Hacker Newsnew | past | comments | ask | show | jobs | submit | jorisw's commentslogin


Would it be simple to explain as well? I'm interested

I am not OP, but completely isolating the AI from any actions other than what's expected would be a start. IE a specific API only for the AI, in which there is not even any access for the prompt injection to even make sense. But just an idea from an onlooker.

I can recommend having a look at secure design patterns for LLM agents. Simon Willison has a great post on this: https://simonwillison.net/2025/Jun/13/prompt-injection-desig...

Now that you mention it, why don't we encrypt injectable data that comes from users and only decrypt it on the client?

You mean, use encryption (+base64 or something) as a "poor man's" string-escape? Interesting idea!

The issue is that certain questions may genuinely require the LLM to have the raw descriptions. For example, "List my grocery store transactions".

Safari didn't crash. The web app did, for abusing the browser history API.

> SecurityError: Attempt to use history.replaceState() more than 100 times per 10 seconds


Yep, seems to refer to "SecurityError: Attempt to use history.replaceState() more than 100 times per 10 seconds"

I hate the History API especially pushState. Even with this limit of 100 times per 10 seconds it still pollutes my browsing history too much. I need to vibe code an extension that makes pushState/replaceState noops on all webpages.

StopTheMadnessPro > Protect History.

https://underpassapp.com/StopTheMadness/


Seems like you hate the abuse of the API more than the API itself. For Single Page Apps it makes sense to support the Back button by, based on merit, populating the history synthetically

Then you'll discover many pages are SPAs in disguise.

Such as?

Because joke’s on you, my browser gets so slow that I know when a page is a SPA, even when it uses History API.


They feel the slowness of the page load

Not on their iPhones operating over 5G or the corporate WiFi.

It's still present. JSON/JS parsing still has a delay. And in either case (as the author states) not everyone is using an iPhone over 5G. Heavy React apps are a miserable experience on low end Android phones, even when the connection is fast. I've seen JS/JSON parsing times in the multiple seconds.

There's 5 bars 5G and there's one bar 5G anyway... Citing connection types really is completely beside the point.

My old iPhone handles well react apps, but frequently freeze/crash on heavy advertised pages and pages with huge images/auto loading videos.

You don't think there's any palpable difference as long as the connection is any good?

I think there’s a palpable difference but many young developers have no concept of why.

Salesforce and SAP are not fast, even on that. But ubiquitous for building corporate platforms for their customers.

The vast majority of global users are not using iPhones.

Yes, that was kind of the point of my comment. Apparently not well made.

Read the article. Typical users had old browsers often with poor reception. One user was using a PlayStation Portable which had very limited WWW capability.

The person you are replying to is saying the PMs are using new phones on WiFi, not that the customers are.

Thank you.

"What, support Safari? Isn't that, like, less than 20%? And its standards support is abysmal! No, not worth my time, they can upgrade to a normal browser like everyone else."

But if they dont, where is the disrespect? They dont know what a megabyte is, they dont feel a slow page load. Where is the disrespect?

React is too heavy weight for a lot of things. But it's ridiculous to call it disrespectful.


If Rick Rubin could take a tape to his car to listen to his mixes, your product people can try their websites on £20 phones from Tesco. They can ask to sit in on user tests with minority groups. Extending your knowledge like this is trivial, but rarely done.

May i ask why, specifically, Rick Rubin? I don't know who that is, but whenever we finished mastering a new song, we had a series of "systems" we listened to it on. We went out to my dad's work van and listened there. We called up our friend with a street-comp sound system in his car, and listened in there (neighbors must have loved us!), and then a "cheap" boombox with large-ish speakers but cheap.

if it sounded "clean" on all 3, without the bass muffling everything, and the highs not hurting the eardrums, we called it "good" and released.


Working in the music industry and not being aware who Rick Rubin is… is a bit weird.

i don't work in the industry, sorry. We just made music and released mp3s, 1997-2008. Co-creator of Def Jam, alright.

I wonder if David Lynch watches his stuff on a tiny screen just to make sure everyone has a good experience.

hint: no, he thinks small screens are stupid.

ETA: after like 3 years of mastering and reviewing this way i trusted my ears and my studio monitors enough to know what it would sound like. I also wrote in headphones and mastered on speakers, then remastered in monitor headphones. Anyhow, i think the whole point i was making is "yes, this is a good thing to do, for music, for websites, for software, etc"


Yeah but for those not using £20 phones from Tesco, where is the disrespect?

[Replied to wrong comment]

That's totally unrelated to what I wrote

I think you're trying to say, the term 'AI' is _associated_ with chatbots being added in places (websites mostly) where they are more of a nuisance than added value.

OpenAI's ChatGPT is AI consumer software and is a hit, albeit mostly free tier users.


Don’t forget Google search and Copilot giving you wrong answers. The first time someone gets graded poorly or called out at work for obviously not checking what they sent tends to reframe their perspective.

And that's the thing, 90% of people's interactions with "AI" is negatives in places it didn't belong, Klarna had to roll back "AI" customer service, useless chatbots everywhere "because AI", copilot this and that and so on.

And yes, ChatGPT is a hit but who will subsidize the hardware for freeloaders, Google's (cheap to run) AI is good enough now that I don't need to move over to ChatGPT for simple answers, thus the Google moat will probably remain intact denying OpenAI the search revenue stream all whilst OpenAI proposals/trials to add ADs were met with annoyance.

AI where useful is becoming a commodity, Apple did the correct thing in waiting and using the commodity parts and we're otherwise also quickly heading to the bubble's pop, HN even censoring articles on the topic sure seems to be an indicator that those in power are afraid.


Care to at least refer to some sources why?

It's literally a deflection mechanism to the fact they want to build data centers all over the land by proposing a fantastical better way that simply won't work.

That has been covered to death since months, there is no good solution to cooling without an atmosphere. But even going into the technical details is a waste of time, think about how complicated maintaining such a system in space would be compared to having it on earth, the whole idea is a complete grift from beginning to end. There is literally no benefit to do it in space other than as a marketing tool.

Nobody who suggests the idea has ever presented a model that is even remotely close to reality


Quite the typical outsider's simplistic view. Privacy is one of their core brand values. If they don't follow through on those, their brand erodes.

And what history?


You can look up the history of this company's claims versus reality on their promises re. privacy yourself, there's enough to be found between Siri listening when it shouldn't, user data being accessible to the company in contrast to promises of privacy, the company collecting user data which is used for targeted advertising, several examples of push notification data being handed over to law enforcement agencies in several countries, leaky 'airdrop' allowing user identification which wasn't fixed by the company even after a fix was published by outsiders and more.

The real question is why you seem to be so credulous when it comes to this company. Do you extend this trust to other similar companies or is it only reserved for this specific company? I ask this because you're not the first person who seems to consider this company to be almost above criticism even though they've shown to be just like other companies in all respects. When Jobs was still around this stance was supposedly caused by his 'reality distortion field' but he has been gone for a long time and given that Cook has the charisma of an accountant this can no longer be the reason. What makes them so special to some even though their claims have been punctured many times over?


Oh, brb, looking up the history

I was thinking distilled?

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: