Hacker Newsnew | past | comments | ask | show | jobs | submit | rglullis's commentslogin

Oooh... can you imagine if servers actually took the hint and sent only text if the client provided Accept: text/markdown, text/plain headers?

> Accept: text/markdown

funnily enough, the rise in agentic coding has actually made this on the rise


If people are willing to consume content but not willing to pay for it, then you have a very strong indicator it has no value at all and therefore no actual need to be produced in the first place.

People willing to pay by consuming ads are indicating the content is worth that price - to them. The fact such people exist is proved by the fact such sites exist.

This is not how it works. Ad-subsidized content is functionally equivalent to price-dumping. The more ad-subsidized content is out there, the less incentive there is to focus on quality and quantity of eyeballs become the only metric that matters.

On the contrary, content quality is a major driver of ad revenue.

Then you'd have to explain why every reputable newspaper is putting up paywalls and all the quality sites that used to cover specific niches went out of business in the last 20 years.

Saying "revenue goes up with content quality" only makes sense if you compare one poor site with another, but when you put in terms of ROI, you will see it is a lot easier to set up hundreds of different content farms than to keep a sustainable source of well written, reputably sourced reports.


Or at least, not enough subjective value for that person to outweigh the cost. Paywalls are a great screening filter that actually tests if people want to spend any money or time on an article, or merely clicked through from force of habit.

So? Ads are a screening filter that tests if people want to spend time consuming ads to consume content.

What's odd is when people here complain of screening by ads because they'd think screening should instead be by money. It is proper that the choce for the publisher's site is made by the publisher and for the reader's visits is made by the reader.


> A funding crunch since 2023 yet those features have been necessary for many years before 2023.

But before 2023, the funding was going to things like solving state resolution, a VoIP system that was not dependent on Jitsi, getting rid of "could not decrypt message" errors, and so on.


Is Twitter still in any way relevant? I understand that those people who already have a following would be less inclined to give it up, but whenever I go back is to delete the half a dozen of bot comments on old posts of mine.


Twitter is the best source of information for AI. Much to bsky's dismay.


That sounds like a pro not a con for bsky :)


Not really. You still see celebrities and influencers use it occasionally. But it's fallen off dramatically compared to where it was just a few years ago. TikTok has largely replaced it.


"Don't do anything, let China handle it" ?


No just the first part, China ain't doing no ground invasion for oil, minerals and power half around the world. Iraq and whole surrounding region became a hellhole due and only due to US failed invasion, gave the world ISIS and screwed entire region badly for decades to come. Afghanistan became (again) a hellhole due to failed US invasion too, 0 positive long term things achieved, just death all around.

US military-industrial complex (aka the republicans in power but not only) will try and force any way US will spend trillions on military equipment again and again, thats glaringly obvious to literally whole world and not something new or secretly done behind many curtains.

If US would actually want to have an image (and not just self-image) of somebody standing up to tyranny and genocide and protecting the weak and just, they would support Ukraine and not backstab it frequently as they do. Thats a fine litmus paper for this in current times, don't need anything else. The fact that enemy there is a mortal enemy of US itself and all principles US holds (held?) dear like freedom, democracy, capitalism or right to self-determination is just the proverbial cherry on the top of the cake. No amount of words can bullshit around this simple fact.

Also in the process US is losing its by far biggest and strongest ally in whole world on all existential, moral and societal levels - Europe. An army of expert spies and hackers wouldn't be able to achieve in decades what current potus achieved in less than a year.


> No just the first part,

Ok. Then the question is "If the US really goes full isolationsist and packs it home, who takes the power vaccum?"

> China ain't doing no ground invasion for oil

I didn't say that "China handling it" is about invading anything. I also didn't say anything that the US is justified in invading Venezuela. I am just wondering that if those saying "the US shouldn't do anything" understand that someone will do something, even if this something is stupid, counterproductive or plain evil.


Nostr will always be a fringe network. The normies do not want to manage their own keys.


Hopefully some day we will get state-managed PKI, and citizens will get used to handling their keys appropriately.

It's crazy that some functionality on e.g. the IRS website requires me to verify my identity using a private company (ID.me).


That also goes to the other extreme.

For all the faults of current Fediverse software implementations, it at least gives more options than nostr. If you don't care about controlling your own identity, you can use someone else's server. Nostr doesn't give you that, it's all or nothing.


No thank you. That last thing anyone should want is governments holding ownership over their private keys.

Private companies are bad enough, but at least they won't declare you an undesirable for your political beliefs or religion or ethnicity or gender identity or sexual preference or whatever and shoot you in the head over it.

Except where governments and private companies collaborate, which of course happens (looking at you literally every American social media platform.)


There's certainly a middle ground. I'd like to have A WAY to authenticate with the US government, other than an in-person ID check or a random private company.

It would be great if governments provided the option to authenticate with third party PKI. Having a public option would be nice as well. Identity management and verification is a core competency of government, after all.


> Hopefully some day we will get state-managed PKI, and citizens will get used to handling their keys appropriately.

Passports have had keys in them for a while now (so-called "e-passports")


These keys are intentionally not usable for non-repudiable signatures.


european IDs already have a chip with your personal keys and you can use that to log into any state operated service


Neither do all EU member states (in case you mean that by "European") issue ID cards, nor do the ones that do universally enable them for digital signatures.

Many EU countries have existing e-signature rails completely independent from physical ID cards, which only have to conform to ICAO document verification standards (and these are intentionally not usable in an e-signature context).


There is no European ID. Please specify individual countries (I think this is just Estonia at the moment?)


German ID cards also support eID functionality on their citizen ID cards and even permanent resident ID cards, but ironically EU citizens are qualified for the issuance of neither, so they had to introduce another type of card for them to not run afoul of EU anti-discrimination laws.

All of this is currently pretty messy and there's only limited practical cross-country acceptance of eIDAS signatures, but is supposed to get unified under the banner of EUDI (EU Digital Identity) "wallets".


Portuguese IDs also have a sim card, but I never used it for anything other than accessing government services.


in my case Spain with the DNI 3.0 but as others commented its a thing in many of them


has been the case for Hungarian ID cards for a decade now, but it was never really used, except maybe by burorats in gov offices to access their systems.

but no one understands it, including the people who need to issue new signing keys.

it didn't get anywhere really. it was just a good opportunity for a lot of taxpayer money to... "lose its taxpayer money nature" (actual phrase by an actual politician when cornered by questions).

and now they are "moving on" to an app that must be installed on your phone to access more and more services.

ID2030 is roaring on worldwide... soon mandatory iris scans, vaccine implants, and who knows when they will try to roll out mandatory brain implants against thought crimes.

the more i think about the sign of the beast (as an atheist), the more sense it makes.


Normies manage their house keys just fine. Obviously crypto keys come with different challenges but that's a UX problem. People losing their house keys is not generally an Earth shattering event. Losing a crypto key doesn't have to be either.

A wallet is easier to lose than a bank vault, but it also holds less money for the same reason. Crypto keys can be designed the same way, with high importance keys managed by safer means like m of n schemes mixed with traditional "hard" storage in geographically distributed safe deposit boxes or whatever, while less important keys can be treated in a more relaxed fashion.


This analogy misses the entire system keeping house keys manageable. If you lose your keys, a locksmith can help you regain access cheaply and quickly because there’s an entire legal system allowing you to prove that you are the legitimate owner. The system you describe for crypto keys is not only significantly harder to use but also lacks that cushioned landing if any part of that fails. Any teenager with poor impulse control can toss a brick through the window and gain access to my house, maybe even grab the spare keys, but they couldn’t occupy it for very long or transfer it to a new owner, which is a significant risk mitigation compared to those crypto keys even before you consider how many more attackers you have to worry about online – there’s no real-world analog to some guy phishing someone on the other side of the planet to post ads or make fake reviews, secure in the knowledge that their local police don’t care.


>People losing their house keys is not generally an Earth shattering event.

yes because if you lose your house keys you don't lose your property, precisely because there is an entire legal and governmental apparatus securing it, the exact thing the crypto people first try get rid off and then reinvent (shoddily) when they inevitably discover that nobody wants to live in the jungle


> Normies manage their house keys just fine.

Your local locksmith would beg to differ.


Not really sure this analogy works since the usability of my house and everything in it is unrelated to having them. The house keys only make getting into my house easier.


People seem to manage their whatsapp (or signal, etc) keys just fine. Because its an app that just stores it as a file and doesn't tell you about it.

So i think there are viable solutions here. It mostly just means having an app to manage the keys for you.


> People seem to manage their whatsapp (or signal, etc) keys just fine.

The opposite is the case: WhatsApp and Signal manage the keys for them, mostly in the background (unless you actively verify identities).

You can try it yourself: Turn off your phone, ask a friend to send you a message, throw your phone into a volcano, reactivate your account on a new phone without entering any secret keys. You'll still receive the message.

I personally think that most of Signal's and even WhatsApp's tradeoffs are reasonable for a product with an adaption of hundreds of millions, but it's decidedly not cryptographic self-custody.


Both signal and WhatsApp punt key revocation and recovery to phone number verification, so ultimately these keys belong to phone number provider.


Sure, there are costs involved in the trade off, but the benefit is a system that actually works for the average user.


My point is that is this is not a trade-off but a complete violation of the principles that are used to justify the existence of nostr.

Nostr's whole shtick is about "users owning their keys". If I can not change the keys used on WhatsApp or Signal, I do not own them. They are not in the same class, so the comparison is moot.


I dont see any reason why an app approach cant support that.

But honestly one of the reasons why these sorts of apps dont take off, is they rigidly adhere to security properties that dont make sense and nobody really cares about, at the expense of making an unusable app.


> I dont see any reason why an app approach cant support that.

Matrix clients have e2ee encryption like Signal or WhatsApp.

Every single one of my close contacts that I have on my server have ignored or misunderstood the instructions to download and store the recovery key when they first access the servers.

I have customers on my support channel who keep trying different clients (Element, ElementX, Fractal) and every time they fail to validate their sessions.

Then I have customers who got their phone stolen and then come asking me to either delete the data on their phone.

---

There is no magic about "putting it in a app to manage it". If any "app approach" you come up with creates a sandbox between user and device, then the user can not even see their private keys, then they effectively do not own it.

If you are doing "nostr, but with keys sandboxed on the device", then you are just recreating Signal - which is not decentralized - then what's the point?


Sandboxing keys on the device is indeed removing one point of nostr, but to clarify on your point: The difference between Signal and Nostr is that in nostr there are hundreds of independent servers (relays) that your app broadcasts events to, whereas on Signal it's just one centralized server.


There is nothing special about independent relays. ActivityPub also have relays around. Store-and-forward is how IRC works.


https://sneak.berlin/20181022/sneaks-law/

sneak’s law: “Users can not and will not securely manage key material.”


they already manage passwords and passkeys. It isn't that complicated.



how is it any more difficult than taking care of a password?


It is not about the difficulty, it's the potential consequences.

People also take care of their house keys and their wallets, but If I lose the keys to my house, it isn't automatically taken over by squatters and if I lose my ID card I can issue a new one quickly.

What happens if you lose the cryptographic key to your nostr account? Who do you call for help?


Can I click a link to reset my keys?

What happens when the key is lost, and the consequences like "lose all your money" or "lose your account access" are non-starters, as someone who owns a hardware key for my email account

Multi-sig wallets are even more complicated and not for normies


what happens if you lose your password? You click a link to reset it, and it gets sent to your email. What happens if you lose access to your email password?

It is the same problem.


My email has multiple recovery methods

It's not the same problem


Send your key to your email. Then it's less secure but I take it you wouldn't mind.


This attitude (the snark) is why Nostr fails to attract any meaningful number of users outside of the crypto bro cult(ure)


I'm again toying around with the idea of building an ActivityPub Server built around the principles of RDF, JSON-LD and the Linked Data Platform. [0]

It can work already as a "Generic" ActivityPub server and it can be made to work with Client-to-Server API, but given that there are not mature clients for that, I am now in the middle of an exercise where I am taking the existing server and implementing Lemmy's and Mastodon's APIs based on top of it. Once I can get any Lemmy and a Mastodon client working, I will then start changing their own SDKs, and then I can replace calls from their application-specific APIs with direct calls to Linked Data server.

  [0] https://activitypub.mushroomlabs.com


zk-proofs already exist to do just that.


They’ll need a contextual system around them that is convenient and trusted by people who don’t know what they are or how they work in order to be successful


By your analogy, the developers of stockfish are better chess players than any grandmaster.

Tool use can be a sign of intelligence, but "being able to use a tool to solve a problem" is not the same as "being intelligent enough to solve a specific class of problems".


Im not talking about this being the "best maze solver" and "better at solving mazes than humans". Im saying the model is "intelligent enough" to solve a maze.

And what Im really saying is that we need to stop moving the goal post on what "intelligence" is for these models, and start moving the goal post on what "intelligence" actually _is_. The models are giving us an existential crisis on not only what it might mean to _be_ intelligent, but also how it might actually work in our own brains. Im not saying the current models are skynet, but Im saying I think theres going to be a lot learned by reverse engineering the current generation of models to really dig into how they are encoding things internally.


> Im saying the model is "intelligent enough" to solve a maze.

And I don't agree. I think that at best the model is "intelligent enough to use a tool that can solve mazes" (which is an entirely different thing) and at worst it is no different than a circus horse that "can do math". Being able to repeat more tricks and being able to select which trick to execute based on the expected reward is not a measure of intelligence.


I would encourage you to read the code it produced. Its not like a simple "solve maze" function. There are plenty of "smart" choices in there to achieve the goal given my very vague instructions, and as a result of it analyzing why it failed at first and then adjusting.


I don't know how else to get my point across: what I am trying to say is that there is nothing "smart" about an automaton that needs to resort to A* algorithm implementations to "solve" a problem that any 4-year old child can solve just by looking at it.

Where you are seeing "intelligence" and "an existential crisis", I see "a huge pattern-matching system with an ever increasing vocabulary".

LLM's are useful. They will certainly cause a lot of disruption of automation on all types of white-collar work. They will definitely lead to all sorts of economic and social disruptions (good and bad). I'm definitely not ignoring them as just another fad... but none of that depends on LLMs being "intelligent" in any way.


> They're not paying me to use it.

Of course they are.

> As long as the inference is not done at a loss.

If making money on inference alone was possible, there would be a dozen different smaller providers who'd be taking the open weights models and offering that as service. But it seems that every provider is anchored at $20/month, so you can bet that none of them can go any lower.


> If making money on inference alone was possible, there would be a dozen different smaller providers who'd be taking the open weights models and offering that as service.

There are! Look through the provider list for some open model on https://openrouter.ai . For instance, DeepSeek 3.1 has a dozen providers. It would not make any sense to offer those below cost because you have neither moat nor branding.


> If making money on inference alone was possible

Maybe, but arguably a major reason you can't make money on inference right now is that the useful life of models is too short, so you can't amortize the development costs across much time because there is so much investment in the field that everyone is developing new models (shortening useful life in a competitive market) and everyone is simultaneously driving up the costs of inputs needed for developing models (increasing the costs that have to be amortized over the short useful life). Perversely, the AI bubble popping and resolving those issues may make profitability much easier for the survivors that have strong revenue streams.


You need a certain level of batch parallelism to make inference efficient, but you also need enough capacity to handle request floods. Being a small provider is not easy.


The open models suck. AWS hosts them for less than closed models cost but no ones uses them, because they suck.


It's not the open models that suck, it's the infrastructure around them. None of current "open weights providers" have:

   - good tools for agentic workflows
   - no tools for context management
   - infrastructure for input token caching
These are solvable without having to pay anything to OpenAI/Anthropic/Google.


Why would the open weights providers need their own tools for agentic workflows when you can just plug their OpenAI-compatible API URL into existing tools?

Also, there are many providers of open source models with caching (Moonshot AI, Groq, DeepSeek, FireWorks AI, MiniMax): https://openrouter.ai/docs/guides/best-practices/prompt-cach...


> when you can just plug their OpenAI-compatible API URL into existing tools?

Only the self-hosting diehards will bother with that. Those that want to compete with Claude Code, Gemini CLI, Codex et caterva will have to provide the whole package and do it a price point that is competitive even with low volumes - which is hard to do because the big LLM providers are all subsidizing their offerings.


They do make money on inference.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: