Top 10 Hacker News posts, summarized
HN discussion
(360 points, 473 comments)
The article criticizes passkeys as a technology designed by security engineers without understanding consumer usability. The author, a tech company head, admits personal confusion about what passkeys are and how they function. The piece argues that passkeys introduce ambiguity—they can be biometrics, stored on devices, browsers, or operating systems—making them difficult for average users to grasp. Unlike passwords or 2FA apps, which can be backed up or reinstalled, passkeys risk permanent loss if the sole device holding them is lost, creating a security paradox where robustness is undermined by a high risk of key loss.
The Hacker News discussion reveals deep divisions. Many experienced technologists express confusion about cross-device passkey management across multiple browsers and operating systems, and worry about losing access when devices fail or are replaced. Practical issues dominate: family account sharing breaks with passkeys, forced enrollments lock users to specific devices, and portability remains inconsistent despite the new CXP standard. Some users report smooth experiences using password managers (1Password, Bitwarden) as passkey providers, while others see passkeys as a vector for Big Tech lock-in via device attestation and "naughty client" blocklists. A few commenters suspect ulterior motives, such as reducing liability for credential leaks or enabling surveillance. Physical security keys (U2F) are recalled as more intuitive for non-technical users. Overall, the consensus is that passkeys solve phishing and password reuse but fail on usability, portability, and flexibility for real-world scenarios like shared accounts or device loss.
HN discussion
(372 points, 384 comments)
LG Electronics USA announced it will suspend apps on its webOS smart TV platform that embed residential proxy SDKs, following research by security firm Spur revealing that over 42% of apps in LG's store contained such components. These SDKs covertly turn televisions into always-on proxy nodes, routing third-party internet traffic through users' home connections. LG Senior Vice President John Taylor stated residential proxy networks are not an intended use for LG smart TVs and that the company is working with developers to remove the functionality, with non-compliant apps facing suspension. The proxy SDKs, predominantly from provider Bright Data, were found in apps ranging from games to utilities, with developers monetizing by selling users' bandwidth. Bright Data maintains its network operates on consent, vets customers, and undergoes independent audits, while Spur argues that one-time consent prompts on consumer devices like TVs are insufficient for meaningful transparency, especially when minors may provide consent. The announcement follows separate criticism of LG for automatically installing McAfee antivirus promotions on its monitors via Windows Update.
HN commenters expressed skepticism about LG's motives, with several questioning why the ban wasn't implemented earlier and suggesting the move may distract from LG's concurrent controversy over McAfee software on monitors. Many users advocated treating smart TVs as hostile devices, recommending complete network disconnection or using external streaming devices like Apple TV instead. A significant thread discussed the desire for "dumb" TVs without embedded operating systems, with users sharing workarounds involving HDMI CEC, KDE Plasma, and custom setups to avoid vendor software entirely. Commenters debated the ethics of residential proxies, with some viewing bandwidth-sharing as a fair value exchange while others equated it to botnet participation. Several called for regulatory intervention rather than relying on vendor self-policing, and tech reviewers were urged to prioritize privacy and security as first-class features in evaluations.
HN discussion
(517 points, 106 comments)
Bento is a self-contained presentation tool delivered as a single HTML file that functions as a complete PowerPoint alternative. The file includes slide data in a readable JSON block and the application logic in a compressed, base64-encoded blob that decompresses in the browser via DecompressionStream, requiring no external resources at runtime. Built on reveal.js with GSAP/Flip for animations and custom charting implementations, it uses the File System Access API for saving changes directly to the same file with ECDSA-signed updates. Collaboration is optional, enabled via invite files that generate encryption keys; a Cloudflare Durable Objects blind relay handles encrypted CRDT sync without seeing plaintext data, supporting read-only access and per-user revocation.
The Hacker News discussion overwhelmingly praised the single-file, offline-first architecture as a refreshing alternative to cloud-dependent SaaS tools, with several users calling it a "breath of fresh air" and highlighting the 560 KB default size as a standout feature. The creator detailed the technical implementation, including the CRDT-based collaboration model and custom rendering stack. Commenters requested an animation toggle, a default view mode with an edit button, and integration capabilities for live demos/prototypes. Some questioned the heavy AI marketing on the homepage and the obfuscated base64 payload, while others noted a naming conflict with Chef's Bento project. A few users connected the project to broader themes: the failure of Google Workspace to enable AI-driven editing, the surprising rarity of AI-recreated enterprise software, and the potential for Pandoc integration. The concept of "Single-File Web Apps" was referenced as an emerging category.
HN discussion
(378 points, 192 comments)
Mathematician Terence Tao shared a ChatGPT conversation in which he explored a potential counterexample to the Jacobian Conjecture, a long-standing open problem in polynomial mapping theory. The dialogue shows Tao using the LLM as a collaborative research partner: he directs it with precise, jargon-heavy prompts, asks it to expand expressions, change representations, verify algebraic identities, and search for geometric explanations that avoid coordinate-dependent constructions. The counterexample centers on a specially structured polynomial map whose Jacobian determinant reduces to a monomial, and Tao iteratively guides the model to uncover why the construction works and how it might generalize. The conversation also highlights a known limitation: the model's training cutoff (July 2026) means it "knows" the conjecture is unsolved, creating tension when presented with a purported disproof.
Commenters emphasize how the transcript reveals expert–AI interaction patterns rather than raw model capability. Observers note Tao's technique of short, high-context prompts that steer the model into "colleague mode," prompting it to match his technical level and occasionally push back with corrections or caveats. Several programmers draw parallels to their own workflows—decompose, re-represent, verify locally, re-integrate—suggesting the exchange models effective human–AI collaboration across domains. The mathematical density renders the content opaque to non-specialists, fueling demand for "explainer agents" that can translate such dialogues. A recurring theme is the model's ability to maintain context over a long, multi-tool session (Q&A, code, PDF ingestion, reasoning) without drifting, which many view as a more meaningful progress indicator than benchmark scores.
HN discussion
(166 points, 394 comments)
A U.S. government statement alleges that Moonshot AI distilled Anthropic's Fable model to develop its K3 model, using a sophisticated internal platform to conduct large-scale distillation against U.S. models while switching access methods to avoid detection. The statement also claims Moonshot acquired GB300-equipped servers and accessed GB300s in Thailand for model training. While acknowledging legitimate distillation's role in open innovation, the statement condemns "large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research" as unacceptable.
Commenters express widespread skepticism about the allegations, citing timeline implausibility (Kimi K3 released July 16, Fable access only broadly available from July 1) and questioning how distillation, benchmarking, and release could occur in such a short window. Many characterize the claims as FUD from Anthropic and the U.S. administration to suppress foreign competition. A dominant theme is perceived hypocrisy: U.S. labs trained on scraped internet data without permission, yet object when their outputs are distilled. Several argue distillation is fair if API access was paid for, while others note consumers benefit from cheaper, better models. Technical questions arise about detection methods, especially given Anthropic hides thinking traces. The consensus frames the dispute as "robbers blaming robbers" and predicts such accusations will backfire.
HN discussion
(251 points, 141 comments)
The article distills two years of production Postgres experience into a practical scaling guide organized across three tiers. The basics cover schema design (iterative approach, identity columns or UUIDs for primary keys, `timestamptz`, foreign keys with cascading deletes for low-volume tables), read query optimization (index lookups vs. sequential scans, compound indexes aligned with `ORDER BY`), write patterns (short transactions, minimal row locking, `CREATE INDEX CONCURRENTLY`), additive migrations run in transactions, and connection pooling via pgbouncer or in-memory pools. Intermediate topics address the query planner as a "leaky abstraction" requiring `EXPLAIN ANALYZE` debugging and statistics maintenance, bulk inserts via batching for ~10× throughput gains, autovacuum tuning to prevent dead tuple accumulation and transaction ID wraparound, and bloat management (pg_repack for tables, `REINDEX INDEX CONCURRENTLY` for indexes). Advanced techniques include `FOR UPDATE SKIP LOCKED` for job queues and lease management, table partitioning for time-series data (independent autovacuum, instant partition drops), and large-table migration patterns using triggers with batched backfills outside transactions to avoid long-running transaction bloat.
Commenters identified several critical omissions: monitoring/alerting for failure modes like XID wraparound (thundergolfer), backup/restore strategies and tooling like Barman (theallan), and the importance of deliberate schema design over ORM-generated schemas (zer00eyz). Practical disagreements emerged on `timestamptz` vs. `timestamp` (lennoff prefers the latter to enforce UTC), cascading deletes (mjr00 argues explicit deletes improve maintainability), and JSONB usage (sgarland warns of performance costs and data integrity issues). Operational advice emphasized separating application and database deployments with backwards-compatible schema changes (mjr00), using migration tooling like pg-osc or Flyway (mjr00, tracker1), and considering alternatives like uuidv7, hash indexes, BRIN indexes, and GIN/GIST for specific access patterns (ComputerGuru). Several commenters noted that for very early-stage or frugal startups, managed Postgres can be cost-prohibitive compared to SQLite, DynamoDB, or DuckDB (hmokiguess), while others stressed organizational discipline: avoiding ORMs, using append-only source-of-truth tables, minimizing explicit transactions and locking, and resisting anti-patterns like enum-typed tables or self-referential graph structures (frollogaston).
HN discussion
(180 points, 165 comments)
The article examines whether creatine supplementation improves cognitive function. Creatine is a nutrient naturally obtained from meat and synthesized by the body, essential for rapid ATP regeneration via phosphocreatine in muscles and the brain. It reliably increases strength and power output by 5–15% by expanding short-term energy reserves. The brain also contains creatine, and deficiency causes intellectual disability, suggesting a vital role. However, evidence for cognitive enhancement in healthy adults is weak. The seminal 2003 study (Rae et al.) reported massive IQ gains (~17–26 points) in vegetarians, but subsequent replications, including a large, rigorous 2023 trial (Sandkühler et al.), found only trivial, non-significant effects (~1–2.5 IQ points). Meta-analyses are hampered by methodological flaws and missing data. The European Food Safety Authority (2024) concluded that human studies do not show a consistent effect. The author estimates a possible small benefit (0.1–0.3 SD) for stressed populations (e.g., sleep deprivation, vegetarians, elderly) but considers the evidence inconclusive for healthy adults.
Commenters are largely skeptical of meaningful nootropic effects. The top-voted critique argues that the null replication results, combined with a low prior probability for supplement marketing claims, imply the cognitive benefits are likely illusory—driven by p-hacking, publication bias, or motivated reasoning. Several users report subjective benefits specifically for mitigating sleep-deprivation headaches and mental fatigue, not baseline cognition. Others note that increased water intake (necessitated by creatine) may explain perceived cognitive improvements. Historical contamination of creatine products with prohormones is cited as a confounder for early anecdotal reports. A few users reference Gwern’s independent analysis reaching similar conclusions. Questions remain about cycling protocols, pill formulations, pediatric safety, and potential interactions with vitamin D or ketogenic diets.
HN discussion
(210 points, 88 comments)
Brian "Beej" Hall, a veteran developer and CS instructor, explores his personal discomfort with claiming authorship of AI-generated work. While acknowledging the productivity gains of LLMs, he argues that "making" requires direct engagement with the craft—writing code, driving nails, painting strokes—and that prompting an AI feels like managing a contractor rather than creating. He tests this intuition against analogies (compilers, hammers, CNC machines) and finds the distinction blurry but meaningful: using a compiler preserves a mathematically precise, predictable relationship between input and output, whereas AI introduces an opaque, human-like negotiation. Hall concludes that for him, fulfillment comes from the act of making itself, not just the completed artifact, and that AI-assisted work—while useful—lacks the pride and understanding that come from hands-on creation.
Commenters largely split between those who share Hall's sense of lost craft and those who view prompting as a legitimate new layer of abstraction. Several emphasize that "making" entails internalizing understanding—if you couldn't recreate the work without the tool, you commissioned it rather than made it. Others compare AI to hiring contractors or using CNC machines: the vision and judgment remain yours, but the manual execution is delegated. A recurring theme is the bifurcation of developers into those who use AI to augment deep understanding versus those who outsource comprehension entirely. Some note they've lost motivation for side projects, while others celebrate shipping previously impossible projects. The compiler analogy draws scrutiny: unlike deterministic compilation, AI output is non-deterministic and less inspectable, breaking the reasoning loop that many consider essential to programming.
HN discussion
(203 points, 86 comments)
Dylan Castillo investigated whether AI labs are "pelicanmaxxing"—optimizing models specifically for the informal benchmark of generating an SVG of a pelican riding a bicycle, popularized by Simon Willison. The experiment generated 1,008 SVGs across seven frontier models (GPT-5.6 Terra, Claude Sonnet 5, Gemini 3.5 Flash, Grok 4.5, Qwen3.7-Max, GLM-5.2, DeepSeek V4 Pro) using a grid of 8 animals × 6 vehicles, with three samples per prompt. A three-stage pipeline rendered SVGs to PNGs, scored them via GPT-5.6 Luna (1–5 ratings for animal, vehicle, and coherence), and extracted scene features with Gemini 3.1 Flash-Lite. A fixed-effects regression controlled for the inherent difficulty of each animal–vehicle combination and tested for per-lab boosts on pelicans, bicycles, and the specific pelican-bicycle cell.
Visual inspection revealed no obvious superiority in pelican-bicycle outputs. Quantitatively, pelicans ranked 6th of 8 animals and bicycles 5th of 6 vehicles overall. The regression found no statistically significant per-lab pelican effects (all p > 0.25), no significant pelican-bicycle cell effects (largest GLM-5.2 at p=0.12), and only one marginal bicycle effect (Gemini 3.5 Flash, p=0.022)—consistent with a false positive given 21 tests. All 21 pelican-bicycle images faced right, but this matched the general right-facing bias (60% of all images) driven by bicycle drivetrain placement in training data. The author concludes there is little evidence of targeted pelicanmaxxing; the more plausible story is general "SVGmaxxing" (broad SVG capability improvement), which this design cannot detect. Limitations include a single LLM judge, a modest $80 budget, and inability to distinguish general SVG optimization from benchmark-specific tuning.
Commenters highlighted technical nuances: each model exhibited a consistent visual style across the grid (dcchambers), and specialized SVG models like Refract V4 produce markedly better results (johndough). Several questioned the scoring methodology, suggesting pairwise Elo ratings would be more reliable than absolute scores (tomas789). The difficulty of SVG generation for LLMs was emphasized—dllu likened it to "reciting coordinates," noting that raster image models handle the same scene easily but vector output requires structural decomposition that current LLMs lack. apwheele contrasted the pelican benchmark with practical icon generation, where models fail on simple icons despite succeeding on complex whimsical scenes.
Broader reactions included Simon Willison (simonw) praising the methodology and noting his "dream" of catching a lab cheating on his benchmark. mauvehaus provided a compelling explanation for the universal right-facing bias: bicycle drivetrains are on the right in training imagery, so models reproduce that perspective even when it implies the rider's legs are both on one side—evidence of pattern matching over mechanical understanding. andrewstuart and cute_boi criticized the benchmark itself as absurd and unrepresentative of real tasks, while BeetleB jokingly noted that publishing the dataset enables future training contamination. stusmall appreciated the quantitative rebuttal to persistent HN claims that labs secretly train on the pelican prompt, referencing Willison's own analysis of why such cheating would be detectable.
HN discussion
(228 points, 45 comments)
Gigatoken is a new Rust-based tokenizer library claiming ~1000x speedups over HuggingFace's tokenizers and tiktoken, both of which already use multithreaded Rust implementations. It supports most common tokenizers (BPE-based models like Llama, Qwen, DeepSeek, Gemma, Phi, Nemotron, Kimi, and others) and runs on modern x86 and ARM CPUs. The library offers two usage modes: a native Gigatoken API for maximum performance, and compatibility modes that drop into existing HuggingFace or Tiktoken workflows with reduced but still substantial speedups. Benchmarks on an 11.9 GB OpenWebText dataset show throughput of 8.3 GB/s (Apple M4 Max, 16 cores), 24.5 GB/s (AMD EPYC 9565, 144 cores), and proportional token rates. Key optimizations include replacing regex-based pretokenization with SIMD implementations, aggressive caching of pretoken mappings (addressing long-tailed distributions), minimizing Python-Rust boundary overhead, and reducing inter-thread communication. SentencePiece/WordPiece tokenizers are not yet well optimized. Windows support is limited; WSL is recommended. A CLI tool (`uvx gigatoken bench`) allows validation and benchmarking against HuggingFace models.
Commenters expressed amazement at the reported speedups, with several calling it "incredible" and "best release all week." A recurring theme was questioning practical impact: multiple users noted tokenization typically accounts for <0.1% of total LLM inference time, making the engineering effort seem disproportionate for inference workloads. However, others pointed out value for data preprocessing pipelines, dataset preparation, and standalone tokenization tasks. Technical questions included requests for compatibility-mode benchmarks (the article shows native API only) and whether HuggingFace would adopt the library upstream. One commenter speculated about similar 1000x optimization opportunities elsewhere in the inference stack. A Rust advocate suggested rewriting more Python tooling in Rust, while another humorously called optimizing a 0.1% bottleneck "the most software developer thing imaginable." The author responded in-thread, confirming optimizations are consistent across CPUs and tokenizers, and detailing the SIMD pretokenization and caching strategies.
Generated with hn-summaries