Hacker Newsnew | past | comments | ask | show | jobs | submit | arcfour's commentslogin

Vercel runs on AWS.

Which PaaS are running on their own servers and earning a profit?

That's why I wrote my own compiler and coreutils. Can't trust some shit written by GNU developers 30 years ago.

And my own kernel. Can't trust some shit written by a Finnish dude 30 years ago.

And my own UEFI firmware. Definitely can't trust some shit written by my hardware vendor ever.


Yeah definitely no difference between GNU coreutils and some vibe coded AI tool released last month that wants full oAuth permissions.

I’m not joking, but weirdly enough, that’s what most AI arguments boil down to. Show me what the difference is while I pull up the endless CVE list of which ever coreutils package you had in mind. It’s a frustrating argument because you know that authors of coreutils-like packages had intentionality in their work, while an LLM has no such thing. Yet at the end, security vulnerabilities are abundant in both.

The AI maximalists would argue that the only way is through more AI. Vibe code the app, then ask an LLM to security review it, then vibe code the security fixes, then ask the LLM to review the fixes and app again, rinse and repeat in an endless loop. Same with regressions, performance, features, etc. stick the LLM in endless loops for every vertical you care about.

Pointing to failed experiments like the browser or compiler ones somehow don’t seem to deter AI maximalists. They would simply claim they needed better models/skills/harness/tools/etc. the goalpost is always one foot away.


"endless list of CVE" seems rather exaggerated for coreutils. There are only very few CVEs in the last decade and most seem rather harmless.

Now I'd genuinely like to know whether "yes" had a CVE assigned, not sure how to search for it though...

I wouldn't describe myself as an AI maximalist at all. I just don't believe the false dichotomy of you either produce "vulnerable vibe coded AI slop running on a managed service" or "pure handcrafted code running on a self hosted service."

You can write good and bad code with and without AI, on a managed service, self-hosted, or something in between.

And the comment I was replying to said something about not trusting something written in Akron, OH 2 years ago, which makes no sense and is barely an argument, and I was mostly pointing out how silly that comment sounds.


I used to believe that too, yet the dichotomy is what’s being pushed by what I called an “AI maximalist” and it’s what I was pushing against.

There is no “I wrote this code with some AI assistance” when you’re sending 2k line change PR after 8 minutes of me giving you permission on the repo. That’s the type of shit I’m dealing with and management is ecstatic at the pace and progress and the person just looks at you and say “anything in particular that’s wrong or needs changing? I’m just asking for a review and feedback”


It's such a bad faith argument, they basically make false equivalencies with LLMs and other software. Same with the "AI is just a higher level compiler" argument. The "just" is doing a ton of heavy lifting in those arguments.

Regarding the unix philosophy argument, comparing it to AI tools just doesn't make any sense. If you look at what the philosophy is, it's obvious that it doesn't just boil down to "use many small tools" or "use many dependencies", it's so different that it not even wrong [0].

In their Unix paper of 1974, Ritchie and Thompson quote the following design considerations:

- Make it easy to write, test, and run programs.

- Interactive use instead of batch processing.

- Economy and elegance of design due to size constraints ("salvation through suffering").

- Self-supporting system: all Unix software is maintained under Unix.

In what way does that correspond to "use dependencies" or "use AI tools"? This was then formalised later to

- Write programs that do one thing and do it well.

- Write programs to work together.

- Write programs to handle text streams, because that is a universal interface.

This has absolutely nothing in common with pulling in thousands of dependences or using hundreds of third party services.

Then there is the argument that "AI is just a higher level compiler". That is akin to me saying that "AI is just a higher level musical instrument" except it's not, because it functions completely differently to musical instruments and people operate them in a completely different way. The argument seems to be that since both of them produce music, in the same way both a compiler and LLM generate "code", they are equivalent. The overarching argument is that only outputs matter, except when they don't because the LLM produces flawed outputs, so really it's just that the outputs are equivalent in the abstract, if you ignore the concrete real-world reality. Using that same argument, Spotify is a musical instrument because it outputs music, and hey look, my guitar also outputs music!

0: https://en.wikipedia.org/wiki/Not_even_wrong


So it’s not a binary thing, there’s context and nuance?

Embrace the suck.

cue Jeopardy theme song

Who is Apple?


TempleOS, is that you?

Pfft, just grab a teletype and run lpr -P ttyUSB0 ai_generated_report.txt ;-)

I know the best way to solve a problem with corruption and lack of transparency: involve the government! Nobody could ever pay off a politician. Surely that would only work in our favor.

If a regulation is written well you don't need to depend on the integrity of any one politician because they aren't responsible for enforcement. The hard part is getting the laws passed in the first place because it requires electing representatives that will serve your interests instead of the interests of the corporations who bribe them. It's our job to make sure that our government is working for us. If it's impossible to do that than our democracy has failed.

What would this privilege look like that is meaningfully different from SYSTEM while being properly protected from/able to deal with malware that has an LPE?

CloudFlare has supported it since 2023: https://blog.cloudflare.com/announcing-encrypted-client-hell... Firefox has had it enabled by default since version 119: https://support.mozilla.org/en-US/kb/faq-encrypted-client-he... so you can use it today.

"... so you can use it today."

What if he wanted to use it for requesting blog.cloudflare.com

   ;; ANSWER SECTION:
   blog.cloudflare.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.28.7,104.18.29.7 ipv6hint=2606:4700::6812:1c07,2606:4700::6812:1d07
Where are the ECH keys

For example,

   ;; ANSWER SECTION:
   test.defo.ie. 300 IN HTTPS 1 . ech="AEb+DQBCqQAgACBlm7cfDx/gKuUAwRTe+Y9MExbIyuLpLcgTORIdi69uewAEAAEAAQATcHVibGljLnRlc3QuZGVmby5pZQAA"
or

   ;; ANSWER SECTION:
   cloudflare-ech.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.10.118,104.18.11.118 ech="AEX+DQBBpQAgACB/RU5hAC5mXe3uOZtNY58Bc8UU1cd4QBxQzqirMlWZeQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=" ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76
It's true one can "use it today". One could use it for the past several years as well. The software has been around for a while

But ECH has never been consistently enabled for the general public beyond a small number of test sites that are only for testing ECH


https://tls-ech.dev indicates that Safari doesn't support it, but Chrome does.

That’s likely due to iOS/macOS not supporting it in production-default-enabled yet; there’s an experimental opt-in flag at the OS level, but Safari apparently hasn’t (yet) added a dev feature switch for it.

https://developer.apple.com/documentation/security/sec_proto...

Presumably anyone besides Safari can opt-in to that testing today, but I wouldn’t ship it worldwide and expect nice outcomes until (I suspect) after this fall’s 27 releases. Maybe someone could PR the WebKit team to add that feature flag in the meantime?


Opt in features are a great way to increase user frustration and confusion. See the whole new geolocation API they had to make for browsers since people would perma-deny it reflexively and then complain that geolocation features weren't working.

That's a good point, though I'm not familiar with the (changes to the) geolocation API you mention. Do you have any recommendations for reading up on that development?

Sure, I should have said geolocation element, since the original API still exists and is used: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

As a user, I really don't care about the supposed purity or correctness of a website's tech stack. When I click "back" I want to go back to what I think the previous page was.

As a user, I don’t really care about the building materials used in construction. But that doesn’t mean builders should cut corners.

A building collapse and a poorly built website UI are completely different in terms of actual risk.

A building collapsing isn’t the only way people are affected by choices in construction. But if you want to talk about worst case scenarios then I can pick out some examples in IT too:

We constantly see people’s PII leaked on the internet, accounts hacked and money stolen, due to piss poor safeguards in the industry. And that’s without touching on the intentional malpractice of user tracking.

And yes, this is a different issue, but it’s another symptom of the same problem. Tech businesses don’t give a shit, and developers make excuses about how it’s not life or death. Except our bad choices do still negatively affect people’s lives even if we try to convince ourselves it doesn’t.


"The other side are where all of the bad guys and crazy violent lunatics are. The side I align with is the only sensible one; we would never do anything like that."

This sort of thinking causes extremism and division. It only perpetuates more of the thing you don't want!

It's also empirically not true: there are crazy people on both sides, but most people are pretty reasonable. If you treat them as if they are, despite your differences, they won't feel so alienated and perhaps you can both have a productive conversation. Both sides views are then likely to soften, and you can maybe even start working together.


This is about propaganda regimes, as much as about whataboutisms. Both sides paint the other as violent. Which is more believable. Sad as though the answer may be.

Nope. Both sides are not equivalent. The political right, in the U.S., has been significantly more violent than the political left for quite some time. And it’s not even close. https://pmc.ncbi.nlm.nih.gov/articles/PMC9335287/

> We included individuals whose public exposure occurred between 1948 and 2018.

The times they are a-changin'.


Show some data!

Here’s a report on political terrorism up to 2025: https://www.csis.org/analysis/left-wing-terrorism-and-politi...

I encourage anyone reading to look at the charts. There’s a single clearly anomalous data point with significantly reduced violence for “right terrorists” and significantly high number for “left” in 2025. It is the only year in any chart where left violence exceeds (or even comes near to) right.

It’d be extremely silly to infer some trend from this one anomaly.


Does it really matter who is more violent? The fact of the matter is both sides do have a nonzero amount of crazy/violent people and both sides could treat the other with more respect instead of furthering division.

You will notice I never said that both sides have the same amount of violence (since I don't think that that's actually relevant), so you are responding to a point I never made to begin with.


Vending machines and guns both kill people, so we should expend equal effort addressing the problems with both. Do I have that right?

This obsession with just pretending the two sides are mirror images, who simply need respect each other more is just lazy thinking. Interrogate what the contemporary American right values and believes. It is deep seated resentment (urban elites!), hate (owning the libs), bigotry (mass deportations now!), all wrapped up in a victimhood (white replacement theory) / inferiority complex. It should surprise exactly no one that the statistics are what they are.

The left’s biggest problem is people find them annoying for suggesting others could be more empathetic or do better at being inclusive. These two camps are just nowhere near comparable.

To address an issue, you first must understand it. I very much believe what the right values informs why they’re violent. These values and beliefs need to be shamed into oblivion. Diversity is a strength! Expertise is valuable! People should have freedom to live their lives so long as they don’t harm others! People who believe otherwise should tremble with embarrassment to say so.


Well, I guess you'll always live in a land of division and spite, always angry yourself, and the "others" always angry back at you, squabbling forever while things slowly get worse. I hope you enjoy the bed you've made for yourself.

Is this why shop owners board their windows and doors up every time there’s an [insert left wing cause] protest in their area? I haven’t kept up but was Charlie Kirk’s assassin a left or right winger, or one of those horseshoe fellas.

Are you trying to make a point? Go ahead and make it. Or are you one of those “just asking questions” types?

I’m one of the types who can parse observable reality and notice that businesses don’t board up when democrats win elections. They do it when the other guy wins. The claim that the “right wing”, such as it exists as a cohesive entity, is uniquely responsible for political violence today is an absurd claim on its face because I could look out my window on my commute and simply notice who was doing the violence. Or, in the case of Charlie Kirk, who was doing the assassinating.

Begone, AI spambot.

Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: