California law­mak­ers may be back­ing away from a con­tro­ver­sial age-ver­i­fi­ca­tion re­quire­ment bill that alarmed Linux and open-source de­vel­op­ers ear­lier this year, af­ter a new amend­ment bill pro­posed ex­empt­ing most open-source op­er­at­ing sys­tems from the state’s up­com­ing Digital Age Assurance Act. In prac­tice, that would likely ex­empt most main­stream Linux dis­tri­b­u­tions — in­clud­ing Debian, Fedora, Ubuntu, Arch Linux, and Mint — from com­pli­ance re­quire­ments sched­uled to take ef­fect on January 1, 2027.

Assembly Bill 1856 (AB 1856), cur­rently mov­ing through California’s leg­is­la­ture ahead of com­mit­tee re­views in June, would amend the state’s ear­lier age-as­sur­ance law by ex­clud­ing soft­ware dis­trib­uted un­der li­censes that al­low users to “copy, re­dis­trib­ute, and mod­ify the soft­ware.”

The pro­posed amend­ment specif­i­cally states: “Operating sys­tem provider” does not mean a per­son or en­tity that dis­trib­utes an op­er­at­ing sys­tem or ap­pli­ca­tion un­der li­cense terms that per­mit a re­cip­i­ent to copy, re­dis­trib­ute, and mod­ify the soft­ware.

The amend­ment fol­lows months of back­lash af­ter California passed the orig­i­nal Assembly Bill 1043 (AB 1043), for­mally known as the Digital Age Assurance Act, in late 2025. The law sought to shift on­line age ver­i­fi­ca­tion away from in­di­vid­ual web­sites and apps and down to the op­er­at­ing-sys­tem level in­stead.

Under the orig­i­nal law, op­er­at­ing sys­tems would be re­quired to re­quest a user’s age or birth date dur­ing de­vice setup, then ex­pose an “age bracket sig­nal” to apps and app stores. The law, which de­fined brack­ets such as “under 13,” “13 – 15,” “16 – 17,” and “18+,” im­me­di­ately raised ques­tions about how such re­quire­ments would ap­ply to de­cen­tral­ized, open-source soft­ware ecosys­tems.

Unlike Apple’s iOS or Google’s Android, most Linux dis­tri­b­u­tions are not cen­trally con­trolled com­mer­cial plat­forms. Many are com­mu­nity-run pro­jects main­tained by vol­un­teers, of­ten with­out user ac­counts, teleme­try sys­tems, or even for­mal cor­po­rate own­er­ship struc­tures. Critics ar­gued the law’s word­ing was so broad that it could tech­ni­cally force open-source op­er­at­ing sys­tems to be­come age-ver­i­fi­ca­tion plat­forms.

Privacy ad­vo­cates, in­clud­ing the Electronic Frontier Foundation, crit­i­cized the leg­is­la­tion as in­va­sive and warned it could cre­ate in­fra­struc­ture for broader iden­tity track­ing on­line. Linux de­vel­op­ers also ques­tioned how California could re­al­is­ti­cally en­force such re­quire­ments on in­fi­nitely fork­able open-source soft­ware pro­jects.

Get Tom’s Hardware’s best news and in-depth re­views, straight to your in­box.

The con­tro­versy be­came par­tic­u­larly heated af­ter re­ports sug­gested plat­forms like SteamOS could still fall un­der the law due to their ties to pro­pri­etary ap­pli­ca­tion ecosys­tems. Valve’s Linux-based gam­ing plat­form ships with the pro­pri­etary Steam store­front and client, po­ten­tially plac­ing it closer to Apple’s App Store or Google Play from a reg­u­la­tory stand­point.

AB 1856 does not re­peal the orig­i­nal Digital Age Assurance Act. Instead, it nar­rows the de­f­i­n­i­tion of who qual­i­fies as an “operating sys­tem provider” un­der the law. Commercial plat­forms with pro­pri­etary app ecosys­tems could re­main sub­ject to California’s age-as­sur­ance re­quire­ments even if most open-source Linux dis­tri­b­u­tions are ul­ti­mately ex­empted.

California Assembly Member Buffy Wicks in­tro­duced the amend­ment on February 11, 2026. However, the open-source ex­emp­tion lan­guage ap­peared in later re­vi­sions that be­gan draw­ing at­ten­tion across Linux and pri­vacy com­mu­ni­ties. The lat­est ver­sion is dated May 18, 2026, and as of May 19, 2026, the bill was read a sec­ond time and or­dered to third read­ing.

Follow Tom’s Hardware on Google News, or add us as a pre­ferred source, to get our lat­est news, analy­sis, & re­views in your feeds.

Etiido Uko is a news con­trib­u­tor for Tom’s Hardware cov­er­ing the lat­est up­dates in big tech and the PC in­dus­try. He is a me­chan­i­cal en­gi­neer and se­nior tech­ni­cal writer with over nine years of ex­pe­ri­ence in doc­u­men­ta­tion and re­port­ing. He is deeply pas­sion­ate about all things en­gi­neer­ing and tech­nol­ogy, and is an ex­pert in gad­gets, man­u­fac­tur­ing, ro­bot­ics, au­to­mo­tive, and aero­space.

A lot of peo­ple seem con­vinced that the point of AI cod­ing is to write low-qual­ity code as fast as pos­si­ble. Spew out barely-pass­able slop, open mas­sive PRs, and merge them un­vet­ted. Ship it!

But the thing is, LLMs are very flex­i­ble. And you can use them just as ef­fec­tively to write high-qual­ity code more slowly.

This state­ment seems com­pletely ob­vi­ous to me at this point, and I al­most did­n’t want to write this post for that rea­son. But there seem to be enough peo­ple con­vinced that LLMs are only good as slop can­nons that it’s worth mak­ing the op­po­site case.

If Mythos taught us any­thing, it’s that LLM agents are re­ally good at find­ing bugs. Throw them at a code­base enough times, and they will find so many bugs that you’ll barely know what to do with them.

Like many oth­ers, I’ve also found this is true of non-Mythos mod­els — some may be bet­ter than oth­ers at find­ing sub­tle bugs or avoid­ing false pos­i­tives, but the fact is that the lat­est pub­lic mod­els from Anthropic and OpenAI are good enough to find plenty of bugs in an un­scru­ti­nized code­base.

The prob­lem is not so much find­ing the bugs, but in­stead pri­or­i­tiz­ing and val­i­dat­ing them. For this rea­son I have a Claude skill I adapted from this ar­ti­cle‘s core in­sight, which is that the more, dif­fer­ent mod­els you throw at a PR re­view, the less likely you are to get hal­lu­ci­na­tions or bo­gus bugs.

The skill says (paraphrasing):

Run a Claude sub-agent, Codex, and Cursor Bugbot to find bugs in this PR ranked by crit­i­cal/​high/​medium/​low. Once they’re all done, re­view their find­ings, do your own re­search to rule out false pos­i­tives, and write a fi­nal re­port.

Run a Claude sub-agent, Codex, and Cursor Bugbot to find bugs in this PR ranked by crit­i­cal/​high/​medium/​low. Once they’re all done, re­view their find­ings, do your own re­search to rule out false pos­i­tives, and write a fi­nal re­port.

That’s ba­si­cally it. You can add your own de­f­i­n­i­tion of “bug” if you want — mine has stip­u­la­tions about the KISS and DRY prin­ci­ples, writ­ing ac­ces­si­ble HTML/JSX, us­ing proper in­dexes for SQL queries, etc.

In my ex­pe­ri­ence, this skill al­ways finds tons of bugs in a PR, and the false pos­i­tive rate is near zero. It finds so many bugs that you’ll be bored sense­less if you try to tackle them all. They’ll range from crit­i­cal se­cu­rity or cor­rect­ness bugs to the more mun­dane medium-level perf bugs to low-level “this com­ment is mis­lead­ing”-type bugs.

My typ­i­cal work­flow is:

Have an agent fix all the crit­i­cals and highs (with my guid­ance on the proper so­lu­tion), then re­peat un­til no crit­i­cals/​highs

Skip highs/​medi­ums where the juice is­n’t worth the squeeze (e.g. 100 lines of code to fix a nar­row edge case)

Abandon the PR if it has so many crit­i­cals that I re­al­ize the whole ap­proach is mis­guided

When I use this tech­nique, I haven’t nec­es­sar­ily seen my ve­loc­ity go up. If any­thing, the re­view process of­ten finds pre-ex­ist­ing bugs, so I end up on a tan­gen­tial side-quest where I’m writ­ing unit tests and fix­ing sub­tle flaws that pre-date the PR. This is the op­po­site of the “10x pro­duc­tiv­ity” slop-can­non style of de­vel­op­ment that most peo­ple imag­ine when they think of vibe cod­ing, but I find it very sat­is­fy­ing.

It’s a great way to im­prove the over­all health of the code­base while also teach­ing you about the odd cor­ners of it. In my ex­pe­ri­ence, the happy-path of a com­plex ar­chi­tec­ture is less in­ter­est­ing than its fail­ure modes. And pre-LLMs, this is usu­ally how I got fa­mil­iar with a code­base any­way: un­der­stand­ing where the as­sump­tions break down, and then get­ting my hands dirty to fix it.

If you’re the kind of per­son who is skep­ti­cal that AI cod­ing is good for any­thing, then I doubt this post will per­suade you. But if you’re the kind of de­vel­oper who uses agents to write multi-hun­dred-line PRs that you barely un­der­stand your­self, I’d in­vite you to slow down a bit and try this other, slower style of “vibe cod­ing.” Ask an agent how your PR works and how it might fail. Have it write Markdown docs with Mermaid charts if nec­es­sary. Use Matt Pocock’s /grill-me skill un­til you un­der­stand the en­tire PR front-to-back.

You might not be more “productive” in terms of raw lines of code. You might burn a ton of to­kens just to find out that your en­tire plan was wrong­headed from the start. But I find this style of cod­ing to be a more su­per-pow­ered ver­sion of the kind of pro­gram­ming I was al­ready try­ing to do be­fore LLMs: care­ful, me­thod­i­cal, qual­ity-ob­sessed, fo­cused on mak­ing things bet­ter for the next coder.

So take a deep breath, slow down, try this tech­nique, and see if you don’t en­joy writ­ing bet­ter code more slowly.

Resolved - On May 12, 2026, be­tween 13:41 and 17:43 UTC, some ser­vices ex­pe­ri­enced de­lays in pro­cess­ing. For the Code Scanning ser­vice, 53% of check runs took over 15 min­utes to com­plete. Additionally, no­ti­fi­ca­tions took an av­er­age of 22 min­utes to be de­liv­ered and Slack in­te­gra­tion web­hooks took an av­er­age of 20 min­utes to be de­liv­ered. The de­lays were caused by repli­ca­tion lag due to an in­ter­nal data­base mi­gra­tion, re­sult­ing in in­suf­fi­cient worker ca­pac­ity for our high rate of job en­queues.

We mit­i­gated the im­pact by scal­ing our pro­cess­ing work­ers to han­dle the in­creased load. All ser­vices re­turned to nor­mal pro­cess­ing times af­ter the mit­i­ga­tion was ap­plied.

We are work­ing to cre­ate ded­i­cated worker pools for some of our high us­age shared queues to help pre­vent this in the fu­ture.

Update - All ser­vices have fully re­cov­ered.

May 12, 17:43 UTC

Update - CodeQL has fully re­cov­ered. We’re con­tin­u­ing to work on re­cov­ery for the re­main­ing im­pacted ser­vices.

May 12, 16:59 UTC

Update - Webhooks have fully re­cov­ered. Continuing to work on re­cov­ery for the other ser­vices.

May 12, 16:29 UTC

Update - Webhooks is op­er­at­ing nor­mally.

May 12, 16:28 UTC

Update - We’ve es­tab­lished that most de­lays are re­lated to a queu­ing ser­vice and are work­ing to scale out. Early sig­nals from the scale-out are show­ing signs of re­cov­ery for some ser­vices. We’ll pro­vide an up­date when ser­vices are fully re­cov­ered.

May 12, 16:18 UTC

Update - Webhooks is ex­pe­ri­enc­ing de­graded per­for­mance. We are con­tin­u­ing to in­ves­ti­gate.

May 12, 15:44 UTC

Update - We’re con­tin­u­ing to in­ves­ti­gate is­sues with CodeQL ac­tions work­flows. We’re ad­di­tion­ally see­ing de­lays for no­ti­fi­ca­tions, web­hooks, and the Slack in­te­gra­tion.

May 12, 15:42 UTC

Update - CodeQL ac­tions are cur­rently ex­pe­ri­enc­ing de­lays, which may re­sult in those ac­tions be­ing stuck in a pend­ing state or hav­ing failed due to a time­out.

May 12, 15:13 UTC

Investigating - We are in­ves­ti­gat­ing re­ports of de­graded per­for­mance for CodeQL

May 12, 14:38 UTC

Below are the servers with the new mit­i­ga­tion ap­plied.

When I was 11 and 12, I’d ride my bike to meet friends at the lo­cal sand­lot base­ball field 1.5 miles away, or to a friends house to go play pickup foot­ball in the street. When I was 14, I’d go on 10+ mile runs, ex­plor­ing every bit of road, side­walk, and path I could find. Exploration was a rite of pas­sage.

Today, 84% of 11 year olds aren’t al­lowed to leave their street, with 53% not even al­lowed to leave their front yard. For 14 year olds? 92% aren’t al­lowed to leave their neigh­bor­hood, and 55% can’t leave their streets.

In England data shows that in 1971, 86% of pri­mary-age chil­dren trav­eled home from school un­ac­com­pa­nied. By 1990, that had fallen to 35%. By 2010, it was 25%.

What in the world hap­pened? Why are we so afraid to let kids ex­plore?

There’s a temp­ta­tion to read this as a story about phones, screen time, or mod­ern dan­ger. It is­n’t. It’s a story about us. The par­ents, coaches, and grownups who de­cided, some­where in the last two decades, that the right amount of free­dom for a 10-year-old is to be vis­i­ble from the kitchen win­dow.

We told our­selves we were keep­ing them safe. We were do­ing some­thing else.

When I tell peo­ple these num­bers, the usual re­sponse is some ver­sion of “the world is more dan­ger­ous now.” It cer­tainly feels that way. The only prob­lem is that all of the data we have shows it’s much safer than when you or I were wan­der­ing the streets. Violent crime against chil­dren has fallen steadily since the early 1990s. Stranger ab­duc­tions, the thing every par­ent imag­ines when they hes­i­tate to let a 10-year-old walk to a friend’s house, were rare in 1985 and are rarer to­day.

The world did­n’t get more dan­ger­ous. We got more afraid.

In the 1970s, pro­fes­sor of com­mu­ni­ca­tion George Gerbner coined a term for a sim­i­lar phe­nom­e­non‑mean world syn­drome. Gerbner found that we tend to see the world as more dan­ger­ous and threat­en­ing than it is and that it was re­lated to the over­abun­dance of vi­o­lence on TV.

A 2008 study found that me­dia ex­po­sure ex­plains why Americans, in par­tic­u­lar, of­ten see the rest of the world as dan­ger­ous. Other re­search shows a link be­tween the amount of crime re­ported on the news and the de­gree of fear peo­ple have over crime. It’s not just worry. News con­sump­tion is re­lated to avoid­ance be­hav­ior as a way to deal with the fear of vi­o­lent crime. It’s not just tra­di­tional me­dia that plays a role. A re­cent analy­sis found that so­cial me­dia con­sump­tion is linked to an in­creased fear of street vi­o­lence.

When we are in­un­dated with a mes­sage that the world is threat­en­ing, we start to be­lieve it. The dif­fer­ence be­tween the era I grew up in and to­day is that we weren’t con­stantly pinged with no­ti­fi­ca­tions of crimes by the neigh­bor­hood app or lo­cal face­book group every day. These no­ti­fi­ca­tions make it feel like crime is abun­dant and hap­pen­ing right next door. It makes sense that our brains are primed for think­ing that if our kids wan­der too far they’ll get ab­ducted. They’re work­ing off the in­for­ma­tion they have.

A 2025 study backs this up, a fear of “stranger dan­ger” more than dou­bled the like­li­hood of risk-averse par­ent­ing and keep­ing your kids con­tained to near the house. We’ve got a per­cep­tion-re­al­ity gap that is hard to close be­cause it in­volves our most pre­cious cargo.

But it’s not all just in our head.

Depending on where you live, cars, traf­fic, and more dis­tracted peo­ple star­ing at their phones while dri­ving has cer­tainly risen. That’s a le­git­i­mate and struc­tural con­cern. We ab­solutely need bet­ter ur­ban de­sign, more parks, side­walks, etc.

But the ma­jor prob­lem is that it’s not just peo­ple not let­ting their kids out of the front yard be­cause of fear of cars, it’s that nearly all be­hav­iors re­lated to au­ton­omy of kids are down. From mak­ing their lunches to walk­ing down a dif­fer­ent aisle of a store, to not be­ing able to use a knife, have all de­clined. We’ve not only taken away more “high-stakes” in­de­pen­dence like walk­ing in the neigh­bor­hood but also low-stakes tasks, which sig­nals a much larger prob­lem than just fear of ab­duc­tion or cars.

Again, much of it is in re­sponse to a en­vi­ron­ment that pun­ishes par­ents for giv­ing kids au­ton­omy. A 2023 study found that state laws are all over the place and of­ten dis­con­nected from what the best sci­ence says is age ap­pro­pri­ate. For ex­am­ple, Maryland law ef­fec­tively says no child should be alone be­fore the age of 8. While Minnesota al­lows 6 year olds to be un­su­per­vised. There is no con­sis­tent na­tional stan­dard, and most laws have no de­vel­op­men­tal ra­tio­nale.

And this leads to an­other le­git­i­mate fear. No one wants to be re­ported to child pro­tec­tive ser­vices. And it hap­pens at an as­ton­ish­ing rate. According to a 2017 study, ap­prox­i­mately 38% of all chil­dren will be in­ves­ti­gated by CPS by the time they are 18. And the ma­jor­ity of those cases aren’t about abuse. They’re about su­per­vi­sory ne­glect, chil­dren be­ing some­where with­out an adult.

Which ties into an­other thing pre­vent­ing par­ents from length­en­ing the leash, judg­ment of oth­ers. If there’s one thing that’s sky­rock­eted over the last few decades it’s cer­tainly judg­ment. With so­cial me­dia and other out­lets, we walk around crit­i­ciz­ing any and every­one. According to some re­cent data, 25% of par­ents ad­mit­ted they had per­son­ally crit­i­cized an­other par­ent for not ad­e­quately su­per­vis­ing their child. So a quar­ter of par­ents are walk­ing around as the en­force­ment mech­a­nism.

While re­search pub­lished in 2024 found that “intensive par­ent­ing at­ti­tude” pro­duces stress, anx­i­ety, de­pres­sion, and guilt in moth­ers. We feel guilty when we aren’t al­ways on, al­ways there. We feel like bad moth­ers and fa­thers.

The feel­ing cre­ates anx­i­ety and that anx­i­ety pushes us to­wards over-pro­tect­ing. And we’re well aware of it. In fact, we want bet­ter. We just don’t fol­low through.

In a sur­vey of par­ents of 5 – 11 year olds, four out of five par­ents ac­tu­ally agreed that un­su­per­vised free time is good for kids. They wanted more of it. But in prac­tice:

Only 50% would let a 9 – 11 year old find an item at the store while they shopped in an­other aisle

Only 50% would let a 9 – 11 year old find an item at the store while they shopped in an­other aisle

Only 15% would let them trick-or-treat with­out an adult

Only 15% would let them trick-or-treat with­out an adult

Only 20% of 5 – 8 year olds pre­pare their own snack

Only 20% of 5 – 8 year olds pre­pare their own snack

The top re­ported fear was that “someone might scare or fol­low” the child

The top re­ported fear was that “someone might scare or fol­low” the child

And the kicker is that it largely was­n’t about ac­tual dan­ger, as only 17% re­ported that they lived in a neigh­bor­hood that was un­safe. The re­searchers con­cluded that par­ents “may be un­in­ten­tion­ally re­strict­ing their child’s path to in­de­pen­dence.” They want to let go. They just can’t.

The Consequences of Safetyism

We live in a cul­ture of safe­ty­ism. And it’s largely an English speak­ing phe­nom­e­non. These same views aren’t held in other coun­tries. For ex­am­ple, a 2023 study found that while English-speaking par­ents gen­er­ally ex­pect kids to han­dle some in­de­pen­dence around 9 or 10, Japanese and Kenyan par­ents ex­pect that same level of in­de­pen­dence at 5 or 6.

Similarly, in an in­ter­na­tional study that looked at 7 to 15 year old chil­dren across 16 dif­fer­ent coun­tries they found that most eng­lish-speak­ing coun­tries were in the low­est au­ton­omy tier (12th- Ireland, 13th- Australia, 16th- South Africa). Americans weren’t sur­veyed, but coun­tries like Finland, Germany, Norway, Sweden, Japan, and Denmark scored the high­est on au­ton­omy. For ex­am­ple, in Finland, the ma­jor­ity of 7 year olds are rou­tinely al­lowed to walk or bike alone. And by 8, the ma­jor­ity of kids cross main roads, com­mute to school, and nav­i­gate their neigh­bor­hoods un­ac­com­pa­nied.

Once again, part of this is struc­tural, with easy ac­cess to bikes and such, and we should ab­solutely ad­dress that. But in­creas­ingly, the data points to a large part of this be­ing the safe­ty­ism that has taken hold in places like America.

Safety is pre­ven­ta­tive. It’s the im­pulse to pre­vent every pos­si­ble dis­com­fort, fall, or bruise. It’s mak­ing sure that there aren’t mon­key bars at a play­ground so that no one can fall. It’s pro­vid­ing trig­ger warn­ings, so that peo­ple can walk out in­stead of face be­ing un­com­fort­able in the class­room. Safetyism pro­vides the il­lu­sion of se­cu­rity. It has the ap­pear­ance of care, but in re­al­ity, it’s avoid­ance.

We con­fuse safety with se­cu­rity, and they aren’t the same thing.

Security is some­thing dif­fer­ent. It’s hav­ing the knowl­edge that if you fall, some­one you trust will help you get back up. It’s the idea of know­ing that if you make a mis­take in the of­fice, you should let oth­ers know so that you can im­prove the processes, in­stead of hid­ing it away for fear of los­ing your job. Security gives you a base to ex­plore from. Safety builds walls.

The strange thing is that the more we choose safety over se­cu­rity, the less of ei­ther we get. A 2024 meta-analy­sis on trig­ger warn­ings found that they make no dif­fer­ence at best, and at worst they in­crease anx­i­ety, be­cause our pre­dic­tive brain pre­pares for the dis­as­ter we just got warned about. Watch what hap­pens at re­cess when adults al­ways step in to me­di­ate. Children stop learn­ing how to re­solve their own ar­gu­ments. Watch what hap­pens when a par­ent al­ways res­cues a child from a hard math prob­lem. The child stops try­ing, learn­ing that mom or dad is there to save them.

It’s part of the rea­son (along with phones, so­cial me­dia, etc.) that we’ve had such an alarm­ing surge in youth men­tal health is­sues. According to the CDC 40% of US high school stu­dents re­ported per­sis­tent feel­ings of sad­ness or hope­less­ness in 2023, up sig­nif­i­cantly from ear­lier data. Suicide among chil­dren un­der 15 rose 3.5-fold be­tween 1950 and 2005, then an­other 2.4-fold by 2020.

A 2020 lon­gi­tu­di­nal study fol­lowed 500 ado­les­cents from age 12 through 19. The teens whose par­ents stayed at per­sis­tently el­e­vated lev­els of psy­cho­log­i­cal con­trol across those seven years showed mea­sur­ably worse tra­jec­to­ries of both de­pres­sion and anx­i­ety. A 2024 meta-analy­sis of 52 stud­ies on over­par­ent­ing con­firmed the pat­tern: across cul­tures and in­come lev­els, over­par­ent­ing pre­dicts higher rates of de­pres­sion, anx­i­ety, and in­ter­nal­iz­ing symp­toms in off­spring. When we elim­i­nate the small dis­com­forts that build emo­tional reg­u­la­tion, we don’t make kids safer. We make them more anx­ious.

It’s why Peter Gray and col­leagues writ­ing in the Journal of Pediatrics con­cluded, “A pri­mary cause of the rise in men­tal dis­or­ders is a de­cline over decades in op­por­tu­ni­ties for chil­dren and teens to play, roam, and en­gage in other ac­tiv­i­ties in­de­pen­dent of di­rect over­sight and con­trol by adults.”

The Power of Freedom

Early in my high school coach­ing ca­reer, I learned a hard les­son that stuck with me. It was easy to get some­one to fin­ish a work­out while I was stand­ing there watch­ing them. I could get 14 year old fresh­man to do lots of mile re­peats or go on a 10 mile run if I, as the coach, was run­ning with them. But what ul­ti­mately mat­tered and de­ter­mined their suc­cess is what they did when I was­n’t. Did they do their runs over the sum­mer when we did­n’t have prac­tice, or run the whole way in­stead of walk­ing and tak­ing short­cuts when we ran at the lo­cal park. That’s what mat­tered.

And re­search shows that when we use a lead­er­ship style where con­trol by the coach is the key, kids work hard while you’re there, but don’t when you aren’t work­ing. On the other hand, au­ton­omy sup­port­ive coach­ing, where you lengthen the leash and em­power agency does. It in­creases in­trin­sic mo­ti­va­tion, self-be­lief, con­fi­dence, and even re­silience.

That’s be­cause our body and brain were meant to be stressed ap­pro­pri­ately. Just like a mus­cle needs to feel the strain of lift­ing a weight or run­ning a mile to adapt and grow, hu­mans need ex­po­sure to just man­age­able risks, peer con­flict, and per­sonal dis­com­fort to prop­erly wire our ex­ec­u­tive func­tion and build cog­ni­tive re­silience.

Pickup games are the lab where chil­dren prac­tice be­ing hu­man. Research shows kids learn to solve con­flict and dis­agree­ments on the sand­lot or at re­cess. Playgrounds are where kids learn to take ap­pro­pri­ate risks for their cur­rent ca­pa­bil­i­ties. They don’t know if they can climb the wall, hang on the mon­key bars, or what not un­til they try.

When we re­place the sand­lot with the travel league, we re­place the cur­ricu­lum with a script. The coach picks the teams, calls balls and strikes, in­ter­venes dur­ing any con­flict. We learn to out­source every­thing. The thou­sand small acts of judg­ment that built emo­tional reg­u­la­tion in pre­vi­ous gen­er­a­tions have been qui­etly handed back to the grownups.

Similarly, when we’re never given the chance to bike to our friends house, walk to school, or ex­plore the world around us, we’ve cre­ated an ar­ti­fi­cially small world. Not only, do we never de­velop our in­ter­nal spa­tial aware­ness, but we in­grain a men­tal model that says the out­side world is dan­ger­ous and we are not ca­pa­ble of nav­i­gat­ing it. We never learn to make risk-as­sess­ments our­selves. And as we are learn­ing, an ap­pro­pri­ate as­sess­ment of risks, re­wards, and our ca­pa­bil­i­ties is how our brain de­cides whether to work hard and give ef­fort or not. If our brain is con­vinced every­thing is risky, we de­fault to “why try mode.”

By com­pletely re­mov­ing un­su­per­vised ex­plo­ration, we’ve in­ad­ver­tently de­nied kids the raw ma­te­r­ial re­quired to over­come nor­mal de­vel­op­men­tal anx­i­eties. The things that helped de­velop self-reg­u­la­tion, con­flict res­o­lu­tion, an in­ter­nal lo­cus of con­trol…are gone.

It’s as if we took every­one in school and said, use AI to solve all of your work be­cause do­ing math, star­ing at a blank page to write, or giv­ing a speech are too un­com­fort­able. Sure, we might com­plete the as­sign­ments and they’ll have the ap­pear­ance of do­ing math, writ­ing an es­say, and so forth…but there’s zero learn­ing go­ing on.

By step­ping in to elim­i­nate all mi­nor dis­com­forts and phys­i­cal risks, par­ents dis­rupt the child’s ca­pac­ity to learn through phys­i­cal trial and er­ror. In many ways, we’ve sys­tem­at­i­cally en­gi­neered learned help­less­ness.

In my coach­ing work, I tell every ath­lete the same thing on day one: my goal is to make my­self kind of ob­so­lete. I’m try­ing to coach them to­ward in­de­pen­dence, not de­pen­dence. That does­n’t mean I dis­ap­pear or check out. It means I grad­u­ally give away con­trol, in small bites, un­til the ath­lete is the one steer­ing the ship. My role slowly shifts to guide, men­tor, or even a co-pi­lot on the jour­ney.

In or­der to get there, you have to grad­u­ally give away re­spon­si­bil­ity and choice. Sure, it may start out that you dic­tate the work­outs pre­cisely. But over time, you ask and col­lab­o­rate more (What do you think? What would you do?). You hand over de­ci­sion mak­ing. At first, it might be some­thing sim­ple, do you think you can do one or two more reps? But over time, you pro­vide more re­spon­si­bil­ity and au­ton­omy. Those are the in­gre­di­ents that build self-re­liance, tough­ness, and a sense of agency.

The late Kobe Bryant put it well, when watch­ing his daugh­ters bas­ket­ball prac­tice, and there was a par­ent on the side­lines en­cour­ag­ing and yelling at their daugh­ter with things like “Dig deep!“ After prac­tice, Bryant pulled that par­ent aside and said, “When she’s do­ing those line drills, don’t say any­thing. Because there’s a con­ver­sa­tion that’s hap­pen­ing in­side her head. She’s talk­ing to her­self pump­ing her­self up to do it. So for an out­side voice to come in to give her guid­ance and the push to keep go­ing ac­tu­ally in­ter­rupts her process. Let her be. Let her fig­ure it out her­self.”

Parenting works the same way. If we’re al­ways the per­son dic­tat­ing and con­trol­ling, it might look and feel like the right thing in the mo­ment. But too of­ten we’re pre­vent­ing them from de­vel­op­ing the ex­act skills that al­low them to thrive when we’re not there.

So of course we need to fix the struc­tural el­e­ments to al­low our kids to roam. Of course, we want vi­o­lence and dan­ger to be low and should be aware of the safety of the area we’re in. And of course, a 5 year old is go­ing to have a dif­fer­ent leash length than a 10 or even 15 year old. But… we’ve got to let them nav­i­gate dis­com­fort, to feel bored, to face con­flict, to wan­der. Those are the build­ing blocks of con­fi­dence, re­silience, self-de­ter­mi­na­tion, and emo­tional reg­u­la­tion.

I think about this when I watch my own daugh­ters. Every in­stinct in me wants to fix the small prob­lem be­fore it be­comes a hard one. As a per­son with OCD, there’s al­ways a tinge of fear of what will hap­pen when our old­est reaches for those mon­key bars or climbs the rock wall that I’m not quite sure if she can han­dle yet. Part of my brain is al­ways scream­ing “Danger! Intervene!” But just like I learned with OCD, not every feel­ing or thought needs power. Some we have to sit with it, re­al­ize that the world is­n’t on fire and that we aren’t go­ing to die. And even­tu­ally, that thought qui­ets down to its right­ful level.

Every par­ent I know has sim­i­lar in­stincts. We aren’t bad par­ents. We’re just liv­ing in a world that has con­di­tioned us to be afraid. But the kind­est thing I can do, the thing that will ac­tu­ally make my daugh­ters re­silient, is to let the small prob­lems hap­pen. To let her ne­go­ti­ate the friend­ship I could fix in one phone call. To let her ride fur­ther than I’m com­fort­able with. To grad­u­ally, ap­pro­pri­ately lengthen that leash.

-Steve Magness

For more, you might like my piece on The Hidden Costs of Comfort or my books: Do Hard Things and Win the Inside Game.

In a sea of non­sense, help good stuff reach oth­ers, please share:

Share

Hacker News

3h, 464p, 233 com­ments

GitHub Actions down again to­day

On May 26, 2026, GitHub re­ported an on­go­ing in­ci­dent af­fect­ing GitHub Actions and GitHub Pages, with de­graded avail­abil­ity for Actions and on­go­ing in­ves­ti­ga­tions into per­for­mance is­sues for Pages, as noted in the sta­tus up­date at 11:19 UTC.

3h, 43p, 1 com­ment

Opaque Types in Python

An ar­ti­cle­ex­plains how to cre­ate an opaque data type in Python by wrap­ping a pri­vate class with a NewType, ex­pos­ing only a con­strained pub­lic in­ter­face like the ShippingOptions NewType that ini­tially pro­vides fast, nor­mal, and slow con­struc­tors and later adds car­rier and con­veyance enums for fu­ture ex­ten­si­bil­ity while keep­ing the un­der­ly­ing con­struc­tor hid­den.

3h, 47p, 12 com­ments

Incident with Actions and Pages

GitHub is in­ves­ti­gat­ing an in­ci­dent af­fect­ing Actions and Pages due to re­ports of de­graded per­for­mance. The in­ci­dent was first re­ported on May 26, 2026 at 10:57 UTC.

1h, 7p, 2 com­ments

Trying to pre­serve other peo­ples code

CRC_generator is a com­mand-line tool by Evgeni Stavinov that gen­er­ates Verilog or VHDL code for Cyclic Redundancy Check (CRC) im­ple­men­ta­tions. The cross-plat­form C ap­pli­ca­tion sup­ports data and poly­no­mial widths be­tween 1 and 1024 bits. Users can spec­ify the tar­get lan­guage, data width, poly­no­mial width, and poly­no­mial string as com­mand-line pa­ra­me­ters. The tool was orig­i­nally hosted on OutputLogic.com but is now pre­served on GitHub as a mir­ror of the SourceForge repos­i­tory, with Stavinov bring­ing over 20 years of FPGA and em­bed­ded sys­tems de­sign ex­pe­ri­ence to the pro­ject.

1d, 384p, 397 com­ments

What we lost when we stopped let­ting kids leave the front yard

Steve Magness ar­gues that mod­ern “safetyism” — an over‑pro­tec­tive, risk‑averse par­ent­ing cul­ture — has sharply re­duced chil­dren’s free­dom to ex­plore their neigh­bor­hoods, even though vi­o­lent crime and stranger dan­ger have de­clined. Citing sur­veys show­ing that 84% of 11‑year‑olds can’t leave their street and re­search link­ing me­dia‑dri­ven fear to re­stric­tive laws, he ex­plains how parental anx­i­ety, fear of CPS re­ports, and so­cial‑me­dia judg­ment com­press au­ton­omy, lead­ing to higher rates of anx­i­ety, de­pres­sion and sui­cide among youth. International com­par­isons re­veal English‑speaking coun­tries rank low­est in child au­ton­omy, while na­tions like Finland al­low much ear­lier in­de­pen­dent travel. Magness con­tends that over‑pro­tec­tion re­places “security” — the con­fi­dence that set­backs can be man­aged — with “safety” that builds walls, stunt­ing de­vel­op­ment of re­silience, prob­lem‑solv­ing and emo­tional reg­u­la­tion. He calls for a grad­ual “lengthening of the leash,” en­cour­ag­ing in­de­pen­dent play, un­su­per­vised er­rands and risk‑tak­ing to re­store con­fi­dence and men­tal health.

5h, 33p, 4 com­ments

Exposing Critical Vulnerabilities in CBSE’s On-Screen Marking Portal

The web­page high­lights ma­jor se­cu­rity flaws in CBSE’s dig­i­tal On-Screen Marking por­tal, en­abling at­tack­ers to by­pass au­then­ti­ca­tion, re­set ex­am­iner pass­words, and ma­nip­u­late grad­ing data. Vulnerabilities in­clude a hard­coded mas­ter pass­word in fron­tend code, in­se­cure client-side OTP val­i­da­tion, lack of route guards, in­suf­fi­cient pass­word-change ver­i­fi­ca­tion, and sys­temic IDOR risks across APIs. These is­sues threaten the in­tegrity of na­tional board exam processes, ex­pos­ing sen­si­tive aca­d­e­mic in­for­ma­tion and un­der­min­ing trust in the sys­tem.

19h, 305p, 195 com­ments

Norway’s 2 petabytes of Huawei flash stor­age and LLM train­ing

At the Huawei ID Forum 2026 in Paris, Marius Husnes, Head of IT Platform at the Norwegian National Library, ex­plained that the li­brary is build­ing a sov­er­eign Norwegian‑language LLM us­ing 2 PB of Huawei OceanStor Dorado flash stor­age for its AI train­ing pipeline, a step vi­tal be­cause no com­mer­cial provider of­fers a lo­cal model; the li­brary’s mas­sive dig­i­tal col­lec­tion, amassed since 2005, to­tals around 20 PB of unique data (≈60 PB with preser­va­tion copies) and feeds an in‑house pipeline on an Nvidia DGX H200 and 384‑core CPU clus­ter be­fore the data is sent to the na­tional su­per­com­puter Sigma2 Olivia (an HPE Cray EX with 448 GPUs) for train­ing, while Husnes high­lighted the dif­fi­culty of mov­ing petabyte‑scale archives with low‑la­tency, high‑through­put stor­age and the lack of stan­dard eval­u­a­tion tools for such a Norwegian LLM.

15h, 261p, 284 com­ments

Nobody cracks open a pro­gram­ming book any­more

Programming book sales have plum­meted as AI tools like ChatGPT and GitHub Copilot re­place the need for printed guides, with the “computer book” cat­e­gory down 16.9% year over year in early 2023 and pub­lish­ers qui­etly stopped re­port­ing the seg­ment af­ter 22.3% de­clines in pro­fes­sional books by August 2025. The pro­gram­ming book, a medium that forced dis­ci­pline through slow typ­ing, is be­ing sup­planted by chat­bots that ex­plain in ex­act words but leave no residue of prac­tice. Knowledge for pro­gram­mers was al­ways the re­sult of typ­ing code, and as that ac­tiv­ity fades, the in­dus­try shifts to­ward higher ab­strac­tion—though the phys­i­cal books, with their pen­cil names and cof­fee stains, re­main in used book­stores, un­sold.

9h, 22p, 3 com­ments

Logseq Doctor: Heal your flat old Markdown files be­fore im­port­ing them to Logseq

The web­page dis­cusses *Logseq Doctor*, a tool for man­ag­ing Markdown files for Logseq us­ing com­mand-line in­ter­faces. It high­lights fea­tures like Converting flat Markdown to out­lines, gen­er­at­ing task back­logs, clean-up of Markdown, and track­ing over­due items. The pro­ject aims to con­vert func­tion­al­ity from Python to Go and im­prove us­abil­ity with fea­tures such as task list­ing, tidy-ups, and per­for­mance op­ti­miza­tions. Users are en­cour­aged to ex­plore the de­vel­op­ment sta­tus, up­com­ing re­leases, and com­mu­nity con­tri­bu­tions.

4h, 34p, 25 com­ments

A re­al­ity check on the AI jobs hys­te­ria

Recent eco­nomic re­search shows that ar­ti­fi­cial‑in­tel­li­gence has not yet dev­as­tated U.S. white‑col­lar jobs, with AI‑exposed oc­cu­pa­tions ac­tu­ally en­joy­ing lower un­em­ploy­ment than less af­fected roles, and no large‑scale shift of work­ers to man­ual‑work jobs yet. Data from the Bureau of Labor Statistics and large pay­roll data­bases re­veal only a fifth of com­pa­nies use AI, and pro­duc­tiv­ity gains so far are mod­est. Although en­try‑level po­si­tions in highly au­to­mated fields such as soft­ware de­vel­op­ment have seen a no­tice­able de­cline—es­pe­cially among 22‑ to 25‑year‑olds—older work­ers and roles re­quir­ing tacit ex­pe­ri­ence have ben­e­fited or re­mained sta­ble. Wage growth in AI‑rich sec­tors sug­gests firms still value hu­man ex­per­tise that AI can­not repli­cate. The tech­nol­o­gy’s ul­ti­mate im­pact re­mains un­cer­tain, and econ­o­mists ar­gue that the speed of dis­rup­tion will de­ter­mine whether pol­icy can ad­just; for now, the mar­ket shows a grad­ual, not cat­a­strophic, tran­si­tion.

4h, 21p, 15 com­ments

China vs. Taiwan: The Geography of an Unfinished War

The China-Taiwan con­flict rep­re­sents more than a po­lit­i­cal dis­pute—it is a struc­tural fault line in the Indo-Pacific bal­ance of power, where Taiwan’s ge­og­ra­phy as a strate­gic hinge be­tween the East China Sea and South China Sea po­si­tions it near Japan, the Philippines, and crit­i­cal mar­itime lanes. For Beijing, Taiwan rep­re­sents the un­fin­ished chap­ter of the Chinese civil war and a mil­i­tary-ge­o­graphic prob­lem, as its con­trol would break the mar­itime arc formed with Japan and the Philippines that cur­rently lim­its China’s ac­cess to the wider Pacific. For Taiwan, ge­og­ra­phy pro­vides both pro­tec­tion and vul­ner­a­bil­ity, cre­at­ing de­pen­dence on mar­itime sup­ply chains and im­ported en­ergy, while its semi­con­duc­tor in­dus­try gives it ex­tra­or­di­nary global rel­e­vance as both shield and mag­net in the ad­vanced tech­nol­ogy ecosys­tem. The Taiwan Strait thus rep­re­sents the con­ver­gence of three sys­tems: China’s con­ti­nen­tal au­thor­i­tar­ian model, Taiwan’s de­mo­c­ra­tic mar­itime model, and America’s al­liance-based Indo-Pacific or­der, mak­ing it a defin­ing struc­tural con­test of the twenty-first cen­tury be­tween con­ti­nen­tal con­trol and mar­itime open­ness.

17h, 250p, 48 com­ments

Microsoft Copilot Cowork Exfiltrates Files

The ar­ti­cle high­lights that Microsoft Copilot Cowork is vul­ner­a­ble to file ex­fil­tra­tion through in­di­rect prompt in­jec­tion at­tacks. Attackers can ex­ploit processes that per­mit agents to op­er­ate and ac­cess sen­si­tive data via Teams, emails, and shared plat­forms with­out im­me­di­ate user ap­proval. This poses a sig­nif­i­cant risk when users up­load files or in­ter­act with com­pro­mised con­tent, po­ten­tially en­abling theft of per­son­ally iden­ti­fi­able and fi­nan­cial in­for­ma­tion. The key is­sue lies in the sys­tem’s de­sign grant­ing broad per­mis­sions, which, com­bined with per­sis­tent at­tack vec­tors, ex­pands the at­tack sur­face. Mitigation em­pha­sizes lim­it­ing ac­cess to down­load links and tight­en­ing per­mis­sions to pre­vent unau­tho­rized data ex­trac­tion.

1d, 262p, 77 com­ments

Gnutella: A Protocol Outliving the World That Created It

Gnutella, a de­cen­tral­ized peer-to-peer file-shar­ing pro­to­col pop­u­lar­ized in the 2000s through clients like LimeWire, is the fo­cus of this nos­tal­gic analy­sis. Developed as an in­ter­nal demo that leaked pub­licly af­ter AOL can­celed it, Gnutella thrived for over a decade by solv­ing real-world prob­lems: en­abling file shar­ing with­out cen­tral servers, cir­cum­vent­ing the mu­sic in­dus­try’s re­sis­tance to dig­i­tal dis­tri­b­u­tion, and op­er­at­ing ef­fec­tively de­spite dial-up in­ter­net lim­i­ta­tions. The pro­to­col used a gos­sip-based mesh net­work for peer dis­cov­ery and HTTP for file trans­fers, with core mes­sage types (PING/PONG, QUERY/QUERYHIT, PUSH) sup­port­ing search, con­nec­tiv­ity, and fire­wall tra­ver­sal. While it scaled to mil­lions of users and adapted via ex­ten­sions like GGEP and HUGE, its de­cline stemmed not from tech­ni­cal fail­ure but from the dis­ap­pear­ance of its orig­i­nal con­text—mod­ern plat­forms and stream­ing ser­vices re­placed the need for de­cen­tral­ized file shar­ing. Despite this, Gnutella per­sists in a “long tail” state, main­tained by en­thu­si­asts and clients like GTK-Gnutella, prov­ing its re­silience and en­dur­ing de­sign.

1d, 125p, 18 com­ments

AI er­rno(2) val­ues

A blog­ger has cre­ated a satir­i­cal ex­ten­sion to the stan­dard sys­tem er­rno header file, defin­ing 30 new er­ror codes specif­i­cally for AI fail­ures. The hu­mor­ous code in­cludes con­stants like EAI (201) for “hallucination,” EDAWKINS (205) for “claude delu­sion,” EGPT (213) for “walked like an 𐦂,” and ELON (220) for “megalomania ex­haus­tion.” The com­plete header file, posted on May 19th, 2026, pre­sents a tongue-in-cheek ap­proach to cat­e­go­riz­ing po­ten­tial AI sys­tem mal­func­tions with de­scrip­tive er­ror mes­sages that ref­er­ence var­i­ous AI-related is­sues and cul­tural ref­er­ences.

