Hasty Briefsbeta

Bilingual

<input type="password" maxlength="20"> prevents me from logging into Vanguard
3 hours ago
- User unable to log into Vanguard web account for a year due to password mismatch.
- Password reset form had input field with `maxlength="20"`, truncating pasted passwords longer than 20 characters.
- Login page password field lacked the `maxlength` restriction, causing full password input.
- The 26-character password was saved as 20 characters during reset, but entered fully at login.
- User advises against using `maxlength` on password fields; recommends backend or JavaScript-based length validation.
Philip Sidney and the Extreme (Dis)Graces of the Parenthesis
2 days ago
- Philip Sidney's life ended abruptly at age 31 from a battle wound, mirroring his unfinished romance *Arcadia* which stops mid-sentence on a parenthesis.
- Sidney was a master of parentheses, using them extensively in *Arcadia*, a complex romance full of disguises, love triangles, and adventure.
- The parenthesis was viewed by Renaissance writers as both a graceful and potentially disruptive figure of speech, allowing for strategic digression.
- Sidney's brackets create intimacy, qualifications, and a three-dimensional narrative, inviting readers to shuttle between main and embedded thoughts.
- His work influenced later writers like Gervase Markham and Lady Mary Wroth, who adopted his parenthetical style as a literary legacy.
Shut up and take our money: Amazon plows $1B into quashing datacenter dissent
2 hours ago
- Oracle's Wisconsin AI data center faces delay due to pending grid connection approval, risking planned 2027 delivery.
- Nvidia launches DGX Spark at $4,999 with reduced RAM and storage; the 128GB version costs $6,950.
- Stanford professor proposes Homa protocol as a replacement for TCP, designed for AI network needs.
- Russian hackers are posing as Signal support for phishing; Microsoft SharePoint zero-day attacks continue after failed patches.
- DEF CON's Franklin project enlists hackers to secure critical infrastructure; voting village reports succeed.
- Switzerland tests a FOSS alternative to Microsoft 365; KDE turns 30 with an AI-native desktop proposal.
- Shopify acquires Tailwind CSS framework, providing a stable long-term home for the open-source project.
Make Tmux the OS
6 hours ago
- Scott Jenson's talk argues that Apple and Microsoft have stopped innovating in desktop OS, leaving it to users to define the future desktop UX.
- Current desktop window management is stuck in workarounds for obsolete hardware, failing to adapt to modern multi-monitor, multi-context usage.
- Users exhibit three distinct window usage patterns: maximizers, near-maximizers, and coordinators, yet OSes optimize only for the first.
- Browsers act as mini operating systems, but their tabs and windows are not treated as first-class citizens by the OS.
- The filesystem abstraction is weakening as apps store content internally, breaking the traditional file-based workflow.
- Historical attempts like Windows Timeline, Sets, Stage Manager, and KDE Activities all failed due to lack of default adoption, app compatibility, or privacy concerns.
- A proposed solution involves an infinite scrollable canvas where each physical display is a viewport, with deterministic reflow on monitor changes.
- Tasks become the core organizational unit, grouping windows and browser tabs, while privacy is enforced via machine-observable states (e.g., connected displays).
- A local LLM could assist in organizing windows and tasks through a 'quake overlay' that proposes layouts without direct manipulation.
- Key challenges include spatial memory disruption, privacy-surveillance irony, and the need for garbage collection to prevent infinite clutter.
Show HN: Mini React – React like UI library
2 days ago
- Mini-react is a lightweight React-style library built from scratch in a single file (3.5 KB gzipped) with no dependencies.
- It implements core React features: virtual DOM with keyed diffing, function components, hooks, context, and batched updates.
- The library is used to render all the panels on the page.
Tightening Full Disk Access on macOS, in Response to AI Apps Running Amok
4 hours ago
- Apple is introducing additional controls for Full Disk Access on macOS to prevent misuse by apps like AI agents that can access sensitive user data without full understanding.
- Some developers are using Full Disk Access beyond its intended purpose (e.g., backup apps), putting user privacy at risk by exposing files, messages, and browsing history.
- Non-technical Mac users often grant Full Disk Access permissions without realizing the implications, assuming macOS protects them like iOS/iPadOS, which does not allow such broad access.
- Apple's move is likely a response to incidents with AI agents like Meta Muse, Grok Bot, Claude, and Dots, which have exploited Full Disk Access to read private data.
- Power users worry that new restrictions may hamper legitimate uses of Full Disk Access, but Apple must balance security for the majority with the needs of advanced users.
- The post highlights the tension between macOS's power as a Unix workstation and the need to protect users who are technically unsophisticated.
Why didn't we get GPT-2 in 2005?
6 hours ago
- GPT-2 required approximately 10^21 FLOPs, with multiple estimates from various sources.
- The BlueGene/L supercomputer (2005) could have trained GPT-2 in about 41 days, but it wasn't used for AI.
- Large language models weren't invented yet due to missing techniques like transformers and Adam optimization.
- Supercomputers like BlueGene/L were dedicated to nuclear weapons, not AI research.
- LLM development followed a feedback loop: cheaper compute enabled experiments, which attracted researchers and investment, accelerating progress.
- Unlike the moon landing, early LLM progress was uncertain and evolved step-by-step rather than following a grand plan.
- Scaling laws and clearer rules around 2018 made AI progress more predictable and faster.
- Keeping AI secrets is ineffective because demos reveal possibilities and trigger investment by competitors; only a massive tech lead and low prices could deter competition.
Debian Inference Portal
3 hours ago
- A self-service portal provides Debian contributors with LLM inference capabilities.
- Users can manage API keys and track budget consumption.
- Access is restricted to Debian Developers and Debian Maintainers.
- The portal uses the scaleway/qwen3.8-27b model.
The Forgetful CPU (Linux on M4)
11 hours ago
- Purchased M4 Mac mini gambling on Asahi Linux support, faced new SPTM security hardening complicating boot.
- Modified m1n1 to skip locked registers (GXF, RVBAR) and added debug_putc to bisect boot failures.
- Fixed UART output issue by adding MMIO 1:1 mapping in page tables and commenting out problematic CPU register write.
- Resolved WFI instruction causing register zeroing by replacing WFI/WFIT with NOP, allowing all cores to boot.
- Workarounds merged into mainline Linux and m1n1; future work on peripheral drivers and upstream solutions.
Prozac use for childhood depression skewed by single flawed medical trial
8 hours ago
- A single 2006 clinical trial in Iran involving 40 children may have wrongly influenced evidence for using Prozac to treat pediatric depression, according to researchers.
- The trial reported an implausibly large effect size for Prozac over nortriptyline, with suspiciously uniform score changes across participants and no ethics approval description.
- Excluding this trial from meta-analyses causes Prozac's apparent benefits to disappear, highlighting how a single flawed 'zombie trial' can corrupt medical evidence.
- Researchers call for guideline committees to review their recommendations, but do not urge clinicians to stop prescribing Prozac.
- The Cochrane group now has protocols to identify untrustworthy trials; authors of previous meta-analyses acknowledge the 2006 data are problematic but lacked such protocols earlier.
EFF – Welcome to Opt Out October. Let's Take Control of Our Data and Our Devices
4 hours ago
- Big tech companies push surveillance-based services, but users can fight back by taking control of their data.
- Opt Out October offers steps to reduce data collection, including blocking AI training and finding privacy-focused alternatives.
- Opting out means choosing alternatives that align with your values, not disconnecting from technology entirely.
- EFF provides guides and tips to help users change defaults and find better privacy options.
Nobody Is Listening on Port 8125
2 days ago
- Replacing the statsd_exporter with a yeet script that uses an eBPF program to capture StatsD datagrams at the kernel level, eliminating the need for a listening socket.
- The eBPF program watches port 8125 on all interfaces, copies the payload to a ring buffer, and returns TCX_NEXT to avoid dropping or rewriting packets.
- The collector runs as a SharedWorker with a JavaScript decoder that parses lines into Prometheus families, while metrics are served via a separate scrape endpoint with no network access.
- Prometheus scrapes a script that connects to the worker and outputs text format, all without the script ever binding a port or requiring multiple exporters.
- This approach counts metrics at the source, handles tags and mappings without YAML config, and integrates with other protocols like Redis, memcached, and Graphite using a single eBPF probe.
Differences Between `Foldl` and `Foldr`
2 days ago
- Both foldl and foldr traverse lists left to right; the difference is associativity (left vs right grouping).
- In strict languages, foldl is tail-recursive and uses constant space; foldr requires linear stack space.
- In lazy languages (like Haskell), foldl builds large thunks, so use foldl' for strict functions for constant space.
- foldr can be lazy: if the combining function is lazy in its second argument, it can work incrementally and on infinite lists.
- General rule for lists: use foldl' for strict operations, foldr for lazy second argument; avoid plain foldl or foldr'.
- These rules are specific to lists; other data structures may require different choices (e.g., snoc lists).
More like SC-Forth-thousand, am I right?
a day ago
- The Soggy-1000 is a clone of Sega's SG-1000/SC-3000, designed to be compatible with the SG-1000 keyboard and allow safe tinkering.
- The author is porting CamelForth to the Soggy-1000 as part of RetroChallenge 2026/10, aiming for a low-level Forth programming environment on the machine.
- CamelForth was originally CP/M-based, so porting required writing hardware init, a reset handler, moving buffers, and replacing CP/M-specific words like KEY and EMIT.
- The assembler port from Z80MR to zasm hit issues with macros, especially DOCODE handling, string quoting, and conditional directives, requiring macro rewrites.
- Terminal output uses the TMS9918 VDP; scrolling was implemented with a bitmask to align to 32-byte rows instead of using modulo, avoiding a RAM frame buffer.
- A bug in CamelForth's KEY/KEY? handling caused repeated QUIT calls; the author rewrote the keyboard driver, initially just enough to enter a word.
- Future goals include adding TMS99xx/SN76489 words for graphics and sound, and building a useful Soggy Forth cartridge; keyboard handling is the immediate next step.
- The article serves as a primer for the RetroChallenge project, explaining why Forth is well-suited for limited 8-bit hardware.
The Softmax function and its derivative
a day ago
- Softmax transforms an N-dimensional vector of arbitrary real values into a vector of probabilities in (0, 1) that sum to 1.0, preserving relative order.
- The softmax function is a 'soft' version of the maximum function, giving a proportionally larger share to the maximal element while distributing some probability to others.
- Softmax has a probabilistic interpretation, making it suitable for multiclass classification tasks in machine learning, such as multiclass logistic regression.
- The derivative of softmax is a Jacobian matrix, and it can be computed using cases with the Kronecker delta: ∂S_i/∂z_j = S_i (δ_{ij} - S_j).
- Numerical stability when computing softmax can be improved by shifting inputs by their maximum, preventing overflow or underflow due to exponentiation.
- In a softmax layer (fully-connected matrix multiplication followed by softmax), the derivative with respect to weights can be computed via the multivariate chain rule, resulting in a sparse Jacobian.
- Cross-entropy loss is commonly used with softmax for training; its gradient with respect to weights simplifies to (P - Y) times the input, where P is the softmax output and Y is the one-hot true label.
ICE Has Been Dumping Protester Photos into a Palantir Database
5 hours ago
- A court filing alleges DHS built dossiers on ICE observers, including photos and license plate numbers, stored in Palantir's Investigative Case Management (ICM) database.
- The filing describes agents intimidating protesters via drive-bys, border inspections, and threatening watchlist placement.
- Specific incident: An agent (J.C.) created ICM records on observers, ran license plates, and used facial recognition via Mobile Query app.
- One observer was warned her spouse might be added to a domestic terrorism watchlist; records were shared with CBP's TECS system as lookout records.
- DHS calls the case 'meritless' and denies maintaining a database of domestic terrorists, while plaintiffs argue the surveillance chills First Amendment rights.
- Plaintiffs seek to archive records, bar use of collected information, and prohibit threats or following observers.
The Harness Is the Company
5 hours ago
- A harness broadly refers to all infrastructure, interfaces, context, and state that surround a stateless LLM, including tools like LangGraph and coding agents.
- SaaS businesses follow a trajectory from no harness, to individuals operating harnesses, to orchestrating harnesses, and finally to harnesses orchestrating individuals—turning the company itself into a harness.
- In a harness-driven company, core tasks are done by agents, the product is model output, and humans become part of the harness by providing taste and judgment where it matters most.
- Building a harness does not necessarily lead to low-quality output; instead, it can maximize customer value by spending human attention only where needed.
- The harness becomes the core differentiator for a company, shaping trust, distribution, efficacy, and domain context—more important than traditional org structures.
- Companies are beginning to build in-house AI developer tools (e.g., Ramp, Stripe, DoorDash) as the start of this trend, and they should own the top-level harness while plugging in vendor products for specific workflows.
- Implications include a rise in in-house harness building, reshaping of org roles, AI-native startups beating incumbents in harness-friendly domains, and the need for all software to be headless for the harness to operate.
Everyone's Packing Up
6 hours ago
- Many users are leaving major platforms like Reddit, WordPress, Discord, GitHub, and Photoshop.
- Reasons for leaving include pricing changes, AI training on user content, new ownership, policy updates, and a sense that platforms no longer serve individuals.
- People are migrating to smaller, more controlled spaces such as personal sites, self-hosted apps, and obscure platforms like Gopher or Gemini.
- The shift prioritizes control over reach, and what once seemed like giving up now appears sensible.
- Big platforms will persist, but the users who made them engaging are quietly departing.

firstprev0next

Hasty Briefsbeta

<input type="password" maxlength="20"> prevents me from logging into Vanguard

Philip Sidney and the Extreme (Dis)Graces of the Parenthesis

Shut up and take our money: Amazon plows $1B into quashing datacenter dissent

Make Tmux the OS

Show HN: Mini React – React like UI library

Tightening Full Disk Access on macOS, in Response to AI Apps Running Amok

Why didn't we get GPT-2 in 2005?

Debian Inference Portal

The Forgetful CPU (Linux on M4)

Prozac use for childhood depression skewed by single flawed medical trial

EFF – Welcome to Opt Out October. Let's Take Control of Our Data and Our Devices

Nobody Is Listening on Port 8125

Differences Between `Foldl` and `Foldr`

More like SC-Forth-thousand, am I right?

The Softmax function and its derivative

ICE Has Been Dumping Protester Photos into a Palantir Database

The Harness Is the Company

Everyone's Packing Up