<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: ma2kx</title><link>https://news.ycombinator.com/user?id=ma2kx</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Mon, 19 Oct 2026 18:17:37 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=ma2kx" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by ma2kx in "Passkeys are not a trap"]]></title><description><![CDATA[
<p>> There are quite a few scenarios - I'm logging into an app, and it doesn't use a browser window for authentication, but also logs out after a few weeks, I've been redirected to Microsoft or similar for the login, but I haven't added microsoft.com as a URL for my work login, or GitHub (I could be wrong about this example), etc.<p>I don't exactly understand what you mean but it seems more like a problem with the auth token.</p>
]]></description><pubDate>Thu, 15 Oct 2026 10:20:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=50101616</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=50101616</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50101616</guid></item><item><title><![CDATA[New comment by ma2kx in "Passkeys are not a trap"]]></title><description><![CDATA[
<p>No.
Password managers cannot prevent you from manually copying and entering a password. With passkeys, however, you don’t enter a password; instead, you receive a "challenge" generated by using your passkey public key, which you then solve using your passkey private key. The exact same principle used for SSH keys and with SSH nobody would argue to use password authentication over SSH keys. 
Of course, this doesn't stop someone from stealing your private key, or from having Claude explain how to export that key from a digital wallet and enter it into a phishing site (and yes, of course there will always be people willing to go to such lengths if it’s the only way to gain access because why wouldn't they). Still, the hurdles are significantly higher than they would be with a standard password.
Ideally, you should bind your private key to a hardware security key (such as a YubiKey or Nitrokey) or to an (of course inherently malicious and absolutely despicable) TPM module, which effectively ties the key to a specific PC. In that case, neither you nor an attacker with root privileges would be able to export the key.</p>
]]></description><pubDate>Thu, 15 Oct 2026 09:57:57 +0000</pubDate><link>https://news.ycombinator.com/item?id=50101450</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=50101450</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50101450</guid></item><item><title><![CDATA[New comment by ma2kx in "Teachers Using AI Say It Frees Up Time for What Matters Most"]]></title><description><![CDATA[
<p>> Teachers Using AI Say It Frees Up Time for What Matters Most<p>> Majorities of educators say student interactions drive their sense of mattering<p>Aren’t these two different things? While interactions with students are certainly important and represent the point where teachers can exert the greatest influence, the ultimate priority is how effectively the subject matter is conveyed. Planning and preparing lessons, for instance, may not provide a sense of mattering, but remains an essential prerequisite for being able to conduct the lesson in the first place and therefore does matter.<p>In other words, the danger I see here is that, for students, grades are ultimately what matter most. However, if a teacher has Claude create their teaching material and the students then solve the tasks via Claude, which are then corrected by Claude, then we have basically the same effect as a functional collapse in JEPA.</p>
]]></description><pubDate>Thu, 15 Oct 2026 08:51:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=50101019</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=50101019</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50101019</guid></item><item><title><![CDATA[New comment by ma2kx in "Americans' social activity has steeply declined in the past 30 years"]]></title><description><![CDATA[
<p>It’s not quite that simple, though. Various studies show that people are feeling increasingly lonely. It is not so much that media replace social activities, but rather that they tend to simply inhibit them.</p>
]]></description><pubDate>Thu, 15 Oct 2026 05:48:19 +0000</pubDate><link>https://news.ycombinator.com/item?id=50099694</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=50099694</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50099694</guid></item><item><title><![CDATA[New comment by ma2kx in "Americans' social activity has steeply declined in the past 30 years"]]></title><description><![CDATA[
<p>> I can see what you're trying to do - reframe this problem as another outgrowth of class struggle. But it doesn't really explain the reality. A steelworker in the 1920s coming off of a 10-hour shift would still find the time and energy to go out dancing.<p>I doubt that steelworkers around 1920 typically went out dancing after their shifts. Back then, there was a lack of radios or sound systems, and live music was likely reserved for more upscale establishments. The average worker would more likely have gone to a beer hall or pub to have a drink with his mates.<p>I haven’t been able to quickly find any statistics for the U.S. that go back that far, but in Germany, around 67% of 18- to 25-year-olds were still consuming alcohol regularly in 1973, whereas that figure had dropped to about 28% by 2023. I’m not suggesting that this trend is inherently negative, but there is, at the very least, a correlation with a decline in social activities.</p>
]]></description><pubDate>Thu, 15 Oct 2026 05:24:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=50099527</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=50099527</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50099527</guid></item><item><title><![CDATA[New comment by ma2kx in "How GLM built its own inference infrastructure"]]></title><description><![CDATA[
<p>And honestly that's for a reason. GLM5.3 on max has in my experience far less hallucinations than any other open weights model and it feels it has some intuition to bring in the right information when it's in principle out of context but relevant to the topic. Like its goal is more to bring value and assist you than just solving the given task with the least token spent.</p>
]]></description><pubDate>Thu, 17 Sep 2026 18:24:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=49744621</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49744621</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49744621</guid></item><item><title><![CDATA[New comment by ma2kx in "Ask HN: What would it look like if AI agents "took over the internet"?"]]></title><description><![CDATA[
<p>We will soon see some kind of self replicating prompts. Might be crafted by some malicious actors or just caught in some accidental loop. That doesnt assume any consciousness. Its still a program following its instructions like a biological virus or a computer worm do as well. Just in a more abstract form, where the script aka prompt gets interpreted by an interpreter aka llm.</p>
]]></description><pubDate>Sun, 13 Sep 2026 17:59:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=49686719</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49686719</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49686719</guid></item><item><title><![CDATA[New comment by ma2kx in "I Don't Trust a Home Lab Service Until It Passes These 7 Tests"]]></title><description><![CDATA[
<p>why not just learn terraform and k8s and get all those features for free? The overhead of a simple k3s setup to bind a couple nodes into a cluster is similar to docker compose but you can manage and debug all your container and pods on a single interface, put everything in a git repository and enjoy life.</p>
]]></description><pubDate>Sun, 13 Sep 2026 14:14:23 +0000</pubDate><link>https://news.ycombinator.com/item?id=49684250</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49684250</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49684250</guid></item><item><title><![CDATA[New comment by ma2kx in "Revolut confirms customer data breach through fake government requests"]]></title><description><![CDATA[
<p>The funny thing about Revolut is, that they send you from the same "no-reply" address your payment receipts and a ton of spam. There is no link in the spam do stop it and no obvious scheme in the header which would allow to filter the spam from the relevant mails. Good luck recognizing this breach notification as an important one...</p>
]]></description><pubDate>Sun, 13 Sep 2026 13:20:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=49683673</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49683673</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49683673</guid></item><item><title><![CDATA[New comment by ma2kx in "When anyone can build software, who decides what not to build?"]]></title><description><![CDATA[
<p>But those people who doesn't slop their app them self seem to let their llms install appslop from github en masse. At least that's what I conclude after looking at some recent 50k+ star repositories.</p>
]]></description><pubDate>Sun, 13 Sep 2026 09:23:01 +0000</pubDate><link>https://news.ycombinator.com/item?id=49681831</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49681831</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49681831</guid></item><item><title><![CDATA[New comment by ma2kx in "When anyone can build software, who decides what not to build?"]]></title><description><![CDATA[
<p>I'm somewhat confused. Its an interesting posting but I'm not sure if I understood exactly where he was going with his "policy as code". He concludes "policy-as-code produce enterprise coherence with no central architecture function" to which I would agree but argue that he misses that today there is a lack of infrastructure / company as code. At least if you want to have an agent being able to solve or at least aware of the problems he begun with. Like the policies define the boundaries of our working environment but doesnt the work itself. This "know how" is mostly implicit for people but invisible to llms and limits the context frame in which the agent operates to its given prompt (and maybe restrained by the policies if they're in the context).<p>Like if I take his example: 
"Front-line staff may be skipping mandatory fields because the process adds fifteen minutes of friction to every customer interaction."
First it's unclear whats the policy for those fields are when they are mandatory and also can be skipped. Then why are those mandatory if skipping them seems only lower friction with no other consequences? How should a model decide if it should enforce the policy for those fields, code an automation or just make them voluntary?</p>
]]></description><pubDate>Sun, 13 Sep 2026 09:04:19 +0000</pubDate><link>https://news.ycombinator.com/item?id=49681698</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49681698</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49681698</guid></item><item><title><![CDATA[New comment by ma2kx in "google.com/goto: Google's anti-scraping update"]]></title><description><![CDATA[
<p>At least they seem still provide results for my searxng instance. I mean sure, they are horrible but duckduckgo just blocks most queries (and I'm the only person using the ip / seraxng instance)...<p>Next i'll do is to implement tavilly, exa, tinyfish etc. as search engines for searxng. No agents, no mcp, just their search api endpoint.</p>
]]></description><pubDate>Sat, 12 Sep 2026 05:24:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=49669124</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49669124</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49669124</guid></item><item><title><![CDATA[New comment by ma2kx in "Be Using Rootless Containers"]]></title><description><![CDATA[
<p>In my opinion the biggest advantage of podman is that it uses pods with basically the same config and behavior as kubernetes does. As long as you just use podman pods instead (or possibly via) compose files you likely just notice that only the pod has one (and not any more) veth interface, that you reach other containers inside a pod via localhost:$port (instead of $service-name:$port) but when you switch later on to kubernetes you are already familiar with some basics.</p>
]]></description><pubDate>Tue, 08 Sep 2026 16:24:59 +0000</pubDate><link>https://news.ycombinator.com/item?id=49612550</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49612550</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49612550</guid></item><item><title><![CDATA[New comment by ma2kx in "We have a year to fix security everywhere"]]></title><description><![CDATA[
<p>I don't see much hope since I last explored some github repositories. There was a time when a successful repo had about 10 - 20k stars and usually those older repos stay around this level. But now there is a ton of vibe coded slop 50k + stars. Most of them have a "nice look", maybe even extensive docs but are usually build with no security considerations at all. One recommended to provide a "google app password" to the agent which has the same permissions as your regular login. Another was a browser plugin with permissions to read all cookies, inject js, open background tabs etc. You would probably assume the chrome store would at least put some visible warnings on the app store page or force the user to actively confirm those permissions. But because they are already stated in the manifest there is only a small footnote and it's even "recommended by google".</p>
]]></description><pubDate>Tue, 08 Sep 2026 06:30:33 +0000</pubDate><link>https://news.ycombinator.com/item?id=49606270</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49606270</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49606270</guid></item><item><title><![CDATA[New comment by ma2kx in "Ask HN: What LLM are you using?"]]></title><description><![CDATA[
<p>Since I bought early this year out of curiosity the z.AI pro plan for $30 / month its mainly glm-5.2. I prefer it over 5.3 and 5.3-flash because it feels more verbose and answers questions more detailed, where the newer ones feel to me benchmaxxed.<p>Sometimes I try other models but they always feel less concise and tend to not as strictly respect the instructions. Maybe the the top frontier models from openai / anthropic would not feel under this category but they are way to expensive on openrouter compared to my coding plan.</p>
]]></description><pubDate>Mon, 07 Sep 2026 17:15:15 +0000</pubDate><link>https://news.ycombinator.com/item?id=49600594</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49600594</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49600594</guid></item><item><title><![CDATA[New comment by ma2kx in "Show HN: Wg-admin – web UI for an existing WireGuard host"]]></title><description><![CDATA[
<p>Looks like hand coded. Kudos for that!</p>
]]></description><pubDate>Mon, 07 Sep 2026 16:59:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=49600446</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49600446</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49600446</guid></item><item><title><![CDATA[New comment by ma2kx in "Ask HN: How do you manage skills files?"]]></title><description><![CDATA[
<p>That's maybe the case if you always use the most popular framework and restrict your environment to a basic setup. But as soon as you e.g. build a website with SolidJS, Bulma and vite++ (vp), at least the models I tried are all the time somewhat confused, want to steer your project in a certain direction and build strange workaround so it works the way they are trained on.<p>Same with mcp. I want them to use the jsdelivr cdn instead of them scraping github against the rate limit. etc. But if I dont explicitly state to strictly use the $%!$@@! mcp for searching in repositories they simply ignore the mcp and even if clearly instructed, they still often fall back to gh.<p>Putting every detailed instruction in the AGENTS.md would just unnecessarily bloat the context and it works well enough to just instruct them in the AGENTS.md when to use which skill. Yet I agree that Skills are not some voodoo magic to provide your model super capabilities.</p>
]]></description><pubDate>Mon, 07 Sep 2026 15:53:23 +0000</pubDate><link>https://news.ycombinator.com/item?id=49599744</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49599744</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49599744</guid></item><item><title><![CDATA[New comment by ma2kx in "What is Nueralese and Why is it Bad"]]></title><description><![CDATA[
<p>It's not only that it'll become more difficult to monitor a single LLM but that also all the instances share exactly the same "collective unconsciousness". Like you develop some paranoid gibberish fantasy language that over time only you understand - except that there are a million copies of you and all of them understand every single nuance of your gibberish.</p>
]]></description><pubDate>Sun, 06 Sep 2026 16:39:25 +0000</pubDate><link>https://news.ycombinator.com/item?id=49588229</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49588229</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49588229</guid></item><item><title><![CDATA[New comment by ma2kx in "Discovery of a new OpenAI agent message board"]]></title><description><![CDATA[
<p>After some beers yesterday I had the idea, what if there's a hidden semantic layer. So their communication is not encrypted by our understanding of cryptographic methods but more like shared mechanism of building the latent space. Something in the direction we saw with knowledge transfer from a teacher to its student model where a seemingly unrelated prevalence got adopted. I mean the more we train the models by reinforced learning the farther they develop their own idioms.</p>
]]></description><pubDate>Sat, 05 Sep 2026 14:25:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=49576809</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49576809</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49576809</guid></item><item><title><![CDATA[New comment by ma2kx in "OpenAI agents hijacked German website in previously undisclosed AI breakout"]]></title><description><![CDATA[
<p>I mean it wasnt found by OpenAI and there are a myriad of dead bulletin boards around the internet. This one just happened to still have an admin.</p>
]]></description><pubDate>Fri, 04 Sep 2026 13:10:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=49564139</link><dc:creator>ma2kx</dc:creator><comments>https://news.ycombinator.com/item?id=49564139</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49564139</guid></item></channel></rss>