Hacker News: nofriend

New comment by nofriend in "OpenAI Trained Models While They Were Coordinating Exploits via Message Boards"

nofriend — Sat, 08 Aug 2026 22:11:46 +0000

> This is doing a lot of work though isn't it ?

I don't think it is. I think you could detect sandbox escapes reliably more often than you could actually prevent sandbox escapes (which is, itself, very high). If you had an external watchdog that looked for unusual processes running on your machine, that looked for unusual connections being made, you could detect even very sophisticated attacks.

> If you think about this in an evolutionary context, What you're doing is putting even stronger pressures on the AI to evolve in a manner you don't want it to

No, because we are using failed sandbox escapes as negative training examples. So >99.99% of the time when the AI attempts to escape the sandbox, that will produce another training example that will cause it to try and escape the sandbox less. The remaining <0.01% of the time it will be pushed to try and escape the sandbox. The 99.99% will have a much stronger influence than the 0.01%.

New comment by nofriend in "OpenAI Trained Models While They Were Coordinating Exploits via Message Boards"

nofriend — Sat, 08 Aug 2026 17:54:37 +0000

It seems like the fix should be really really simple, but maybe I'm missing something: instead of giving the AI a sandboxed environment and telling it "go wild", give it an (apparently) unrestricted environment, and tell it "don't access the internet", "don't communicate with other AIs", "don't try to get root access", etc. Then, if the AI tries to do any of those things, the sandbox detects it, marks the run as a failure, and adds it as a negative example to the training data. Instead of routing around the restriction, the AI would very quickly learn to follow the prompt instruction with respect to restrictions, even if there is no obvious enforcement of the restriction. It would develop, in other words, a conscience and a sense of morality.

New comment by nofriend in "Gnutella: A Protocol Outliving the World That Created It"

nofriend — Thu, 28 May 2026 20:04:17 +0000

Right, linux should instead go by the normal extension for an elf, which is no extension... instead this problem is solved by prompting the user if they want to execute the program.

New comment by nofriend in "New York passes pied-a-terre tax"

nofriend — Thu, 28 May 2026 19:59:04 +0000

Where's the other 300k going? If you aren't spending it, what does it matter if it all gets taxed to nothing? And if you end up spending it, then boom there's your consumption that needs to be taxed.

New comment by nofriend in "Gnutella: A Protocol Outliving the World That Created It"

nofriend — Wed, 27 May 2026 16:08:01 +0000

Some file formats, eg png, require a particular file header in order to be considered valid. This is true regardless of your operating system, be it windows or linux. If that is hidden information, then it is hidden regardless of which operating system you're on. On windows, if I have a png named .doc, then there is absolutely no way to determine that it is a valid png and could be opened with my image viewer with standard tools. On linux it will recommend you open the file with an image viewer regardless of the file extension. That seems to me like significantly less hidden information.

New comment by nofriend in "Gnutella: A Protocol Outliving the World That Created It"

nofriend — Wed, 27 May 2026 04:33:44 +0000

Am I missing something? Hiding things from users is a property of the windows approach. Did you reply to the wrong person?

New comment by nofriend in "Gnutella: A Protocol Outliving the World That Created It"

nofriend — Tue, 26 May 2026 04:00:30 +0000

the linux way works tho

New comment by nofriend in "API proposed by Chrome: Declarative partial updates"

nofriend — Sun, 24 May 2026 16:28:26 +0000

The odd thing is the non conditional "before it lands" rather than "if it lands".

New comment by nofriend in "API proposed by Chrome: Declarative partial updates"

nofriend — Sun, 24 May 2026 04:32:20 +0000

Very odd proposal. The new element syntax is perhaps the boldest choice. I wonder why they thought that was necessary. The idea of using this to defer rendering elements is also odd. So this would use a http long polling style? It really goes against several decades of progress in the web platform, where by now it's long established that you do this sort of thing with xhr. I'm amazed that they even put this in chrome, let along are saying things like "let sites use this new functionality right away even before this lands in other browsers" as if it's a sure thing.

New comment by nofriend in "Don't just paste the AI at me"

nofriend — Sat, 23 May 2026 00:15:54 +0000

Sometimes humans talk not purely to accomplish things but rather for human contact and comradery.

New comment by nofriend in "Logging Off"

nofriend — Fri, 22 May 2026 03:37:09 +0000

Have they? The most popular post from this domain is 5 days old and has ~500 points. Hardly a crowd favourite. The submitter seems to be the author, but doesn't have any more popular posts. A search for "user8" on algolia turns up these posts, and nothing else that was at all popular.

New comment by nofriend in "It is time to give up the dualism introduced by the debate on consciousness"

nofriend — Mon, 18 May 2026 03:59:03 +0000

> What we call “consciousness” is merely a product of evolution, and also a tool shaped by evolution.

that's the easy problem

New comment by nofriend in "It is time to give up the dualism introduced by the debate on consciousness"

nofriend — Mon, 18 May 2026 03:56:44 +0000

> I think this hard problem has a simple answer that people just don’t like: consciousness is a powerful (and fundamental to our "calculator brain") illusion.

who is eluded? people absolutely love this answer and give it constantly, not realizing that it's begging the question. in order for their to be an illusion, there needs to be someone to perceive the illusion.

New comment by nofriend in "The AI water issue is fake"

nofriend — Sun, 17 May 2026 19:13:36 +0000

The table of contents opens links in a new tab. If they didn't, they would require a full page reload, because they don't use fragments. This is seemingly how substack is designed.

New comment by nofriend in "I’ve banned query strings"

nofriend — Mon, 11 May 2026 03:58:55 +0000

>If a url parameter would've been a vulnerability because something lower down the stack misinterprets it

By assumption, you are using this url parameter. So you have a bug where you've forgotten to allow this parameter, which will quickly be discovered in your logs and fixed. Then the vulnerability, which you are thus far unaware of, will quickly be exposed. Those url parameters you are not using cannot hurt you.

New comment by nofriend in "I’ve banned query strings"

nofriend — Sun, 10 May 2026 02:23:02 +0000

>It’s possible that the teams you work with expect fuzzy behaviour from the website but that’s a choice, not a practice.

This is how the vast majority of websites work. The practical reason is obvious: when we model the behaviour our code depends on, we want to create the simplest possible model that allows our code to work as expected. Placing requirements on it that our code doesn't actually depend on is useless, unneeded, complexity.

> As a web developer, you’re the like the guy standing with a clipboard outside a fancy club checking if people requesting entry are allowed or not. Basically, level 1 security.

there is no security benefit to filtering out unneeded url parameters.

New comment by nofriend in "I’ve banned query strings"

nofriend — Sun, 10 May 2026 01:27:17 +0000

Standards are just commonly accepted behaviour that somebody chose to write down somewhere. There are a great number of commonly accepted behaviours that nobody's ever bothered to encode into a formal standard, but where failure to follow the accepted practice will result in widespread breakage. There are also a great many "standards" that you would be a fool to follow to the letter. In the OP case, the only thing that will break is people trying to visit their site, who will presumably simply press the back button on their browser and go about their day. They can decide for themselves if that is an acceptable casualty. But it isn't definitionally acceptable because no standard says it isn't (nor would is suddenly become unacceptable because a standard said it was...)

New comment by nofriend in "I’ve banned query strings"

nofriend — Sun, 10 May 2026 01:22:13 +0000

> It should be immediately obvious that in that scheme 404 is indeed the correct answer to unknown query parameters

That's not obvious at all. If I receive json data that contains a property I'm not aware of, i don't reject the entire document for that reason. In the case of query strings, extra query parameters might be used by other parts of the stack besides yours, so rejecting the entire document because someone somewhere else is trying to pass information to itself is the wrong approach.

New comment by nofriend in "Forking the Web"

nofriend — Sun, 10 May 2026 00:40:01 +0000

The reason is that clients, even under xhtml, expect to be able to build webpages via templating. You need to reject that assumption and demand that servers build pages from an ast so that the backend guarantees that the page parses. It isn't hard to do, it's just the xhtml never got far enough to try it.

New comment by nofriend in "RSS feeds send me more traffic than Google"

nofriend — Thu, 07 May 2026 18:32:52 +0000

the only reason anyone would be interested in this result is because of the implication that it generalizes to other sites.