Hacker News: unddoch

New comment by unddoch in "Azure's Weakest Link – Five Full Cross-Tenant Compromises"

unddoch — Sun, 01 Nov 2026 11:30:48 +0000

I am a service provider. I have an Azure app registered so that clients can connect my app to their Azure environment.

Client A connected their Azure env to my service. Now an attacker creates a different tenant at my service and goes through the integration flow. Then he sends a request to my callback that says "admin consent configured for client A's tenant" and wants to steal Client A's data. How do I protect against that? Should I validate that the user who started the flow belongs to the same Azure tenant id? In itself it's not enough, what if it's just a random user without actual permissions to go through admin consent? What if a client legitimately has multiple tenants in my service that need to connect to the same azure tenant?

New comment by unddoch in "Azure's Weakest Link – Five Full Cross-Tenant Compromises"

unddoch — Fri, 30 Oct 2026 16:09:53 +0000

If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?

The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.

New comment by unddoch in "How the Claude Code team does code review"

unddoch — Sat, 17 Oct 2026 09:31:22 +0000

It needs to gather a bunch of inputs and feed into the remote GPUs correctly and as efficiently as possible. Lots of room to optimize under the constraints that users love cheap tokens, demand a fair billing structure, and want responsiveness and low latency.

New comment by unddoch in "OpenAI Withdraws 3 Math Papers"

unddoch — Thu, 08 Oct 2026 14:20:00 +0000

They literally proved the UGC?

New comment by unddoch in "It may soon be possible to create "mirror life""

unddoch — Wed, 07 Oct 2026 17:17:40 +0000

Being of the opposite chirality doesn't magically make antibodies pass through you. Antibodies can and do bind molecules of all sizes and chiralities.

New comment by unddoch in "It may soon be possible to create "mirror life""

unddoch — Wed, 07 Oct 2026 17:14:44 +0000

I find it really hard to believe that you can make a whole organism that doesn't have any molecules that can be targeted by an antibody. And if you can do that then why go through mirror life anyway?

A reasonable argument is that mirror proteins will evade the usual degradation+antigen presentation pipeline and this will make efficient adaptive response more difficult, or that the innate immune reaction will not be enough to recruit adaptive response. But surely it's not impossible. And if we ever get to this point I'm very optimistic that we would have a good way to vaccinate against this.

New comment by unddoch in "It may soon be possible to create "mirror life""

unddoch — Wed, 07 Oct 2026 13:08:48 +0000

I really doubt a "mirror life" bacteria would be "hidden" from the immune system. Antibodies should have enough search space to be able to detect and neutralise such bacteria?

New comment by unddoch in "Sharing AI progress in mathematics"

unddoch — Wed, 07 Oct 2026 05:43:51 +0000

Knowing is the easy part. An effective cure for cancer will probably be a procedure where you get your tumors sequenced, an AI model considers the unique genetic context and creates a specific treatment. Think CAR-T cell therapy or mRNA vaccines. Then this needs to be manufactured.

All of this means you will need to be rich or have your country invest lots of money into health care systems. In a world where humans don't provide economic value anymore, why would that be?

New comment by unddoch in "The AI boom is making the cheapest smartphones disappear"

unddoch — Tue, 06 Oct 2026 05:36:23 +0000

Similarly, data center loans are starting to make cheap mortgages disappear.

I'm Calling for a Pause in the Development of the Universal Bone Dissolver

unddoch — Tue, 06 Oct 2026 05:34:11 +0000

Article URL: https://www.theatlantic.com/newsletters/2026/10/ai-slowdown-bone-dissolver/688854

Comments URL: https://news.ycombinator.com/item?id=49974591

Points: 1

# Comments: 0

New comment by unddoch in "How did Rosalind Franklin miss the helix in her iconic DNA image? She didn't"

unddoch — Mon, 05 Oct 2026 19:52:07 +0000

New comment by unddoch in "I quit OpenAI because its culture is broken"

unddoch — Sun, 04 Oct 2026 15:53:04 +0000

If you don't like what humans are doing to each other using 20th century warfare methods, consider what they might do with superintelligent AI? Worst places to live in are usually countries fighting civil wars.

New comment by unddoch in "Responsible Release of AI-Generated Mathematics"

unddoch — Wed, 30 Sep 2026 06:23:36 +0000

If youre going to spend 10 million dollars on 10000 agents trying to solve some important maths problem I think it's reasonable to ask for some grants to help digest whatever they came up with. Or you could hire mathematicians and do it in-house, but I guarantee you grants to PhD students are cheaper than silicon value salaries.

New comment by unddoch in "Responsible Release of AI-Generated Mathematics"

unddoch — Wed, 30 Sep 2026 05:17:26 +0000

For every important match problem solved by AI, without mathematicians we wouldn't know about the existence and importance of the problem.

Famous mathematical conjectures are social constructs, formed by decades of even centuries of attention given to them by members of the math community. Without it, the danger is that future math "progress" will be reduced to generating tables of Lean statements and a probable/unprovable bit generated by AI.

New comment by unddoch in "Sonnet 5.5"

unddoch — Mon, 28 Sep 2026 20:53:30 +0000

I think they are trying now to to bake CI awareness into Claude Desktop, didn't use it yet.

But meanwhile we also have the scripts - one script to watch CI, one script to fetch comments (without dumping raw graphql into the agent), etc etc. Can't wait for this phase to end already

New comment by unddoch in "The Copilot+ PC brand is dead"

unddoch — Mon, 28 Sep 2026 05:41:22 +0000

I'm still so mad about Intel and AMD and Microsoft colluding together to remove sleep mode. Horrible for battery life, unfixable, but Microsoft says they need to be able to wake up your laptop every hour.

New comment by unddoch in "Claude Opus 5.5"

unddoch — Tue, 22 Sep 2026 17:27:40 +0000

It is hilarious to me that in the examples they show side by side Opus 5.5 still uses 4 times more words than it needs to use. IME, if you eyeball how many words the thing they're trying to say actually needs, and tell them to use only this many words, they become excellent communicators. I assume something about Anthropic's grader for writing just really wants to tick all its tidy tiny boxes of information the models need to cite. It's terrible.

New comment by unddoch in "Dark Age"

unddoch — Sun, 20 Sep 2026 06:15:53 +0000

Yes. Much more than a bioengineered virus or an out of control terminator, I'm just worrying that governments will feel forced to direct their money to AI capital and away from humans. Why invest billions in undergrad programs when you can build a new data center? Why increase teacher wages when you can buy electricity for better ROI?

New comment by unddoch in "Global bond yields hit 2008 highs, raising stakes for big borrowers"

unddoch — Tue, 15 Sep 2026 18:46:59 +0000

Your local American tariffs can hardly explain a global rise in long term yields. The Iran war isn't going great economically but doesn't explain thks. If anything the Russia-Ukraine war has had a bigger influence.

New comment by unddoch in "Global bond yields hit 2008 highs, raising stakes for big borrowers"

unddoch — Tue, 15 Sep 2026 15:27:24 +0000

It becomes clearer to more people that it's impossible to predict the future shape of the global economy due to AI.

The more clear it is, the cheaper 30 year bonds become.