Comments URL: https://news.ycombinator.com/item?id=49550614

Points: 361

# Comments: 317

If I didn't know any better, I would have said Grok is using Claude behind the hood. But definitely curious now why it’s happening with both these LLM providers around the same time

The advisory exists through GitHub’s repository-advisory API:

- GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vxw4

- HTTP 200

- state: "published"

- severity: "critical"

- published_at: "2026-08-25T16:16:28Z"

but it's completely missing from the public DB's our scanners rely on:

- https://api.github.com/advisories/GHSA-2xp9-vwfh-vxw4 - HTTP 404

- https://api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4 - HTTP 404

There's already a blog published by Vercel about this, which is seriously concerning because some developers might not know about it until it's too late.

Is this delay expected? If so, how is everyone covering this gap in the scanning pipeline?

Comments URL: https://news.ycombinator.com/item?id=49534734

Points: 2

# Comments: 1

Exactly! One important thing LLMs have made me realise deeply is "No information" is better than false information. The way LLMs pull out completely incorrect explanations baffles me - I suppose that's expected since in the end it's generating tokens based on its training and it's reasonable it might hallucinate some stuff, but knowing this doesn't ease any of my frustration.

IMO if LLMs need to focus on anything right now, they should focus on better grounding. Maybe even something like a probability/confidence score, might end up experience so much better for so many users like me.

For a few edge-case scenarios we ended up mocking the DB layer (which obviously stops being a true e2e test). Something like PgLite would've been a perfect middle ground - real Postgres, zero container overhead, easy to spin up isolated instances per test, and a clean slate for every run.

The GitHub APIs that you are using to list files are getting rate-limited in my case. If somebody else is also facing this issue, just use a VPN or something like Cloudflare Wrap to change your ip - this should fix the issue.

P.S If you are the main dev, giving an option to the visitor to sign in using Github or use a caching layer will be really helpful to make this accessible for the new user.

People can have different opinions on this, of course, but personally, if I have a choice, I'd rather not be juggling both product development and the infrastructure headaches that come with running everything myself. That trade-off isn’t worth it for me.

Also, I believe this should be the correct GitHub issue link - https://github.com/haproxy/haproxy/issues/1404

> Production Lesson: Code that "works fine" at small scale may still hide O(N²) or worse behavior. At hundreds or thousands of nodes, those costs stop being theoretical and start breaking production.

Completely agree with this. I’ve recently been dealing with building few CI workflows, and honestly, I was very frustrated by how much time everything was taking. A lot of that frustration came from having nothing to do while waiting for the CI to pass, and I could clearly see how much time all of it was costing me.

Looking back, I realize that I’ve wasted far more time during my normal development workflow because of small inefficiencies here and there.

This has led me to believe that the human mind is much more prone to thinking linearly than in a compounding way.

The idea that the permanent record of the internet could hinge on the ethics of one stranger behind a server rack is deeply unsettling.