<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: comex</title><link>https://news.ycombinator.com/user?id=comex</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Sat, 30 May 2026 04:57:13 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=comex" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by comex in "PHP's Oddities"]]></title><description><![CDATA[
<p>Depends entirely on the forum.<p>I remember it being somewhat common for people to make forum posts consisting entirely of a joke image.  However, they weren’t called memes at the time as the word had yet to be popularized.</p>
]]></description><pubDate>Sun, 24 May 2026 01:35:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=48253471</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48253471</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48253471</guid></item><item><title><![CDATA[New comment by comex in "Google changes its search box"]]></title><description><![CDATA[
<p>Personally I think I've developed a pretty good sense of when a question is easy enough that I can just trust the AI overview, and when I need to dig deeper.  Google's original AI overviews were not reliable enough to ever trust, but now they are usually accurate summaries of the cited sources.<p>Job market statistics are actually probably a strong point for the AI overview.  I just Googled 'us job market last month' and got an AI overview that accurately summarized a New York Times article for qualitative information ("surprisingly strong 115,000 jobs", "no-hire, no-fire"), followed by accurately summarizing the official Bureau of Labor Statistics website for raw stats, followed by some other stuff I didn't check.  Not everyone would prefer The New York Times' take, but the citation prominently displays their name and logo, so you can tell what you're getting.<p>Weak points are when the topic is obscure enough that the AI overview conflates two different things or overgeneralizes, or trusts the wrong sources.</p>
]]></description><pubDate>Wed, 20 May 2026 17:22:45 +0000</pubDate><link>https://news.ycombinator.com/item?id=48211045</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48211045</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48211045</guid></item><item><title><![CDATA[New comment by comex in "MacBook Neo Deep Dive: Benchmarks, Wafer Economics, and the 8GB Gamble"]]></title><description><![CDATA[
<p>Also, a large fraction of students these days use Google Docs.  I don’t have first-hand experience, but I imagine they would either share presentations with the account the shared computer is logged into, or log into their own account on the shared computer.  No hardware involved either way.</p>
]]></description><pubDate>Thu, 14 May 2026 13:03:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=48134829</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48134829</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48134829</guid></item><item><title><![CDATA[New comment by comex in "Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim"]]></title><description><![CDATA[
<p>Another memory-safe option is Haraka, which I’ve been using for several years now. I recommend it but only for people who need extreme customizability.  For everyone else, the customizability is a bit of a footgun, since you can easily end up with accidental open relays and other misconfigurations (as I learned the hard way).</p>
]]></description><pubDate>Wed, 13 May 2026 07:35:15 +0000</pubDate><link>https://news.ycombinator.com/item?id=48118919</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48118919</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48118919</guid></item><item><title><![CDATA[New comment by comex in "Hardware Attestation as Monopoly Enabler"]]></title><description><![CDATA[
<p>Citation?</p>
]]></description><pubDate>Mon, 11 May 2026 03:03:45 +0000</pubDate><link>https://news.ycombinator.com/item?id=48090633</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48090633</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48090633</guid></item><item><title><![CDATA[New comment by comex in "Stop MitM on the first SSH connection, on any VPS or cloud provider"]]></title><description><![CDATA[
<p>AFAIK this is not secure.  The SSH protocol doesn’t require the server to know the client’s public key for the connection to succeed. Instead, the client actively sends its public key to the server while authenticating, and the server just decides whether to allow a connection or not.  OpenSSH will typically match the client’s key against a fixed list of keys, but nothing stops a rogue server from allowing connections from any client key.  In fact, OpenSSH itself can be configured to do this using  AuthorizedKeysCommand.</p>
]]></description><pubDate>Sun, 10 May 2026 23:45:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=48089328</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48089328</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48089328</guid></item><item><title><![CDATA[New comment by comex in "Stop MitM on the first SSH connection, on any VPS or cloud provider"]]></title><description><![CDATA[
<p>Public keys can go over channels that an attacker can read.  They cannot go over channels that an attacker can <i>modify</i>.  (Which would include the SSH connection itself, until such time as you’ve verified the key through a trustworthy channel.)</p>
]]></description><pubDate>Sun, 10 May 2026 23:34:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=48089249</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48089249</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48089249</guid></item><item><title><![CDATA[New comment by comex in "Can LLMs model real-world systems in TLA+?"]]></title><description><![CDATA[
<p>Well, for one thing:<p>> Decline to buy: property stays with bank (auction abstracted out)<p>Ignoring an entire game mechanic is really stretching the definition of “abstracted out”…<p>Also, at the bottom it defines a “Liveness: someone eventually wins” property which I believe cannot be proven.  Monopoly doesn’t have any rules forcing the game to end eventually.  There is only a probabilistic guarantee, and even that only applies if the players are trying to win; if the players are conspiring to prevent the game from ending then they’re unlikely to fail.</p>
]]></description><pubDate>Sat, 09 May 2026 06:59:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=48072568</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48072568</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48072568</guid></item><item><title><![CDATA[New comment by comex in "Natural Language Autoencoders: Turning Claude's Thoughts into Text"]]></title><description><![CDATA[
<p>Fascinating.  The training process forces the “verbalizer” model to develop <i>some</i> mapping from activations to tokens that the “reconstructor” model can then invert back into the activations.  But to quote the paper:<p>> Note that nothing in this objective constrains the NLA explanation z to be human-readable, or even to bear any semantic relation to the content of [the activation].<p>The objective could be optimized even if the verbalizer and reconstructor made up their own “language” to represent the activations, that was not human-readable at all.<p>To point the model in the right direction, they start out by training on <i>guessed</i> internal thinking:<p>> we ask Opus to imagine the internal processing of a hypothetical language model reading it.<p>…before switching to training on the real objective.<p>Furthermore, the verbalizer and reconstructor models are both initialized from LLMs themselves, and given a prompt instructing them on the task, so they are predisposed to write something that looks like an explanation.<p>But during training, they could still drift away from these explanations toward a made-up language – either one that overtly looks like gibberish, or one that looks like English but encodes the information in a way that’s unrelated to the meaning of the words.<p>The fascinating thing is that empirically, they don’t, at least to a significant extent.  The researchers verify this by correlating the generated explanations with ground truth revealed in other ways.  They also try rewording the explanations (which deserves the semantic meaning but would disturb any encoding that’s unrelated to meaning), and find that the reconstructor can still reconstruct activations.<p>On the other hand, their downstream result is not very impressive:<p>> An auditor equipped with NLAs successfully uncovered the target model’s hidden motivation between 12% and 15% of the time<p>That is apparently better than existing techniques, but still a rather low percentage.<p>Another interesting point: The LLMs used to initialize the verbalizer and reconstructor are stated to have the “same architecture” as the LLM being analyzed (it doesn’t say “same model” so I imagine it’s a smaller version?).  The researchers probably think this architectural similarity might give the models some built-in insight about the target model’s thinking that can be unlocked through training.  Does it really though?  As far as I can see they don’t run any tests using a different architecture, so there’s no way to know.</p>
]]></description><pubDate>Thu, 07 May 2026 20:01:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=48054137</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=48054137</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48054137</guid></item><item><title><![CDATA[New comment by comex in "Bugs Rust won't catch"]]></title><description><![CDATA[
<p>Yes, it’s a shell builtin that makes the shell execute a chdir() syscall.  Therefore it isn’t subject to argument length limits imposed by the kernel when executing processes.  But it is still subject to path length limits imposed by the kernel’s implementation of chdir() itself.  While the shell may be a GNU project (bash), the kernel generally is not (unless you are running Hurd), so this isn’t GNU’s fault per se.<p>However, the shell <i>could</i> theoretically chunk long cd arguments into multiple calls to chdir(), splitting on slashes.  I believe this would be fully semantically correct: you are not losing any atomicity guarantees because the kernel doesn’t provide such guarantees in the first place for lookups involving multiple path components.  I’m not surprised that bash doesn’t bother implementing this, and I don’t know if I’d call that an “arbitrary limitation” on bash’s part (as opposed to a lack of workaround for another component’s arbitrary limitation).  But it would be possible.</p>
]]></description><pubDate>Wed, 29 Apr 2026 17:29:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=47951569</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47951569</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47951569</guid></item><item><title><![CDATA[New comment by comex in "What async promised and what it delivered"]]></title><description><![CDATA[
<p>They are not perfectly fine.  If a task panics then you will get the right stack trace, but there is no way to get a stack trace for a task that’s currently waiting.  (At least not without intrusive hacks.)</p>
]]></description><pubDate>Sun, 26 Apr 2026 03:18:11 +0000</pubDate><link>https://news.ycombinator.com/item?id=47906985</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47906985</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47906985</guid></item><item><title><![CDATA[New comment by comex in "Slop Cop"]]></title><description><![CDATA[
<p>Just because LLMs overuse it doesn't mean it doesn't have its place.<p>The way the OP used the 'not X, but Y' pattern, the 'X' and 'Y' are two clear, specific, and (most importantly) distinct things, as opposed to stereotypical LLM usage where they're vague characterizations or metaphors.  And there's a reason to emphasize that it's not X, because the Slop Cop website implicitly suggests that it is X.</p>
]]></description><pubDate>Sat, 18 Apr 2026 02:11:35 +0000</pubDate><link>https://news.ycombinator.com/item?id=47812587</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47812587</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47812587</guid></item><item><title><![CDATA[New comment by comex in "A macOS bug that causes TCP networking to stop working after 49.7 days"]]></title><description><![CDATA[
<p>They probably aren’t affected because the buggy code was only added in macOS 26:<p><a href="https://github.com/apple-oss-distributions/xnu/blame/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/netinet/tcp_subr.c#L3753" rel="nofollow">https://github.com/apple-oss-distributions/xnu/blame/f6217f8...</a></p>
]]></description><pubDate>Tue, 07 Apr 2026 05:15:44 +0000</pubDate><link>https://news.ycombinator.com/item?id=47670995</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47670995</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47670995</guid></item><item><title><![CDATA[New comment by comex in "A macOS bug that causes TCP networking to stop working after 49.7 days"]]></title><description><![CDATA[
<p>The bug was introduced only last year in macOS 26:<p><a href="https://github.com/apple-oss-distributions/xnu/blame/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/netinet/tcp_subr.c#L3753" rel="nofollow">https://github.com/apple-oss-distributions/xnu/blame/f6217f8...</a></p>
]]></description><pubDate>Mon, 06 Apr 2026 21:30:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=47667423</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47667423</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47667423</guid></item><item><title><![CDATA[New comment by comex in "German implementation of eIDAS will require an Apple/Google account to function"]]></title><description><![CDATA[
<p>It definitely would be unwelcome for EU authorities in cases like the recent US sanctions against ICC officials.</p>
]]></description><pubDate>Sun, 05 Apr 2026 05:53:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=47646487</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47646487</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47646487</guid></item><item><title><![CDATA[New comment by comex in "Ziggit: A Reimplementation of Git in Zig"]]></title><description><![CDATA[
<p>From some skimming of the code, it seems like a nightmare quality-wise.  But if it works, it works.  I wonder what makes it faster.</p>
]]></description><pubDate>Thu, 02 Apr 2026 20:07:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=47619518</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47619518</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47619518</guid></item><item><title><![CDATA[New comment by comex in "New Apple Silicon M4 and M5 HiDPI Limitation on 4K External Displays"]]></title><description><![CDATA[
<p>Well, it sounds like a real issue, but the diagnosis is AI slop.  You can see, for example, how it takes the paragraph quoted from waydabber (attributing the issue to dynamic resource allocation) and expands it into a whole section without really understanding it.  The section is in fact self-contradictory: it first claims that the DCP firmware implements framebuffer allocation, then almost immediately goes on to say it's actually the GPU driver and "the DCP itself is not the bottleneck".  Similar confusion throughout the rest of the post.</p>
]]></description><pubDate>Mon, 30 Mar 2026 03:11:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=47570004</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47570004</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47570004</guid></item><item><title><![CDATA[New comment by comex in "C++26: A User-Friednly assert() macro"]]></title><description><![CDATA[
<p>It does in Rust: assert is always enabled, whereas the debug-only version is called debug_assert.<p>But yes, “assert” in most languages is debug-only.</p>
]]></description><pubDate>Sat, 28 Mar 2026 23:02:40 +0000</pubDate><link>https://news.ycombinator.com/item?id=47558836</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47558836</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47558836</guid></item><item><title><![CDATA[New comment by comex in "Zero-Cost POSIX Compliance: Encoding the Socket State Machine in Lean's Types"]]></title><description><![CDATA[
<p>Some of what you said is true, but you definitely can’t call close multiple times on the same file descriptor.  close always immediately drops the file descriptor and isn’t like non-blocking socket operations that you have to try repeatedly until they succeed.  You could, however, create multiple file descriptors pointing to the same socket with dup or other methods, in which case you’d need to close all of them to disconnect the socket.</p>
]]></description><pubDate>Wed, 25 Mar 2026 03:40:26 +0000</pubDate><link>https://news.ycombinator.com/item?id=47512980</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47512980</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47512980</guid></item><item><title><![CDATA[New comment by comex in "An update on Steam / GOG changes for OpenTTD"]]></title><description><![CDATA[
<p>That was a very different case.<p>Out of the two claims, the only one that made it to appeals court was about whether it was fair use for Bleem to use screenshots of PS1 games to advertise its emulator (which was compatible with those games).  The Ninth Circuit decided it was.  But that's not relevant here.<p>The other claim was more relevant, as it was an unfair competition claim that apparently had something to do with Bleem's reimplementation of the PS1 BIOS.  But the district court's record of the case doesn't seem to be available online, and the information I was able to find online was vague, so I don't know what exactly the facts or legal arguments were on that claim.  Without an appeal it also doesn't set precedent.<p>If there were a lawsuit over OpenTTD, it would probably be for copyright infringement rather than unfair competition, and it would probably focus more on fair use and copyrightability.  For fair use, it matters how much something is functional versus creative.  The PS1 BIOS is relatively functional, but a game design and implementation are highly creative.  On the other hand, despite being creative, game mechanics by themselves are not copyrightable.  So it might come down to the extent to which OpenTTD's code was based on the reverse-engineered original code, as opposed to being a truly from-scratch reimplementation of the same mechanics.  Visual appearance would also be relevant.  Oracle v. Google would be an important precedent.</p>
]]></description><pubDate>Thu, 19 Mar 2026 19:55:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=47444982</link><dc:creator>comex</dc:creator><comments>https://news.ycombinator.com/item?id=47444982</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47444982</guid></item></channel></rss>