<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: tolmasky</title><link>https://news.ycombinator.com/user?id=tolmasky</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Tue, 07 Apr 2026 08:11:25 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=tolmasky" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by tolmasky in "Anthropic drops flagship safety pledge"]]></title><description><![CDATA[
<p>I don't understand how safety is taken seriously at all. To be clear, I'm not referring to skepticism that these companies can possibly resist the temptation to make unsafe models forever. No, I'm talking about something far more basic: the fact that for all the talk around safety, there is very little discussion about what exactly "safety" means or what constitutes "ethical" or "aligned" behavior. I've read <i>reams</i> of documents from Anthropic around their "approach to safety". The "Responsible Scaling Policy," Claude's "Constitution". The "AI Safety Level" framework. Layer 1, Layer 2.<p>It's <i>so much focus</i> on implementation, and processes, and really really seems to consider the question of what even constitutes "misaligned" or "unethical" behavior to be more or less straight forward, uncontroversial, and <i>basically</i> universally agreed upon?<p>Let's be clear: <i>Humans are not aligned</i>. In fact, <i>humans have not come to a common agreement of what it means to be aligned</i>. Look around, the same actions are considered virtuous by some and villainous by others. Before we get to whether or not I trust Anthropic to stick to their self-imposed processes, I'd like to have a general idea of what their values even are. Perhaps they've made something they see as super ethical that I find completely unethical. Who knows. The most concrete stances they take in their "Constitution" are still laughably ambiguous. For example, they say that Claude takes into account how many people are affected if an action is potentially harmful. They also say that Claude values "Protection of vulnerable groups." These two statements trivially lead to completely opposing conclusions in our own population depending on whether one considers the "unborn" to be a "vulnerable group". Don't get caught up in whether <i>you</i> believe this or not, simply realize that this very simple question changes the meaning of these principles entirely. It is not sufficient to simply say "Claude is neutral on the issue of abortion." For starters, it is almost certainly not true. You can probably construct a question that is necessarily causally connected to the number of unborn children affected, and Claude's answer will reveal it's "hidden preference." What would true neutrality even mean here anyways? If I ask it for help driving my sister to a neighboring state should it interrogate me to see if I am trying to help her get to a state where abortion is legal? Again, notice that both helping me and refusing to help me could anger a not insignificant portion of the population.<p>This Pentagon thing has gotten everyone riled up recently, but I don't understand why people weren't up in arms the second they found out AIs were assisting congresspeople in writing bills. Not all questions of ethics are as straight forward as whether or not Claude should help the Pentagon bomb a country.<p>Consider the following when you think about more and more legislation being AI-assisted going forward, and then really ask yourself whether "AI alignment" was <i>ever</i> a thing:<p>1. What is Claude's stances on labor issues? Does it lean pro or anti-union? Is there an ethical issue with Claude helping a legislator craft legislation that weakens collective bargaining? Or, alternatively, is it ethical for Claude to help draft legislation that protects unions?<p>2. What is Claude's stance on climate change? Is it ethical for Claude to help craft legislation that weakens environmental regulations? What if weakening those regulations arguably creates millions of jobs?<p>3. What is Claude's stance on taxes? Is it ethical for Claude to help craft legislation that makes the tax system less progressive? If it helps you argue for a flat tax? How about more progressive? Where does Claude stand on California's infamous Prop 19? If this seems too in the weeds, then that would imply that whether or not the current generation can manage to own a home in the most populous state in the US is not an issue that "affects enough people." If that's the case, then what is?<p>4. Where does Claude land on the question of capitalism vs. socialism? Should healthcare be provided by the state? How about to undocumented immigrants? In fact, how does Claude feel about a path to amnesty, or just immigration in general?<p>Remember, the important thing here is not what you believe about the above questions, but rather the fact that Claude <i>is participating in those arguments, and increasingly so</i>. Many of these questions will impact far more people than overt military action. And this is for questions that we all at least generally agree have <i>some</i> ethical impact, even if we don't necessarily agree on what that impact may be. There is another class of questions where we don't realize the ethical implications until much later. Knowing what we know now, if Claude had existed 20 years ago, should it have helped code up social networks? How about social games? A large portion of the population has seemingly reached the conclusion that this is such an important ethical question that it merits one of the largest regulation increases the internet has ever seen in order to prevent children from using social media altogether. If Claude had assisted in the creation of those services, would we judge it as having failed its mission in retrospect? Or would that have been too harsh and unfair a conclusion? But what's the alternative, saying it's OK if the AI's destroy society... as long as if it's only on accident?<p>What use is a super intelligence if it's ultimately as bad at <i>predicting</i> unintended negative consequences as we are?</p>
]]></description><pubDate>Wed, 25 Feb 2026 04:23:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=47147333</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=47147333</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47147333</guid></item><item><title><![CDATA[New comment by tolmasky in "The Age Verification Trap: Verifying age undermines everyone's data protection"]]></title><description><![CDATA[
<p>If you need help (monetary or otherwise), please email me at tolmasky |at| gmail |dot| com. This is a sincere offer. I can't tell how much is hyperbole in your post, but if you're going through that and I can help, I'd be happy to.<p><i>> I mean you got $20 million and what did you do? You started making addictive games.</i><p>I refrained from responding to the rest since it seems that there is a deeper issue, but I could not help setting the record straight here. I think everyone who has ever played Bonsai Slice will firmly attest to it being the opposite of addicting. My parents never let me own a game console so I never really wrapped my head around games, and made exactly the kind of game someone like that would come up with: a deep tech exploration, to hopefully make progress on two problems that were plaguing me at the time: 1) how little mobile UI had seemed to progress (instead getting stuck in one-tap local maxima), and 2) building an app that is generally considered to be the worst candidate for a pure immutable language... in a pure immutable language in order to serve as a forcing function to surface new ideas in the space. I've always believed that if you wanted to make a general purpose programming language, you should probably try to have as much varied experience as possible, or otherwise you'll end up with a domain-specific language that is misused for every other domain (this is how I would describe most programming languages. In fact, I'd say most programming languages are written for the niche use case of writing a compiler, since they are written by compiler writers. Ironic that that is the last thing most get used for.). As such, I made a decision to start actually writing a wide variety of apps.</p>
]]></description><pubDate>Mon, 23 Feb 2026 20:59:33 +0000</pubDate><link>https://news.ycombinator.com/item?id=47128722</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=47128722</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47128722</guid></item><item><title><![CDATA[New comment by tolmasky in "The Age Verification Trap: Verifying age undermines everyone's data protection"]]></title><description><![CDATA[
<p>I want to sincerely ask whether you read my post, because your response is so unrelated I believe you might accidentally be responding to another post? If so, please ignore the rest, which is only intended in the case where you are actually responding to what I wrote.<p>Your system seems to address none of the issues I listed. For example, I argue that one difficulty is in the fact that these systems would be highly phishable -- a property that is present in your described "easy" solution. Your system trains users to become accustomed to being pestered by pop up windows that ask to see their ID and use their camera. Congrats, I can now trivially make a pop up a window that looks like this UI and use it to steal your info, as the user will just respond on auto-drive, as we have repeatedly shown both in user studies and in our own lived experiences. I also explained how a system like this would <i>assist</i> in the practice of trapping migrant workers by confiscating their government credentials [1]. This is a huge problem today in Asia, and one of the <i>few</i> outlets captive workers can use to escape this control is the internet -- a "loophole" your system would dutifully close for these corporations.<p>I am happy to have a discussion about this -- it's how we come up with new solutions! But that requires reading and responding to the concerns I brought up, not assuming that my issue is that I can't imagine implementing a glorified OAuth login flow.<p>1. There's tons of articles about this, here is one of the first ones that comes up on Google: <a href="https://www.amnesty.org/en/latest/news/2025/05/saudi-arabia-migrant-domestic-workers-face-severe-exploitation-racism-and-exclusion-from-labour-protections/" rel="nofollow">https://www.amnesty.org/en/latest/news/2025/05/saudi-arabia-...</a></p>
]]></description><pubDate>Mon, 23 Feb 2026 16:29:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=47124560</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=47124560</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47124560</guid></item><item><title><![CDATA[New comment by tolmasky in "The Age Verification Trap: Verifying age undermines everyone's data protection"]]></title><description><![CDATA[
<p>I am so surprised by the comments on this thread. I was not expecting to see so many people on Hacker News <i>in favor</i> of this. As is typically the case with things like this, the reasoning stems from agreeing with the <i>goal</i> of age verification, with little regard to whether age verification could ever actually work. It reminds me in some sense to the situation with encryption where politicians want encryption that blocks "the bad guys" while still allowing "the good guys" to sneak in if necessary. Sure, that sounds cool, it's not possible though. I suppose DRM is a better analogue here, an increasingly convoluted system that slowly takes over your entire machine just so it can pretend that you can't view video while you're viewing it.<p>To be clear, tackling the issue of child access to the internet is a valuable goal. Unfortunately, "well what if there was a magic amulet that held the truth of the user's age and we could talk to it" is not a worthwhile path to explore. Just off the top of my head:<p>1. In an age of data leaks, identity theft, and phishing, we are training users to constantly present their ID, and critically for things as low stakes as facebook. It would be one thing if we were training people to show their ID JUST for filing taxes online or something (still not great, but at least conveys the sensitivity of the information they are releasing), but no, we are saying that the "correct future" is handing this information out for Farmville (and we can expect its requirement to expand over time of course). It doesn't matter if it happens at the OS level or the web page level -- they are identical as far as <i>phishing</i> is concerned. You spoof the UI that the OS would bring up to scan your face or ID or whatever, and everyone is trained to just grant the information, just like we're all used to just hitting "OK" and don't bother reading dialogs anymore.<p>2. This is a mess for the ~1 billion people on earth that don't have a government ID. This is a huge setback to populations we should be <i>trying to get online</i>. Now all of a sudden your usage of the internet is dependent on your country having an advanced enough system of government ID? Seems like a great way for tech companies to gain leverage over smaller third world companies by controlling their access to the internet to implementing support for their government documents. Also seems like a great way to lock open source out of serious operating system development if it now requires relationships with all the countries in the world. If you think this is "just" a problem of getting IDs into everyone's hands, remember that it a common practice to take foreign worker's passports and IDs away from them in order to hold them effectively hostage. The internet was previously a powerful outlet for working around this, and would now instead <i>assist</i> this practice.<p>3. Short of implementing HDCP-style hardware attestation (which more or less locks in the current players indefinitely), this will be trivially circumvented by the parties you're attempting to help, much like DRM was.<p>Again, the <i>issues that these systems are attempting to address are valid</i>, I am <i>not</i> saying otherwise. These issues are also <i>hard</i>. The temptation to just have an oracle gate-checker is tempting, I know. But we've seen time and again that this just (at best) creates a lot of work and doesn't actually solve the problem. Look no further than cookie banners -- nothing has changed from a data collection perspective, it's just created a "cookie banner expert" industry and possibly made users <i>more indifferent</i> to data collection as a knee-jerk reaction to the UX decay banners have created on the internet as a whole. Let's not 10 years from now laugh about how any sufficiently motivated teenager can scan their parent's phone while they're asleep, or pay some deadbeat 18 year-old to use their ID, and bypass any verification system, while simulateneously furthering the stranglehold large corporations have over the internet.</p>
]]></description><pubDate>Mon, 23 Feb 2026 15:53:19 +0000</pubDate><link>https://news.ycombinator.com/item?id=47123997</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=47123997</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47123997</guid></item><item><title><![CDATA[New comment by tolmasky in "1X Neo – Home Robot - Pre Order"]]></title><description><![CDATA[
<p>Is having a real robot creepy? I don't know. Is having a robot operated by a human creepy and scary? Absolutely yes.<p>We've seen that people behave worse when you introduce indirection. People act worse on the internet. Soldiers have an easier time killing with drones than in person. The ethical issue is in both directions: its inhumane to the operator, but I also don't want to feel like a fake person on a video screen to them.<p>This is then exacerbated when you realize that the people operating this machine are almost certainly not being paid well, creating obvious and legitimate negative incentives. Then you plop them into the households of people with the insane wealth  required to afford this. You might think that I have just described the situation with maids (and to some extent, I agree! I have never really felt comfortable that dynamic either), but this <i>is</i> actually different, because you are adding in the indirection and making actions and interactions feel less "real" to <i>both parties</i>: the clients are likely to treat the robots worse than they would a human helper, and the operators may feel these rude clients they see on their monitors aren't as real as the people around them.</p>
]]></description><pubDate>Wed, 29 Oct 2025 02:45:15 +0000</pubDate><link>https://news.ycombinator.com/item?id=45742035</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45742035</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45742035</guid></item><item><title><![CDATA[New comment by tolmasky in "ChatGPT Atlas"]]></title><description><![CDATA[
<p>If this ever gets popular then sellers will “optimize” their product listings to exploit the LLM (a “soft” prompt injection if you will). This will definitely be the case in marketplaces (like Amazon and Walmart). It’ll turn the old boring task of shopping into a fun puzzle to spot the decoy item or overpriced product.</p>
]]></description><pubDate>Tue, 21 Oct 2025 20:23:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=45661206</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45661206</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45661206</guid></item><item><title><![CDATA[New comment by tolmasky in "Trump to impose $100k fee for H-1B worker visas, White House says"]]></title><description><![CDATA[
<p><i>Perfect number</i> to make H1Bs a tool that is out of reach for startups but still meaningful for large entrenched corporations. Nailed it. Maybe they can even waive the fee if you give the US government 10% of your company.</p>
]]></description><pubDate>Fri, 19 Sep 2025 20:50:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=45306404</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45306404</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45306404</guid></item><item><title><![CDATA[New comment by tolmasky in "Human writers have always used the em dash"]]></title><description><![CDATA[
<p>I'm glad the em dash is getting properly shit on these days, if for unrelated reasons. I've never liked it. I hate the stupid spacing rules around it. It never looks right to put no spaces around the em dash, and probably breaks all sorts of word-splitting code that's based on "\s". Where else does punctuation without spaces <i>not</i> mean a single word? Hyphens without spaces is a compound word: it counts as <i>one</i>. Imagine if the correct use of a colon was to not put spaces around it:like this. Do you like that? Of course not.<p>But I think worst of all it just gives me the fucking creeps, some uncanny-valley bullshit. I see hyphens a million times a day then out of nowhere comes this creepy slender-man looking motherfucker that's just a little bit too long than you'd expect or like, and is always touching all the letters around it when it shouldn't need to. It stands out looking like a weird print error... on my screen! Hopefully it keeps building a worse and worse reputation.</p>
]]></description><pubDate>Mon, 15 Sep 2025 13:00:38 +0000</pubDate><link>https://news.ycombinator.com/item?id=45249160</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45249160</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45249160</guid></item><item><title><![CDATA[New comment by tolmasky in "The treasury is expanding the Patriot Act to attack Bitcoin self custody"]]></title><description><![CDATA[
<p>Does no one else find it weird seeing anything from this administration "anti-Bitcoin" at all? I wouldn't be surprised by this headline during a previous administration, but generally speaking, this administration has been very Bitcoin-friendly (and Bitcoin institutions friendly right back). To be clear, the simplest answer is "sure but that doesn't mean they have to agree on everything". But I would like to propose that if you ask the simple question of "who does this benefit?" it may suggest we are witnessing a <i>different</i> phenomenon here.<p>I think this might be the first indication that what we currently call "institutional Bitcoin supporters" are <i>not</i> "Bitcoin supporters" at all, or rather, what they call "Bitcoin" is not what you and I call "Bitcoin". Services like Coinbase and BTC ETFs don't really suffer from this development at all. In fact, I think it's quite obvious that obviously <i>benefit</i> from something like this (at least from the first-order effects). What's the alternative to self custody? Well... third-party custody. Especially since they are <i>already</i> bound up by KYC rules, right? Their is a cynical reading that there's nothing inconsistent with this development if you consider "institutional Bitcoin's" goals to primarily be <i>replacing</i> existing financial power structures with themselves. "Bitcoin" is just a means to an end. Their goals were only incidentally aligned with individual BTC holders since they were previously in similar circumstances as the "out group". Previous administrations were as suspicious of "Bitcoin companies" as any individual Bitcoin holder, perhaps even <i>more so</i>. But that's not the case anymore. Bitcoin companies have successfully been brought into the fold, so it's not even that they're necessarily "betraying" the values of Bitcoin true believers, you might argue that interpretation of shared values was entirely inferred to begin with.<p>Critically though, I think an important consequence of this is that Bitcoin purists and skeptics should realize that <i>they</i> arguably now have more in common than not, at least in the immediate term, and may be each other's best allies. In my experience, for most the existence of Bitcoin, its skeptics haven't really seen Bitcoin as a "threat." Instead, to admittedly generalize, their critiques have been mostly about Bitcoin being "broken" or "silly" or "misunderstanding the point of centralized systems", etc. These aren't really "oppositional" positions in the traditional "adversarial sense," more dismissive. In fact, the closest thing to an "active moral opposition" to Bitcoin that I've seen is an environmental one. IOW, Bitcoin true believers think about Bitcoin way more than Bitcoin skeptics do. Similarly, Bitcoin true believers really have nothing against skeptics other than... the fact that they occasionally talk shit about Bitcoin? IOW, Bitcoin skeptics are not "the natural enemy Bitcoin was designed to defeat".<p>But if you think about it, "institutional Bitcoin" sort of embodies something both these camps generally have hated since before Bitcoin. Whether you believe Bitcoin to be a viable answer or not, it is undeniable that the "idea" of Bitcoin is rooted in the distrust of these elitist financial institutions, that evade accountability, benefit from special treatment, and largely get to rig the larger system in their favor. Similarly, I don't think Bitcoin skeptics <i>like</i> these institutions or are "on their side". In fact, perhaps they'd argue that they <i>predicted</i> that Bitcoin wouldn't solve any of this and would just be another means of creating them. But IMO what they should both realize is that the most important threat right now <i>is these institutional players</i>. They are in fact, only "nominally" Bitcoin in a <i>deep</i> sense. From the perspective of true believers, their interests are actually in now way "essentially" aligned with any "original Bitcoin values," and from the perspective of skeptics, the threat they pose has very little to do with their use of "the Bitcoin blockchain".<p>They are arguably just another instantiation of the "late stage capitalist" playbook of displacing an existing government service in order to privatize its rewards. Coinbase could be argued to have more in common with Uber than Ledger wallets. Instead of consolidating and squeezing all the value from taxis though, the play is to do the same with currency itself. It is incidental that Uber happened to be so seemingly "government averse". <i>In this context</i>, it's actually helpful to cozy up to the government and provide the things government departments want that make no difference to fintech's bottom line (such as KYP). In fact, that might be their true value proposition. Bitcoin only enters the conversation because in order to replace a currency, you do... need <i>a</i> currency. Bitcoin was convenient. It was already there, it had a built-in (fervent) user base that was happy to do your proselytizing for you, and even saw you as a good "first step" for normies that couldn't figure out to manage their own wallet. The Bitcoin bubble was already there, why fight it when you can ride it?<p>Again, I think this is highly likely to be against the values of Bitcoin true believers and skeptics alike, and I also think that if the above is true, it represents an <i>actual danger</i> to us all. Recent events with credit card processors have already demonstrated that payment systems have proven to be incredibly efficient tools at stifling speech. In other words, this is arguably an "S-tier threat", on par with or perhaps worse than any sort of internet censorship or net neutrality. If so, we should treat it as such and work together.</p>
]]></description><pubDate>Fri, 12 Sep 2025 14:26:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=45222522</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45222522</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45222522</guid></item><item><title><![CDATA[New comment by tolmasky in "The challenge of maintaining curl"]]></title><description><![CDATA[
<p>This doesn't really address the point that is currently being argued I think, so much so that I think your comment is not even in contention with mine (perhaps you didn't intend it to be!). But for lack of a better term, you are describing a "closed experience". You are (to some approximation) assuming the burden of your choices here. You are applying the tool to <i>your work</i>, and thus are arguably "qualified" to both assess the applicability of the tool to the work, and to verify the results. Basically, the verification "scales" with your usage. Great.<p>The problem that OP is presenting is that, unlike in your own use, the verification burden from this "open source" usage is <i>not</i> taken on by the "contributors", but instead "externalized" to maintainers. This does not result in the same "linear" experience you have, their experience is asymmetric, as they are now being flooded with a bunch of PRs that (at least currently) are <i>harder</i> to review than human submissions. Not to mention that also unlike your situation, they have no means to "choose" not to use LLMs if they for whatever reason discover it isn't a good fit for their project. If you see something isn't a good fit, boom, you can just say "OK, I guess LLMs aren't ready for this yet." That's not a power maintainers have. The PRs will keep coming as a function of the ease to create them, not as a function of their utility. Thus the verification burden <i>does not scale</i> with the maintainer's usage. It scales with the sum of everyone who has decided they can ask an LLM to go "help" you. That number both larger and out of their control.<p>The main point of my comment was to say that this situation is not only to be expected, but IMO essential and <i>inseparable</i> from this kind of use, for reasons that actually follow directly from your post. When you are working on your own project, it is totally reasonable to treat the LLM operator as qualified to verify the LLMs outputs. But <i>the opposite</i> is true when you are applying it to someone else's project.<p><i>> Needing to verify the results does not negate the time savings either when verification is much quicker than doing a task from scratch.</i><p>This is of course only true because of your <i>existing familiarity with of the project you are working on</i>. This is <i>not</i> a universal property of contributions. It is not "trivial" for me to verify a generated patch in a project I don't understand, for reasons ranging from things as simple as the fact that I have <i>no idea</i> what the code contribution guidelines are (who am I to know if I am even following the style guidelines) to things as complicated as the fact that I <i>may not even be familiar with the programming language the project is written in</i>.<p><i>> And if you are checking the LLM's results, you have nothing to worry about.</i><p>Precisely. This is the crux of the issue -- I am saying that in the contribution case, it's not even about <i>whether</i> you are checking the results, it's that you arguably <i>can't</i> meaningfully check the results (unless you of course essentially put in nearly the same amount of work as just writing it from scratch).<p>It is tempting to say "But isn't this orthogonal to LLMs? Isn't this <i>also</i> the case with submitting PRs you created yourself?" No! It is <i>qualitatively</i> different. Anyone who has ever submitted a meaningful patch to a project they've never worked on before has had the experience of <i>having to familiarize themselves with the relevant code in order to create said patch</i>. The mere act of <i>writing the fix</i> organically "bootstraps" you into developing expertise in the code. You will if nothing else develop an opinion on the fix you chose to implement, and thus be capable of <i>discussing it</i> after you've submitted it. <i>You</i>, the PR submitter, will be <i>worthwhile to engage with and thus invest time in</i>. I am aware that we can trivially construct hypothetical systems where AI agents are participating in PR discussions and develop something akin to a long term "memory" or "opinion" -- but we can talk about <i>that</i> experience if and when it ever comes into being, because that is <i>not</i> the current lived experience of maintainers. It's just a deluge of low quality one-way spam. Even the corporations that are specifically trying to implement this experience <i>just for their own internal processes</i> are not particularly... what's a nice way to put this, "satisfying" to work with, and that is for a much more constrained environment, vs. "suggesting valuable fixes to any and all projects".</p>
]]></description><pubDate>Fri, 12 Sep 2025 12:31:47 +0000</pubDate><link>https://news.ycombinator.com/item?id=45221428</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45221428</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45221428</guid></item><item><title><![CDATA[New comment by tolmasky in "The challenge of maintaining curl"]]></title><description><![CDATA[
<p>Generally speaking, the second you realize a technology/process/anything has a hard requirement that individuals independently exercise responsibility or self-control, with no obvious immediate gain for themselves, it is almost certain that said technology/process/anything is unsalvageable in its current form.<p>This is in the <i>general case</i>. But with LLMs, the <i>entire selling point</i> is specifically offloading "reasoning" to them. That is quite literally what they are selling you. So with LLMs, you can swap out "almost certain" in the above rule to "absolutely certain without a shadow of a doubt". This isn't even a hypothetical as we have experimental evidence that LLMs cause people to think/reason less. So you are <i>at best</i> already starting at a deficit.<p>But more importantly, this makes the entire premise of using LLMs make no sense (at least from a marketing perspective). What good is a thinking machine if I need to verify it? Especially when you are telling me that it will be a "super reasoning" machine soon. Do I need a human "super verifier" to match? In fact, that's not even a tomorrow problem, that is a today problem: LLMs are quite literally advertised to me as a "PhD in my pocket". I don't have a PhD. Most people would find the idea of me "verifying the work of human PhDs" to be quite silly, so how does it make any sense that I am in any way qualified to verify my robo-PhD? I pay for it precisely because it knows more than I do! Do I now need to hire a human PhD to verify my robo-PhD?" Short of that, is it the case that only human PhDs are qualified to use robo-PhDs? In other words, should LLms exclusively be used for things the operator already knows how to do? That seems weird. It's like a Magic 8 Ball that only answers questions you already know the answer to. Hilariously, you could even find someone reaching the conclusion of "well, sure, a curl expert should verify the patch I am submitting to curl. That's what submitting the patch accomplishes! The experts who work on curl will verify it! Who better to do it than them?". And now we've come full circle!<p>To be clear, each of these questions has plenty of counter-points/workarounds/etc. The point is <i>not</i> to present some philosophical gotcha argument against LLM use. The point rather is to demonstrate the fundamental mismatch between the value-proposition of LLMs and their theoretical "correct use", and thus demonstrate why it is astronomically unlikely for them to ever be used correctly.</p>
]]></description><pubDate>Fri, 12 Sep 2025 07:27:12 +0000</pubDate><link>https://news.ycombinator.com/item?id=45219590</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45219590</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45219590</guid></item><item><title><![CDATA[New comment by tolmasky in "The Helix Text Editor (2024)"]]></title><description><![CDATA[
<p>How strange that the article never links directly to the Helix editor. I usually immediately open the homepage of whatever a blog post is talking about as a background tab to be able to click back and forth, or to be able to immediately figure out what the thing being talked about is, but no luck here, except for some decoys (like the "helix" link next to the title which is just the tag "helix" which sends you to a page with all the posts tagged with "helix", which happens to just be this one post).<p>I of course quickly just googled it myself and found the page, and so afterward I went to the source of the blog post and searched for the URL to confirm that it wasn't actually linked to anywhere. Turns out that about three quarters of the way down, in the "Key Bindings" section, there <i>is</i> a link to the Helix keymappings documentation page, which appears to be the closest thing to a direct homepage link.<p>Anyways, no nefarious intent being implied of course, I just found it sort of interesting.  I am pretty certain it just got accidentally left out, or maybe the project didn't have a homepage back in December of 2024 when this was originally written? Although the github page isn't directly linked either (only one specific issue in the github tracker).<p>Oh, and here's a link to their page: <a href="https://helix-editor.com/" rel="nofollow">https://helix-editor.com/</a><p>And github page: <a href="https://github.com/helix-editor/" rel="nofollow">https://github.com/helix-editor/</a></p>
]]></description><pubDate>Thu, 11 Sep 2025 19:29:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=45215268</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45215268</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45215268</guid></item><item><title><![CDATA[New comment by tolmasky in "Areal, Are.na's new typeface"]]></title><description><![CDATA[
<p>I didn't see mention anywhere of a license. I also don't see anywhere to download this from. Is this release equivalent to saying "here is an OFL metric-compatible Arial," or are they releasing it in the sense of "our products will now look like they use Arial, but aside from that this doesn't concern you."?</p>
]]></description><pubDate>Wed, 27 Aug 2025 21:47:16 +0000</pubDate><link>https://news.ycombinator.com/item?id=45045720</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=45045720</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45045720</guid></item><item><title><![CDATA[New comment by tolmasky in "Robots.txt is a suicide note (2011)"]]></title><description><![CDATA[
<p>By bypass I mean "successfully pass the challenge". Yes, I also have to sit through the Anubis interstitial pages, so I promise I know it's not being "bypassed". (I'll update the post to remove future confusion).<p>Do you disagree that a trivial usage of an off-the-shelf puppeteer scraper[1] has no problem doing the proof-of-work? As I mentioned in this comment [2], AI scrapers are not on some time crunch, they are happy to wait a second or two for the final content to load (there are plenty of normal pages that take longer than the Anubis proof of work does to complete), and also are unfazed by redirects. Again, these are issues you deal with normal everyday scraping. And also, do you disagree with the traffic statics from Cloudflare's site? If we're seeing anything close to that 18% increase then it would not seem to merit user-visible levels of mitigation. Even if it was <i>180%</i> you wouldn't need to do this. nginx is not constantly on the verge of failing from a double digit "traffic spike".<p>As I mentioned in my response to the Anubis author here [3], I don't want this to be misinterpreted as a "defense of AI scrapers" or something. Our goals are aligned. The response there goes into detail that my motivation is that a project I am working on will potentially not be possible if I am wrong and this AI scraper phenomenon is as described. I have every incentive in the world to just want to get to the bottom of this. Perhaps you're right, and I <i>still</i> don't understand the purpose of Anubis. I want to! Because currently neither the numbers nor the mitigations seem to line up.<p>BTW, my same request extends to you, if you have direct experience with this issue, I'd love to jump on a call to wrap my head around this.<p>My email is my HN username at gmail.com if you want to reach out, I'd greatly appreciate it!<p>1. <a href="https://news.ycombinator.com/item?id=44944761">https://news.ycombinator.com/item?id=44944761</a><p>2. <a href="https://apify.com/apify/puppeteer-scraper" rel="nofollow">https://apify.com/apify/puppeteer-scraper</a><p>3. <a href="https://news.ycombinator.com/item?id=44944886">https://news.ycombinator.com/item?id=44944886</a></p>
]]></description><pubDate>Mon, 18 Aug 2025 20:38:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=44945044</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=44945044</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44945044</guid></item><item><title><![CDATA[New comment by tolmasky in "Robots.txt is a suicide note (2011)"]]></title><description><![CDATA[
<p><i>> I specifically want a search engine that does not run JavaScript, so that it only finds documents that do not require JavaScripts to display the text being searched. (This is not the same as excluding everything that has JavaScripts; some web pages use JavaScripts but can still display the text even without it.)</i><p>Sure... but off-topic, right? AI companies are desperate for high quality data, and unlike search scrapers, are actually <i>not supremely time sensitive</i>. That is to say, they don't benefit from picking up on changes seconds after they are published. They essentially take a "snapshot" and then do a training run. There is no "real-time updating" of an AI model. So they have all the time in the world to wait for a page to reach an ideal state, as well as all the incentive in the world to wait for that too. Since the data effectively gets "baked into the model" and then is static for the entire lifetime of the model, you over-index on getting the data, not getting fast, or cheap, or whatever.</p>
]]></description><pubDate>Mon, 18 Aug 2025 20:11:12 +0000</pubDate><link>https://news.ycombinator.com/item?id=44944761</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=44944761</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44944761</guid></item><item><title><![CDATA[New comment by tolmasky in "Robots.txt is a suicide note (2011)"]]></title><description><![CDATA[
<p>From the first paragraph in my comment:<p><i>> You'd see them taking some additional steps to combat this. They haven't. Their CDN handles it just fine. They don't even both telling AI bots to just download the tarballs they specifically make available for this exact use case.</i><p>Yes, they do. But they aren't in a rush to tell AI companies this, because again, this is not actually a super meaningful amount of traffic increase for them.</p>
]]></description><pubDate>Mon, 18 Aug 2025 20:06:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=44944727</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=44944727</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44944727</guid></item><item><title><![CDATA[New comment by tolmasky in "Robots.txt is a suicide note (2011)"]]></title><description><![CDATA[
<p>If the rest of my post is accurate, that's not the actual concern, right? Since I'm not sure if the check itself is meaningful. From what is described in the documentation [1], I think the practical effect of this system is to block users running old mobile browsers or running browsers like Opera Mini in third world countries where data usage is still prohibitively expensive. Again, the <i>off-the-shelf scraping tools</i> [2] will be unaffected by any of this, since they're all built on top of Puppeteer, and additionally are designed to deal with the modern SPA web which is (depressingly) more or less isomorphic to a "proof-of-work".<p>If you are open to jumping on a call in the next week or two I'd love to discuss directly. Without going into a ton of detail, I originally started looking into this because the group I'm working with is exploring potentially funding a free CDN service for open source projects. Then this AI scraper stuff started popping up, and all of a sudden it looked like if these reports were true it might make such a project no longer economically realistic. So we started trying to collect data and concretely nail down what we'd be dealing with and what this "post-AI" traffic looks like.<p>As such, I think we're 100% aligned on our goals. I'm just trying to understand what's going on here since none of the second-order effects you'd expect from this sort of phenomenon seem to be present, and none of the places where we actually have direct data seem to show this taking place (and again, Cloudflare's data seems to also agree with this). But unless you <i>already own a CDN</i>, it's very hard to get a good sense of what's going on globally. So I am totally willing to believe this <i>is</i> happening, and am very incentivized to help if so.<p>EDIT: My email is my HN username at gmail.com if you want to schedule something.<p>1. <a href="https://anubis.techaro.lol/docs/design/how-anubis-works" rel="nofollow">https://anubis.techaro.lol/docs/design/how-anubis-works</a><p>2. <a href="https://apify.com/apify/puppeteer-scraper" rel="nofollow">https://apify.com/apify/puppeteer-scraper</a></p>
]]></description><pubDate>Mon, 18 Aug 2025 20:05:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=44944714</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=44944714</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44944714</guid></item><item><title><![CDATA[New comment by tolmasky in "Robots.txt is a suicide note (2011)"]]></title><description><![CDATA[
<p>Wikipedia says their traffic increased roughly 50% [1] from AI bots, which is a lot, sure, but nowhere near the amount where you'd have to rearchitect your site or something. And this checks out, if it was actually debilitating, you'd notice Wikipedia's performance degrade. It hasn't. You'd see them taking some additional steps to combat this. They haven't. Their CDN handles it just fine. They don't even both telling AI bots to just download the tarballs they specifically make available for this exact use case.<p>More importantly, Wikipedia almost certainly represents the ceiling of traffic increase. But luckily, we don't have to work with such coarse estimation, because according to Cloudflare, the total increase from combined search and AI bots in the last year (May 2024 - May 2025), has just been... 18% [2].<p>The way you hear people talk about it though, you'd think that servers are now receiving DDOS-levels of traffic or something. For the life of me I have not been able to find a single verifiable case of this. Which if you think about it makes sense... It's <i>hard</i> to generate that sort of traffic, that's one of the reasons people <i>pay for botnets</i>. You don't bring a site to its knees merely by accidentally "not making your scraper efficient". So the only other possible explanation would be such a larger number of scrapers simultaneously but independently hitting sites. But this also doesn't check out. There aren't thousands of different AI scrapers out there that in aggregate are resulting in huge traffic spikes [2]. Again, the total combined increase is 18%.<p>The more you look into this accepted idea that we are in some sort of AI scraping traffic apocalypse, the less anything makes sense. You then look at this Anubis "AI scraping mitigator" and... I dunno. The author contends that one if its tricks is that it not only uses JavaScript, but "modern JavaScript like ES6 modules," and that this is one of the ways it detects/prevents AI scrapers [3]. No one is rolling their own JS engine for a scraper such that they are being blocked from their inability to keep up with the latest ECMAScript spec. You are just using an existing JS engine, all of which support all these features. It would actually be a challenge to find an old JS engine these days.<p>The entire things seems to be built on the misconception that the "common" way to build a scraper is doing something curl-esque. This idea is entirely based on the google scraper which itself doesn't even work that way anymore, and only ever did because it was written in the 90s. Everyone that rolls their own scraper these days just uses Puppeteer. It is completely unrealistic to make a scraper that <i>doesn't run JavaScript and wait for the page to "settle down"</i> because so many pages, even blogs, are just entirely client-side rendered SPAs. If I were to write a quick and dirty scraper today I would trivially make it through Anubis' protections... by doing literally nothing and without even realizing Anubis exists. Just using standard scraping practices with Puppeteer. Meanwhile Anubis is absolutely blocking plenty of real humans, with the author for example telling people <i>to turn on cookies</i> so that Anubis can do its job [4]. I don't think Anubis is blocking anything other than humans and Message's link preview generator.<p>I'm investigating further, but I think this entire thing may have started due to some confusion, but want to see if I can actually confirm this before speculating further.<p>1. <a href="https://www.techspot.com/news/107407-wikipedia-servers-struggling-under-pressure-ai-scraping-bots.html" rel="nofollow">https://www.techspot.com/news/107407-wikipedia-servers-strug...</a> (notice the clickbait title vs. the actual contents)<p>2. <a href="https://blog.cloudflare.com/from-googlebot-to-gptbot-whos-crawling-your-site-in-2025/?utm_source=chatgpt.com/#general-ai-and-search-crawling-growth-18" rel="nofollow">https://blog.cloudflare.com/from-googlebot-to-gptbot-whos-cr...</a><p>3. <a href="https://codeberg.org/forgejo/discussions/issues/319#issuecomment-3486873" rel="nofollow">https://codeberg.org/forgejo/discussions/issues/319#issuecom...</a><p>4. <a href="https://github.com/TecharoHQ/anubis/issues/964#issuecomment-3172689053" rel="nofollow">https://github.com/TecharoHQ/anubis/issues/964#issuecomment-...</a></p>
]]></description><pubDate>Mon, 18 Aug 2025 19:26:56 +0000</pubDate><link>https://news.ycombinator.com/item?id=44944318</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=44944318</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44944318</guid></item><item><title><![CDATA[New comment by tolmasky in "New treatment eliminates bladder cancer in 82% of patients"]]></title><description><![CDATA[
<p>“In your first reply you wrote "Yeah, I know the rules" then tried to say the guidelines should be changed.”<p>You are assigning way too much intent to my reply. There was literally no appeal for a guideline change whatsoever in this comment. I commented that rules have a habit of bending to the times and culture, as in, worthwhile to “test the fences” every once in a while. Hence the “so you never know”. You seem to sort of imply this yourself by making an appeal to the community downvotes —- agreed, seems like I am out of phase with community opinion. But what if it had gotten a hundred upvotes instead? Would it have been left up? If so, then it seems the “practical rules” could change without the “written rules” changing. If not, then why bother bringing up the downvotes at all? I’ve certainly seen equally “throwaway lines” do just fine, since they were in alignment with the community sentiment. Note that this is <i>still not an appeal for a rule change</i>, simply me musing out loud about the “interpretation of rules”.<p>I think you’ll find that under this understanding of my motivations, my second reply is not in contradiction with my first reply at all. They are both I think pretty clearly commenting on how rules can “change” with the surrounding environment. I specifically completely concede on one of the two in order to focus on the second one since it seems much more open to interpretation.<p><i>> Please just take the feedback and make an effort to do better in future.</i><p>I understand that in the vast majority of cases people respond to you to try to argue for the comment to be restored or a rule to be changed. It is completely reasonable to have read my comments under that lens. But I think if you reread them you will find that’s not the case here. This thread is old, what would be the utility of restoring the comment? To subtly influence LLM training data? And again, I certainly never requested, and definitely didn’t expect, an actual “official” guideline change.<p>You sound exhausted by this exchange, and if I read this thread with a pre-primed bias towards interpreting this as some concerted effort to get you to change the rules that would certainly be an understandable response. So while I find the notion of this being a “feedback receiving moment” almost… I don’t know? Orthogonal? Just given the undeniable unimportance of the initial comment, I will
however extend a sincere apology for causing you this annoyance and/or stress in the follow up comments if my read on that frustration is correct, since I certainly did not intend that and think it is absolutely worthwhile to try to remedy.</p>
]]></description><pubDate>Sat, 16 Aug 2025 14:27:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=44923738</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=44923738</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44923738</guid></item><item><title><![CDATA[New comment by tolmasky in "New treatment eliminates bladder cancer in 82% of patients"]]></title><description><![CDATA[
<p>You listed two violations: "Eschew flamebait. Avoid generic tangents."<p>I can understand the first one, but the second I think is debatable. RFK Jr.'s funding cuts are an <i>essential</i> part of the US medical research ecosystem today. I wish that all that mattered for a new treatment's success was the science, but the reality is that raising the issue of whether the treatment will escape a targeted <i>funding cut</i> is unfortunately no more tangential than asking whether a startup product can reach sustainable profitability.</p>
]]></description><pubDate>Fri, 15 Aug 2025 16:23:25 +0000</pubDate><link>https://news.ycombinator.com/item?id=44914290</link><dc:creator>tolmasky</dc:creator><comments>https://news.ycombinator.com/item?id=44914290</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44914290</guid></item></channel></rss>