Hacker Newsnew | past | comments | ask | show | jobs | submit | nippoo's commentslogin

Except scratch cards are a guaranteed statistical loss. Trading cards, if you're skilled and know what you're doing, can be a sensible side-income.

It's the difference between poker and roulette...


Every TCG buyer I've spoken to is always "up" on cards, though if you dig further you'll find they haven't cashed in any actual gain and are just mentally up based on what they think they could sell them for. While also mentally discarding any losses.

The real winners are probably the people reselling the unopened packs for slightly higher than retail since they have removed the gambling aspect.


You can pretty much be guaranteed to break even if you check the odds of scratch tickets and buy enough of them. You can check how many tickets are left and which prizes are left for a particular game. That's what we did when I went in on a bunch of tickets with some friends.

Speaking of trading cards as a side hustle, a couple of my friends used to drive around the region buying boxes of baseball cards. They'd weigh them to figure out if some specific special cards was in it, return the light boxes, and throw out most of the other cards from the boxes they opened. Now that same card series has unopened boxes going for like $2k


Most people who try to make money in trading cards will lose money


Another similarity is the endless line of credulous people who "have a system".



>The FBI is aware of a software misconfiguration

That's not a misconfiguration, that's incompetence.

How do these people get hired?


That's actually really easy:

1. be government agency

2. pay 30-70% less than private sector companies would for a similar position

3. receive applicants that are 30-70% less competent

Bonus:

- have 30+ year old systems nobody understands anymore because the team behind them has been dead/retired for a decade

- have hiring process handled entirely by out of touch suits

- have a revolving door of motivated soon-to-be burnouts mopping up the mess behind the aforementioned regular employees


in 2026, by a drunk who gives out whiskey bottles branded with their name


To each their own. I find soldering (with a nice iron!) very therapeutic, much like knitting. I'll put on a good album or catch up with some friends on the phone.

If you're impatient, plenty of fab houses (like JLCPCB) will do all the soldering for you, for about 0.1 cents per SMD joint or 2 cents per THT joint...


Nice iron,a good clamping set-up, and a high-quality correctly specked (to the task) solder make all the difference


I enjoy soldering, and like your comparisons. Yet I certainly don't blame the author for highlighting how unhealthy it is.


The lead is leaded solder is entirely manageable. You should keep track of it all and dispose of it properly. (I.e. not in a landfill.) Wash your hands afterwards. It doesn't vaporize, or at least not in any quantities that you should care about.

As long as you are not directly inhaling in the flux smoke while hovering over the project, it's not that unhealthy. If you are a hobbyist doing an hour of soldering a week, you probably get more smoke particle inhalation making toast. Or pizza. Or frying literally anything.

(If I was soldering for a living, yes I'd want a really good fume extractor on the bench, though.)


That's effectively time-based request sharding which seems sensible but you'd still have to reconcile trades and any open positions (etc) across the time boundary where one system stops accepting requests and the other one starts. And keep the databases synchronous (ie have some system to make sure they're in sync at the changeover time) - or have a few minutes/hours of downtime between weekends and weekdays while you copy the whole production database from one system to another. The devil is in the details!


For what it’s worth, in some financial markets, there is a sort of natural daily cutover time [0] across which you are often not trading quite the same instrument. For example, the settlement date may roll over, etc. And a lot of Very Serious Finance is already built on the idea that most parties do not instantaneously reconcile anything and don’t depend on real-time trade lists.

I really can imagine a system in which the Monday trading system runs all day and then turns off at a predetermined time. Then it has 15 minutes to produce and disseminate a final list of all transactions, after which it becomes completely unavailable and is ready for maintenance. Any subsequent amendment to Monday’s trading would be done out of band. Open orders at the end of Monday do not carry over immediately to Tuesday, although front ends are welcome to recreate them. Everyone would understand that liquidity would be thin for the first few seconds after the system rolls over.

For added fun, Monday and Tuesday could actually be allowed to overlap in a hypothetical trading system, although the market participants might not love this.

[0] which is not the same for all instruments, and holidays mean that not every instrument rolls over meaningfully every day.


I can't find the original source, but I remember reading a study showing that this rise was closely correlated to states which had legalised or loosened laws on gambling!


> In states that allowed online betting, the study reported a 10% increase in the likelihood of bankruptcy and an 8% increase in debt collection amounts — outcomes that tended to appear about two years after the practice was legalized.

https://www.npr.org/2026/04/04/nx-s1-5773354/legal-sports-be...


kalashi is coming


???

<https://www.wisdomlib.org/definition/kalashi> is best I can find, doesn't seem relevant.



Are there markets where people can bet on bankruptcy rates too? Gambling increases bankruptcies, and then people gamble on the bankruptcies.


after word spreads of easy pickings, funds swell into bankruptcy rate contracts. the success stabilizes average losses across Kalshi portfolios; the bankruptcy rate falls.

after smart money then moves to predicting the period of the oscillations, …


Relevant snl skit: https://youtu.be/wXZNuwY_5-U


Double or nothing!


I can see the potential link there, but my intuition says that the SKYROCKETING cost of living is probably more to blame.


i think you mean the ever increasing greed of the 1%


One and the same until we off of a corrupted unbacked fiat based print on demand system


They are the same thing


An oil supply shock is not "ever increasing greed".


It's so disgusting watching how much sports gambling and "prediction markets" have exploded in recent years


I'd argue that, while a portion of this rise obviously consists of troubled/problem/addicted gamblers, a huge part of the rise of gambling is from desperation: The public's growing belief that the traditional wealth-producing ladders have all been pulled up, and that gambling is the last remaining hope that normal people have of making decent money.

"Work hard all your life and retire with a pension." - fantasy in 2026.

"Invent something new and capitalize on it." - not realistic in the face of gigantic, powerful, all-owning corporations who will squash you.

"Buy an existing business and live off the proceeds." - impossible without existing wealth.

"Become a famous pop star or sports hero." - as improbable as ever.

People have no hope anymore, and hopeless people turn to random chance as the last and only remaining option.


I think "huge part ... is from desperation" needs a citation. Gambling has been known to be a vice for millenia. There was an article on here not long ago where a reporter did sports gambling for a year for a story; he started off Mormon, disinterested in gambling, with $10k from the company, and after he lost it, he put himself on the state self-exclusion list because now he had a problem with gambling. The null hypothesis is that gambling is a vice, so to make it about desperation needs some evidence.

Also, "traditional wealth-producing ladders have all been pulled up" is nonsense. The stock market is available to all comers, and long investing is a traditional path. There was a story here a few years ago about a black janitor in NYC who died and left $7 million to the MoMA (or some such); he had invested $10k a year in the stock market. People in the trades still make good money. People on this site also tend to be in the making good money careers. I saw a bunch of young couples--and not the techy-looking ones, either--at the open houses this spring in the midwest. Also, one should not extrapolate one's situation at 25 to be the same at 45; if you've done reasonable savings, 45 should looking wealthier.


You're asking for a citation on an intentionally speculative comment, offering your own wall of unqualified anecdotes that come up every time someone claims young people are desperate, and mean nothing unless someone fills in details with whatever they want to believe.

Usually what it comes down to is that the ladder hasn't been pulled up if you've got a step ladder to the new starting point, or have already been a tradesperson with a scarce skillset in a low cost of living area that only exists because it's cheap (midwest) for long enough to not have to destroy your body doing it on an ongoing basis.

COVID and the subsequent two years have literally halved the value of money, which was great for people who already owned homes or had a huge amount in the stock market, but otherwise many will be waiting another 5-10 years before income from work catches up with what it used be worth. Major layoffs have been happening every year since.


Gambling has been a thing forever, but never this easy and accessible. It's like smoking but you can do it anywhere, it's physically on your person and available 24/7. It's novel and very dangerous.


> "Become a famous pop star or sports hero." - as improbable as ever.

It's even more improbable. For both of those, your starting to see more and more of the current generation that are children/nieces/nephews of the already famous. They have the financial comfort to pursue it, and the family connections in the industries.

And for sports, the level at which you have to be competitive is getting younger and younger. So much more sports science/nutrition going in at the middle school/high school level.

Those were two fields that seemingly were still meritocratic, but that is fading fast, if it ever existed at all.


> And for sports, the level at which you have to be competitive is getting younger and younger. So much more sports science/nutrition going in at the middle school/high school level.

For endurance-based sports, online coaching has really accelerated this as well.

For skills, you still really need in-person coaching.


It’s also kinda the case for sports too — I literally just watched LeBron throw an alley oop to his kid a few nights ago.


The rise in gambling isn’t caused by “desperation.” It’s caused by the loosening of social taboos against gambling. Gambling isn’t common in say Bangladesh even though conditions there are much more desperate than anywhere in the U.S.



Spot on. Gambling is their Hail mary shot at getting the life they were promised.


That's overly doomer.

I know it's unpopular to ever say statistics show this generation is fine, because of course there's always a bunch of other troubling statistics, not to mention always people that are actually struggling.

But honestly, many people that feel hopeless can afford to put a few thousand in an ETF every year. That would likely be millions even adjusting for inflation after many years.


Eh I dunno. In my experience the “working class” sports gamblers who very likely should not be engaging in regular betting are not participating in bets that would be remotely life changing. And they know that. They are putting down $5-20 bets with maybe $100 payouts on parlays or whatnot. They talk about it maybe paying a utility bill or pay for drinks at the bar for game day.

Multi-state lotteries seem to be far more of the “hopeless” case where there is actually a life changing amount of money up for grabs. But far less consistent dopamine hits. The regular low stakes sports gamblers who piss away their paychecks in small chunks over time are doing it for those small wins and chasing the next one.

That’s not to invalidate the point people feel hopeless, I just don’t think the average “degenerate” Fanduel bettor really is chasing that sort of thing.


In most forms of gambling you could drop your whole paycheck on gambling and still not end up terribly off. You'd be in about the position you would be in if you had to go to a check cashing place to cash your paycheck, although with more volatility. Dropping your entire paycheck worth of volume on slots and you are down what, like 5-10% on average -- most people have that much margin to spend on savings/discretionary/retirement.

Where you get in trouble is where you're cycling through multiples of your paycheck on wagers, recycling your bets. Then you're getting eaten for multiples of the house take on your income.


The problem is your typical slots player doesn't have the discipline to stop after running their roll once. They turn the $100 into $90, then the $90 into $81, then the $81 into...


> while a portion of this rise obviously consists of troubled/[...], a huge part of the rise of gambling is from desperation

Is that really so? It's a get-rich-quick scheme and absolutely no one is under any illusions otherwise, including the people gambling their rent money. They know it's a very long shot and that most people don't make bank, but they hope it'll go different for them.

WallStreetBets, just another form of gambling, is filled with posts of people losing everything but it doesn't seem to stop newbies.

The gap between troubled/problem/addicted and "desperate" has to be paper thin, if it exists at all.


> and absolutely no one is under any illusions otherwise

Having a gambling addiction kinda requires that you operate under a lot of illusions in your reasoning.


yeah it seems winning the lottery is now our best chance for survival.


IMO prediction markets are an interesting tool but you can just ban sports gambling and keep 100% of their value and remove 90% of their downsides.


You can also ban 100% of gambling advertising and get 100% of the (dubious, but I'll humour the possibility) 'benefits' of gambling, while removing 90% of the downsides.


Agreed with that too


I'll be honest as someone who doesn't gamble my perception is the prediction markets are just people with inside information using that to con money out of people. I don't see the value in it.


Well if you think of the point as "winning money" then that really sucks (which I've discussed in prior comments as a big problem for overall participation). If the point is instead to extract and compress information into a simple numerical prediction, then the insider trading is arguably a feature more than a bug.

Not to say it shouldn't be viciously punished, to be clear.


Prediction markets are 90% sports gambling.


So?


So prediction markets solely exist as a way to sidestep regulation of sports gambling (mostly) and insider trading secondarily. It's just grift.


That conclusion doesn’t follow from the premise at all lol.

Low-effort complaining, not interested.


Can you explain the value you're talking about?


Highly liquid markets are good information compression systems, but existing financial markets tend to be impossible to disaggregate with regard to any discrete event you care about.



The old adage of bread and circuses ?.


TV and social media have been the modern bread and circuses for a while now. Gambling continues to be a vice.


Not to mention fools and their money parting.


Having recently seen a thread here where a lot of people threw a lot of shade on gambling: I really recommend finding that source.

That being said: I'm more likely to believe inflation to be the cause; and I think it's a bad idea to use this to fan moral panic


>I'm more likely to believe inflation to be the cause

based on what?


Because increasing the cost of living will trigger bankruptcies in people who are living paycheck to paycheck and unable to afford the cost of living increase.

(This is generally the cause that economists blame for increases in bankruptcy)


Based on how much they like gambling.


Truly! As someone who's worked with HPC and GPUs in a scientific research context, trying to get a service like this to work reliably is a different ballgame to your usual webapp stack...


But… imagine that same scientific research but you have an unlimited budget. I’d imagine that helps.

Some of the comments here mention their monthly spend, and it’s eye watering.


It would be "unlimited budget" if they were a monopoly, but they're in a bidding war with three other "unlimited" budget AI companies, over a resource no one expected to be scarce. There's simply not enough supply to meet demand, no matter how much money you have


I think you have to see this as a bunch of stateless requests, and this makes the problem way easier.

  LLM requests that do not call tools do not need anything external by definition.
  No central server, nothing, they can even survive without the context cache.
  All you need is to load (and only once!) the read-only immutable model weights from a S3-like source on startup.

  If it takes 4 servers to process a request, then you can group them 4 by 4, and then send a request to each group (sharding).

  Copy-paste the exact same-setup XXX times and there you have your highly-parallelizable service (until you run out of money).
It's very doable, any serious SRE can find a way setup "larger than one card" models like Kimi or DeepSeek (unquantized) if they have a tightly-coupled HPC (or a pair of very very beefy servers).

If you run out of servers, then again a money problem, but not an architectural problem (and modern datacenters are already scalable).

Take the best SRE, but no budget, and there is no solution.

So inference is the easy part.

Codex or Claude Code if it takes lot of time or have slow cold latency, it's considered very acceptable.

Some users would probably not even see the difference if a request takes 2 minutes versus 3 minutes.

The real difficult part is to have context caching and external tools, because now you are depending on services that might be lagging.

  Executing code, browsing the web, all of that is tricky to scale because they are very unreliable (tends to timeout, requires large cache of web pages, circumventing captchas, etc).
These are traditional scaling problems, but they are more difficult because all these pieces are fragile and queues can snowball easily.


Yeah, and totally missed RAI part, billing, model deployment, security patches, rate-limiting, caching, dead GPUs, metrics, multiple regions, gov clouds, gdpr(or data locality issues), monitoring, alerting and god knows what else while at extreme loads.


GDPR doesn’t affect load, dead GPUs are no different than any software freeze, model is a file update, metrics are already scaling very well and even way way way bigger and they are very linear, security updates are hedged with gradual rollouts, canary, feature flags, etc.

From an ops perspective all of these things are already really well solved issues in a very scalable manner, because plenty of companies had to solve these issues before.

It’s even better here because you can throw millions in salaries to “steal” the insider info on how their production actually.

No doubt it is fast-paced but the complexity to go from 100k GPUs to 1M is much lower than from going from 1k to 10k GPUs.

All 3 big AI companies had the luxury that during the scaling phase they could do everything directly on production servers.

This is because customers were very very tolerant, and are still quite tolerant.

You can even set limits of requests to large users and shape the traffic.

Cloudflare in comparison, high-scale, low-latency, end users not tolerant at all to downtime, customers even less tolerant, clearly hostile actors that actively try to make your systems down, limited budget, a lot of different workloads, etc.

So, for LLM companies where you have to scale a single workload, largely from mostly free users, and where most paid customers can be throttled and nobody is going to complain because nobody knows what are the limits + a lot of tolerance to high-latency and even downtimes then you are very lucky.


Can you speak a little more to this? I'm curious what kind of parameters one must consider/monitor and what kind of novel things could go wrong.


My guesses are:

hardware capacity constraints is going to be the big one

Effective caching is another, I bet if you start hitting cold caches the whole things going to degrade rapidly.

The ground is probably shifting pretty rapidly.

Power users are trying to get the most out of their subscriptions and so are hammering you as fast as they possibly can. See Ralph loops.

Harnesses are evolving pretty rapidly, as well as new alternatives harnesses. Makes the load patterns less predictable, harder to cache.

The demand is increasing both from more customers, but also from each user as they figure out more effective workflows.

Users are pretty sensitive to model quality changes. You probably want smart routing, but users want the best model all the time.

Models keep getting bigger and bigger.

On top of that they are probably hiring more onboarding more, system complexity and codebase complexity is growing.


Just ask Claude and some agents to fix it...


This is probably a good place to debunk the usual wisdom that "decoupling capacitors must be placed very close to the IC pins". If you're using a solid power plane, rather than routing power through traces (and honestly 4/6 layer boards are cheap enough these days) it really doesn't matter where you place decoupling capacitors for most uses - keep the via traces short or ideally in the pad, and you can put all your decoupling capacitors in one place on the boards a way away from the chip and focus on good routing of your signals. Figure 15 on this paper (and the whole paper!) explains it well: https://scholarsmine.mst.edu/cgi/viewcontent.cgi?article=221...


Loop inductance is what really matters with decoupling. Once you understand that, it becomes really easy to make good decisions. This article explains how you can approximate the inductance for a given layout, so it makes evaluating layouts much simpler. It actually used the data from the paper you referenced in example 3!

https://learnemc.com/estimating-connection-inductance

You can even use mutual inductance of vias improve performance, either by having vias spaced close together and in the right order (https://learnemc.com/decoupling-for-boards-with-widely-space...), or arranging capacitors in alternating or doublet layouts (https://incompliancemag.com/decoupling-capacitor-design-on-p...).

As you say, just having power planes and directly connecting to them is almost always going to be superior to using a trace, despite seeing this all the time, especially in datasheet example layouts. It made sense for 2 layer boards, but not today. Just think, the inductance of the planes is practically zero, and distance to the plane from the components is going to be on the order of 0.2mm, round trip 0.4mm. Is there any way I could place the capacitor 0.4mm away from the pins to achieve an equivalent inductance? And even if you could, you can't add extra vias to lower inductance, and you don't benefit from mutual inductance.


Yeah

The ELI5 for decoupling capacitors is "imagine an energy storage for quick usage"

The ELI(tired EE student) is more like the explanation above

And this concept is ok for most of the 'low speed' circuits

in RF ranges, everything is a capacitor (except when you need one), everything is an inductor (except when you need one) and the intuitive explanations break down and everything looks like dark magic


I love your reverse psychology analogy. That does make me wonder, if a cap past its SRF is an inductor, and and inductor past its SRF is a cap, why not swap caps for inductors and vice versa, put an amplifier on the end and call it a day!


You can't, because all amplifiers oscillate (except when you need an oscillator).


And every wire or PCB trace is an antenna, broadcasting and/or receiving whatever it has access to, at its own particular frequencies.

Across distances according to the power available, where ariel orientation makes a big difference, "as expected".


Explanations like that are a lot easier to understand if you can see the equivalent circuit with the parasitic components.


Well, till it does. Paper talks about frequencies in 200MHz range, not every project can afford solid power planes and putting it next to a chip costs literally nothing. It's like safety helmet, 99.9% of the time it's not needed


Above 400MHz or so, the on-die/on-chip capacitance starts being the most important thing (you're going to have inductance through the legs or balls of the chip).

Putting your decoupling capacitors next to the power pins _does_ cost. Not just in board space, but I've seen and reviewed layouts where the signal traces had to snake around decoupling caps or in some cases through vias because the designer believes that putting the caps close to the pins was the most important thing...


Great paper!. Anyonw know whether there are any modern tools/software that can simulate this during design?


For approximative simulation, any SPICE simulator works. You'll need to know your capacitors parasitics and power supply output impedance, find a typical via's impedance, and manually compute traces impedances and board capacitance.

For accurate simulation, the actual board geometry needs to be fed to a simulator that'll compute the actual impedances. Last I checked only Very Expensive Software could do that in a user-friendly way (I had to route a DDR3 bus. I ended up being very cautious so that all traces had the same topology and the same lengths, and cross my fingers. It worked).

If anyone knows of free alternatives for that, I'd be interested to hear about it.


So, the concentration is 1000x less than the carcinogenic threshold in mice, and it's possible that our carcinogenic threshold is even higher than that, but the advice is "be careful how you store your potatoes and don't fry them too much and don't eat charred toast"? Surely the correct response is "it's probably totally fine"


"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry."

Do other (tech-literate) people do this?! Giving anything access to my emails and Google Drive would keep me up at night and I try and be very granular with permissions and revoke them when I don't use an app any more. I would assume that anything confidential/NDA in my emails had been compromised and leaked well before this point!


At my job I was asked to help integrate our Google Workspace account with an AI notetaking tool another team purchased. The vendor instructed us to set up Domain-wide Delegation for reading/writing emails and Google Drive files. Essentially this would automatically opt in every user in my organization and there would be no way to opt out.

I had to contact the vendor to set up a "less recommended" way of requiring users to actually log into the tool and accept the OAuth permissions prompt. The entire time, everybody (the vendor and my organization) acted like it was a waste of my time.

I can't control what everyone else does, if they want to grant some tool these broad permissions, feel free. But I find it unethical to just enable it for all users with no ability to opt out if this isn't actually a critical tool. Not to mention the security concerns with this.

What is most concerning to me is how people are turning their brains off for anything tangentially related to AI. The people making this request to me are smart people who 5 years ago would have never asked to do this. Now suddenly they don't care - everyone else is doing it, why not?


>What is most concerning to me is how people are turning their brains off for anything tangentially related to AI.

Everyone is betting the farm on that .01% chance that they become wild trillionaires. We're going to burn down the whole planet and use all of the resources so a few people can have a minuscule chance at being obscenely rich.


Personally, no. This comment from the other day has been stuck in my head: "Anyone trying to stay safe will be on the gradient to a Stallmanesque monastic computing existence."[0]

It's both hilarious and true. As much I want to reap the gains of having an openclaw agent going ham on my personal data, I abstain. I shed a tear at all the cool stuff I'm missing out on, but permissions are never about now. Once they have it, they'll always have it.

0: https://news.ycombinator.com/item?id=47796469#47797330


> Do other (tech-literate) people do this?!

I'm sure it's very common, yes. Permissions & popup fatigue is very real. Today, every application and website throws 6 dozen popups at you that you have to get through to get to the stuff you came there for. Most of it is marketing; some of it is from braindead lawyers; some of it is important; none of it gets read by users. At some point you give up and just click "yes, goddamnit, I have work to do" and all the security stuff is out the window.

Always remember: there is no such thing as computer security. If your data is on a networked computer, consider it to be semi-public. The first and only rule of computer security is don't store or do anything on a networked computer that would devastate you if it were leaked or compromised

And, make sure not to think about how much of our modern infrastructure is built on top of computers connected to the Internet.


Boss: "Just slap something together for the meeting with the Big Cheese this afternoon."

(Engineer internal monologue) "OK I'll just agree to everything during setup, I can just tear it all down later."

Six months later the slapped together demo is the production release.


As the engineering saying goes, nothing more permanent than a temporary solution


> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry."

No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry.

You authorized it because the onboarding flow asked, and you weren't given an opportunity to say no. What are you to do: say no, and then not use the app?

This whole concept is just wrong. Instead of saying "no" and the app seeing that you didn't grant permission: you should be able to say "no", and the app shouldn't see any denial at all. It should just see empty data when requesting it. Problem fucking solved. You get to use whatever apps you want, apps get to ask for whatever permissions they want, and you get to deny that permission without the app fucking you over.


I think it's a bit easier to add a "Some" option so that then the App is unaware to the effective "No" answer.

But also a lot of the permissions are just bad. Like I think it's reasonable for somebody to make a web-app that uses my Google Drive as a backend for storing data. I don't think its reasonable that it should be able to open files it didn't create though.


This just moves the problem to support. The app doesn't work for users, they don't remember clicking no, and then some CSR has to hand-hold them through clicking "yes".


> This just moves the problem to support.

Boo-hoo. Support should exist. Support should be trained. Support should help educate the customer. If your business isn't doing that then your business is trashy anyway.

Many companies don't have support. That's a major problem. We have a lot of trashy businesses.


The app shouldn't see empty data, it should see statistically likely fake data.


While you're right, I'll be happy with just empty data for now. Generating statistically-likely false data is only recently available generally and turns out to be rather expensive.


For the most sensitive fields (names, addresses, phone numbers) it's quite simple. For names, you get a list of the (say) 1,000 most common names, and pick randomly from the list. For phone numbers, you generate random numbers with valid formatting (not all area codes are valid, etc.). For addresses, you pick randomly from a database of real addresses. Etc. No LLM-style generation needed.


What? This makes no sense to me. What's the threat model where you'd rather the OAuth flow result in the client app getting fake data?

If you reject the permissions the client already doesn't hear about it because the callback redirect isn't invoked (or at least, there's no reason for it to be, but that's up to you).

> What are you to do: say no, and then not use the app?

Um, yes? That's literally the point of what's happening. The app is asking for permissions because it needs it to do whatever it's doing. If you don't want to give it access to the data then there's no reason to use the app.


I usually pay pretty close attention if something wants more than my email address, name and profile image, etc... I've used a couple things that request drive access, only because they actually deal with documents. I'm not sure that I've given any AI agents particularly open access... though if Claude Code wanted to, it could probably pwn me... I've been considering shifting to a VM for that.


It's hard to avoid, but there are steps we can make towards fixing it. I spent years in academia building open-source data processing pipelines for neuroscience data and helping other researchers do the same. Most quantitative research goes through "lossy" steps between raw data and final results involving Excel spreadsheets, one-off MATLAB commands, copy pasting the results, etc.

In a lot of cases (where data is being collected by humans with a tape measure, say) there is room for error. But one of the things that's getting traction in some fields is open-source publication of both raw datasets and the evaluation/processing methods (in a Jupyter Notebook, say) in a way that lets other people run their analysis on your data, your analysis on their data, or at least re-run your start-to-finish pipeline and look for errors!

As is often the case, the holdups are mostly political: methods papers are less prestigious than the "real science" ones, and it takes journals / funders to mandate these things and provide funding/hosting for datasets for 10+ years, etc - researchers are a time-poor bunch and often won't do things unless there's an incentive to!


Taking notebooks to a production environment isn't fun either. With ai there's no more excuse for using that coding crutch.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: