Hacker Newsnew | past | comments | ask | show | jobs | submit | petcat's commentslogin

They also got to keep their new Ayatollah and continue with their religious government. An escalation of the war would have certainly ended with a complete regime change. Which would have been very expensive in life (Iranians) and money (Americans).

A complete regime change would probably only come with a large scale invasion, bigger than Iraq's. A huge majority of Americans don't want that.

Or with their people rising up, which is I think what the US and Israel were hoping for - though they didn’t seem to plan for a way to actually make it happen.

We will see what happens at the end of this war when people come out of their homes to a crumbling country. They could decide that enough is enough and bring in some change.

There was never going to be a regime change. Continuing the war meant many Americans were going to die (in addition to bankrupting the US). I'm a US citizen and very glad Iran came out on top here.

US is bankrupt to the tune of trillions already.

When you don't the money, you can't go bankrupt.

But, if you had an amazing reputation for paying your debts, and get super low interest rates because of it, and all of a sudden you change your reputation and demand for holding your debt and currency goes down, well, then that's created a massive problem for the currency that reduces everyone's quality of life drastically.


Their new Ayatollah is braindead. It's not over yet.

> has less cores than I remember seeing at the same price a decade ago

Less cores but probably 5x more performance per core now.


This is more helpful when software doesn't just pin the first 4 available cores at 100% to get things done.

How? If each core is 5x faster then it's done 5x sooner. I can't think of a use case for a cheap vps where 5x faster per core cpus are not helpful.

A slower background transcode usually doesn't matter, but a faster transcode that stops important processes running in the meantime might. This is usually fixable with effort, but sometimes it's nice to not have to configure everything to the nth degree.

I don't really buy it. The idea that somehow getting one less core but faster per core speeds per pricing bracket makes any difference in this imagined problem.

There are many different configurations of vps available with different numbers of cores, if you are picking the vps configuration specifically to have more cores than some transcoding software uses by default to avoid configuring a thread limit for that software then you are still configuring things to the nth degree just at the objectively wrong level of abstraction.


You don't have to buy anything, however I ran into this exact issue two days ago. YMMV

Vercel is basically just an AWS reseller too though

I have found that Claude Opus 4.6 is a better reviewer than it is an implementer. I switch off between Claude/Opus and Codex/GPT-5.4 doing reviews and implementations, and invariably Codex ends up having to do multiple rounds of reviews and requesting fixes before Claude finally gets it right (and then I review). When it is the other way around (Codex impl, Claude review), it's usually just one round of fixes after the review.

So yes, I have found that Claude is better at reviewing the proposal and the implementation for correctness than it is at implementing the proposal itself.


Hmm in my experience (I've done a lot of head-to-heads), Opus 4.6 is a weaker reviewer than GPT 5.4 xhigh. 5.4 xhigh gives very deep, very high-signal reviews and catches serious bugs much more reliably. I think it's possible you're observing Opus 4.6's higher baseline acceptance rate instead of GPT 5.4's higher implementation quality bar.

This is also my experience using both via Augment Code. Never understood what my colleagues see in Claude Opus, GPT plans/deep dives are miles ahead of what Opus produces - code comprehension, code architecture is unmatched really. I do use Sonnet for implementation/iteration speed after seeding context with GPT.

I agree. Opus, forget the plan mode - even when using superpowers skill, leaves a lot of stuff dangling after so many review rounds.

Along with claude max, I have a chatgpt pro plan and I find it a life-saver to catch all the silliness opus spits out.


I agree, I use codex 5.4 xhigh as my reviewer and it catches major issues with Opus 4.6 implementation plans. I'm pretty close to switching to codex because of how inconsistent claude code has become.

Maybe it's all just anecdotal then. Everyone is having different experiences.

Maybe we're being A/B tested.


The experience one has with this stuff is heavily influenced by overall load and uptime of Anthopic's inference infra itself. The publicly reported availability of the service is one 9, that says nothing of QoS SLO numbers, which I would guess are lower. It is impossible to have a consistent CX under these conditions.

I have noticed this as well. I frequently have to tell it that we need to do the correct fix (and then describe it in detail) rather than the simple fix. And even then it continues trying to revert to the simple (and often incorrect) fix.

You have to throw the context away at that point. I've experienced the same thing and I found that even when I apparently talk Claude into the better version it will silently include as many aspects of the quick fix as it thinks it can get away with.

I have a similar workflow but I disagree with Codex/GPT-5.4 reviews being very useful. For example, in a lot of cases they suggest over-engineering by handling edge cases that won't realistically happen.

No need to ban phones, just coat the walls in magnetic paint and install faraday cages on the windows.

You will get "No bars". (and also maybe no customers and a safety code violation?)


Intentionally interfering with 911 would probably be a poor decision.

Passive interference like this isn’t illegal, although you might have a lawsuit if a customer gets injured and it takes a few extra seconds for someone to step outside and dial 911 (people will sue over anything). It’s active jamming that violates FCC regulations.

Oh yeah definitely. Also your own POS system probably wont even work unless it's hard-wired.

Have staff/employee wifi for the PoS to use.

Wifi wont work at all (or at least be very packet-droppy) in this configuration

Hi, I have worked in numerous shielded environments, built one, and am in the process of building a second.

Wifi works perfectly fine inside a shielded enclosure, if both the AP and the client are inside the shield. It should not work across the shield, if the AP is inside and the client is outside, or vice versa. (If that worked, it wouldn't be a very good shield.)

It is entirely plausible, practical, and not even all that hard, to build precisely the environment described up-thread. "Magnetic" paint is not necessary, it just has to be conductive. Ecofoil® Ultra NT® is my favorite shielding material, it's good as a radiant energy barrier (say, to keep your hot roof from radiating heat down at your attic) and as a radiant signal shield. Which makes sense, when you consider that RF is just RF is just RF. Filtered power passthroughs aren't particularly hard (Start with the Delta 20DBAG5 and add some ferrite beads), and if you really want to be snazzy with your data passthrough, use fiber. There are all sorts of cheap-and-cheerful ethernet switches with SFP slots now.

The door seals are the tricky part. Commercial shielded enclosures go all-out with complicated lever-actuated doors that wouldn't feel out-of-place on a bank vault, but I've found that simply sanding the paint off a commercial steel door and covering the bare steel with copper tape, then engaging it with beryllium-copper spring finger-stock around the doorjamb, is sufficient for about 60-80dB of isolation, which is plenty in many environments.


Good to know! I only knew about the magnetic paint because a company I worked for a long time ago wanted to put up big mural-like pictures throughout the office space and decided to mount them on magnets and cover the walls in magnetic paint so they would stick. But then some of our conference rooms couldn't get good wifi even though the AP was right next door... We only figured out later (after putting hard-wired APs in every room LOL) that it was because of the magnetic paint.

Inside of the cage it'll be fine. It just won't do great traversing the boundary. As long as there's a WAP/antenna inside the cage everything inside the cage will get a signal.

Jamming cell signals is illegal. There are good reasons for this such as people who are on call or people who need to call 911.

The only way around this is to build somewhere that happens to have no cell reception.


Passively blocking signals through absorptive materials is not jamming and is not illegal.

> Customers on existing Plus, Pro and Enterprise/Edu plans should continue to use the legacy rate card. We’ll migrate you to the new rates in the upcoming weeks.

> Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address.

I think a lot of services will "de-alias" the email addresses from these tricks to prevent alts, account spam, and to still target the "real" account holder email. So the old tricks like "<name>+<website>@<host.com>" is not considered a unique email from "<name>@<host.com>". Unless your site-specific emails are completely new inbox aliases, then I don't think this is as effective as people think it is anymore.


The way that this is done these days (and likely what the author did/does) is that you use a custom domain to receive mail; you provide an email like service@custom.com, and that way when service@ starts receiving spam you know exactly where it comes from

^ I've been doing this with catchalls since before Google Apps for Domain was even a thing.

Sometimes customer support staff bring up "oh, do you work at <company> too"? I just tell them that I created an email address just for their company, in case they spam me.


> up "oh, do you work at <company> too"?

Oh boy, I had many of these conversations and especially non technical people never grasp the concept, I had some cases where they demanded to change it and use a “real email like gmail!!”, one time I bought shoes and the store guy asked me the email to signup for whatever, so I read the shoe’s name and added the custom domain, gave me the the look as if I am bullshitting him. Another at a government connected agency and she thought “I work there because I have the agency email” despite it is the alias not the domain.

But similar to OP, few times I found the service is leaking my email, or they got compromised who knew.


I've got a few dozen domains, and primarily use two of them for business interactions. One is a catchall, while the other requires me to create explicit email addresses (or aliases).

Aside from issues such as the business entity (sometimes silently) prohibiting their name in my email address, I have sometimes encountered cases where part of the email validation process checks to see if the email server is a catchall, and rejects the email address if it is. It takes a little extra effort on my part to make a new alias, but sometimes it's required.

Lots of organizations (such as PoS system providers) will associate an email I provided with credit card number, and when I use the card at a completely different place, they'll automatically populate my email with the (totally unrelated) one that they have. Same goes for telephone numbers.

I've had many incidents similar to the author. More often than not, it's a rouge employee or a compromised computer, but sometimes it is as nefarious as the author's story.


Wildcard email addresses will subject you to a torrent of spam when spammers try dictionary attacks against your domain. It's better to explicitly create aliases, I built a web UI for Postfix to do this for myself and family (https://GitHub.com/fazalmajid/postmapweb)

> checks to see if the email server is a catchall

How is this possible? Do they test sending to a few random addresses?


I am more specific: if I start receiving pornographic spam like I did to the address I gave Dell, I will know they have been hacked.

I will also not hold my breath waiting for the legally required breach notification they are supposed to send.


Take it a step further and do uuid@

yes, but service is too guessable, so append a randomly generated nonce as well, eg service_rjfh34@example.com. It doesn't need to be cryptographically random, just non trivially guessable to prove the service is leaking email addresses.

iCloud has a great feature that allows you to generate unique aliases on the fly quickly and easily. For example when signing up for new services via the web browser on iOS, you can generate a new address with the click of a button.

Many years ago, before I started using iCloud Mail, I was running my own email server and had it set up to forward everything sent to any address on my domain to my inbox. The advantage was that I could invent random aliases any time I wanted and didn’t even need to do anything on the server for those emails to get delivered to my main inbox. The very big drawback as I soon experienced was that spammers would email a lot of different email addresses on my domain that never existed but because I was going catch-all, would also get delivered to my main inbox. They’d be all kinds of email addresses like joe@ or sales@ or what have you. So apparently they were guessing common addresses and because I was accepting everything I’d also get tons of spam.


The downside of such iCloud aliases is that you cannot send emails from there (you can only reply to emails, and ofc receive emails)

True, and there has been a time or two where that has been inconvenient for me as well.

Initial account creation confirmation email, and maybe even some newsletters, were sent from noreply@ some domain. Responding to such an email address directly will likely either bounce or be silently dropped on their side, as indicated by them using noreply as the sender address.

The website might say to email support@ their domain. But because like you point out iCloud alias addresses cannot be used as sender when composing a new message, and I don’t have any past received emails from that address, I can’t email them using the same alias email address that I used to create an account.

And of course if the account belongs to jumping.carrot-1j@icloud.com and I instead send an email to them from a different sender address, then they will be sceptical about whether it really is the account owner trying to get in touch or some impostor. Assuming they don’t completely ignore the email on that grounds, you might eventually get support if you are able to either answer questions from them about past invoice amounts and dates or similar, or if they are willing to email the original account owner address from their support address. But it’s extra hassle, if they even bother to respond at all.

Fortunately most websites have a contact form or similar to get in touch with their support, but there are a few sites that have an email address as the only way to contact their support.


I use Fastmail with my own domain and 1Password. Together they give me a “masked email” button for forms that generates a random enough email address (two common words and four digits) and records the domain it was for. You can also create them ad-hoc from Fastmail’s interface.

As well as simply attributing leaks, it’s most valuable as a phishing filter. Why would my bank ever email an address I only used to trial dog food delivery?


Yeah, Fastmail's aliases are great. I used to do things described by some other commenters, like myemail+nameofservice@ and whatnot, but this way the email is automatically generated and you don't have to put any thought into it.

I just do <website>@<myhost.tld>. It is sometimes confusing by when interacting with customer support ;-)

Yes ma'am, my email address really is bofa.com@<optionoft's-lastname>.com

No I'm not trying to hack you.

Which in hindsight is also what a hacker would say. I can't win...


Where, of course, 'bofa' is merely short for 'bofetada.'

On top of it my email address is .me so is very common to when I finish spelling my e-mail, people waiting for .com

There are some big brain companies who will block you if their name appears in the email address. Like Discord. You can create an account, with discrod@example.com. But a seconde later you will get an email that your account got band.

They know their way around IT security! /s


What you say is often true, but in the case of Discord, at least in my case, you are wrong. My Discord email address is discord@xxx.com, and I am still receiving emails from them.

It happend to me when i created my account in 2025. Within seconds of verifying the address I got a email that my account was band for TOS violation. I than created a seconds account (within minutes from the same IP) only writing "dc" instead of "discord" and that worked. ¯\_(ツ)_/¯

Apparently they (unlike other entities I've dealt with) did not go back and review all of the existing, valid email addresses in their user database.

It's always an unpleasant surprise when some company terminates a years-old, active and valid account because of a stupid policy change on their part.


I had one website forward my mail to their legal department who asked me why I’m impersonating them :D Only required a short explanation though.

I've had this a couple times too

I often get asked whether I'm a fellow employee.

I have an account just like that at Best Buy with my domain. The teenage cashier I gave it to thought it was cool.

Of course. I use Firefox Relay to generate a unique email address for every site where I have to use an email. That method hasn't failed me so far.

I use DuckDuckGo Email and it generates unique addresses that I can both receive emails (obviously) and reply to from that email. There's also an option to shutdown that address and never receive spam again.

> So unless your site-specific emails are completely new inbox aliases, then I don't think this is as effective as people think it is anymore.

Even if it's a "new" alias, I often see people[1] using simple schemes to derive the address, eg. facebook@mydomain.example. With cheap LLMs it's not hard to automatically guess what the underlying pattern is.

edit:

[1] ie. in this very thread


I personally do x@mydomain.com. It makes it very obvious when you start getting spam (I’m looking at you dji).

> Instead of reimbursing the customers who paid more for goods, Costco said on a March 2026 earnings call that it plans to use tariff refunds to lower future prices.

> That plan enraged customers who joined Costco based on the proposition that Costco would operate on the slimmest possible margins to ensure they never pay more for goods than Costco can afford to sell them.

I feel like Costco is generally a pretty good company, but this is a wild fantasy when dealing with any commercial entity with a fiduciary responsibility to shareholders.


As a long-time Costco member and very minor shareholder (like 10 shares), lawsuits like this are frustrating. It is in my best interest as both member and shareholder for Costco to relentlessly look for opportunities to reduce costs, including getting credits back from procurement and sourcing. It would be costly to try and determine the tariff impact to every member and then pass it back along. I'd rather see those funds contribute to keeping prices low by offsetting other cost pressures.

Fiduciary duty is fun to define because I’d bet it could be argued both ways here. If you want to consider Costco’s low margins as a core factor as to why consumers choose them, opting for a decision that makes their customer base run off wouldn’t be very responsible to shareholders.

Consider the Target backlash last year. They’re since down 14% vs Walmart (up 30-ish%). Regardless of anyone’s political beliefs, I don’t think a 14% loss seemingly caused by behavior that a segment of customers considered hostile is thinking of the shareholders.


Right but they're not being sued by their shareholders, they're being sued by a handful of customers and "on Behalf of All Others Similarly Situated".

> they're being sued by a handful of customers

To be fair, they’re being sued by customers who were marketed memberships.


To be really fair, they're being sued by lawyers hoping to take 50% of the proceeds, or 50% of some settlement that they get by shaking down Costco via threats to its reputation.

> To be really fair, they're being sued by lawyers

Is that the case history? Or bullshit assumption? Because this looks plaintiff sponsored.


Adding "bullshit" to a sentence does nothing to hide this kind of ambulence-chasing vulturism and exploitation - in fact it rather highlights it.

I mean, one of the legal firms behind this is Milberg PLLC, https://en.wikipedia.org/wiki/Milberg, who has been charged with illegally paying plaintiffs to sue in order to enrich themselves.


> this is a wild fantasy when dealing with any commercial entity with a fiduciary responsibility to shareholders.

"Fiduciary duty" is less strict than you'd expect. Courts generally recognize a "business judgment rule," where executives are offered broad discretion in strategy subject to some basic reasonability tests.

This would allow Costco to say "in order to cultivate goodwill and maintain our reputation, after we receive refunds we will distribute them to our customers based on purchased goods with refunded tariffs." It would also allow the directors to book the refund as profits, or use it for later incentives or marketing, or a variety of other actions.

The 'fiduciary duty' aspect here is mostly a myth. Directors do indeed have a fiduciary duty, but that duty is towards the corporation as a whole – including its long-term interests – rather than strictly towards short-term profit maximization. The fiduciary duty doctrine exists more to prevent graft and self-dealing, where managers and directors 'loot' the company by smuggling out profits in ways that benefit themselves personally rather than the company as a whole.


I don't even really understand why that plan would be "enraging" or really even counter to what customers expect from Costco. Assuming you continue to buy from Costco, and most Costco customers are regular buyers, you'll effectively get the money back in future lower prices and end up paying the same total amount on Costco purchases as if they had sent you a refund check.

I can see the appeal of an immediate refund check, but using the tariff refund to lower future prices for customers in a way that drives continued sales seems like both responsible thing to do from a fiduciary perspective and a not unreasonable compromise for the customer. Many companies would, and will, simply pocket the refund.


Especially given the complexity of how prices actually increased. Did priced change solely due to tariffs? No, there were other factors.

This whole this is just lawyering at its core. I find the outrage “on behalf of customers” to be disingenuous.


I advise not to waste any time/tokens building clients for 3rd party commercial platforms even if they claim to allow it (Discord doesn't and will ban you).

Twitter, Reddit, etc. are all infamous rug-pullers that should have taught everyone this lesson permanently.


Curious how people and companies like this are approaching matters of intellectual property now that the courts have ruled that basically no part of AI generated content or code is copyrightable and is therefore impossible to claim ownership of.

Are people just not going to open source anything anymore since licenses don't matter? Might as well just keep the code secret, right?


It was always a bit weird how heavily software companies leaned on copyright, and I think you could basically replicate the same intuitions and dynamics on top of trade secret law if you had to. KFC didn't go out of business when a Chicago Tribune reporter found what's most likely the secret recipe.

I'm also not sure that the current precedent on the matter is _quite_ as strong as you're thinking. The high-profile case you're most likely thinking of was from a guy Stephen Thaler, who was seeking not just to claim copyright on AI-generated content but to specify the AI as the sole author. (IIUC, he planned to still own the copyright on the theory that it was a work-for-hire.)


There are no secrets when you are using AI providers. They track all interactions b/c that's valuable information for improving their models.

I'm talking about sharing things publicly that you are trying to claim as your own

It doesn't matter. If someone has the same idea then they can use AI the same way you did to recreate it. Keeping it a secret benefits no one other than the AI providers b/c now they can charge money for giving someone else "your" code. The AI providers don't care about license restrictions so it's the perfect way to launder code. If you want credit for something then you'll have to claim it publicly b/c the AI providers sure as hell are not going to give you any credit.

strange downvotes, not only these services allow anyone with money to copy their competitors if they use the same services, but on the long run, Anthropic could very well be the competition, trained on corporations that use Claude. Why would this startup be any different from Google or Microsoft on the long run? People can't seem to learn their lesson.

People are very naive about how technology companies operate.


Even if you believe the "we don't train on your data" claim/lie, that leaves a whole lot of things they can do with it besides training directly on it.

Analytics can be run on it, they can run it through their own models, synthetic training data can be derived from it, it can be used to build profiles on you/your business, they could harvest trade/literal secrets from it, they could store derivatives of your data to one day sell to competitors/compete themselves, they can use it to gauge just how dependent you've made yourself/business on their LLMs and price accordingly, etc.


No. Your data or any derivative of it does not leave RAM unless you are detected as doing something that qualifies as abuse, then it is retained for 30 days.

Even the process of deciding what "qualifies as abuse" does what I'm talking about: they're analyzing your data with their own models and doing whatever they want with the results, including storing it and using it to ban you from the product you paid for, and call the police on you.

Either way, I don't believe it.


You are a Star Wars Rebel fighting Darth Vader. Good job!

Thanks

That's about the API. It doesn't say anything about their other products like Codex. Moreover, even in the API it says you have to qualify for zero retention policies. They retain the data for however long each jurisdiction requires data retention & they are always improving their abuse detection using the retained data.

> Our use of content. We may use Content to provide, maintain, develop, and improve our Services, comply with applicable law, enforce our terms and policies, and keep our Services safe. If you're using ChatGPT through Apple's integrations, see this Help Center article (opens in a new window) for how we handle your Content.

> Opt out. If you do not want us to use your Content to train our models, you can opt out by following the instructions in this article . Please note that in some cases this may limit the ability of our Services to better address your specific use case.

https://openai.com/policies/row-terms-of-use/ https://openai.com/policies/how-your-data-is-used-to-improve...


Codex just talks to the responses API with store=false. So unless the model detects you are doing something that qualifies as abuse, nothing is retained.

Alright, good luck to you. I'm not really interested in talking to people who think they're lawyers for AI providers. If you think they don't keep any of the data & don't use it for training then you are welcome to continue believing that. It makes no difference to me either way.

> Alright, good luck to you. I'm not really interested in talking to people who think they're lawyers for AI providers.

Codex is open source, you can inspect it yourself, but let's not let facts ruin your David vs Goliath fantasy.


And you believe them?

Yes. That's the rational position.

There is no such court ruling.

Courts ruled that AI works can't be copyrighted

https://fairuse.stanford.edu/case/thaler-v-perlmutter/


Please read the link you're citing

> The court held that the Copyright Act requires all eligible works to be authored by a human being. Since Dr. Thaler listed the Creativity Machine, a non-human entity, as the sole author, the application was correctly denied. The court did not address the argument that the Constitution requires human authorship, nor did it consider Dr. Thaler’s claim that he is the author by virtue of creating and using the Creativity Machine, as this argument was waived before the agency.

Or in other words: They ruled you can't register copyright with an AI listed as the author on the application. They made no comment on whether a human can be listed as the author if an AI did the work.


An earlier attempt at registering AI creations without AI attribution was rejected by the Copyright Office[1], saying that person in particular needed to make an AI attribution, which they were originally not doing.

In this case, the court is saying AI attribution is not okay, either. There is no way to register copyrights for AI creations.

It's consistent with the Copyright Office's interpretation of copyright law where it holds that it only applies to human creations and doesn't apply to non-human creations, which is what they say AI creations fall under:

> The Copyright Office affirms that existing principles of copyright law are flexible enough to apply to this new technology, as they have applied to technological innovations in the past. It concludes that the outputs of generative AI can be protected by copyright only where a human author has determined sufficient expressive elements. This can include situations where a human-authored work is perceptible in an AI output, or a human makes creative arrangements or modifications of the output, but not the mere provision of prompts.

[1] https://www.copyright.gov/rulings-filings/review-board/docs/...

[2] https://newsroom.loc.gov/news/copyright-office-releases-part...


Bullshit. Did you even read the court's opinion in that case? The Dunning-Kruger effect strikes again.

You think people open sourced things mostly because of license obligations?

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: