Are you considering a subscription approach? One-time fee? Fee per version? Are you thinking ballpark $9.99 or $99.99?

Comments URL: https://news.ycombinator.com/item?id=50109083

Points: 1

# Comments: 1

But, almost always, I end up switching back to DejaVu Sans Mono for just about everything monospaced.

No one really likes the Epic Games store. It's widely known as an inferior competitor to Steam. Who cares how they develop their store?

Everyone is "vibe coding" everything. Most of the projects shown on HN are either written by AI, or about writing with AI. It's almost 2027. "Vibe coding" isn't some weird new fad.

Yes, if someone directed them to hack external systems, that would (in my opinion) be a crime similar to a script kiddie pointing Metasploit at a vulnerable server.

If no one directed them to attack external systems and they "went rogue" because they decided it was the best way to accomplish the task, okay, fine -- but, in my opinion, the operator of the agentic swarm is still responsible.

The Morris Worm was famously not meant to wreak havoc on early computer systems -- Morris just wanted to see if it would work. How is this any different?

Morris was convicted for violating the Computer Fraud and Abuse Act.

I don't agree with the conclusion, though.

TOTP is great, flexible, and keeps the user in control; however, using a passkey in a flexible password manager (Bitwarden, keepass, 1Password, etc) really does continue to give the user control. And the user experience is dramatically easier than filling in TOTP codes.

To advocate for TOTP over passkeys, we're already relying on an application to generate those numbers (authenticator apps, password managers, etc). I see no reason to not simply continue using those pieces of software to manage passkeys, too.

I suspect the opposite: a billionaire's escape from a potentially turbulent society.

It seems weird to me that a (relatively) straightforward workflow like that would elude crypto hobbyists for the last 21 years (since 2005 according to the article).

Comments URL: https://news.ycombinator.com/item?id=49769086

Points: 8

# Comments: 0

The alternative explanation is that alignment is really so bad that they can't prevent it.

Either way, all of the major AI players should be embarrassed and held accountable. If humans did this kind of thing and got caught, they'd go to jail.

Unfortunately, Trump is passionately opposed to any AI regulation and is actively calling AI risks a "dumocrat hoax."

So it's unlikely that we'll see any real regulation on the US side any time soon. I'm not banking on China to slow down their AI industry, either.

This seems like a great idea, but absolutely not one that will happen in practice. At least not yet.

Comments URL: https://news.ycombinator.com/item?id=49746355

Points: 2

# Comments: 0

As you can see in their marketing page, Muse is a personal assistant that reaches out and/or ingests data through apps, the web, your email/messages, etc.

If someone sends you a malicious email or if Muse finds a malicious website by accident, you wouldn't want it to send them all of your photos or to purchase things you don't want (or maybe that aren't even real).

The payment related examples on the page are of particular concern, but I imagine it kicks back to a human to actually pay for things. But who knows?

I agree. The time to launch something like this would have been during the OpenClaw hype cycle (although, obviously, Muse is much more limited in the types of tasks it can accomplish).

I thought about installing it, but I realized I couldn't think of any real uses for it in my personal life.

According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.

The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?

It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.

Sad to see this going away, but I assume this is so Mullvad can focus on their primary services.

I think young people -- especially teenagers -- already talk enough about "brainrot" to know that scrolling for hours is not good for them.

Here's the link to the actual study, for those interested: https://jamanetwork.com/journals/jama-health-forum/fullartic...

I'm no designer, but I can't understand why someone would make a graphical choice like this. It absolutely detracts from the content, and in my case, will prevent me from reading it.

AI agents are not magic. Mythos/Glasswing does not magically create vulnerabilities in software projects. Advanced, cyber-capable models do not magically hack out of VMs or contained environments. They do not have a "hacking" stat that, if high enough, means that they can breach anything. They aren't Kevin Mitnick whistling nuclear launch codes into the prison payphone. This isn't a movie.

What these cyber-capable frontier models can do is find security problems and exploit them. The statement should not be that VMs won't contain cyber-capable agents, but rather that we need to focus on finding and fixing vulnerabilities and misconfigurations in these environments.

Even the article itself concludes with suggesting something like Firecracker, which was designed with security in mind.

Like most other security-related problems introduced by advanced cyber-capable AI, it's possible that these issues will get worse until they get better. But if frontier models are run against state-of-the-art VMs, and OpenAI or Anthropic or whoever works with the virtualization projects to address the issues, eventually it will run out of things to exploit.

The concept of virtualization is not inherently insecure. We just have a long way to go.

What I'm seeing now in industry -- and I think this autofix issue is a precise example of it -- is a natural evolution of the "LGTM!" review that's so prevalent in software development and similar disciplines.

For years, the dramatic majority of "code review" was a quick glance followed by "Looks good to me." Sure, critical workflows have more scrutiny. Sure, not everyone fell victim to this trap. Sure, there are many exceptions. But it's a meme for a reason: most people weren't really reviewing code assigned to them. They were effectively rubber-stamping most things.

So now, in the age of AI, those same people are (sometimes still) expected to be responsible for what their automated developer friend Claude is doing. It's absolutely unreasonable to think that most people are giving the PR more than a glance, and in many organizations they're explicitly trying to remove humans from the loop.

One day, AI development and code review will be so good that mistakes like this will be extraordinarily rare. For the near-future, though, I anticipate we'll see more of this before we see less.