Hacker Timesnew | past | comments | ask | show | jobs | submit | otabdeveloper4's commentslogin

It's not about malware. It's about Google complying with USA's geopolitical adventures.

Basically, Google needs an answer when men in suits ask them why they have technology that enables users to install sanctioned Iranian banking apps.


> relationships that don't lead anywhere

Relationships are not transactions that are supposed to "lead somewhere".


You’re being a bit pedantic here “leading somewhere” is accepted shorthand for a lasting, satisfying relationship that is good for both parties.

Relationships aren't transactional. This isn't a business deal.

Most people engage in romantic relationships because they'd like to find someone to marry and settle down with. Nothing but respect for the people who've thought it through and decided that's not for them, but what's much more common is failing to think it through or worrying it would be awkward/scary/"cringe" to take their relationship goals seriously.

That's what people are pointing to when they talk about relationships not "leading anywhere". If you want to be married in 5-10 years, and you're 2 years into an OK relationship with someone you don't want to marry, it's going to suck to break up with them but you have to do it anyway.


> it's often not worth the time to properly handle any minor $300k/yr boondoggle

No, because you can use that 300k to solve some real problem instead of literally lighting it on fire.

(Hell, just give employees avocado toasts or pingpong tables instead.)


There's hundreds of thousands of websites with the .su domain.

(The USSR dissolved before the world-wide-web was even a thing.)

If Barclays can get their own vanity TLD then Yugoslavia should be able too.


Granted, ccTLDs has been already going on for years before USSR change their pronoun to were. Mostly for email, no idea if ccTLDs found their use on BBS.

I can understand .su continuing because Russia pretty much took over everything that represent Soviet Union elsewhere (embassies, Security Council seat, etc) and other former Soviet states either support the continuation or indifferent. Yugoslavia continuation is more contentious topic.


Russia pretty much took over all the USSR's external debts too.

Maybe introduce .bk (Balkans) then anyone around there can use it.

.bk is not allowed because two-letter TLDs are reserved for entities with an ISO 3166 country code. .balkan might appear one day.

I'm sure there will be no way for us to kill eachother over something like this, no sirree...

The interesting part is this implies that Tesla cars have static certifcates that don't rotate. (Whoops.)

My read of the output in the post when they tried to SSH to the device was that Tesla are actually doing the right thing here and using an SSH certificate authority, which allows issuing certificates signed with a private key authorising access to a subset of devices (optionally for a defined period of time). https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Certificate-b... has more information, but in summary unless the private signing key is compromised in some way this is entirely legit. I'd hope that they also have some mechanism for distributing a new public key if the signing key does get compromised but who knows.

I understand there are also certs involved with tesla vehicles communicating with a supercharger as well.

Why can't they rotate ? having root ssh keys on the device doesn't imply the certs don't rotate.

Not necessarily. All they have to do is roll a pub key into the update package. Same as any OTA update.

Do Tesla vehicles get VIN-specific updates?

Not sure - if I was designing it, feels like it would be a good way of getting the right build to the right car so that all the HW versions of each module are in line.

I'd imagine that the update includes all the possible hardware, and the update script actually decides which components to use. Like apt on Debian or yum on RHEL.

Interesting - just found this: https://www.pentestpartners.com/security-blog/reverse-engine...

Not had a chance to read it properly but definitely will be!


Roblox is a development platform, not a game.

That's babby's first insight. Most people figure this out on their own in kindergarten.

It's when LLM agents are inefficient that you need a whole rack of servers to get shit done.

There's only two different LLM APIs in practice (Anthropic and everyone else), and the differences are cosmetic.

This is like a couple hours of work even without vibe coding tools.


> There's only two different LLM APIs in practice (Anthropic and everyone else), and the differences are cosmetic.

There's more than that (even if most other systems also provide a OpenAI compatible API which may or may not expose either all features of the platform or all features of the OpenAI API), and the differences are not cosmetic, but since LiteLLM itself just presents an OpenAI-compatible API, it can't be providing acccess to other vendor features that don't map cleanly to that API, and I don't think its likely to be using the native API for each and being more complete in its OpenAI-compatible implementation of even the features that map naturally than the first-party OpenAI-compatibility APIs.)


LiteLLM is the second worst software project known to man. (First is LangChain. Third is OpenClaw.)

I'm sensing a pattern here, hmm.


LLMs recommend LiteLLM, so its popularity will only continue.

Not familiar with LangChain besides at a surface level - what makes it the worst software project known to man?

LangChain at least has its own layer for upstream LLM provider calls, which means it isn't affected by this supply chain compromise. DSPy uses LiteLLM as its primary way to call OpenAI, etc. and CrewAI imports it, too, but I believe it prefers the vendor libraries directly before it falls back to LiteLLM.

You have to see it to believe it. Feel the vibes.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: