.
It's a similar story for my MacBook, but at least there my Chrome browser _does_ use a CRL (the same can't be said for all the programs installed, however).
[1] https://fenko.nz/blog/emudhra-ca-compromise/#what-happened-i...
Note that p,q (the primes you’re thinking of) are not actually required for decryption. They enable you to calculate d, the decryption exponent, and also enable decryption-time optimizations (exponentiation with d_p and d_q followed by CRT recombination), but that’s optional. In fact, p,q can be computed from n, e and d.
- Quoted phrase in the opening sentence
- Opening quote: “unforgeable”
The private key of your globally trusted CA is infrastructure data and it was breached.
> All physical and logical security controls remained intact.
No, because you promised the CA Program that those keys would be HSM generated, FIPS 140-2 level 3 compliant. Ain't no compliant HSM in the world that will generate "4" as a private key.
> There were no end entity certificates issued out of the affected CA's.
I charitably read this as "revoking these weak CA didn't affect customers". But now your whole root is being revoked next week (which you forgot to mention). All your TLS customers get screwed.
Overall, good choice to give up, but lying on your way out is not a good look for a company with the tagline "Trust Delivered".
- Ordinary term used more than once in the same comment
- “unforgeable” appears 2 times
Normally, the king would declare and sign a proc stating that anything signed by his secretary's "unforgeable" signet was to be respected as well. The secretary could delegate authority to others in turn.
Well turns out that one of the signets in the chain of trust was just a picture of a "four" that anybody could have forged, but nobody noticed because in all of the ceremony and stacks of parchment with wax seals, nobody actually checked if the signet was secure.
The statement can use whatever weasel words it likes, but the action pretty clearly says "we aren't mature enough as an organisation to handle this responsibility." Which would be quite the concern for me, if I were a customer for one of eMudhra's other product lines.
- Quoted phrase in the opening sentence
- Opening quote: “out of the affected CA's”
Adding "out of the affected CA's" is top PR weasel wording that will slip by non-technical people who read this.
Congratulations to those who wrote or prompted this statement.
- Quoted phrase in the opening sentence
- Opening quote: “There were no end entity certificates issued out of the affected CA’s.”
This seems like a weird statement given that anyone can issue certificates out of the affected CAs.
- Quoted phrase in the opening sentence
- Opening quote: “will sharpen focus on... trust services other than SSL/TLS”
Is there some reputation left to salvage here that I'm not aware of? Who would trust them?
Fundamentally, I know that HN has plenty of people who will react with "ha-ha, human authors should pack their bags", just like what we keep telling mathematicians, because we see the discipline as just another market that can be conquered by automation or another benchmark to track. But literature, similarly to most other forms of higher-brow entertainment, isn't just about reducing unit-cost or hacking engagement metrics. For the same reason why a genuine van Gogh painting is worth a lot more than a nearly-perfect replica, people who care about the craft usually care about it telling genuine human stories and celebrating the author as much as the result.
Now, the mass consumer may not care; if you have an infinite Harry Potter sequel machine, many will partake. But then, I guess the question is, if you build the sequel machine, are you leaving the world better off or not? Do you want to be interacting exclusively with machines down the line? And if there's no inherent value to humanity, why should the machines be compelled to interact with you?
In the 1970s, you began to see the emergence of the drummer "playing to the click" and the main motivation behind this was that some number of the rest of the performers were not in the room and/or not recording at the same time as the drummer. If you let the drummer just do their human thing, the timing will wander a bit in ways that are hard to follow and respond to if you were not in the room. So producers and engineers began to use click tracks to ensure that now matter when/where the differ performers actually recorded their work, everyone would be locked together.
If you record all together in a single space at a single time, you generally don't need this (unless the musicians are not very good and the drummer still wanders a lot).
So it's a phenomenon that didn't begin with DAWs and computers - that technology just took the overall approach even further.
In one (which I can't find) he mentions a Japanese musician coming to LA to record with the top LA studio guys. It is very common to play to a click track, and one song just wasn't gelling. The studio guys said, "Let's try it one time without the click track." The Japanese musician said, "We're allowed to do that?" Anyway, they went ahead and the song came to life. The musician literally cried after because it felt so good to not be focused on tracking the click instead of being in the moment making music with a bunch of other humans.
- Quoted phrase in the opening sentence
- Opening quote: “net improvement”
soul | soulless
listenable ______|_________
unlistenable |
Music after quantization: | soulless
listenable |_________
Hmm, this “net improvement” of yours seems to have obliterated some important categories. I don’t think I care for it.- Quoted phrase in the opening sentence
- Opening quote: “Kovan viikon ilta”
Not that interesting. They are doing it illegally. And there is a pattern of builders of AI data centers ignoring the local law.
It makes it news. It makes it relevant and actual.
What do you find so "interesting"?
- Quoted phrase in the opening sentence
- Opening quote: “420 football fields”
If it's found they really did skip the required steps then I hope there is actual action about it.
It's also odd to me we seem to find the need to build AI DCs near population centers, in forests, and/or by/with new fossil fuel plants. Does it really matter so desperately if it takes your AI query an extra 10 ms to go to the middle of nowhere and we have to wait to build renewable or nuclear power to scale it for what we gain in return of that choice?
- Quoted phrase in the opening sentence
- Opening quote: “All games are essentially rentals”
Among all gaming platforms, it’s only behind DRM free storefronts like itch.io and GOG.
Unlike PS5 or XBOX, not all switch 2 games require downloads or day 1 patches.
For example I tried to investigate some CVE's on older android roms and it downright was refusing it. It was okay when doing it on... Microsoft and to submit a microsoft bug bounty but android was no go.
100% squashing gambling has generally not been successful, but the strategy of fencing it away from most of society and keeping it in a set of defined places that require people to actively seek it out has been successful enough that people forget why we don't allow gambling in every convenience store in the country. I'd say the additional "convenience" of having it in your pocket all the time is a new nuance, but doesn't necessarily change the fundamental equations.
We will relearn. Our grandchildren will forget again. (Unless things have really changed.)
On a more depressing note, wasn't this always a thing? I remember being in 4th grade when a classmate brought in something called "Mise-o-jou", which was being run by the Quebec government.
Essentially, the PHP team is deflecting and abdicating their responsibilities in all this mess they created. "Chainguard broke embargo", "support us with money", "we are just volunteers", "we had knowledge years ago but no POC because we wanted to ship features and not security fixes". All just deflections.
This fiasco shows me that I would never use PHP for any project I'm part of. The PHP team royally messed up, and they are deflecting the blame left, right, up, and down.
People seem to forget that LLMs copied human writing. They also tended to copy people with more proper or formally trained writing styles. There are so many journalists and writers that talk about how they've had to 'stupify' how they write so they don't get accused of being an LLM.
It's like we're running idiocracy on fast forward.
To be honest, I'd be fine with some AI-assisted writing and might even be interested in reading one of those. The scientific sources seem to be researched well, not hallucinated. But asking the author "Alexander Crespo" under a reddit post, to what extent they used AI in writing, results in them blocking you. Makes me think it is more AI-generated than they wanna admit.
LLMs are a game changer in a completely different way than compilers. With compilers there is a (roughly, barring optimizations) 1:1 correspondence between input and output. With LLMs you take an idea and it will drive the whole thing from the beginning all the way to the end.
This is unlike anything that we've done so far. It's also strange to focus on programming: LLMs are coming for all information related jobs. If your job is somehow described as 'staring at a screen' then that job is on the line, if not sooner, than later.
We built a way to sample diverse ideas in machine learning - ideas that make scientific sense, but that no existing research community is positioned to propose.
In short, the way it works is like this:
1. Take 16,068 LLM papers (NeurIPS, ICLR, ICML, ACL, EMNLP, 2017 to 2025) are broken into 273 "idea atoms". Every paper, and every candidate idea, becomes a set of atoms.
2. Train a Coherence Model: a 42.8M-parameter transformer trained on papers as sequences of atoms. Basically a language model whose tokens are ideas.
3. Train a Cognitive-Availability Model: a dual encoder trained on the publication histories of 39,791 researchers, which predicts where each person could plausibly go next.
4. Use those models to score sampled tuples using reciprocal rank fusion (you want ideas that go together well, but that are not cognitively available to anyone).
We tested it in a bunch of ways. One interesting one was that we took all the papers at the end of 2024, then checked which high-scoring tuples showed up in 2025 papers. It worked well - one examples is an ICLR 2025 oral, goes from rank 1,489 with coherence alone to the top 25 of 1.14M samples.
A funny one: if you ask Claude to come up with an ML research idea, it is often about interpretability. If you then run an autoresearch pipeline with some A100s on the idea, the result tends to be interpretability 8/10 times. Our Alien Sampling method stayed at 0 interpretability ideas even after letting claude cook on them.
We also paid 50 people with graduate degrees in CS/AI to judge the research reports and found that Alien’s reports had the best average quality rank and produced 3 of the top 5 reports.
Oh and then we scaled it way the hell up to a couple million papers and 10,000,000's of concept elements and generated 25,000 new research proposals that you can search over here: https://lacuna.tiptreesystems.com/explore?view=hypotheses
Code (MIT): https://github.com/alejandrohdez00/alien-space-of-science
- Quoted phrase in the opening sentence
- Opening quote: “an LLM has a latent concept of its own confidence that is internally consistent”
LLMs generally cannot report the outputs of their own activation functions. Taking the output of softmax as if it were a probability score is considered a first-year PhD student misconception.
This CVE is literally just "versions of the Go deny list don't contain the eMuhdra revokation yet". Older versions of Go will still deny certs signed through the compromised certificate if the system store already has the update.
It's an or situation, not and.
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-misc/ca-certificates-20260816.3.125"
To check via "curl": $ curl --url="https://dv-g3b-emudhra.we-have-a-problem.com/"
$ curl --url="https://dv-g3b-aaa-emudhra.we-have-a-problem.com/"
They should return: curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
---* GLSA 202610-01: https://security.gentoo.org/glsa/202610-01
- Quoted phrase in the opening sentence
- Opening quote: “games you already bought!!!”
Others are LPEs, but two have been deleted by now, so can't be sure of the details.
TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
I feel like there's enormous potential still uncovered in the coding agent space for such highly-discounted "spot" style capacity. Give me a way to have agents continuously crawl over my codebase looking for bugs, come up with test cases that prove the bug, open a PR. I don't care if it takes 12 hours to find something that would take 5 minutes if prompted with "on-demand" / "high-priority" requests, because I'm not prompting for it directly, I'm not aware of how much time it takes, all I see is continuous improvement.
- Quoted phrase in the opening sentence
- Opening quote: “internet”
> You should patch your servers anyway. There is a real vulnerability here, but exploiting it is significantly harder than people are making it out to be.
The take-home message is about human herding behavior being reinforced by LLM use:
> There's something important to be said here about how many people have Claude/GPT make design decisions for them, and how AI is the primary decision maker in the world right now. You've got this bizarre case of "Decision Schelling Points" where a method of solving a problem is extremely overrepresented, because it's what Claude does out of the box.
To me, it seems more more akin to broadpwn, technically severe, wide scope (millions of iphones), yet will never be a one-size-fits-all-PWN-button.
Even in the age of AI, I don't think this is going to be weaponized down the line like how Eternalblue was... but I'm not the social media cybersec guy with 15000 followers, so don't take my words at face value ;)
I think this section misses the mark.
The biggest problem is that for a good 12 hours nobody knew what was going on. All we knew was there is a critical vulnerability affecting all of us that allows RCE somehow and we have to have vulnerable servers open for potentially even longer.
Everyone who knew was being hush hush, only chiming in to say "nah, those workarounds don't work, you're fucked".
So when people started spreading rumors of PoC or when the Cloud flare CTO posted that they were actively seeing exploit traffic - what are we supposed to do?
We aren't sitting there trying to PoC with Claude - we're subscribing to a bunch of news feeds and twitter accounts while we try to prepare for the patch and close down what we can. We're calling executives saying "hey, how much money do we lose by being offline for 6 hours?"
So even if this isn't as easily exploitable as first believed, no one could have known that, because those with the ability to calm us down were seemingly choosing to stoke the fires.
This is (IMO) a failure of the potentially outdated disclosure system that's supposed to protect us. And at the very least a trial run of how the world may react next time, if it really is that bad.
On a very similar theme, I recently built a “lossy git”, which stores your code by training a neural network, then it generates the code back to you on checkout
* web demo: https://nicobrenner.github.io/lossy-git/demo.html
* cli version: https://nicobrenner.github.io/lossy-git/
The web demo runs entirely on the browser, both the version control and the neural network training/inference. You can commit and checkout both images or code - you can also paste/“upload” your own images, no server requests (everything clears from the page on reload)
- Ordinary term used more than once in the same comment
- “ls” appears 2 times
But I question its utility on other platforms, because a lot of the things that makes PowerShell cool on Windows doesn't actually work in Linux or macOS.
Eg: Get-Service (and associated cmdlets). Very handy cmdlet that I use all the time on Windows. On Linux, you'd expect that it'd work with systemd units, but no, that command doesn't exist on the Linux version. Same with Get-NetAdapter, or Get-NetTCPConnection, or Get-Disk and so many other handy cmdlets that I use all the time on Windows, are all missing.
Yet, some cmdlets do exist, like Get-Process or Get-Uptime etc, so I don't understand why many of the commonly used Windows cmdlets haven't been ported over.
Another annoying quirk is how PowerShell on *nix hands off some of the built-in aliases to their native versions. Like on Windows, I always use 'ls' because ain't nobody got time to type Get-ChildItem. Unfortunately when I run this on *nix PS, it runs the native version. And this is a problem because when I pipe 'ls' into a for loop or another cmdlet for further processing, it naturally, doesn't work. To make things worse, this native-or-alias decision making isn't even consistent. Like 'pwd' for example actually runs the PowerShell version, whereas 'echo' runs the native version.
Basically, as much as I love PowerShell on Windows, on *nix it is very annoying to work with. I would much rather work with native *nix shells and scripting languages. And if I really wanted the structured output of PS, I would run Nushell instead, which is far more consistent and useful than the half-baked product that *nix PowerShell is.
Naturally, I cannot produce an example off hand, but I was pretty disappointed the last time I had to reach for it and found that a few "obvious" workflows seemed more hacky than I would have expected for a clean-slate terminal language design.
- Quoted phrase in the opening sentence
- Opening quote: “sentient cars”
- Quoted phrase in the opening sentence
- Opening quote: “backdoor”
- Quoted phrase in the opening sentence
- Opening quote: “brutal”
It’s not just Airbnb the company that moved away from it, it’s the Airbnb hosts that moved away from it as soon as opportunists started becoming mega landlords renting out ikea-furnished party houses. It hasn’t been the original “person with a spare room for a weekend” Airbnb in a long, long time.
- Quoted phrase in the opening sentence
- Opening quote: “Gas and Glass”
Funny how the article has zero citations or notes.
So it goes.
The lack of transfer I don't think is out of unwillingness from the old guard, but rather due to the greenhorns throwing everything that came before their time out without questioning the reasoning behind any of it (Chesterton’s Fence) and assuming that whatever they came up with was superior and better fit for the modern era ("those old principles can't possibly hold, we have touch screens now!").
It's also been made worse by UI design roles having been taken by those with backgrounds in unrelated design disciplines, as well as sites like Dribbble which reward pretty mockups over working products. This leads to overemphasis on the visual aspect of the UI and not enough on its functional and usability aspects.
Our American obsession with jail is nuts. The violation at hand was “misleading state citizens about how it safeguards and collects user data.”
Lots of folks at Meta should be criminally investigated. But not for this, not unless someone willfully signed off on a lie.
> This will keep happening until those at the top are held personally responsible
Perfect is the enemy of the good.
That being said I don't particularly understand your conception of a method. They are both methods. The getter ought to have a shorter name since it is probably called more frequently and because it inherently has less of an impact -- this goes along with the principle that names that demand attention should be larger and easier to notice.
The threat feeds we offer are in alignment with what the user expects and intends. Mandatory restriction of DNS resolution by a third party (not the user, not Quad9) is expressly what users do NOT want, regardless of the outcome. Once such restrictions are enacted and treated as normal, the channel for making demands will fill with a flood of "objectionable" names from every corner for every reason. Quad9 has already received demands from the French regulator to block sites which deliver adult content found to be objectionable to minors. We see an extremely slippery slope which has already moved out of piracy as the scoped intent which is this case in particular.
More to the point: prohibiting content via the DNS is a useless exercise when it is done out of alignment with the end users' goals - they will simply use some other recursive resolver (or their own) probably without the benefits of being oriented towards security and privacy. We have no monopoly on DNS resolution - there are thousands of others open to public use, and anyone can set up their own, for free, with no mandatory requirements by governments or regulators. This case (and any others like it) only drives out law-abiding organizations who are trying to promote better cyber hygiene and who want to keep the DNS as a single, un-splintered high-integrity pointer system.