<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: varenc</title><link>https://news.ycombinator.com/user?id=varenc</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Wed, 21 Oct 2026 07:45:25 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=varenc" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by varenc in "Passkeys are not a trap"]]></title><description><![CDATA[
<p>If you lose your domain, you have bigger problems than just passkeys.  If you just used passwords, users would still have to somehow locate your new site and trust it with the password previously associated with your old site. Password managers won't input passwords from one domain onto a new domain.<p>As someone else said, you'd have to do an email blast and hope users trust the email blast as authentic to trust your new domain, and just someone phishing.<p>Loss of a domain is so catastrophic for trust that passkeys don't make it much worse.</p>
]]></description><pubDate>Sat, 17 Oct 2026 15:53:00 +0000</pubDate><link>https://news.ycombinator.com/item?id=50132174</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=50132174</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50132174</guid></item><item><title><![CDATA[New comment by varenc in "Passkeys are not a trap"]]></title><description><![CDATA[
<p>> Why are passkeys better?<p>Passkeys provide perfect protection from phishing attacks, since it's impossible to send a passkey to the wrong domain. That's a huge improvement over TOTP.<p>Re: it being confusing where they're stored, I agree. The solution is to make sure you store your passkeys in your cross-platform password manager. The experience can be confusing though. In Chrome I've found that by default when creating a new Passkey Chrome offers to store it first. But if I click cancel, I'm then given the option to store it in 1Password where I want it.</p>
]]></description><pubDate>Wed, 14 Oct 2026 15:42:39 +0000</pubDate><link>https://news.ycombinator.com/item?id=50089450</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=50089450</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50089450</guid></item><item><title><![CDATA[New comment by varenc in "Show HN: WallHop – 12ft.io is gone, so I built a replacement"]]></title><description><![CDATA[
<p>News site probably want to be accessible to all search engine crawlers, not just Google, and I bet some of them don't have the reverse DNS verification method.<p>But also, tons of news sites also only implement the paywall in client-side JS! This is so obviously easy to bypass it seems intentional, and they just don't care about the 'hackers'. Or perhaps they've know that people that are going to use tricks to access an article are very unlikely to pay for a subscription anyway.<p>(I wish I could just pay $1 on demand and read a paywalled article. I'd do it all the time, but I'm quite reluctant to sign up for any forever recurring subscriptions)</p>
]]></description><pubDate>Mon, 12 Oct 2026 02:05:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=50050423</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=50050423</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50050423</guid></item><item><title><![CDATA[New comment by varenc in "WallHop – 12ft.io is gone, so I built a replacement"]]></title><description><![CDATA[
<p>> ... it chains several bypass methods per request<p>I'm curious what are the techniques? I'm familiar with spoofing yourself as a Googlebot, or extracting the content directly when paywall enforcement is done in client-side JS only. But surely you need more tricks than that to get around WSJ or NYTimes.  Also, ironically, I assume archive.is's CAPTCHA would need bypassing to fall back to that. (but volume might be low enough you can do it with a few cookies you've established trust on)</p>
]]></description><pubDate>Sun, 11 Oct 2026 02:33:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=50039266</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=50039266</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50039266</guid></item><item><title><![CDATA[New comment by varenc in "WallHop – 12ft.io is gone, so I built a replacement"]]></title><description><![CDATA[
<p>> it doesn't have the recaptcha<p>Agreed that makes it quite nice! Though I wonder how long that will last, since I imagine archive.today is dealing with some problems that necessitated it.</p>
]]></description><pubDate>Sun, 11 Oct 2026 02:29:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=50039242</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=50039242</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50039242</guid></item><item><title><![CDATA[New comment by varenc in "No Man Is an Island"]]></title><description><![CDATA[
<p>For fun I looked up how Donne originally wrote it in 1624:<p>> No man is an <i>Iland</i>, intire of it ſelf; euery man is a piece of the <i>Continent</i>, a part of the <i>maine</i>; if a <i>clod</i> be waſhed away by the <i>Sea</i>, <i>Europe</i> is the leſſe, as wel as if a <i>Promõtory</i> were, as well as if a <i>Mannor</i> of thy <i>friends</i>, or of thine owne were; Any mans <i>death</i> diminiſhes mee, becauſe I am inuolued in <i>mankind</i>; and therefore neuer ſend to know for whom the <i>bell</i> tols; It tols for <i>thee</i>.<p>Italics are original. Weird chars are best attempts by LLM transcription. Still quite readable, but interesting how much spelling has changed/standardized. Because its prose, I think we feel more free to modernize it than if it was poetry.<p>scan of it as published in 1624: 
<a href="https://archive.org/details/bim_early-english-books-1475-1640_devotions-upon-emergent-_donne-john_1626/page/n401/mode/2up" rel="nofollow">https://archive.org/details/bim_early-english-books-1475-164...</a><p>and a more readable 1924 republish: <a href="https://archive.org/details/devotionsuponeme00donnuoft/page/98/mode/2up?ref=ol" rel="nofollow">https://archive.org/details/devotionsuponeme00donnuoft/page/...</a><p>It doesn't end on "It tolls for thee" or start on "No man is..". It keeps going in both direction, and no indication he every meant for this section to be pulled out into its own small piece the way it has.  Here's some of what comes after:<p>> ... It tolls for <i>thee</i>.  Neither can we call this a <i>begging of Miserie</i> or a <i>borrowing of Miserie</i>, as though we were not miserable enough of our selves, but must fetch in more from the next house, in taking upon us the <i>Miserie</i> of our <i>Neighbours</i>. Truly it were an excusable <i>covetousnesse</i> if wee did; for <i>affliction</i> is a <i>treasure</i>, and scarce any man hath <i>enough</i> of it....</p>
]]></description><pubDate>Sun, 11 Oct 2026 01:59:14 +0000</pubDate><link>https://news.ycombinator.com/item?id=50039079</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=50039079</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50039079</guid></item><item><title><![CDATA[New comment by varenc in "No Man Is an Island"]]></title><description><![CDATA[
<p>The whole John Donne meditation the title is referencing:<p><pre><code>    No man is an island,
    Entire of itself;
    Every man is a piece of the continent,
    A part of the main.
    
    If a clod be washed away by the sea,
    Europe is the less,
    As well as if a promontory were:
    As well as if a manor of thy friend's
    Or of thine own were.
    
    Any man's death diminishes me,
    Because I am involved in mankind.
    And therefore never send to know for whom the bell tolls;
    It tolls for thee
</code></pre>
(had to memorize it in High School, and its one of my favorites. It was written <i>over 400 years ago</i> and has aged quite well.)</p>
]]></description><pubDate>Fri, 09 Oct 2026 21:11:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=50026608</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=50026608</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=50026608</guid></item><item><title><![CDATA[New comment by varenc in "Claude Haiku 5.5"]]></title><description><![CDATA[
<p>decompilation doesn't trigger any safeguard refusals? I would have assumed it would but glad it doesn't.  Very cool and would also love to hear more.</p>
]]></description><pubDate>Wed, 07 Oct 2026 21:42:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=49999179</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49999179</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49999179</guid></item><item><title><![CDATA[New comment by varenc in "Turn off Apple Intelligence on macOS 27 and get its disk space back"]]></title><description><![CDATA[
<p>I believe if you have a much older iDevice that no longer supports the latest OS, they will keep releasing security updates for that device for a long time, which is good on them. But if you have a newer device, after awhile the only way to get security updates is a major version upgrade.  You luck out if your device happens to be old enough not support to newer iOS versions.</p>
]]></description><pubDate>Mon, 05 Oct 2026 02:02:26 +0000</pubDate><link>https://news.ycombinator.com/item?id=49959906</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49959906</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49959906</guid></item><item><title><![CDATA[New comment by varenc in "Turn off Apple Intelligence on macOS 27 and get its disk space back"]]></title><description><![CDATA[
<p>Sadly not updating the OS is very bad from a security perspective. Though it's frustrating that Apple rarely provides any sort of "security fix only" updates, and to fix security issues you just have to install all the new things at once.</p>
]]></description><pubDate>Mon, 05 Oct 2026 00:48:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=49959543</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49959543</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49959543</guid></item><item><title><![CDATA[New comment by varenc in "I was impressed by Jev, please explain why I shouldn't be"]]></title><description><![CDATA[
<p>I love horseback riding and do it all the time. I can't walk past an open field without wishing my horse Fawkes and I were cantering across it.<p>So when I heard about Jev, I was pretty excited. But as I learned more, I realized Jev can't ride horses, can't muck a stall, can't teach a flying lead change, and can't even reset a thrown shoe.<p>Maybe I'm doing it wrong, but I can't figure out why this exciting new thing doesn't work for my personal interest. Its lack of horseback riding support is a dealbreaker for me.</p>
]]></description><pubDate>Thu, 01 Oct 2026 03:22:21 +0000</pubDate><link>https://news.ycombinator.com/item?id=49917344</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49917344</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49917344</guid></item><item><title><![CDATA[New comment by varenc in "You said no MCP"]]></title><description><![CDATA[
<p>For Home Assistant, the MCP can enable the LLM to make changes without using up excessive tokens.<p>For example, the only way to make a change to an HA automation via the API is to POST a whole new copy of the YAML, even if changing one things.  The skill and HA MCP I use allows the LLM to use tools which make more precise changes without excessive context usage.<p>Certainly still works either way though. And of course your LLM instance could just roll its own tools to do the exact same thing.</p>
]]></description><pubDate>Thu, 01 Oct 2026 00:38:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=49916310</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49916310</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49916310</guid></item><item><title><![CDATA[New comment by varenc in "ChatGPT now knows what you do on other websites via ad collector"]]></title><description><![CDATA[
<p>For browsers that implement strict cookie partitioning, the privacy concern is moot.  With this, the cookie jar that's used when chatgpt.com is a 3rd party site is completely separate for the jar used on the 1st party site. So your chatgpt.com account can't be linked to your ad views.<p>Since this has been standard ad tech for awhile, browsers have reacted to this to implement cookie partitioning for exactly these privacy reasons.</p>
]]></description><pubDate>Sun, 20 Sep 2026 20:35:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=49779819</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49779819</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49779819</guid></item><item><title><![CDATA[New comment by varenc in "Android 17 is the first since 3.x to add new APIs without releasing to the AOSP"]]></title><description><![CDATA[
<p>> Google simply regrets android being open source.<p>Could Google backtrack on this if they wanted? If they suddenly decided to stop releasing public code updates, what would they be violating? I can guess: Anti-trust maybe. probable at least contractual commitments Or is there some stronger forcing function?</p>
]]></description><pubDate>Sat, 19 Sep 2026 03:36:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=49763081</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49763081</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49763081</guid></item><item><title><![CDATA[New comment by varenc in "Artificial intelligence now beats some of the best human forecasters"]]></title><description><![CDATA[
<p>Relatedly: I suspect LLMs are influencing baby names.  If you ask Claude or ChatGPT for its favorite baby names, you'll get baby names that right now are skyrocketing in terms of popularity.</p>
]]></description><pubDate>Thu, 17 Sep 2026 17:05:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=49743610</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49743610</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49743610</guid></item><item><title><![CDATA[New comment by varenc in "Introducing System One Models and Jev"]]></title><description><![CDATA[
<p>Congrats ! Really excited for the team.</p>
]]></description><pubDate>Wed, 16 Sep 2026 03:27:23 +0000</pubDate><link>https://news.ycombinator.com/item?id=49721766</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49721766</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49721766</guid></item><item><title><![CDATA[New comment by varenc in "Introducing System One Models and Jev"]]></title><description><![CDATA[
<p>The output tokens are just responses to your inputed questions and their probability. So relatively few output tokens. No unstructured text back in the response.</p>
]]></description><pubDate>Wed, 16 Sep 2026 01:16:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=49721019</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49721019</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49721019</guid></item><item><title><![CDATA[New comment by varenc in "Introducing System One Models and Jev"]]></title><description><![CDATA[
<p>I think the trouble is that Typesafe APIs don't fit into the normal OpenAI-style API that every other regular LLM provider users. You're not just providing unstructured text and getting unstructured text back. It would take a different request and response format than every other model on Open Router. Though you could shoe-horn it in some way, it'd be hacky.<p>But agreed it'd be very useful to see it deployed on other hubs, and it seems worth it to provide the bespoke API format. Perhaps Typesafe's API will end up becoming the standard for a new type of structured model, the way OpenAI's API did.</p>
]]></description><pubDate>Wed, 16 Sep 2026 01:10:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=49720981</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49720981</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49720981</guid></item><item><title><![CDATA[New comment by varenc in "I'm being cyberattacked by Tesla, Inc"]]></title><description><![CDATA[
<p>I'm curious about your use of agents for security bug bounties. Do you use self hosted models? GLM 5.2? Do the economics of self-hosting make it worth it? Or if you use 3rd party hosted models, don't you run into safeguards that try to prevent hacking? (unless convincing them it's a genuine ethical bug bounty program works, but it doesn't in my experience)</p>
]]></description><pubDate>Sun, 13 Sep 2026 23:19:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=49689773</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49689773</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49689773</guid></item><item><title><![CDATA[New comment by varenc in "The Deathray: A simple way for an untrusted site to freeze a Mac"]]></title><description><![CDATA[
<p>> notice they have a dom.webgpu.blocked-domains with the sole entries being "easyeda.com,*.easyeda.com", I wonder what that's about?<p>I found this issue: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1980392" rel="nofollow">https://bugzilla.mozilla.org/show_bug.cgi?id=1980392</a>
and commit: <a href="https://phabricator.services.mozilla.com/D262053" rel="nofollow">https://phabricator.services.mozilla.com/D262053</a><p>It looks like per-domain WebGPU blocking was added exclusively just for easyeda.com !<p>Haven't read it all, but the story seems to be that EasyEDA's WebGPU usage was broken because it relies on some aspects which Firefox hasn't implemented yet. So they made this blocklist to get Firefox to behave as if it lacked WebGPU support completely on this domain, which makes EasyEDA fallback to some other non-broken version. Maybe they couldn't get in touch with EasyEDA directly, since it seems far easier to have them just disable WebGPU for some known versions of Firefox.</p>
]]></description><pubDate>Fri, 11 Sep 2026 02:15:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=49652777</link><dc:creator>varenc</dc:creator><comments>https://news.ycombinator.com/item?id=49652777</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49652777</guid></item></channel></rss>