Hacker News: chias

New comment by chias in "Tell HN: Scribd Breached"

chias — Sat, 31 Oct 2026 17:59:55 +0000

IIRC they were part of a base64 encoded blob. IIRC base64 decoding was also referred to as an "advanced hacking technique". But your point very much stands.

The attack chain behind the v1.107.0 LiteLLM release

chias — Fri, 23 Oct 2026 21:05:16 +0000

Article URL: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain

Comments URL: https://news.ycombinator.com/item?id=50215317

Points: 19

# Comments: 0

New comment by chias in "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"

chias — Wed, 21 Oct 2026 19:17:22 +0000

Note: I work at LiteLLM

There exists a critical vulnerability which affects only Enterprise LiteLLM deployments, and does not affect OSS deployments.

We have provided our customers with patched releases distributed via a private registry and are allowing them some time to update their deployments before we release the fix in our public registry and disclose the vulnerability details. Releasing the fix publicly in an open source product would be a de-facto vulnerability disclosure.

New comment by chias in "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"

chias — Wed, 21 Oct 2026 19:13:56 +0000

Note: I work at LiteLLM

There exists a critical vulnerability which affects only Enterprise LiteLLM deployments, and does not affect OSS deployments.

New comment by chias in "NYC's "Click to Cancel" rule is now in effect"

chias — Mon, 12 Oct 2026 10:37:52 +0000

The cookie banners are not required to be this way. They are deliberately designed to be as annoying as they can legally be (many actually moreso), in part to influence your perspective against GDPR.

New comment by chias in "NYC's "Click to Cancel" rule is now in effect"

chias — Mon, 12 Oct 2026 09:34:48 +0000

Yes. I think the idea is that on the path of events or actions between the starting point and the target, you have already completed every single one, and all that remains now is the final step before you can call it done.

You've walked all but the last step of the journey.

New comment by chias in "Compiling Rust to readable C with Eurydice"

chias — Sat, 10 Oct 2026 05:21:10 +0000

What an excellent choice of product name :D

"You're da C"

New comment by chias in "Ten lines of code that changed my world"

chias — Sun, 27 Sep 2026 17:22:54 +0000

if you're using firefox, you can generally juts ctrl-click on the page. It'll draw outlines around every child element without reflowing.

New comment by chias in "Salesforce Global Outage"

chias — Wed, 16 Sep 2026 18:29:59 +0000

Generally, no.

Ignoring for now how you are synchronizing the database and filesystem, and how doing so may well result in your duplicate experiencing the same failure as the original, you can maybe recover from a small class of availability issues that could knock you out of an SLA.

But that assumes you can get online and can fully orchestrate the transition within less than 53 minutes of it starting. Including the time you took to become aware of it. And including the time to diagnose and decide that a switchover would resolve the problem. Including the time it takes for DNS caches to expire and point to the new host. Including the DNS caches which may ignore your TTL. And including all these things again when you switch back.

And assuming, of course, that it doesn't happen again for a whole year.

New comment by chias in "Astra and Fable still hack on simple variants of alignment evals from 2025"

chias — Sun, 13 Sep 2026 18:15:15 +0000

Perhaps to you. But that's because you have prior cultural knowledge of chess, and what it means to "play" something. It seems to me to be perfectly reasonable for an ai agent to define "play chess" as "behave in a way that this arbiter indicates that you have done well"

New comment by chias in "Household Laser Cuts"

chias — Sun, 06 Sep 2026 18:37:51 +0000

I really love boxes.py, and have contributed several designs. The flexbook, shadowbox, coinbanksafe, and frameloom are all mine :)

I'm really proud of the loom.

https://boxes.hackerspace-bamberg.de/FlexBook

https://boxes.hackerspace-bamberg.de/Shadowbox

https://boxes.hackerspace-bamberg.de/CoinBankSafe

https://boxes.hackerspace-bamberg.de/FrameLoom

Recently I've been on a kick making bracelets with that frame loom. The rotating heddle bar makes it super quick to warp up. I've written about how to go from woven rectangle to bracelet here:

https://ojensen.net/musings/bracelet-on-frame-loom

New comment by chias in "The ChatGPT/Codex app bundles a full copy of LibreOffice"

chias — Wed, 02 Sep 2026 07:21:20 +0000

> I agree that it would be the right thing to do. Which is why you have to make the best attempt to make it the legal thing

Do you believe that in an ideal world, any instance of not "doing the right thing" should be illegal?

New comment by chias in "Dwarf Fortress' creator says the industry's in shambles over AI"

chias — Tue, 01 Sep 2026 18:52:45 +0000

The number of dickovers[1] this website pops up while you're trying to read the article is truly astounding. I gave it my best shot, but after the third one i figured I'd probably gotten enough of the gist of it and gave up.

[1] https://daringfireball.net/2026/05/what_is_a_dickover

New comment by chias in "Framework discloses data breach via Metabase 0-day"

chias — Fri, 07 Aug 2026 07:20:05 +0000

The url was to transfer log data from metabase to framework. It is not something that is intended for end user access.

New comment by chias in "I'm switching my phone from Android to Linux"

chias — Wed, 05 Aug 2026 20:46:13 +0000

The author mentions this in the second paragraph...

New comment by chias in "Atom is better than RSS, in ways that matter"

chias — Sun, 02 Aug 2026 07:04:58 +0000

Not relevant to the overall discussion, but this VHS vs Betamax thing is actually a myth, borne from confusing Betamax (a home consumer version, comparable and inferior to VHS) with Betacam (a professional format, which could use the same physical tapes as Betamax, albeit at much shorter runtimes so not suitable for movies).

New comment by chias in "Don't credit the LLM"

chias — Sun, 02 Aug 2026 05:35:32 +0000

There is a difference between crediting the LLM (which i agree is silly) and disclosing the use of an LLM, which I think is important. The author seems to conflate these two.

A disclosure is appropriate whenever the reader might feel differently about the result of armed with this information. For example, "this research on the non-addictive nature of tobacco, funded by the tobacco industry".

Moreover, not citing the LLM is plagiarism. Maybe people outside academia have an oddly narrow understanding of plagiarism, and (for example) cannot understand how it is possible to plagiarize yourself. It is hard to explain the importance of citing LLM contributions to people with this view.

New comment by chias in "Open-weight AI is having its Kubernetes moment"

chias — Sat, 25 Jul 2026 17:17:12 +0000

I was in this state a few weeks ago. I spent a bit of time familiarizing myself then wrote up my learnings as a series of exercises.

If you think of docker as "kinda like vms except not really" and k8s as "kinda like deploying and composing docker containers but not really", this may be for you:

https://ojensen.net/infra/understanding-k8s-1

It's actually really neat, i wish i had bothered to learn it years ago.

New comment by chias in "Pebble Mega Update – July 2026"

chias — Fri, 17 Jul 2026 17:40:19 +0000

the contrast ratio of a black-and-white e-ink screen is significantly better than the contrast ratio of a color e-eink screen when displaying black and white. It's a very noticeable difference between black-and-white vs dark-grey-on-light-grey. The P2D is much more comfortable to read indoors with the backlight off.

https://i.imgur.com/Z2Yrkl1.jpeg

New comment by chias in "Pebble Mega Update – July 2026"

chias — Fri, 17 Jul 2026 10:18:38 +0000

I had my PT2 shipped to Germany. Watch cost $225 and then I had to pay an additional $58.54 in taxes / customs fees.