Hacker News: wky

New comment by wky in "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"

wky — Fri, 30 Oct 2026 14:36:58 +0000

Even more confusing is apparently Cursor Marketplace is OpenVSX + their own proxy to add extensions on top[0], so there are at least two possible cases:

1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it

2. The compromised version was on Cursor's proxy, not OpenVSX itself

[0] https://cursor.com/help/customization/extensions

New comment by wky in "OpenAI agent hacked Australian government website, PM says"

wky — Thu, 24 Sep 2026 14:52:00 +0000

“Rogue uranium escapes from Chornobyl reactors.”

New comment by wky in "The GitHub wiki is an anti-pattern (2022)"

wky — Wed, 23 Sep 2026 14:57:11 +0000

GitHub is pretty good about editing on the web. Markdown files can be edited straight from github.com. On desktop you can hit the period key to directly open the repo in vscode.dev. Technically on mobile you can change github.com to github.dev to do the same, though the editing experience is worse than directly editing on GitHub.

New comment by wky in "Mistral X Mozilla: Private, Multilingual AI Browsing"

wky — Wed, 16 Sep 2026 14:09:00 +0000

You can control this in the settings:

    - Learn from chats in Smart Window
    - Learn from browsing in Classic and Smart Windows

New comment by wky in "Apple Reference Image: A New Approach for Verified Photography"

wky — Wed, 16 Sep 2026 04:56:02 +0000

Edit^2: On triple reread it sounds like the first pass ("Image Capture") sends the image metadata hash to be timestamped, whereas the second pass (Reference Image Development) sends the image itself but is not what actually creates the timestamp attestation. According to Apple[0][1] it sounds like the second pass (development) only happens when the reference image is actually viewed, which means that your image isn't sent if you never view the reference image?

[0] https://support.apple.com/guide/iphone/view-reference-images...

[1] https://www.apple.com/legal/privacy/data/en/reference-image/

> When you take a photo in Reference mode after tapping Reference Mode, your device will include reference image information in the photo’s metadata. If you then view that photo and tap the Reference badge on your iOS device or click it on your Mac, the device will send the raw photograph, metadata about the photograph like the sensor’s signatures and the time frame in which the photo was captured, as well as the sensor’s unique hardware identifiers to Private Cloud Compute.

Edit: On reread it seems they do in fact send the actual photographic data to PCC, which I presume has some reason over signing metadata on-device? Original mistaken post is below for transparency.

You can always not use the reference image mode, and according to the article you send a hash of the signature of the photograph, so all they would know is you took a photograph in reference image mode at some point in time before the request.

New comment by wky in "Apple Reference Image: A New Approach for Verified Photography"

wky — Wed, 16 Sep 2026 04:40:36 +0000

The timestamp system seems like it provides more benefit than signing the image data itself, at least in terms of difficulty to fake. As long as rolling back the stored timestamp token is prevented, I would have to find a phone that never updated its timestamp after the time I want to fake. Of course you could potentially find a phone that last connected to Apple's servers with a plausible timestamp. Even then the upper bound of when it signs the photo after reconnecting to the internet will raise eyebrows if you take too long to find the phone and fake the photo, so it effectively raises the bar to having to take the fake photo roughly simultaneously with the time the event purportedly took place anyway.

New comment by wky in "Show HN: Art – draw one stroke, let symmetry complete it"

wky — Thu, 10 Sep 2026 14:16:37 +0000

This reminded me of such good memories of playing with http://weavesilk.com/. Nice to see someone with a similar concept.

New comment by wky in "What algorithm did Windows XP use to choose your initial user picture?"

wky — Thu, 10 Sep 2026 13:58:01 +0000

A mentally simpler, though slightly biased algorithm is for each item, randomly generate a uint64 (arbitrary bit size) and switch to the new item if and only if the number generated is greater than or equal to all previously seen numbers. The end result is equivalent to randomly generating a number for each item and picking the item with the largest associated number.

New comment by wky in "My practical approach to surfing the web safely"

wky — Mon, 07 Sep 2026 22:09:10 +0000

Is there an advantage over just --guest?

New comment by wky in "Authorization terminology is a mess: Let's fix it"

wky — Fri, 04 Sep 2026 15:08:07 +0000

What I find strange about RFC2119 is technically RFC8174 amends it, yet the amended text never seems to be used.

New comment by wky in "Six curl CVEs after OpenAI and Anthropic came back with zero"

wky — Wed, 02 Sep 2026 14:48:04 +0000

It wouldn’t surprise me if AISLE uses many different providers’ models, and what’s holding back OpenAI and Anthropic is only using first-party models. Just because OpenAI and Anthropic have arguably the strongest models overall doesn’t mean their models are the strongest at finding any given class of vulnerability or lead to follow.

New comment by wky in "P99 0 ms* autocomplete for 240M domain names"

wky — Mon, 31 Aug 2026 15:02:22 +0000

> If supported by a user agent, this event MUST be dispatched when a key is pressed down [...]

https://w3c.github.io/uievents/#event-type-keypress

New comment by wky in "P99 0 ms* autocomplete for 240M domain names"

wky — Mon, 31 Aug 2026 06:31:17 +0000

This raises the question of why real life buttons and virtual buttons behave differently. My unsubstantiated guess is that clicks act on release to give the opportunity to slide off the button to abort, and/or because the button would disappear while pressing if it ex. submits a form.

New comment by wky in "P99 0 ms* autocomplete for 240M domain names"

wky — Mon, 31 Aug 2026 06:18:05 +0000

Holding a key would indeed require both on key down and up. I'd still argue that handling rerender on key down (or to fully match whatever OS/browser semantics, oninput) makes more sense than key up. Pressing Ctrl+V for example produces feedback as soon as "V" is pressed, not when Ctrl and/or V is released.

Interestingly Ctrl+V on OP's website does update immediately when Ctrl+V is pressed.

New comment by wky in "P99 0 ms* autocomplete for 240M domain names"

wky — Mon, 31 Aug 2026 05:01:12 +0000

They do that, yet proceed to kneecap the perceived latency by delaying the render.

> And on keyUp (the user releases the key), we render the suggestions.

New comment by wky in "P99 0 ms* autocomplete for 240M domain names"

wky — Mon, 31 Aug 2026 04:34:18 +0000

The perceived latency starts from keydown, not keyup. Redefining latency to start at keyup reduces measured latency, not perceived latency, and delaying the visual display to keyup makes perceived latency strictly worse, not better. Even sticking with the keyup definition, just displaying the result as soon as it is available gives the possibility of negative (defined) latency.

New comment by wky in "Show HN: Needle2: 14MB agentic LLM for phones, wearables, smart home and robots"

wky — Tue, 11 Aug 2026 15:02:55 +0000

Specifying units seems to be unreliable; I tried adding a description to the set_thermostat temperature:

    "temperature": {
      "type": "number",
      "description": "degrees Fahrenheit"
    },

Set the living room temperature to 70 degrees Celsius

    {
      "function_calls": [
        {
          "name": "set_thermostat",
          "arguments": {
            "room": "living room",
            "temperature": 70,
            "mode": "cool"
          }
        }
      ],
      "confidence": 0.6045
    }

Set the living room temperature to 70 degrees Fahrenheit

    {
      "function_calls": [
        {
          "name": "set_thermostat",
          "arguments": {
            "room": "living room",
            "temperature": 70,
            "mode": "heat"
          }
        }
      ],
      "confidence": 0.4536
    }

Set the living room temperature to 70 degrees

    {
      "function_calls": [
        {
          "name": "set_thermostat",
          "arguments": {
            "room": "living room",
            "temperature": 70
          }
        }
      ],
      "confidence": 0.8517
    }

Trying "in degrees Fahrenheit" for the tool description had similarly counterintuitive confidences.

Edit: to be clear, the counterintuitive behavior is that the confidence ended up higher for the wrong units.

New comment by wky in "Show HN: Needle2: 14MB agentic LLM for phones, wearables, smart home and robots"

wky — Tue, 11 Aug 2026 14:50:08 +0000

Considering it as a classification problem, you could use a representative set of example queries, feed them to this model, then ask a "smart" language model to assess each query + result for whether the result is actually correct. Then you have a dataset you can compute FPR and FNR for any given threshold, and score based on the context, ex. turning the lights on or off is a lot less important if it is right compared to whether your door is locked. You could even pick it based on the tool call itself: Low threshold for locking the door, high threshold for unlocking the door.

New comment by wky in "How Blackwing Pencils are Made [video]"

wky — Mon, 10 Aug 2026 14:43:47 +0000

The main thing that helps with lead breakage is a mechanical pencil with a sliding nose cone/tip. Even finer lead becomes fairly reliable as long as it is protected against sideways pressure. My personal favorite is the Kuru Toga Advance 0.3mm, though a larger lead size and a model purpose-built for break-resistance would be better if tip breakage is the main concern.

New comment by wky in "The Difference Between a Button and a Link"

wky — Wed, 29 Jul 2026 01:48:04 +0000

Additionally, the proposal of button actions is for the opposite purpose, when you want to avoid sending the form data when the button is pressed.