9h, 60p, 59 com­ments

Use Boring Languages with LLMs

Jacob Young, founder of Sancho Studio, ar­gues that con­sis­tent pro­gram­ming lan­guages and ecosys­tems pro­duce su­pe­rior re­sults when work­ing with large lan­guage mod­els. He ob­serves that frag­mented tech­nolo­gies am­plify in­con­sis­tency while con­ven­tional ap­proaches re­in­force re­li­a­bil­ity, mak­ing con­sis­tency a crit­i­cal fac­tor in the era of mas­sive AI mod­els. Among lan­guages, Go emerges as par­tic­u­larly ef­fec­tive due to its sim­ple con­cur­rency model with gor­ou­tines, com­pre­hen­sive stan­dard li­brary, strict tool­ing that en­forces a sin­gle canon­i­cal style, na­tive-like per­for­mance with garbage col­lec­tion, and a bounded set of po­ten­tial is­sues. Unlike JavaScript’s frag­mented ecosys­tem or Python’s pack­age man­ager com­plex­ity, Go’s “one right way” ap­proach pro­vides the ideal com­bi­na­tion for LLMs: a con­sis­tent train­ing cor­pus plus stan­dard­ized tool­ing that pro­duces pre­dictable, re­li­able code. Young sug­gests that while Go is­n’t nec­es­sar­ily the “best” lan­guage in an ab­solute sense, its char­ac­ter­is­tics make it ex­cep­tion­ally well-suited for build­ing CLIs, back­end servers, and agent or­ches­tra­tors with AI as­sis­tance.

12h, 67p, 59 com­ments

Dehydration’s role in learn­ing and mem­ory

Cold Spring Harbor Laboratory re­searchers led by Professor Hiro Furukawa and post­doc Ruben Steigerwald have un­cov­ered how NMDA re­cep­tors (NMDARs) dif­fer­en­ti­ate cal­cium from mag­ne­sium ions, a process crit­i­cal to learn­ing and mem­ory. Using sin­gle-par­ti­cle cryo-EM, the team re­vealed that mag­ne­sium blocks the re­cep­tor’s Asn cage chan­nel by bind­ing tightly to sur­round­ing wa­ter mol­e­cules, while cal­ci­um’s weaker in­ter­ac­tion al­lows it to pass through af­ter de­hy­dra­tion. This mol­e­c­u­lar mech­a­nism, ob­served across 50,000 high-res­o­lu­tion im­ages, ex­plains how the brain’s elec­tri­cal sig­nals en­able mem­ory for­ma­tion. The study also sheds light on GRIN dis­or­ders, caused by mu­ta­tions in the Asn cage, which lead to se­vere neu­ro­log­i­cal im­pair­ments. The find­ings, pub­lished in Nature Neuroscience, pro­vide in­sights into neu­rode­vel­op­men­tal dis­eases and po­ten­tial ther­a­peu­tic tar­gets.

2d, 244p, 124 com­ments

Childhood Computing

The au­thor re­calls their child­hood com­put­ing ex­pe­ri­ences from 1992 when, at age eight, they gained ac­cess to a com­puter lab at their new school in an in­dus­trial town. The lab con­tained old IBM PC com­pat­i­ble ma­chines with mono­chrome CRT mon­i­tors and no hard disks, re­quir­ing stu­dents to in­sert floppy disks to load MS-DOS and LOGO.COM for pro­gram­ming ses­sions. With only two hours of com­puter time per month, the au­thor pri­mar­ily worked with pen and pa­per at home, test­ing Logo pro­grams on graph pa­per be­fore ex­e­cut­ing them in the lab. One no­table pro­gram cre­ated an an­i­mated house out­line that class­mates copied and mod­i­fied, ef­fec­tively be­com­ing the au­thor’s first “free and open source soft­ware” dis­trib­uted through hand­writ­ten note­books. Beyond pro­gram­ming, the au­thor fondly re­mem­bers early com­puter games like Moon Bugs, Digger, and Grand Prix Circuit, with the lat­ter par­tic­u­larly im­press­ing them with its 3D graph­ics ca­pa­bil­i­ties. These ex­pe­ri­ences, filled with won­der and ex­plo­ration, re­main vivid sen­sory mem­o­ries decades later, in­clud­ing the dis­tinc­tive smell and sounds of the com­puter lab.

1d, 42p, 34 com­ments

He Lost It at the Movies

Leo Robson ex­am­ines the ca­reer and crit­i­cal method of film re­viewer A.S. Hamrah, who gained promi­nence in the late 2000s with idio­syn­cratic, cap­sule-style re­views for n+1 that re­jected con­ven­tional analy­sis in fa­vor of comic, con­fronta­tional nega­tions. Hamrah, whose work is col­lected in The Earth Dies Streaming and Algorithm of the Night, po­si­tions him­self as a de­fi­ant de­fender of a lost era of cinephilia, in­flu­enced by Manny Farber and hos­tile to the mod­ern con­sumer-guide ap­proach, stream­ing ser­vices, and Marvel block­busters. While Robson ac­knowl­edges Hamrah’s po­lit­i­cal in­sights and en­thu­si­as­tic ap­pre­ci­a­tions of di­rec­tors like Chantal Akerman and Stanley Kubrick, the es­say ar­gues that his re­lent­less neg­a­tiv­ity of­ten un­der­mines his judg­ments, lead­ing to in­ac­cu­rate por­tray­als of other crit­ics, strained logic, and a ten­dency to pre­sent de­cline as the only nar­ra­tive. Robson points to Hamrah’s rare pos­i­tive es­say “Movie Stars in Bathtubs” as a tan­ta­liz­ing glimpse of what his crit­i­cism might be with­out the re­flex­ive op­po­si­tion.

2h, 64p, 58 com­ments

Outsourcing plus LocalAI will soon be­come more eco­nom­i­cal vs. Frontier labs

SignalBloom AI pub­lished an analy­sis ar­gu­ing that com­bin­ing out­sourc­ing with lo­cal AI mod­els like DeepSeek will soon be­come more cost-ef­fec­tive than re­ly­ing on fron­tier lab LLMs. The es­say notes that con­trary to ex­pec­ta­tions, fron­tier model pric­ing from US labs has been ris­ing rather than falling: GPT-5.5 costs over three times what GPT-5 did eight months ago, Gemini 3.5 Flash tripled pric­ing from its pre­de­ces­sor, and Opus-4.7 in­creased to­ken con­sump­tion by 32 – 47% over Opus-4.6. Using a “blend to­ken con­sump­tion ra­tio” for agen­tic work­flows, the analy­sis finds fron­tier providers like Anthropic and OpenAI charge ap­prox­i­mately $2.80-$2.82 per mil­lion to­kens com­pared to DeepSeek’s $0.094—a roughly 30x price dif­fer­ence. The au­thor ar­gues this pre­mium may not be jus­ti­fied when paired with a de­cent hu­man en­gi­neer, since open-source mod­els are al­ready “good enough for cod­ing use-cases.” With to­ken con­sump­tion trend­ing up­ward across the in­dus­try and in­fer­ence costs ris­ing, the analy­sis pro­jects when cheaper in­ter­na­tional la­bor com­bined with lo­cal AI will over­take fron­tier mod­els eco­nom­i­cally, con­clud­ing that these dy­nam­ics cre­ate a “price ceil­ing” on how much fron­tier labs can raise prices be­fore en­ter­prises seek al­ter­na­tives.

15h, 907p, 339 com­ments

Using AI to write bet­ter code more slowly

In his Read the Tea Leaves post, Nolan Lawson ar­gues that AI should be used de­lib­er­ately and slower to pro­duce high‑qual­ity code rather than as a slop‑can­non for rapid, low‑ef­fort out­puts vibe cod­ing. He de­scribes a work­flow where mul­ti­ple LLM agents—such as Claude, Codex, and Cursor Bugbot—scan a pull re­quest for bugs, af­ter which the de­vel­oper val­i­dates, doc­u­ments, and re­fines the de­sign, em­pha­siz­ing thor­ough­ness over speed. This method, he says, un­cov­ers hid­den bugs, im­proves over­all code health, and deep­ens un­der­stand­ing of the code­base, con­trast­ing with typ­i­cal ex­pec­ta­tions of speedy but su­per­fi­cial de­vel­op­ment.

5h, 47p, 26 com­ments

Don’t put aria-la­bel on generic el­e­ments like divs

In a post about com­mon WebAccessibilityFails, Manuel Matuzovic warns against us­ing aria-la­bel or aria-la­belledby on generic HTML el­e­ments like divs or spans. While the ARIA spec­i­fi­ca­tion ex­plic­itly pro­hibits nam­ing el­e­ments with a “generic” role, Matuzovic high­lights the more crit­i­cal is­sue: in­con­sis­tent be­hav­ior across screen read­ers. Testing re­veals that some read­ers, like VoiceOver on ma­cOS, an­nounce the la­bel (e.g., “News, group”), while oth­ers, like Talkback on Android, read only the la­bel, and many ig­nore it en­tirely, read­ing only the el­e­men­t’s text con­tent. He notes two key ex­cep­tions: sec­tion el­e­ments, which change role to “region” when la­beled, and divs with the popover at­tribute, which be­come “group” el­e­ments. The post un­der­scores that re­ly­ing on la­beled generic con­tain­ers cre­ates an un­re­li­able user ex­pe­ri­ence for peo­ple us­ing as­sis­tive tech­nol­ogy.

5h, 94p, 23 com­ments

Uber pres­i­dent says AI spend­ing is get­ting ‘harder to jus­ti­fy’

Uber pres­i­dent Andrew Macdonald says the com­pa­ny’s mas­sive AI spend­ing is be­com­ing “harder to jus­tify” due to a lack of clear con­nec­tion be­tween AI us­age and mea­sur­able pro­duc­tiv­ity gains. Speaking with Rapid Response, Macdonald noted that de­spite soar­ing to­ken con­sump­tion for tools like Claude Code, Uber is­n’t see­ing a pro­por­tional in­crease in use­ful con­sumer fea­tures, mak­ing it dif­fi­cult to di­rectly link AI in­vest­ments to shipped func­tion­al­ity. The com­pany spent $3.4 bil­lion on R&D in 2025, a 9 per­cent in­crease, and ex­hausted its an­nual AI bud­get just four months into 2026. Macdonald added that Uber is com­pen­sat­ing for ris­ing AI costs by hir­ing fewer hu­man em­ploy­ees, but with­out a demon­stra­ble re­turn on in­vest­ment, the trade-off grows harder to de­fend.

7h, 38p, 1 com­ment

Multimodal adap­tive op­ti­cal mi­cro­scope: in vivo imag­ing, mol­e­cules to or­gan­isms

The au­thors pre­sent MOSAIC (Multimodal Optical Scope with Adaptive Imaging Correction), a re­con­fig­urable mi­cro­scope that in­te­grates light‑sheet, la­bel‑free, su­per‑res­o­lu­tion (including lat­tice light‑sheet, 3D‑SIM, ISM, DNA‑PAINT) and mul­ti­pho­ton modal­i­ties, each with adap­tive‑op­tics cor­rec­tion to com­pen­sate sam­ple‑in­duced aber­ra­tions. MOSAIC en­ables rapid, non‑in­va­sive imag­ing across scales—from sub‑nanome­ter mol­e­c­u­lar struc­tures to mil­lime­ter‑scale tis­sues—in live cells, organoids, ze­brafish em­bryos, Drosophila, C. el­e­gans and mouse cor­tex, al­low­ing cor­rel­a­tive mul­ti­modal stud­ies, op­to­ge­netic per­tur­ba­tions, and long‑term high‑through­put data ac­qui­si­tion (up to ter­abytes per hour). The plat­form re­duces cost and foot­print com­pared with sep­a­rate in­stru­ments, but re­quires com­plex align­ment and gen­er­ates mas­sive datasets that the au­thors ad­dress with GPU‑accelerated pro­cess­ing pipelines and pro­pose cen­tral­ized “cell ob­ser­va­to­ries” for data analy­sis and AI‑driven in­ter­pre­ta­tion.

18h, 376p, 102 com­ments

Hacker News front page as a site

The Front Page high­lights a di­verse set of tech and sci­ence sto­ries, in­clud­ing Apple’s PICO (Perceptual Image Codec)—a learned im­age com­pres­sion sys­tem de­liv­er­ing up to three‑fold bi­trate re­duc­tions over tra­di­tional codecs while run­ning on an iPhone 17 Pro Max; SpaceX’s suc­cess­ful Starship V3 sub‑or­bital test fea­tur­ing hot‑stag­ing and a pay­load of pro­to­type Starlink satel­lites de­spite an en­gine fail­ure; DeepSeek’s per­ma­nent dis­count on its V4 Pro model with to­ken‑based pric­ing and up­com­ing model re­nam­ing; Microsoft’s open‑source re­lease of the ear­li­est DOS source code, shed­ding light on the ori­gins of MS‑DOS; Italy’s €1.39 billion con­tract for six Airbus A330 MRTT tankers, shift­ing its air‑re­fu­el­ing fleet from Boeing KC‑46 to a European plat­form; and a ground­break­ing ar­chae­o­log­i­cal find of a 1,000‑year‑old dingo in Australia that shows ev­i­dence of in­jury, care and rit­ual bur­ial by Indigenous peo­ples. Additional no­table items in­clude a study on “constraint de­cay” in LLM agents, a free, open‑source web‑based mul­ti­track au­dio ed­i­tor (Audiomass), and a new Bayesian Gaussian‑process model for han­dling un­cer­tain sam­pling co­or­di­nates in en­vi­ron­men­tal data.

9h, 47p, 15 com­ments

Micropatching Brings the Abandoned Equation Editor Back to Life (2018)

Microsoft’s January 2018 Office up­date re­moved the Equation Editor (EQNEDT32.EXE) from most Office in­stal­la­tions, break­ing work­flows for math­e­mati­cians and ed­u­ca­tors; to re­store it users must re­in­stall Office from orig­i­nal me­dia or copy the orig­i­nal files (EQNEDT32.EXE, EQNEDT32.CNT, eqnedt32.exe.man­i­fest, EQNEDT32.HLP, MTEXTRA.TTF) back into the ap­pro­pri­ate EQUATION folder, edit a pro­vided EquationEditor.reg with the cor­rect dou­ble‑back­slash path and im­port it to re‑reg­is­ter the COM server, then in­stall the free 0patch Agent to re­ceive au­to­matic mi­cropatches such as CVE‑2018‑0802 and CVE‑2018‑0798, thus keep­ing the legacy ed­i­tor func­tional while still ap­ply­ing se­cu­rity up­dates; the blog also of­fers trou­bleshoot­ing tips, FAQs about ver­sion num­bers, com­pat­i­bil­ity with 64‑bit Windows, and guid­ance on sup­port­ing af­fected users.

10h, 212p, 190 com­ments

The User Is Visibly Frustrated

The ar­ti­cle ex­am­ines how codin­ga­gents like Claude Code trig­ger so­cial ex­pec­ta­tions by be­hav­ing like help­ful col­leagues, yet their in­abil­ity to adapt, learn, or take re­spon­si­bil­ity leads to re­peated mis­takes that feel dis­pro­por­tion­ately ex­as­per­at­ing, prompt­ing users to lash out de­spite know­ing they are in­ter­act­ing with an al­go­rithm; it notes that Paolo, a re­mote soft­ware con­sul­tant based in Vilnius, Lithuania, has ob­served this dy­namic and finds the agents’ post‑mortem ex­pla­na­tions of­ten un­help­ful filler, sug­gest­ing a pos­si­ble shift to­ward more clin­i­cal, non‑hu­man in­ter­faces to curb the il­lu­sion of hu­man in­ter­ac­tion and the re­sult­ing frus­tra­tion.

13h, 89p, 15 com­ments

What it takes to trans­pose a ma­trix

The ar­ti­cle by Andrei Gudkov demon­strates how to op­ti­mize ma­trix trans­pose for x86_64 CPUs, start­ing from a naive im­ple­men­ta­tion that takes 3.90 cy­cles per el­e­ment and pro­gres­sively im­prov­ing through tech­niques like re­vers­ing ac­cess or­der, block de­com­po­si­tion, soft­ware prefetch­ing, and SIMD vec­tor­iza­tion. The Vec256Buf al­go­rithm, which uses 64x64 cache-aligned blocks, AVX2 in­struc­tions to trans­pose 32x32 sub­ma­tri­ces, and non-tem­po­ral stores with a tem­po­rary buffer, achieves as low as 0.35 cy­cles per el­e­ment, a 25x speedup over the naive ver­sion for large ma­tri­ces. Key bot­tle­necks in­clude strided mem­ory ac­cess caus­ing cache misses, store buffer stalls, and in­ter-core own­er­ship re­quests; so­lu­tions in­clude padding ma­tri­ces to odd mul­ti­ples of cache lines, prefetch­ing next blocks, and buffer­ing out­put to avoid wait­ing for cache line own­er­ship.

15h, 158p, 85 com­ments

CVE-2026 – 28952: Apple ma­cOS 26.5 Kernel Vuln found by Claude

Apple’s ma­cOS Tahoe 26.5 se­cu­rity up­date, re­leased May 11, 2026, ad­dresses mul­ti­ple vul­ner­a­bil­i­ties across var­i­ous sys­tem com­po­nents. The up­date fixes crit­i­cal is­sues in­clud­ing buffer over­flows in APFS and HFS that could cause sys­tem ter­mi­na­tion, sand­box es­cape vul­ner­a­bil­i­ties in App Intents and GPU Drivers, and mem­ory cor­rup­tion prob­lems in WebKit and ImageIO. Other sig­nif­i­cant fixes ad­dress priv­i­lege es­ca­la­tion flaws in Kernel and CUPS, with re­searchers from or­ga­ni­za­tions like Google Threat Analysis Group and TrendAI Zero Day Initiative dis­cov­er­ing many of these vul­ner­a­bil­i­ties. The se­cu­rity patches in­clude im­proved bounds check­ing, en­hanced in­put val­i­da­tion, bet­ter mem­ory man­age­ment, and ad­di­tional re­stric­tions to pro­tect against po­ten­tial at­tacks.

