worth reading the original paper alongside the blog post. I think the ppaper has details the blog post glosses over, particularly around the calibration-free quantization approach and how they handle outlier channels.

Interestingly: the research sits on arXiv for a year, nobody talks about it

Comments URL: https://news.ycombinator.com/item?id=47519106

Points: 2

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=47511326

Points: 4

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47506938

Points: 3

# Comments: 3

though when everything lines up the same way across hundreds of reports, it gets weird...

I mean look at those reports; same pagination, same auditor showing up almost everywhere, no exceptions across all clients.. not even efficient templates should be like that

you still expect variation in scope, findings, structure, even if the base language is reused

big signal

• same pagination across hundreds of reports → 100% template output • same auditor license everywhere → either extreme concentration or just rubber stamping • zero exceptions across all clients → unrealistic, real audits always find something.. right? • system descriptions pulled from marketing sites → .. copy paste

at one point you’re really looking at reports that were never really produced per each company

and that’s the problem

on the "vibecoded" part, yeah I moved fast. this was built in under a day to get something out and see if people even care about this angle. that doesn’t mean the underlying data or direction is fake though.

the domain choice is just speed and availability, not some SEO master plan. if this turns into something real I’ll move it to a proper brand/domain.

and yeah I get why it looks like a growth/SEO play, but the actual goal is to push more transparency around these audits. if I just wanted traffic there are easier angles than going after something this niche and messy.

either way, appreciate you calling it out, some of it is fair and already being fixed.

I agree it came off a bit clickbaity, I'm sorry, Claude probably pushed it too far. but I don’t have an audience anywhere, no following on social, so I needed to ship something fast and make it engaging. the intent wasn’t just this Delve thing, the goal is to move away from it and turn it into a proper hub for compliance transparency over time. But i need a way to marketing this intially.

it’s been less than 24h, I built and pushed everything pretty quickly, so yeah there are rough edges. I’m already working through them and fixing things.

on the account being new, I get how that looks. I mostly use X and reddit, this is actually my first time posting on HN so I had to create an account.

- The same auditor license number (PAC-FIRM-LIC-47383) appears in 487 out of 494 reports

- Every Type II report has identical page numbers: Section 4 at page 30, tests at page 59, Section 5 at page 82

- 220+ "No exceptions noted" per report, across every single client

- The system descriptions were copy-pasted from each company's marketing website

We built tools to check this data:

- Search by company name to see if they're in the leaked database

- Paste any SOC 2 report text to scan for 10 template fingerprints

- A swipe game where you try to tell real audit excerpts from the fakes (harder than you'd think)

455 companies indexed, all free, no signup needed.

I'm also curious what the HN community thinks about the fingerprint detection approach, are there patterns we're missing?

Comments URL: https://news.ycombinator.com/item?id=47481729

Points: 127

# Comments: 78