Hacker Timesnew | past | comments | ask | show | jobs | submit | d1sxeyes's commentslogin

No-one knows who you are, and you’re clearly not against using something like GH Actions in a way other than its intended purpose. What’s to say you won’t pivot to running a tiny VM on my machine and making it available to others?

Is that right? Well, some people know. I’m Cris, and you are?

But wait I’ve been building so much, for all this time, but you think what I’ve really being doing is building malware, and there’ve been no consequences, somehow nobody’s noticed and I’ve just “gotten away with it”?

Go check out my GitHub: https://github.com/crisdosaygo


I don’t think anything, and I’m not accusing you of anything, I’m just saying, a lot of folks started with pure motives and got poisoned along the way.

For what it’s worth, it’s not very reassuring that you have a bunch of open source projects but you’ve decided this one is not going to be. Rather than showing I can trust you, it rather makes me wonder what you’re hiding.

The answer may well be nothing, but it’s still strange.


I get you might feel that way about it, but that’s not how it is.

The strange thing is your reaction, don’t you think: If you see a proprietary source product and you think “what’s it hiding?” and if you can’t respect a boundary of not revealing source without projecting an imagined bad onto that, that’s just you, my dude, and I’m not responsible how you react at all.

So you might wanna try to put your mistaken attitude on me, but really you need to own that. And your attitude seems mistakenly entitled.

Also the trust issues are warrantless. And, in reality, if you look at my projects, the most important ones are not “open source”.

You judged too quickly, without context, like many here and arrived at conclusions that are just not warranted.

You shouldn’t be arguing with anyone about that because why you came to those doubts or conclusions is something you have to figure out yourself, it’s not something anyone else can help you with.

> I’m just saying, a lot of folks started with pure motives and got poisoned along the way.

That’s not how I see things. That’s not been my experience of the world. I understand if it’s been yours though. Poor you. I guess in that case my advice is just try to keep in mind that not everyone is gonna have the same kind of negative outlook as you and try to be understanding towards them. There’s a lot of good in the world if you open your eyes to it, I hope you find some.


> if you can’t respect a boundary of not revealing source without projecting an imagined bad onto that, that’s just you, my dude, and I’m not responsible how you react at all

I’m responding to the change, as something worth scrutiny. You used to publish open source projects, now this is closed source. Why?

> So you might wanna try to put your mistaken attitude on me, but really you need to own that. And your attitude seems mistakenly entitled

What mistaken attitude, what am I putting on you, and what is my “entitlement”?

> You judged too quickly > You shouldn’t be arguing > my advice is

Please stop dressing up your arguments as some kind of metaphysical commentary on my character. I don’t need advice, I didn’t judge you, and I didn’t plan on arguing. You built something, some people think it’s cool, a lot of people think it’s problematic. You want to keep it closed source, some people find that worrying.

Keep your faux pity for yourself, engage with me in good faith on the merits of the points I’m making, otherwise we’re done here.


You think I owe you source code, is entitled. You project strange onto change, is low empathy. There's no metaphysics, your unwarranted criticism is a reflection of your character. Don't pretend your weird subjective reaction is anything I need to respond to, nor any reflection of me - it's just you.

You have 0 right to attack or accuse me in any way. That you think you do makes you even more entitled and low empahty. Geez....


Their pattern here of immediately going on the offensive to even the smallest amount of inquiry or criticism is totally normal and not at all suspicious.

Maybe they're just having a bad day. Friendly reminder that you don't have to respond to something as soon as you read it, or even at all.


Dishonest. You have no idea about me, Plus "I don't trust your work" is an attack, it's not a neutral inquiry.

You tried to launder that through a question but it got rejected and exposed. And you can't cover that up now, no matter how much you try ever again.


While they don't sting, a 45cm long dragonfly would have some pretty gnarly mandibles, and could bite if it decided you were a threat. Probably wouldn't be much fun.

But they didn't. Maybe they would if you tried to slap them away, or otherwise make movements which they percieved as threatening.

As it were they were just curiously following me because of my speed, maybe even had fun doing so?

That didn't happen if you'd just walk, or jog along that place. Then they ignored you.


Anna Karenina is public domain, assuming you’re talking about the original? If you translate it then maybe you could release it under GPL, but bit odd?

I think you missed the "what if". It was just a point about how the constructed scenario might be different to the real scenario. Most AIs are not trained only on public-domain work.

I didn't, but not sure what the point is. Maybe I missed something else?

Basically the idea is use hybrid. AES-GCM-256 or ChaCha20-Poly1305 for symmetric encryption (which is already PQ-safe), and ML-KEM looks set to become the standard for key encapsulation.

ML-KEM-768 is fast as an algorithm, faster than X25519 in terms of pure computation, but uses large keys, so has higher overheads on small payloads. Most of the time, they’re about equal, or the absolute time is so slow it doesn’t matter.

Most folks now are doing hybrid ML-KEM and X25519 to guard against undiscovered flaws in ML-KEM.


For people reading this, you may want to know the the NSA is allegedly trying to weaken hybrid ML-KEM and X25519 down to just ML-KEM. This is a good thing to pay attention to!

Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html



is this insinuating that we, collectively, are not 100% confident that ML-KEM on it's own is going to be enough & deduct that the NSA wants the omission of X25519 as sort of a backdoor possibility?

I haven't met a single cryptographer who takes this series of posts seriously and if you have I'd love to talk to them.

this is great, thanks. i'm a little lost on where I even need to apply this in my own work. for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest, im guessing those should be updated. but for other things, i guess theres going to be a lot of waiting for a platform i dont control for instance to update it's support for things like private/public key authentication and more. i understand openssl supports a lot of these pq methods now, trying to gauge how much of a head start i can reasonably get.

> ChaCha20-Poly1305

ha! i ran into this when looking at the source for yaak (guy who made the insomnia rest client who's now making yaak). i never got to the bottom of how it worked.


> for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest

Current best practices for symmetric encryption are considered PQ-safe (provided your key length is long enough). The real question the above algorithms solve is how do you safely share the key for the symmetric encryption. That’s where X25519 and ML-KEM come in. X25519 is not PQ-safe, but it is very well studied and considered robust. ML-KEM is PQ-safe, but new, and not as well tested/audited.


It’s worth noting that e.g. the Go stdlib has this hybrid construction built-in via crypto/hpke.

thank you!!! i shall be using this immediately

So low not so slow

I don’t think the argument as a whole is a fallacy, it’s true that the exact cost to the NHS is more than covered by tax, but most estimates of wider cost to the economy (e.g. lost productivity, disability benefits, etc) is higher. https://fullfact.org/health/farage-smoking-revenue-nhs/

It's equally a fallacious argument to try to fit "cost to the economy", whatever that means, to the healthcare cost (usually this is done to inflate costs to fit the narrative). By that logic, ban everything and allow only what allows individuals to maximise their productive labour... what a nightmare.

Those are not Oxford commas, they’re parenthetical (and I like them too!)


To be fair, that report says

> the self-driving feature had “aborted vehicle control less than one second prior to the first impact”

It seems right to me that the self-driving feature aborts vehicle control as soon as it is in a situation it can’t resolve. If there’s evidence that Tesla is actively using this to “prove” that FSD is not behind a crash, I’m happy to change my mind. For me, probably 5s prior is a reasonable limit.


It's an insane reversal of roles. In a standard level 2 ADAS, the system detects a pending collision the driver has not responded to and pumps the breaks. Tesla FSD does the reverse: it detects a pending collision that it has not responded to, and shuts itself off instead of pumping the breaks. It's pure insanity.

Also, Tesla routinely claims that "FSD was not active at the time of the crash" in such cases, and they own and control the data, so it's the driver's word against theirs. They most recently used this claim for the person who almost flew off an overpass in Houston because FSD deactivated itself 4 seconds before impact[1]. They used it unironically as an excuse why FSD is not at fault, despite the fact that FSD created the situation in the first place.

[1] https://electrek.co/2026/03/18/tesla-cybertruck-fsd-crash-vi...


AEB is enabled even when FSD is off, which sounds like the L2 ADAS behaviour you're describing. Just because FSD disengages, it doesn't mean that no other Collision Avoidance Assist features are operating.

> because FSD deactivated itself 4 seconds before impact

This isn't accurate. The driver deactivated FSD 4 seconds before impact. Don't get me wrong, the video looks pretty much like FSD wouldn't have been able to do anything better than the driver did, but she didn't give it a chance.


IDK, this has the same unethical energy as police turning off body cameras.

in the BEST CASE, this is a confluence of coincidences. Engineering knows about this and leaves it "low prio wont fix" because its advantageous for metrics.

In the worst case, this is intentional.

In any case, the "right thing to do" is NOT turn off the cameras just before a collision, and yet it happens.

This is also Safety Critical Engineering 101. Like.... this would be one of the first scenarios covered in the safety analysis. Someone approved this behavior, either intentionally, or through an intentional omission.


> the "right thing to do" is NOT turn off the cameras just before a collision

Source for autopilot being disabled “seconds before a crash” also disabling cameras? (Sorry if I missed it above.)


This is a policy that Tesla put in place, period. Handling control to driver suddenly in a weird moment can make the whole situation even more dangerous as the driver is not primed to handle it on the spot, it’s all too unexpected.


Yep, your comment reminds me of a time my mother was about to hit a bird in the road. However, she was too busy arguing with the passenger to notice, and her driving was starting to become erratic already. I decided not to tell her because I knew that the shock could cause her do something more drastic like crash the car to try and avoid it.


I guess i'll step in for the counter.

How is a car supposed to pre-empt when it is in a situation that is to challenging for it to navigate? Isn't it the driver who should see a situation that looks dicey for FSD and take control?


Maybe the car should not have this dangerous feature in the first place? Or maybe train drivers thoroughly and frequently for when this situation arises it becomes less dangerous.

It seems to me FSD for Tesla is not ready to go into Prod as it is now.


> Isn't it the driver who should see a situation that looks dicey for FSD and take control?

How does a driver judge what is and is not "dicey" from the FSD's perspective?

If you don't have confidence in FSD, then you wouldn't use it in the first place. If you do have confidence, then why would you ever (or how often) would you take over?

Is there some kind of 'confidence gauge' that the FSD displays in how well it thinks it can handle the situation? If there is/was, perhaps the driver could see it dropping and prime himself to take over.


How is a car supposed to pre-empt when it is in a situation that is to challenging for it to navigate?

By anticipating further ahead. If it finds itself into a situation that it can't get itself out of, it means it should have made more defensive choices earlier or relinquish control earlier. And if it doesn't have either the reasoning capacity or the spatial awareness data to do that, it is not fit for general usage and should be pulled.


Was this case FSD or was this earliest generation technology? And does this still happen?

I agree you right in that's what you expect to happen.


This is reasonable, and you have to imagine many collisions involve the driver taking control at the last second causing the software to deactivate. That being said, this becomes a matter of defining a self-driving collision as one in which self-driving contributed materially to the event rather than requiring self-driving be activated at the exact moment of impact.


Agreed. I also feel like there is a world of difference between the driver deliberately assuming control at the last second because they notice that an accident is about to happen, and the car itself yielding control unprompted because it thinks an accident is about to happen.

The former is to be expected. The latter seems likely to potentially make an already dangerous situation worse by suddenly throwing the controls to an inattentive driver at a critical moment. It seems like it would be much safer for the autopilot to continue doing its best while sounding a loud alarm to make it clear that something dangerous is happening.


> It seems like it would be much safer for the autopilot to continue doing its best while sounding a loud alarm to make it clear that something dangerous is happening.

This is essentially what FSD does, today. When the system determines the driver needs to take over, it will sound an alert and display a take-over message without relinquishing control.


So, the car puts itself in a situation it can't resolve, then just abdicates responsibility at the last moment.

That's still not a good look.

And it does mean that FSD isn't to be as trusted as it is because if the car is putting itself in unresolvable situations, that's still a problem with FSD even if it isn't in direct control at the moment of impact.


The few Tesla post-mortems I’ve read early on stated that FSD turned off before impact and used this as a defence to their system. If they shared that this happened 1 second before impact (so far too late for a human to respond), I’d have sympathy. I have never read a Tesla statement that contained this information.

For normal incidents, 2 seconds is taken as a response time to be added for corrective action to take effect (avoidance, braking). I’d expand this for FSD because it implies a lower level of engagement, so you need more time to reengage with the car.


While that’s true, translations often vary in terms of how faithful they are to the source vs how idiomatic they are in the target language. Take for example the French phrase “j’ai fait une nuit blanche”, which literally means “I did a white night”. Clearly that’s a bad translation. A more natural translation might be “I pulled an all-nighter”.

Similarly, “j’ai un chat dans la gorge” probably translates best as “I’ve got a frog in my throat”, even though it’s a completely different animal, it’s an obvious mapping.

Those are fairly simple because they have neat English translations, but what about for example “C’est pas tes oignons”, which literally means “these aren’t your onions”, but is really a way of telling someone it’s none of their business. You could translate it as “it’s none of your business”, or “keep your nose out” or “stay in your lane” or lots and lots of other versions, with varying levels of paraphrasing, which depend on context you can’t necessarily read purely from the words themselves.


I'll preface this by noting that I don't disagree with anything you've said, but I do have some comments:

> Similarly, “j’ai un chat dans la gorge” probably translates best as “I’ve got a frog in my throat”, even though it’s a completely different animal, it’s an obvious mapping.

Those obvious mappings can sometimes be too seductive for the translator's good. One example is that people translating English-loanwords-in-a-foreign-language into English usually can't help but translate them as the original English word.

Another example is that, in China, there is a cultural concept of a 狐狸精, which you might translate as "fox spirit". (The "fox" part of the translation is straightforward, but 精 is a term for a supernatural phenomenon, and those are difficult to translate.) They can do all kinds of things, but one especially well-known behavior is that they may take the form of human women and seduce (actual) human men. This may or may not be harmful to the man.

Because of this concept, the word also has a sense in which it may be used to insult a (normal) woman, accusing her of using her sex appeal toward harmful ends.

Chinese people translating this into English almost always use the word "vixen", which is, to be fair, a word that may refer to a sexy human woman or to a female fox. But I really don't feel that they're equivalent, or even that they have much overlap. (Unlike the situation with English loanwords, I think native speakers of Chinese are much more likely to choose this translation than native speakers of English are.)

> what about for example “C’est pas tes oignons”, which literally means “these aren’t your onions”

The form closest in structure to that would probably be "none of your beeswax", which is just a minorly altered version of "none of your business". I assume the substitution of "beeswax" is humorous and based on phonetic similarity.

As you note, there are multiple dimensions relevant to translating this and several positions you could take along each. For this particular idea, I would say the two most important dimensions are playfulness and rudeness; it's a very common idea and the language is rich in options for both.

> translations often vary in terms of how faithful they are to the source vs how idiomatic they are in the target language. Take for example the French phrase “j’ai fait une nuit blanche”, which literally means “I did a white night”. Clearly that’s a bad translation. A more natural translation might be “I pulled an all-nighter”.

This isn't what I had in mind. Here are some idiomatic translations:

I pulled an all-nighter.

I was up all night.

I didn't get any sleep.

I never got to bed.

I've been up since [something appropriate to the context].

[Something appropriate to the context] kept me up all night.

I wouldn't call any of the first four "more paraphrased" than the others. (The last two might be, if they included extra information.) If these were reports of the English speech of some other person, one of them (or less) would be a quote, and the others would be paraphrases. But as a report of French speech, they're all paraphrases. The first shares a little more grammatical structure with the French, which doesn't really mean much.

For a fairly similar example from my personal life, someone said to me 这是我第一次听说, and my spontaneous translation of it was "I've never heard that before", despite the fact that there is technically a perfectly valid English expression "this is the first I've heard of that".

What's closer to the grammatical structure of the Chinese? That's hard for me to say. You could analyze 我 as the subject of 听说, and I lean toward that analysis, but my instincts for Mandarin are weak. You might see 我 as being more strongly attached to 第一次, meaning something more like "my first time (to hear ...)" than "I hear (for the first time) ...".

But for whatever it's worth, a word by word literal gloss would be "this is me first time hear".

Between languages with less historical interaction than English and French, it's quite possible that a syntax-preserving translation of some sentence just doesn't exist.


The data Flock holds is not owned by OP.

If I as a photographer take a photograph of someone, the photo does not belong to that person—the photographer retains the IP and ownership rights.

You have rights too, such as privacy/likeness rights, which allow you to restrict what the IP owner is allowed to do with the image that they own, but you do not own the data, and your rights give you a claim against the data owner.

Flock probably have legal obligations or contractual commitments not to delete or destroy their customers' data, and changing that is not necessarily a good thing.


That's not the case under GDPR, CCPA, HIPAA, or other privacy regimes which codify our right to decide who can store our personal data and what they can do with it.


Can you point me to the part of the GDPR that gives you ownership of data that relates to you? I’m fairly confident that you are assigned rights over personal information as it relates to you, but it doesn’t assign ownership.


That “with enough context” is doing a lot of work here. If you take a great engineer, drop them in front of an unfamiliar codebase, it’ll take them more than an hour to do most non-trivial tasks.


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: