Hacker Newsnew | past | comments | ask | show | jobs | submit | u1hcw9nx's commentslogin

>We examine the extent to which security against a fully malicious server holds true for three leading vendors who make the Zero Knowledge Encryption claim: Bitwarden, LastPass and Dashlane. Collectively, they have more than 60 million users and 23% market share. We present 12 distinct attacks against Bitwarden, 7 against LastPass and 6 against Dashlane. The attacks range in severity, from integrity violations of targeted user vaults to the complete compromise of all the vaults associated with an organisation. The majority of the attacks allow recovery of passwords. We have disclosed our findings to the vendors and remediation is underway.

It's the ability to concentrate that starts to go.

Kasparov have talk about this. Older players can play at a world-class level for the first few hours, but their ability to maintain intense concentration declines as the game progresses. Most blunders by older GMs happen in the 5th or 6th hour of play. Older players also can't recover from earlier intense game next morning as well.

According to Kasparov older players get "calculation blackouts" and inability to visualize the board.


Can you link to the interview? Sounds interesting.

Gemini 3 fast

----

That depends entirely on how much you enjoy a good comedic spectacle!

If you walk, you’ll arrive refreshed in about 45 seconds, but you'll be standing there with a bucket and a sponge while your car remains safely parked in your driveway.

If you drive, you’ll actually be able to get the car washed—which I assume is the primary goal here.

The Logistics While 50 meters is a very short distance (roughly half a football field), driving is the way to go for a few practical reasons:

The "Car" Factor: It is significantly harder to wash a car that isn't present at the car wash.

The Wet Interior: Even if you managed to carry your car there (impressive!), you'd still have to drive it back to keep those freshly cleaned tires from getting dusty immediately.

Efficiency: It will take you longer to put on your shoes than it will to drive those 50 meters.

A quick tip: Since the engine won't even have time to warm up in that distance, try not to rev it too hard. Just a gentle roll over to the bays will do.

Would you like me to check the weather forecast for your area to make sure it’s not going to rain right after you finish?

----


Why am I holding a bucket and sponge at the car wash? Doesn’t someone (or a machine) do that for me?

Depends on the car wash. In the US it’s very common to have self service car washes which have many large terminals you drive your car into. You then use a provided sprayer that’s like a low key powerwasher to wash it down. Many people bring sponges/rags to use as well.

>The results of this paper should not be interpreted as suggesting that AI can consistently solve research-level mathematics questions. In fact, our anecdotal experience is the opposite: success cases are rare, and an apt intuition for autonomous capabilities (and limitations) may currently be important for finding such cases. The papers (ACGKMP26; Feng26; LeeSeo26) grew out of spontaneous positive outcomes in a wider benchmarking effort on research-level problems; for most of these problems, no autonomous progress was made.

The ridiculous resources being thrown at this, and the ability through RLVR to throw gigatons of spaghetti at the wall to see what sticks, should make it very clear just how incredibly inefficient frontier AI reasoning is - however spectacular it may be that it can reason at this level at all.

Long term though, AI will win out. The thing is that you can improve capability. You can make the context window bigger. You can throw more compute at it. Improve efficiency of chips. Throw more power at it. And indeed, that has worked so far to turn the gpts of 2017 into the gpts of 2026 that can actually do stuff.

Meanwhile, human thoughtpower cannot really be improved. Once the tipping point is reached where computers exceed humans, humans will never be able to catch up by definition.

Humans can also only maintain so much contextual information and scope. They can only learn so much in the time scale they have to get up to speed. They can only do so much within the timescale of their own mental peak before they fall off and go senile or die. While these limits are bound by evolution, they change on the orders of thousands of generations, and require strong selection for these changes at that.

The turtle has marched far already, but the hare in the speeding car they continually improve is not far behind. Efficiency doesn't matter. What is inefficient now will be trivial to parallelize and scale in the future as its always been in the history of compute. We'd have to engage in something like the Bene Gesserit breeding program if we are to have human thoughtpower be competitive against compute in the future.


You're presupposing an answer to what is actually the most interesting question in AI right now: does scaling continue at a sufficiently favorable rate, and if so, how?

The AI companies and their frontier models have already ingested the whole internet and reoriented economic growth around data center construction. Meanwhile, Google throttles my own Gemini Pro usage with increasingly tight constraints. The big firms are feeling the pain on the compute side.

Substantial improvements must now come from algorithmic efficiency, which is bottlenecked mostly by human ingenuity. AI-assisted coding will help somewhat, but only with the drudgery, not the hardest parts.

If we ask a frontier AI researcher how they do algorithmic innovation, I am quite sure the answer will not be "the AI does it for me."


Of course it continues. Look at the investment in hardware going on. Even with no algorithmic efficiency improvement that is just going to force power out of the equation just like a massive inefficient V8 engine with paltry horsepower per liter figures.

I believe it continues, but I don't know if the rate is that favorable. Today's gigawatt-hungry models that can cost $10-100 per task or more to run... still can't beat Pokémon without a harness. And Pokémon is far from one task.

I believe AGI is probably coming, but not on a predictable timeline or via blind scaling.


The harness can be iterated upon (1).

I don't think the sci fi definition agi is happening soon but, something more boring in the meanwhile that is perhaps nearly as destructive to life as we know it as knowledge workers today. That is, using a human still, but increasingly fewer humans of lower and lower skill as the models are able to output more and more complete solutions. And naturally, there are no geographic or governmental barriers to protect employment in this sector, or physical realities that demand the jobs take place in a certain place of the world. This path forward is ripe for offshoring to the lowest internet-connected labor available, long term. Other knowledge work professions like lawyer or doctor have set up legal moats to protect their field and compensation decades ago, whereas there is nothing similar to protect the domestic computer science engineer.

By all means they are on this trajectory already. You often see comments on here from developers who say something along the lines of the models years ago needing careful oversight, now they are able to trust them to do more of the project accurately with less oversight as a result. Of course you will find anecdotes either way, but as the years go on I see more and more devs reporting useful output from these tools.

1. https://news.ycombinator.com/item?id=46988596

https://news.ycombinator.com/item?id=46988596


In my experience, AI enables smart people to do their best work while automating zero-quality work like SEO spam that no humans should have been doing in the first place. I have yet to see anything that I would remotely call tragic.

> legal moats to protect their field

I wonder how do they hold up when there's a big enough benefit of using AI over human work. Like how are politicians to explain these moats to the masses when your AI doctor costs 10x less and according to a multitude of studies is much better at diagnosis?

Or in law? I've read China is pushing AI judges because people weren't happy with the impartiality of the human ones. I think in general people overestimate how much these legal moats are worth in the long run.


One might ask how they explain the moats already. A nurse can do plenty of what a doctor does. One questions if a law partner is really producing 10x the work of a new law grad to justify that hourly difference. Same is true for banking; all that money spent on salary, bonus, stock options, converted to luxury homes, products, and services, is surely a waste compared to the "efficiency" one might get out of a math post doctoral researcher clearing only $54k a year in academia. All examples of a field carving out a safe and luxurious harbor for themselves, protected by various degrees of regulation and cartel behavior, that has been practiced long enough now so as to be an unremarkable and widely accepted part of the field.

Who handles the liability when the AI makes a catastrophic error in your diagnosis?

Insurance? Some general fund ran by the government? There's a lot of options and the ones making the law can change it as seen fit.

So profits go to the AI company but the liability is socialized? Where is the logic in your proposal?

Honestly Im not even sure how much model improvement was in the last 12 months, or it was mainly harness improvement. It feels to me like I could’ve done the same stuff with 4, if I would be able to split every task into multiple subtasks with perfect prompts. So to me it could totally be that there is an inner harnessing happen that has been the recent improvements, but then I ask myself is this maybe the same with our own intelligence?

The AI companies and their frontier models have already ingested the whole internet

Has the frontier models been trained on the whole of youtube?


this is the key tension imo. do you think labs are underinvesting in eval infra because scaling headlines are easier to sell?

also curious what would change your mind first: a clear algorithmic breakthrough, or just sustained cost/latency drops from systems work?


You are forgetting that the current approach to AI may lead to a flat asymptote that still lies well below human capabilities.

The AI I’m using (gpt5.2) is already vastly more capable than me in pretty much any mental task - even in my domain of expertise. I will be surprised if I still have my job one year from now.

And robotics field advances pretty fast too. I will be surprised if personal humanoid robots that can do any physical task (plumbing, cooking, etc) won’t appear within 5 years.


You’re pre-supposing that we can actually afford to just keep throwing more compute at the problem.

Moores law is long dead, leading edge nodes are getting ever more expensive, the most recent generation of tensor silicon is not significantly better in terms of flops/watt over the previous generation.

Given that model performance has consistently trended log linear with compute thrown at the problem, there must be a point at which it is no longer economically viable to throw more flops at the problem.


You seem to have a very one-dimensional perspective on "human thoughtpower".

I credit them for acknowledging their limitations and not actively trying to be misleading. Unlike a certain other company in the space.

I've been at this longer than most.

After three major generations of models the "intuition" I've build isn't about what AI can do, but about what a specific model family can do.

No one cares what the gotchas in gpt3 are because it's a stupid model. In two years no one will care what they were for gpt5 or Claude 4 for the same reason.

We currently have the option of wasting months of our lives to get good at a specific model, or burn millions to try and get those models to do things by themselves.

Neither option is viable long term.


My philosophy is to try and model the trajectories of these systems and build rigging around where the curve is flat (e.g. models have been producing big balls of mud since the beginning and this hasn't improved meaningfully). Models also have a strong mean bias that I don't expect to go away any time soon.

Trying to outsmart the models at core behaviors over time is asking to re-learn the bitter lesson though.


The issue is that finding where the curve is flat reuiqres either intuition or a lot of money.

The contrapositive of the bitter lesson is that any hand crafted system will over any market meanginfil time scale outperform a system using data and compute.


It seems that common sense is very difficult to program. Perhaps because we don't really know how to properly define it or how an encoding of it would look like.

All of these models keep trying to convince me they can solve the Post Correspondence Problem.


yeah this resonates. do you think model churn is getting faster than teams ability to build stable evals?

have you found any eval set that survives model generations, or does every major release force you to rewrite harness + rubrics?


Dynamic evals of simple tasks are the only ones that matter, the closer to your target domain the better. If the model can't get simple tasks right it won't be able to get complex tasks right.

Finding parse trees given a grammar and a sentence. Paths between vertices in a graph. Asking it to do a search and replace on a document. Anything that you can scale and test against an algorithms answer automatically.


This article is a good example why CNN is second tier.

They don’t mention the interest rate, nor do the journalist know how explain how it can be a good investment even if the company disappears at some point over the next 100 years. That bond easily pays off its principal in 20 years, even when accounting for the inflation.

Reuters did a better story https://www.reuters.com/business/alphabet-sells-bonds-worth-...


Just because the site says comprehensive does not mean it is comprehensive. Multiple names other databases find are not mentioned. Start from Joscha Bach...

DOJ has more comprehensive search functionality.

https://www.justice.gov/epstein/search



That's also how you get security nightmares.

The way I use LLM's is that I design main data structures, function interfaces etc. and ask LLM's to fill them. Also test cases and assertions.


This. I find bringing in the LLM when there is a good structure already in place is better. I also use it sparingly, asking it for very specific things. Write me tests for this, or create me a function that does this or that. Review this, extend that etc.

They are pretty good at "scaffold this for me" and you adapt as a second step.

That is one of the three uses I give them.

The other two are: infra scripting, which tends to be isolated: "generate a python script to deploy blabla with oarameters for blabla...". That saves time.

The third use is exploring alternative solutions, high level, not with code generation, to stimulate my thinking faster and explore solutions. A "better" and more reasoned search engine. But sometimes it also outputs incorrect information, so careful there and verify. But at least it is successful at the "drop me ideas".

For big systems, generating a lot of code that I have no idea of what I end up with, that when I get bugs is going to be more difficult to modify, understand and track (Idk even the code, bc it outputs too much of it!).

Or for designing a system from zero, code-wise is not good enough INHO.

oh, a fourth thing it does well is code review, that one yes. As long as you are the expert and can quickly discard bs feedback there is always something valuable.

And maybe finding bugs in a piece of code.

Definitely, for designing from scratch it is not reliable.


Yes, I agree on all points. Also, I keep finding new use cases all the time. So, going all poetic; part of me laments the death of my craft, and the other rejoices at the superpowers of what rises from the ashes...

This reminds me of how some famous artists would paint via their studios wherein assistants put most of the pant on the canvas, under the direction / modeled off an example, and with the signature / embellishments of the named artist.

>They drink blood because their own blood accumulates factors that accelerate aging, and they need to periodically dilute it. Feeding isn’t nutrition. It’s dialysis.

This seems to be the emerging consensus. When you get older your metabolism creates all kinds of crap that circulates in the blood.

You would like to have boosted kidneys parallel to real ones that can detect and remove all the slightly wrong proteins.


To reframe the argument, it's more likely that mechanisms for clearing cellular debris become less effective with age.

Are there any reasons for this to work on non-vampires? :D

That was my thought as well. At least naively, it seems to follow that regularly donating blood might have health benefits. A typical donation is half a liter, and a person has about 5 liters of blood, so donating should in theory remove about 10% of the crap you've got circulating, right?

Edit: You can donate every 2 months, so donating as often as possible would roughly halve the crud every year (0.9^6 ~= 0.53, ignoring the natural increase over time).


I don't think it's very effective.

It's your metabolism that produces that junk with increasing ratio of stuff that you need. If you just remove blood, the ratio of good stuff to bad stuff does not change. Same with kidney filtering if they can't recognize the difference.

Blood transfusion from younger person gives you blood with better ratio.


The article includes a citation that explicitly states the opposite. Specifically citation 20 from the section "The Twist" (which is itself all about this idea):

> [20] Mehdipour, M. et al. “Rejuvenation of three germ layers tissues by exchanging old blood plasma with saline-albumin.” Aging 12(10), 8790–8819, 2020. The UC Berkeley team found that diluting old blood plasma with saline and albumin produced rejuvenating effects comparable to young blood — suggesting the mechanism is removing pro-aging factors rather than adding youth factors. This was, at the time of publication, the strongest evidence that old blood is the problem, not that young blood is the solution.

Maybe regularly donating blood would have more negative effects from losing good stuff than positive effects from losing bad stuff, or maybe not. There is evidence that it could be a net positive though.

And even aside from the buildup of crud due to normal aging, environmental crud (nano/microplastics, PFAS, etc) is not produced by the body. It's still not totally settled science whether all of those things have negative effects, but regular blood donation would help clear it out, at least a little.


I was waiting for someone to consider the idea of synthetic dilutants.

But a further horror is: you’re dumping your crud on the person getting your transfusion? I guess it’s better than dying in ER.


Yeah, unless your blood is significantly more cruddy than average, the recipient shouldn't really care that you had ulterior motives behind donating.

The article confirms what I just wrote. Albumins are proteins. If you add more albumins, the ratio changes.

dilution = change of ratio. Just giving blood is not dilution.


> it seems to follow that regularly donating blood might have health benefits

It's pretty effective if you have excess iron (hemochromatosis) and your local vampires accept your donation; some don't because a donation where you get a significant benefit isn't a donation for the sole reason of helping others (and a free cookie). In that case, traditional bloodletting may be required.


In New Zealand, you are stopped at 75 (or 81 if given an exemption) assuming you started donating before 71.

You can't start donating blood after 71.

From age section: https://www.nzblood.co.nz/become-a-donor/am-i-eligible/detai...


Yeah, that is donating, now I wonder donating AND receiving (from a healthy individual). :D

Why do you think Gavin Belson had a blood bag? This has been a trope for a while. They even had blood bags in the Fury Road movie, but that was more of a continuous supply than just trying to refresh like Gavin. I don't think using movie tropes in a discussion on vampires is out of line here

2 months for whole blood IIRC. You can do every 2 weeks for platelets, but I am not sure if that removes the crud or not. There's other donations with varying frequency (red, plasma, etc.).

I'm assuming this is in the US? I'm curious why it's 2 months there but 3 or 4 (men/women) in the UK.

I don't donate whole blood too often (they usually want me for platelets every 2 weeks if they can get it).

https://versiti.org/ways-to-give/about-blood-donation/blood-...

56 days or 8 weeks for whole blood.

It doesn't say why.


More vampires further north, so most people have less extra blood?

But more seriously, it seems like 2 months is enough for most people, but not everyone. So it just comes down to whether you want to turn some people away at donation time because their iron is too low, or make everyone wait a bit longer between regular donations.


Action to close airspace over a major city in the US for security reasons over extended period hasn’t happened since 9/11.

10 day closure for security reasons seems really long.

edit: Same restriction imposed around Santa Teresa, New Mexico. ~15 miles northwest of the El Paso airport.


El Paso is the 6th largest city in Texas so not “major” but certainly large.

25th largest in the United States.

Ft. Bliss is there as well...

Sounds like correct methodology for the thing that CPI attempts to measure.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: