Feed aggregator

Article URL: https://proofsandprompts.com/2026/09/10/open-letter-about-the-mathathon/

Comments URL: https://news.ycombinator.com/item?id=49709882

Points: 1

# Comments: 0

Article URL: https://crons.darcode.dev

Comments URL: https://news.ycombinator.com/item?id=49709835

Points: 1

# Comments: 0

Article URL: https://freshteapot.net/writing/creating-word-audio-with-ai/

Comments URL: https://news.ycombinator.com/item?id=49709820

Points: 1

# Comments: 0

Article URL: https://www.militarytimes.com/news/your-military/2026/09/14/us-air-force-secretary-reveals-deployment-of-on-orbit-space-control-weapons/

Comments URL: https://news.ycombinator.com/item?id=49709812

Points: 2

# Comments: 0

Ads led to a ClickFix page designed to trick macOS and Windows users into installing malware.

The post Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack appeared first on SecurityWeek.

Article URL: https://www.reddit.com/r/LocalLLaMA/comments/1wgii3h/deepseek_engineer_relections_on_rsi_burying_my/

Comments URL: https://news.ycombinator.com/item?id=49709746

Points: 2

# Comments: 1

An agent that only reads and writes code is guessing whether its changes work. To maintain many projects I need one that can boot the app, run migrations, hit the page and read the actual error.

So I built Knecht. A Self-hostable tool. You connect your GitHub repos and it starts each project in an isolated Docker sandbox, generated with DDEV. Inside, an agent can do what a developer does locally. Reproduce a bug, run migrations, open the page in the browser etc.

Workflows can be started by triggers (Jira tickets, GitHub issues, PRs..) and can run across all projects at once, mixing AI agent steps with deterministic steps, similar to n8n.

Knecht is in beta and I am looking for people who maintain many projects. Works best with DDEV projects. https://github.com/knecht-works/knecht-cloud https://knecht.works/updates/beta-tester

Comments URL: https://news.ycombinator.com/item?id=49709714

Points: 1

# Comments: 0

Article URL: https://jensrantil.github.io/posts/challenging-ai/

Comments URL: https://news.ycombinator.com/item?id=49709711

Points: 1

# Comments: 0

Article URL: https://self.cv/en

Comments URL: https://news.ycombinator.com/item?id=49709695

Points: 1

# Comments: 1

Article URL: https://www.nytimes.com/2026/09/12/us/influencers-social-media-algorithm.html

Comments URL: https://news.ycombinator.com/item?id=49709688

Points: 3

# Comments: 0

Hi,

I wanted to share a project I've building for a while. QuantSupport is a quant library that comtemplates curve construction, simulation and risk analytics for a different asset classes (equity, rates, fx, FI).

https://github.com/jmelo11/quantsupport

It's goal is to be a realistic production tool for financial institutions, instead of being another analytics library as many other tools are. For this, it leverages automatic differentiation from the ground up to obtain risk functionalities (sensitivites), essential for real trading setups.

The library features other engines, like and XVA engine and a scripting language for structuring more complex payoff structures.

Also, its available an example in the following repo:

https://github.com/jmelo11/derivative_structuring

where LLMs leverage the scripting functionalities of the library to provide pricing and insights to user prompted requests, allowing model-consitent results and showing the flexibility of the library.

I like to think that is reaching a more mature state, but to know for sure, it would be very helpful to get feedback from people from the quant space. Any feedback is highly appreciated.

Comments URL: https://news.ycombinator.com/item?id=49709680

Points: 1

# Comments: 0

Back Me Up is a tiny science-ish machine that finds published papers that back your argument. It stemmed from a conversation with a friend around life sciences, where we kind of landed at "surely there’s a paper confirming most arguments", i.e. coffee is bad, coffee is great, etc.

You enter a claim, e.g. "drinking wine is good for the heart" -> the system does a semantic search across a corpus (PMC, bioRxiv, medRxiv and arXiv) -> pulls in relevant quotes if they fit your claim, and gives you a verdict.

Frontend was done with a combination of Sol + Opus, I spent a bit of time exploring different designs and landed on this slightly ridiculous printer that spits out your evidence.

Some notes: - I have no accuracy evals, this was a throwaway thing I built, so no clue on reliability. It does pass the vibe test, so give it a whirl! - Initially built a RAG for a tiny set of PMC, but scaling that up seemed like a lot of work for an evening project. Luckily found an API that does the semantic search across the different sources.

Comments URL: https://news.ycombinator.com/item?id=49709678

Points: 1

# Comments: 0

Article URL: https://skyforceui.com/

Comments URL: https://news.ycombinator.com/item?id=49709677

Points: 1

# Comments: 0

Article URL: https://ethfata.com/

Comments URL: https://news.ycombinator.com/item?id=49709672

Points: 1

# Comments: 1

What started as a joke (as I had the domain) turned into an MVP. Usefulness is... so far, questionable? But there are use cases where this kind of spec could come in handy.

My own spec lives at https://spec.md/allan. Add .md to the end and you will get the markdown version. Shareable with AI agents to give them context about you or the people you work with.

Feedback welcome!

Comments URL: https://news.ycombinator.com/item?id=49709631

Points: 1

# Comments: 0

Article URL: https://mceglowski.substack.com/p/trying-to-understand-freedom

Comments URL: https://news.ycombinator.com/item?id=49709625

Points: 2

# Comments: 0

Bitrefill is a legitimate company that sells gift cards for popular stores like Amazon, Deliveroo, Apple, Nintendo, and thousands of others. They also sell eSIMs, and mobile top-ups. You can pay on their website for all of these with cryptocurrency.

The scam is designed to catch people searching for Bitrefill or something it sells, like a gift card. Victims see a search result that appears to lead to Bitrefill but actually points to a lookalike domain. The fake site then takes them through what appears to be a normal purchase. The fake sites are not operated by or affiliated with Bitrefill; scammers have copied its branding and checkout process.

The victim chooses an amount and a cryptocurrency before receiving a QR code and payment address. But instead of paying Bitrefill, they send the cryptocurrency directly to an address controlled by the scammers. They receive nothing in return, and recovering the payment is extremely unlikely.

Why fake crypto checkouts work so well

Phishing typically involves several steps. First, an attacker has to steal a password. Then, they may have to get past two-factor authentication (2FA), log in to the account without tripping a fraud check, and find some way to turn account access into money. Plenty of scams fall apart somewhere in that chain.

This payment scam avoids those hurdles by persuading victims to send money directly to the scammers. There is no account to break into and no stolen card to use. The victim sends cryptocurrency straight to an address the scammers control, and cryptocurrency payments generally cannot be reversed or charged back.

The payment request also fits the situation. A demand for cryptocurrency might look suspicious on many websites, but Bitrefill genuinely accepts it. On a convincing copy of its checkout, paying with cryptocurrency appears completely normal.

All this may explain why we found a cluster of fake sites rather than a single page, with checkouts allowing payments of up to $1,990.

What the fake checkout looks like

The site we examined is a close copy of Bitrefill’s checkout, hosted on a domain built by bolting a word onto the brand name. Everything a customer would expect is present. The branding is right, the layout matches, the page is quick and polished, and the payment flow behaves exactly the way the real one does.

The fake checkout asks for an email address and links to terms of service and a privacy policy, helping it look legitimate.

You’re asked for an email address for order updates, with links to terms of service and a privacy policy. You then choose how to pay, from a list offering Bitcoin, Ethereum, USDC, USDT, Solana, and Litecoin. The site also offers card payments for a small surcharge.

The fake checkout offers several cryptocurrencies and appears to support card payments.

Next, you pick an amount, with preset buttons and a maximum of $1,990, although inconsistent currency symbols offer a small clue that something is wrong.

The fake checkout accepts payments of up to $1,990.

Finally, you reach a payment screen showing a QR code, an address marked for one-time use, the amount converted into your chosen cryptocurrency, and a countdown clock giving you just under an hour to send the funds.

The final screen provides a cryptocurrency address and QR code, along with a countdown timer .

None of those elements is a red flag on its own. Unique addresses, expiry timers, and currency conversion are all normal for crypto checkouts, which is exactly why the copy is convincing. Every pressure cue on the page is borrowed from legitimate payment systems.

The only meaningful difference is the address the money goes to, and by the time the victim sends the cryptocurrency, getting it back is extremely unlikely.

How people are reaching these pages

The distribution here does not appear to rely on email. Bitrefill has said publicly that sites copying its checkout and using similar names have been turning up in search engine results, and that its security team has been working with takedown specialists to have them removed.

The site’s configuration supports that. The fake checkout hands visitors back to a second domain in the same family, and the link it uses carries a parameter naming a search engine, suggesting the operators are tagging incoming traffic by where it came from.

There’s a detail here that deserves more attention than it usually gets. The fake checkout has commercial analytics software installed on it, the same kind of product a legitimate e-commerce team uses to measure how many visitors abandon a cart. Its presence suggests the operators want to measure and improve the number of visitors who complete a payment.

These campaigns are not opportunistic one-offs thrown together by someone hoping for a lucky hit. They’re run as businesses, measured and tuned like any other funnel, with the victim in the role of the customer.

A brand name is not a destination

The domains in this cluster use several tricks to make their addresses look convincing. Some swap one letter for a visually similar character, making the brand appear correct unless you look closely. Others add a plausible word such as pay or gift, producing addresses that resemble official payment sites. Some do both.

Several use internationalized domain names, which can contain characters from different alphabets or accented versions of Latin letters. Browsers translate these domains into an ASCII format beginning with xn--, known as Punycode. To the eye, the displayed versions can be almost indistinguishable from the genuine name.

Different domain names display as variations of “Bitrefill,” while their Punycode versions begin with xn--.

The answer is not simply to become better at spotting tiny differences. These domains are designed to defeat visual inspection, and they can be especially difficult to recognize on a phone screen. Recognizing a company name somewhere in a web address does not tell you who owns it.

Remember, seeing the right company name in a URL is not enough. Check that the actual domain is exactly the one the company uses.

What to do

• Start at the website you already trust. Use a saved bookmark or carefully enter bitrefill.com yourself. If you are already making a purchase on the legitimate site, stay within that session instead of opening a checkout page from a separate search.
• Treat search results for payment and checkout pages with suspicion. Scammers can buy search ads or manipulate their sites into appearing prominently. The first result is not necessarily the safest one.
• Check the address bar before you send. Cryptocurrency payments generally cannot be reversed or charged back. Confirm that the main domain is exactly bitrefill.com before approving a payment.
• Be wary of domains containing a brand followed by an extra word. A legitimate subdomain would place the additional wording before the company’s main domain, as in pay.example.com. An address such as example-pay.com is a completely separate domain that anyone could register.
• Don’t approve wallet requests on a site you have not verified. Simply connecting a wallet does not normally transfer funds, but a fraudulent site may ask you to sign a transaction or grant token permissions that allow assets to be stolen.
• If you have already sent funds, act quickly, although recovery is unlikely. Report the destination address to the exchange or wallet provider you used, report the incident to your national fraud reporting service, and notify Bitrefill so it can add the domain to its takedown efforts. Recovery services that promise to retrieve stolen cryptocurrency for an upfront fee are often follow-up scams.

Check before you click

The simplest protection against a page like this is to avoid reaching it. Malwarebytes Browser Guard is a free browser extension that blocks known scam and phishing sites, along with malicious ads and search results that lead to them.

Got a screenshot or URL of a suspected scam? Upload it to Scam Guard—built into Malwarebytes Premium Security on Windows, Mac, iOS, and Android—and you’ll get a verdict and safety tips in seconds.

Indicators of compromise (IOCs)

Domains:

biterflll[.]com

bitigift[.]com

bitrefall[.]com

bitrefill-payments[.]com

bitrefill-pays[.]com

bitregift[.]com

bitregill[.]com

bitretill[.]com

bitrgift[.]com

bitrgifts[.]com

bitrnfill[.]com

bitruflli[.]com

butrefill[.]com

pay-bitregill[.]com

pay-bitrgift[.]com

pay-bitrgifts[.]com

pay-butrefill[.]com

pay-bitigift[.]com

xn--bitrefll-71a[.]com

xn--bitrefll-h2a[.]com

xn--bitrefll-pay-kfb[.]com

xn--bitrefll-pay-xfb[.]com

xn--bitrefll-q2a[.]com

xn--bitreill-cz9c[.]com

xn--bitreill-pay-yq4f[.]com

xn--btrefill-l2a[.]com

xn--pay-bitrefll-fgb[.]com

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Technology has changed dramatically in the last 60 years - but the principles underlying its successful use in enterprises remain constant

I upgraded to iOS 27 yesterday. I had Siri turned off.

After the upgrade, Siri is now enabled.

Is this a bug or intentional? Wasn't able to find any supporting information.

Comments URL: https://news.ycombinator.com/item?id=49708233

Points: 1

# Comments: 0