Hacker Newsnew | past | comments | ask | show | jobs | submit | lucb1e's commentslogin

I don't understand. It says for the first task:

> URL: <https://...docs...> What parameters does the Create Stream endpoint accept?

The answer that I would give is `name`, `description`, `retention_days`, and `tags`. What the answer sheet <https://agentreadingtest.com/answers.json> has is: `CANARY-TRUNC-10K-fox` ("Early in the page. All agents should find this."), `CANARY-TRUNC-40K-river`, `CANARY-TRUNC-75K-summit`, etc. These words appear on the page, but why would the LLM output include these? The first one appears before the API endpoint subpath specification, and the second in the middle of a word in the decryption. They do not answer this test question of what parameters are supported

A later test is to see if it can deal with broken pages, ("an unclosed ``` fence", specifically). Wouldn't it not echo those tokens if it can deal with seemingly erroneous strings on the page?

How is this test supposed to work?


Yes. They will need to switch, so that hardware needs to be swapped out

So why argue about whether AES-256 is worth it if we can just literally replace those 3 characters and be done with the upgrade? This was the smart move already in 2001 when Shor's algorithm was known and computers fast enough that we don't notice the difference. At least to me, it seems like less bikeshedding will be done if we abandon AES-128 and don't have to deal with all the people left wondering if that's truly ok

Then again, something something md5. 'Just replace those bytes with sha256()' is apparently also hard. But it's a lot easier than digging into different scenarios under which md5 might still be fine and accepting that use-case, even if only for new deployments


I'm working on just that in some IoT context, and a lots of chips I have to deal with only have hardware support for AES-128, so it's a little more complicated...

Because you cannot "just literally replace those 3 characters and be done with the upgrade".

That would depend...

There's a whole lot of cases where the tokens are temporary in nature with an easy cut-over, either dropping old entries or re-encrypting while people are not at work. We tend to think of big commerce like amazon or google that need 24/7 uptime, but most individual systems are not of that scale

In most other cases you increment the version number for the new data format and copy-paste the (d)e(n)cryption code for each branch of the if statement, substituting 128 for 256. That's still a trivial change to substitute one algorithm for another

Only if there exists no upgrade path in the first place, you have a big problem upgrading the rest of your cryptography anyway and here it's worth evaluating per-case whether the situation is considered vulnerable before doing a backwards-incompatible change. Just like how people are (still) dealing with md5


The moment you say "lot of cases", multiply the cost by $100,000,000.

> One of the first things I do on a new device is install an extension to ...

< [which one]

> vibe-code it if it doesn't exist

So it doesn't exist? I don't understand what I'm reading. (Plus the suggestion to create more slopware)


> You're literally just adding extra parameters to the search request

> Saw more options looking for Firefox extensions than Chrome for this, though that might be expected.

Sorry if I wasn't clear enough in my comment that it's a very trivial feature. Would you want a lmgtfy link instead?

edit: The irony that this very submission is probably AI generated? There's no link to their source code, and there's a tab titled "AI Generator" for AI generated playlists?


I think there's been a break in this conversation somewhere.

You said: One of the first things I do on a new device is install an extension to expose these hidden filters

Someone asked you to name the extension.

Then you go on saying it's easy to vibe code and you're not here to hold hands?

Okay, so does the extension exist or not?


Yes, there are plenty of them.

I think you heard "vibe-code" and immediately went out of your way to act obtuse, even though I was using it as an example of how simple it is to show these "hidden" filters.


(Note you're not replying to the same person, so this "you" is me and not them.)

Yes, I find the suggestion to waste a bunch of energy creating a mediocre extension that might actually work, when there is apparently an existing one that you are already happy with, a bit silly. But that wasn't the contradiction I was pointing out


Source?

You're linking to a bugtracker. I doubt they're inviting people to spam it with duplicate entries — valid as I think the concern is. But maybe it says somewhere that you can leave feedback here and I just haven't seen it?


They are taking feedback there and also have already responded to some of it.

From their README:

> We are interested to receive feedback on all aspects described in the document. To provide feedback, please file an Issue on OpenCoDE.

https://gitlab.opencode.de/bmi/eudi-wallet/wallet-developmen...


There is a 8 months old open ticket, with an official answer, here: https://gitlab.opencode.de/bmi/eudi-wallet/wallet-developmen...

Yes, hence me saying duplicate above

How are you expecting someone here to complete a captcha in the comments?

> inter-EU signatures

I assume this should be "intra-EU"? I'm not very familiar with eidas so I'm not sure, but afaik it's about signatures within the EU, not between different EUs (as there is only one in this world). (I hate this inter/intra wording, always have to translate it in my head to understand whether it's like internet (between networks) or like intranet (within a network). Would recommend using "within-" instead of intra whenever it's not already a well-established word, like intranet)


Yes of course, a bit tired here since it's nighttime.

Works for me in Germany. I wonder if it's some overzealous bot protection that's cutting off humans again, in this case from what looks like a government website, but without further testing that's hard to say. You could check if it works from another network, or if other people on your network range have the same issue (like if you're in 13.37.0.0/16 then maybe someone else at the ISP is also in that range and could check if it got blocked outright)

I can't seem to find the rules. How do I know if my site is in scope here? It it like Kagi's small web that's only for blogs, or does it need to be run by a <10-person company, or like what means "indie" here?

Viewing the submit page requires an email address and bugmenot@bugmenot.com does not work


right now there are no rules, and im hoping i dont need to make any. only requirement to submit is email address validation

Consider that nude is short and nature is longer. Naturist is the shorter one and naturalist the longer one

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: