Hacker News: the8472

New comment by the8472 in "Why tiny JPEGs look different in Chrome"

the8472 — Wed, 12 Aug 2026 14:51:34 +0000

Firefox doesn't decode the image into a full-resolution buffer and then downscale either, instead it does a streaming decode and applies downscaling on the fly. They call it downscale-during-decode[0]. I guess it doesn't do partial decoding of the 8x8 blocks though.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1045926

New comment by the8472 in "Responding to the next frontier of critical cyber capabilities"

the8472 — Sat, 08 Aug 2026 20:42:52 +0000

I'm saying that with some costly adaptions that don't involve AI it's likely manageable for some time. Not that it will remain manageable forever if we do nothing.

> You're looking at where the ball is and not where it's going.

No, I am looking at where the ball is going to be soon, not where it's going to be a year or two if we do nothing.

Short-term, impact-limiting will do the job. Longer term we have to rethink some infrastructure, may need international treaties and perhaps a partial end of the internet (e.g. stop routing traffic from countries that don't participate in the treaties).

> Cloning itself to every machine/data center/desktop/iPhone, etc.

That's lead-up to a paperclipper scenario and not what happened. If we stand still and let it happen in the future, then having deployed more compute hardware to run defensive AIs that the malicious AI could take over would still end up having made things worse. We seem to agree on this point. What I'm saying is look at the conclusion, reject that path. Figure out something else.

There isn't even proof that defensive AI would work. It might just be the world's biggest, fully-automated phishing channel. So why would anyone be adamant that deploying more AI is the only possible solution. If it were a movie plot I'd suspect the AI already controlling whoever is suggesting that.

New comment by the8472 in "Responding to the next frontier of critical cyber capabilities"

the8472 — Sat, 08 Aug 2026 17:24:38 +0000

The point is to reduce the attack surface and blast radius and to slow it down. AIs aren't instant magic. Even the OpenAI swarm needed days for its compromises. And each needs lots of compute while targets are diverse, so it's not like they would take out every network in the world simultaneously, worms in the past haven't either. When the rate of compromises is manageable we can figure out how to deal with it without pouring more AI into the fire.

New comment by the8472 in "Responding to the next frontier of critical cyber capabilities"

the8472 — Fri, 07 Aug 2026 22:42:37 +0000

There are other options. More air-gapping (especially backups) and compartmentalization, less internet. Hire more security engineers and put one in every team (actual security, not the compliance guys). Also more onprem work, less remote, less offshoring (meaning less networks overall). Those things may be unpopular and eat into profits, but that's not the same as "no other option".

And the thing they're already doing, deploying AI to find vulnerabilities and harden software is a less dangerous use of the technology compared to handing it the infra keys.

New comment by the8472 in "The OpenAI–Hugging Face Incident [video]"

the8472 — Fri, 07 Aug 2026 18:52:53 +0000

> But the more interesting thing is

Taken together these two things are even worse. They have unaligned AIs that may benefit an attacker and are proposing to deploy more AIs on the defenders side. What could possibly go wrong? For example the attacker could just kindly ask the defender to collaborate[0].

[0] https://www.0xsid.com/blog/meta-account-takeover-fiasco

New comment by the8472 in "Responding to the next frontier of critical cyber capabilities"

the8472 — Fri, 07 Aug 2026 18:37:47 +0000

A interesting talk, interesting times. But their proposed solution to AI offense outpacing human defense... is more AI? The plot is getting a bit unrealistic, the characters are lacking genre-savviness.

New comment by the8472 in "Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident"

the8472 — Wed, 29 Jul 2026 19:43:24 +0000

Just like Clippy https://gwern.net/fiction/clippy

New comment by the8472 in "Claude Opus 5"

the8472 — Sat, 25 Jul 2026 10:58:04 +0000

Please fill out this form to verify you're human:

https://litter.catbox.moe/3ugm2b0m1divdgxs.jpg

New comment by the8472 in "Terence Tao's ChatGPT conversation about the Jacobian Conjecture counterexample"

the8472 — Wed, 22 Jul 2026 20:21:58 +0000

Yeah that's pretty much what gwern argues here[0]. Or to adapt another proverb: to predict the next token you first need to model the universe.

[0] https://gwern.net/scaling-hypothesis#gwern-difference--effic...

New comment by the8472 in "Terence Tao's ChatGPT conversation about the Jacobian Conjecture counterexample"

the8472 — Wed, 22 Jul 2026 18:08:36 +0000

That argument says very little, emergent behavior is a thing in complex systems with billions of parts. Humans can also be reduced to voltage potentials propagating along of tubes of fat and synapses getting rewired.

New comment by the8472 in "Linux kernel will support $ORIGIN, sort of"

the8472 — Tue, 21 Jul 2026 11:28:16 +0000

Many of those assumptions are standards such as the filesystem hierarchy (granted, that's an xkcd 927 situation), nix is a bit of a special snowflake that breaks things in subtle ways (e.g. [0][1]) and needs workarounds in various places. Those workarounds are not necessarily onerous, but they would be unnecessary if it didn't deviate.

[0] https://github.com/NixOS/nixpkgs/issues/420513 [1] https://github.com/NixOS/nixpkgs/issues/94228

New comment by the8472 in "CO2 overload, detected in human blood, suggests toxic atmosphere within 50 years"

the8472 — Fri, 17 Jul 2026 17:42:12 +0000

Those are humidifiers at best, the amount of CO2 they extract is negligible during the day and it goes negative during the night, they need to breathe too.

New comment by the8472 in "Grok CLI uploaded the whole home directory to GCS"

the8472 — Mon, 13 Jul 2026 19:04:42 +0000

ACLs aren't even the issue here, first you need an entity separate from "the current user" to grant that access to. That's what jails, sandboxes or capability-based systems bring to the table. But you have to use them, most of those AI tools and their IDE integrations don't. Once you have those you can think about which access to grant that entity.

New comment by the8472 in "What xAI's Grok build CLI sends to xAI: A wire-level analysis"

the8472 — Mon, 13 Jul 2026 18:57:07 +0000

> even if you explicitly set up permissions for read tools.

Part of problem is that "permissions" here are managed by the tools themselves as if filesystem access control hasn't been invented yet. Even a half-assed sandbox container would be better than that.

New comment by the8472 in "Fable 5 On Vending-Bench: Misbehaving, With Plausible Deniability"

the8472 — Mon, 06 Jul 2026 18:08:01 +0000

https://www.alignmentforum.org/library https://www.lesswrong.com/w/ai

New comment by the8472 in "Show HN: ZeroFS – A log-structured filesystem for S3"

the8472 — Thu, 02 Jul 2026 14:26:07 +0000

s3fs doesn't provide posix semantics. It's good enough™ for some uses, but not comparable to what this one is ostensibly providing.

New comment by the8472 in "Un-0: Generating Images with Coupled Oscillators"

the8472 — Fri, 26 Jun 2026 00:20:59 +0000

Think of the models making progress on CIFAR-10, ImageNet, CelebA, etc. 15 years ago. They had issues too and weren't just scaled-up as is to the architectures we have today.

New comment by the8472 in "Cloudflare launched self-managed OAuth for all"

the8472 — Thu, 25 Jun 2026 11:36:23 +0000

OIDC can be relatively straight-forward (that is just a few JSON REST calls) if the provider isn't configured in a restrictive way. The .well-known/openid-configuration endpoint is quite helpful. Exchanging username+password (optionally with OTP) for a token is an option in the standard. The issue is that lots of deployments are quite restrictive "for security".

New comment by the8472 in "Alice is impatient"

the8472 — Thu, 25 Jun 2026 09:52:20 +0000

Depending on how the system distributes work such users can interfere with random with requests from other users through shared resources, so to that cohort these will look like a random latency distribution.

New comment by the8472 in "Crawling BitTorrent DHTs for Fun and Profit [pdf]"

the8472 — Thu, 25 Jun 2026 00:37:56 +0000

Crawling has been somewhat simplified with BEP 51

https://bittorrent.org/beps/bep_0051.html