Hacker News: Replies to jerf

New comment by 1659447091 in "AI isn't replacing SREs, it's deskilling them"

1659447091 — Sat, 31 Oct 2026 07:16:04 +0000

> According to my friendly neighborhood AI there is no commonly accepted term for this effect, but when you have a community of people

Social contagion [0] (not to be confused for memetics [1]) involves behaviour, emotions, or conditions spreading spontaneously through a group or network. [...] Throughout history all social contagions have had a single thing in common: the people who follow them genuinely believe their group is only doing positive effects, and cannot rationalize negative effects from within their group.

Tech executives are a group (and a network), its not some "regression to the mean" its common human social behaviour within group dynamics. It's not just those two there has been a progressive slide of executives joining the 'tech-bro' subgroup.

[0] https://en.wikipedia.org/wiki/Social_contagion

[1] https://en.wikipedia.org/wiki/Memetics

New comment by vkou in "AI isn't replacing SREs, it's deskilling them"

vkou — Sat, 31 Oct 2026 03:21:15 +0000

It's not weirdness, it's just the combination of being an asshole and nobody in his life being able to tell him 'No.'

New comment by hollowturtle in "Building an AI-native engineering org"

hollowturtle — Fri, 30 Oct 2026 22:57:35 +0000

Totally agree but I suspect that our desires are in contrast with ai companies profits

New comment by Yoric in "AI isn't replacing SREs, it's deskilling them"

Yoric — Fri, 30 Oct 2026 19:38:04 +0000

While I agree that handcrafting code has never been any kind of guarantee of secure code, I'd argue that it remains a condition: if all you have is a set of specs (or even worse, specs written by AI and not read carefully by anyone) and no mean to ensure that the implementation actually matches the spec, you essentially have no understanding of what the code is doing, which is security suicide.

Of course, AI reviewers and security tools will catch some security errors, but this should come as an addition to a proper security design, not instead of it.

New comment by 59percentmore in "US Reps Lead Democratic Resolution Opposing A.I. Bubble Bailout for Big Tech"

59percentmore — Fri, 30 Oct 2026 14:32:41 +0000

Plan on them trying bailouts. Every inch of us should resist.

We've been living in an economy distorted by the forces that lead us to this point. We've been locked into the decisions necessary to keep things going as they have been, whether or not they make sense.

The correction that you're talking about frees us to actually make choices. Some of them will be tough choices, but we finally get to make them, with all of our resources and work ethic intact, which don't just disappear because a stock index craters.

If we want trains and local farms instead of data centers and new iPhones, we can actually make that choice, instead of being forced into the latter because every investment fund is pumping them to the point of being a foregone conclusion.

To borrow an aphorism: the bust is a feature, not a bug.

New comment by foobarian in "US Reps Lead Democratic Resolution Opposing A.I. Bubble Bailout for Big Tech"

foobarian — Fri, 30 Oct 2026 13:54:34 +0000

I remember the prevailing opinion in 2008 was that not bailing out would have caused much worse problems. We'll never know I guess

New comment by LtWorf in "I went to Mexico to test-drive the cars Americans can’t buy"

LtWorf — Fri, 30 Oct 2026 08:15:07 +0000

I think this just means we should stop putting smart features on cars.

New comment by 0x457 in "Chained PHP2Shell exploit roots 25 servers, including US Government servers"

0x457 — Thu, 29 Oct 2026 20:31:28 +0000

This exploit depends on the deployment. With PHP-FPM, an OOM during request startup terminates the child, so the corrupted state wouldn’t survive for subsequent requests to exploit. The challenge used PHP’s built-in server, where the worker was reused.

Doesn't mean that there isn't another exploit chain that can be used though. Challenge also had 4 workers total, so pining one worker wasn't that hard.

New comment by LogicFailsMe in "I went to Mexico to test-drive the cars Americans can’t buy"

LogicFailsMe — Thu, 29 Oct 2026 17:13:40 +0000

So apparently Charlize Theron hacking self-driving cars for the "make it rain" one great scene in an installment of the Fast and The Furious franchise was not enough incentive for our short term gains corporate overlords to do anything about it. So apparently it takes your catastrophic strike(tm) to get the job done much like it took 9/11 to justify the price of reinforcing cockpit doors.

I do not like this. But it seems to be how it works here.

New comment by kylestanfield in "Chained PHP2Shell exploit roots 25 servers, including US Government servers"

kylestanfield — Thu, 29 Oct 2026 16:19:14 +0000

In online communities right now there’s a lot of demand for evidence of LLM capabilities being overblown. It’s unfortunate that even if the steal my bitcoin creator apologizes for spreading misinformation due to incompetence, the truth won’t be spread as widely.

New comment by beepbooptheory in "Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers"

beepbooptheory — Thu, 29 Oct 2026 14:30:49 +0000

Also, unless I am reading this wrong, it does not seem like what actually got the bitcoin was a 2shell-like exploit? Seems like memory corruption leading to printing out the flag through just http requests? How would you use this outside of a CTF context?

https://github.com/KillaBoi/StealMyBitcoin-PoC

New comment by cowlevel in "Chained PHP2Shell exploit roots 25 servers, including US Government servers"

cowlevel — Thu, 29 Oct 2026 14:08:27 +0000

Shutting down half the internet was the right move. If it took someone 19 hours to exploit a site, you'd better have shut it down before 19 hours and not after.

I don't see what was confusing about the initial 24 hours. GP was correct, the description of the bug made it clear it was a very high risk.

New comment by NitpickLawyer in "Chained PHP2Shell exploit roots 25 servers, including US Government servers"

NitpickLawyer — Thu, 29 Oct 2026 14:07:07 +0000

It's not 19hours. The server was originally configured with no running php. Once they added a php file, the server got pwned in 2 hours.

New comment by Mawr in "Python's experimental JIT to be removed"

Mawr — Wed, 28 Oct 2026 18:03:41 +0000

I mean, it'd be pretty easy to speed it up by 10x — just need to drop backwards compat and do away with the ridiculous runtime dynamicism that is only truly useful for <%1 use cases.

But yeah, clearly nobody's willing to rip off the bandaid, so that's not happening.

New comment by fmbb in "Emacs Turns 50"

fmbb — Wed, 28 Oct 2026 17:06:47 +0000

Erlang the runtime sure. But Emacs is an application with these properties. There is no editor like Emacs for Erlang (some small clones I am sure) and no other user application utilizing this feature.

Smalltalk is a development environment and an applications platform. The development tools are as extensible and user customizable as Emacs. And like Erlang it is also a runtime you can package software for. Any GUI or server software. For Emacs you can probably do the same, but I’m not convince many users would find the GUI familiar.

New comment by ramblerman in "AI promised less work. I've never worked more"

ramblerman — Wed, 28 Oct 2026 10:27:01 +0000

I agree it's not a uniform answer, but disagree that the majority is the second.

Imo the vast majority of companies would be better with a lot less engineers. For the simple fact that they are not setup for producing that much work.

They need time to discuss, decide what they even want to accomplish, just letting your POs throw more features at all your products on a whim is hugely detrimental.

New comment by keeda in "Microsoft and others tell crypto platform not to tokenize their stocks"

keeda — Tue, 27 Oct 2026 19:59:09 +0000

> Stocks are already tokens.

If it's not happening on a GPU, is it really a "token"? ;-)

New comment by ForHackernews in "Microsoft and others tell crypto platform not to tokenize their stocks"

ForHackernews — Tue, 27 Oct 2026 19:42:37 +0000

I don't think stocks are tokens? Stocks are shares in a company: some fractional ownership that carries legal rights and a claim on assets.

Crypto tokens are just some meaningless entries on a blockchain.

New comment by mancerayder in "AI promised less work. I've never worked more"

mancerayder — Tue, 27 Oct 2026 16:42:25 +0000

There's just one small problem. The AI costs money, and the premise is AI is cheaper than people. If you augment your 100 engineers with AI, they'll cost what, 10% more? That's +10 percent to your cost center, and would be considered very bad. There are tons of tools that make us more productive - think about it, how many of them did we have to beg demand or leave for? You assume they care to maximize productivity, which is your first mistake.

New comment by asdff in "AI promised less work. I've never worked more"

asdff — Tue, 27 Oct 2026 15:55:40 +0000

There is an assumption being made that more engineering leads to more company growth. It just isn’t true though. Sales sure. But doubling the engineering floor does not double sales. You can sell a bug filled product with an unbuilt roadmap still.