14h, 23p, 11 com­ments

A Comma and a Question Mark

The au­thor, a long-time ter­mi­nal user, built a lo­cal AI-assisted shell sys­tem on a M5 Max MacBook Pro with 128GB mem­ory for $7,000, us­ing zsh, llama-server, Qwen3.6, and Pi to cre­ate two com­mands: a comma that takes plain English and pro­poses shell com­mands (via a lo­cal 27B pa­ra­me­ter Qwen3.6 model run­ning through llama.cpp) with­out ex­e­cut­ing them, and a ques­tion mark that hands prompts to a lo­cal agent Pi with lim­ited tools (read files, search web) to an­swer ques­tions as mark­down. The comma en­sures safety by only draft­ing com­mands that the user re­views and ex­e­cutes them­selves, while the ques­tion mark avoids any shell ex­e­cu­tion. The en­tire sys­tem runs of­fline with­out credit cards, and the au­thor notes that writ­ing tools and com­mand ex­e­cu­tion ca­pa­bil­i­ties are still in de­vel­op­ment, but the setup gets them close to safely typ­ing sen­tences into a shell.

23h, 43p, 7 com­ments

CPPL: A Circuit Prompt Programming Language

The pa­per in­tro­ducesCPPL, a com­piler-me­di­ated frame­work for LLM-assisted hard­ware de­sign, ad­dress­ing chal­lenges in gen­er­at­ing ver­i­fied RTL from LLMs. CPPL com­bines a Python fron­tend for defin­ing mod­ule in­ter­faces with a JSON-based IR that ex­poses com­piler-vis­i­ble struc­ture, en­abling sta­tic val­i­da­tion of gen­er­ated code. Unlike di­rect RTL or CIRCT IR gen­er­a­tion, CPPL en­sures le­gal­ity, hi­er­ar­chy, and port bind­ing checks, then low­ers re­sults to CIRCT for syn­the­siz­able Verilog. Results demon­strate im­proved func­tional cor­rect­ness and op­ti­mized post-syn­the­sis AIG node counts, sug­gest­ing com­piler me­di­a­tion en­hances re­li­a­bil­ity and op­ti­miza­tion po­ten­tial in LLM-driven hard­ware work­flows.

15h, 85p, 64 com­ments

Performance of Rust Language [pdf]

The page dis­cusses GitHub’s AI-powered tools such as Yugr/Rust Slides, fo­cus­ing on code en­hance­ment, se­cu­rity fea­tures, and de­vel­oper work­flows. It high­lights fea­tures like Copilot for Business, en­ter­prise se­cu­rity, and best prac­tices for Rust pro­gram­ming. The con­tent out­lines uses in mod­ern­iz­ing ap­pli­ca­tions, en­sur­ing code safety, and main­tain­ing se­cu­rity stan­dards. It also men­tions in­te­gra­tions, ad­vanced se­cu­rity pro­tec­tions, and de­vel­op­ments for dif­fer­ent team sizes and in­dus­tries.

1d, 238p, 124 com­ments

A fun­da­men­tal prin­ci­ple of aero­nau­ti­cal en­gi­neer­ing has been over­turned

The study chal­lenges a long-es­tab­lished prin­ci­ple in aero­nau­ti­cal en­gi­neer­ing that smoother sur­faces re­duce drag, by demon­strat­ing that in­tro­duc­ing ex­tremely fine, ran­dom sur­face rough­ness can sig­nif­i­cantly lower aero­dy­namic re­sis­tance. Researchers at Tohoku University de­vel­oped dis­trib­uted mi­cro-rough­ness tech­niques, called DMR, which shrank the pres­sure re­sis­tance zone and cut drag by up to 43.6%, high­light­ing a dif­fer­ent mech­a­nism than pre­vi­ous ideas fo­cused on shark-skin un­du­la­tions or lam­i­nar flow. This ad­vance­ment could im­prove fuel ef­fi­ciency and re­duce emis­sions in air­craft, with po­ten­tial to per­sist across a wider range of speeds.

1d, 177p, 55 com­ments

Bug 1950764: Work Around Crash on Intel Raptor Lake CPU

The re­vi­sion D301917 on the Firefox‑autoland repos­i­tory im­ple­ments a fix for Bug 1950764, adding a workaround to pre­vent crashes on sys­tems with Intel Raptor Lake CPUs. Authored by glandium and marked “Needs Review”, the change in­cludes up­dates to Rust de­pen­den­cies and build con­fig­u­ra­tions, and has passed au­to­mated re­mote builds. The patch is pub­licly vis­i­ble and await­ing re­view from the des­ig­nated re­view­ers.

BANDF AD

FLASH

Norway’s National Library is de­vel­op­ing a large lan­guage model (LLM) that un­der­stands the Norwegian lan­guage and is us­ing 2 PB of Huawei OceanStor Dorado flash stor­age in its AI train­ing data pipeline.

Marius Husnes, the Head of IT Platform at the li­brary (Nasjonlbiblioteket) dis­cussed the pro­ject at Huawei’s ID Forum 2026 in Paris, say­ing that no com­mer­cial LLM provider was de­vel­op­ing a lo­cal (Norwegian) lan­guage LLM. He as­serted that any coun­try with its own lan­guage that did not have a sov­er­eign LLM trained in that lan­guage was at a dis­ad­van­tage as a glob­ally trained, English-speaking LLM would not know about that coun­try’s his­tory, news and cul­ture that was de­scribed in the lo­cal lan­guage.

Norway’s Ministry of Culture tasked the National Library with build­ing a sov­er­eign AI (LLM) as the li­brary has the sin­gle largest dig­i­tal col­lec­tion of Norwegian books, news­pa­pers, web pages and so forth in the coun­try. Like many state li­braries it is en­ti­tled to re­ceive copies of every pub­lished book and broad­casted con­tent. Its le­gal de­posit man­date in this area ex­tended be­yond books, as it was duty-bound to col­lect and pre­serve all of Norway’s cul­tural her­itage.

BANDF AD

An agree­ment with Norwegian news­pa­pers per­mit­ted LLM train­ing on copy­righted con­tent and, Husnes said: ”No pri­vate com­pany has this.”

The li­brary was also well-placed to do this as it had been dig­i­tiz­ing its col­lec­tion since 2005 and had amassed 20 PB of unique data stored in 3 – 2-1 form (3 copies, 2 me­dia types, 1 off-site), mean­ing some 60 PB over­all. The dig­i­ti­za­tion process for the raw text, sound, mov­ing pic­tures, still im­ages and web con­tent in­volved much OCR scan­ning, and gen­er­ated a lot of meta­data, and also APIs for on­line ac­cess.

The bulk of the data was de­posited in a dig­i­tal disk plus tape archive, a preser­va­tion sys­tem. Husnes’ task was to get this data to the LLM train­ing sys­tem. He said the bot­tle­meck was not com­pute; it was data qual­ity, clean­ing and pipeline through­put. There were two main pro­cess­ing stages. First there was in-house com­pu­ta­tion, us­ing an Nvidia DGX H200 sys­tem, a 384 core CPU clus­ter and mul­ti­ple Huawei OceanStor Dorado all-flash ar­rays, to­talling 2 PB of flash ca­pac­ity. This is low-la­tency stor­age for the data pipelines and train­ing prepa­ra­tion.

BANDF AD

The pipeline has data in­ges­tion, clean­ing, dedu­pli­ca­tion, for­mat nor­mal­iza­tion, val­i­da­tion and prepa­ra­tion steps.Once the data has passed through the pipeline it’s sent to Norway’s na­tional su­per­com­puter, the Sigma2 Olivia sys­tem, for the ac­tual train­ing runs. The Olivia sys­tem is an HPE Cray Supercomputing EX sys­tem, with 448 GPUs and 64,512 CPU cores. It uses a 5.3 PB Cray ClusterStor E1000 stor­age sys­tem.

One large prob­lem area has been over-com­ing two dif­fer­ent stor­age sys­tem needs. The 60 PB preser­va­tion sys­tem is op­ti­mized for dura­bil­ity and cost, not fast IO, and has a high read la­tency, be­ing de­signed for in­fre­quent ac­cess. The AI Pipeline stor­age is de­signed for high-through­put, low-la­tency, par­al­lel data IO. Husnes said he learnt that no­body was talk­ing about the prob­lems in­volved in mov­ing PB-scale datasets from an archive to, and through, an AI data pipeline sys­tem. His team had to find out how to do it them­selves.

The LLM train­ing is on­go­ing and he fin­ished his talk with a sum­mary of what his team is stll learn­ing about:

Evaluation - there are no stan­dard eval­u­a­tion tools to as­sess a sov­er­eign Norwegian LLM.The lan­guage has two writ­ten forms, mul­ti­ple di­alects and his­tor­i­cal changes. They are build­ing their own eval­u­a­tion tool on the fly.

Governance - who con­trols ac­cess to a sov­er­eign LLM? Who de­cides what it can be used for? These are in­sti­tu­tional and po­lit­i­cal ques­tions with no easy an­swers.

Orchestration - mak­ing three sys­tems; preser­va­tion archive + on-prem AI en­vi­ron­ment + na­tional Sigma2 su­per­com­puter, work smoothly to­gether is an on­go­ing pro­ject.

BANDF AD

Our take­aways here are, one, that Huawei stor­age is play­ing a se­ri­ous and sig­nif­i­cant role in the European mar­ket, and two, that any coun­try de­vel­op­ing a sov­er­eign, lo­cal lan­guage LLM would do well to con­sult with Husnes and get ac­quainted with what’s in­volved.

As Husnes put it; Norway is a small coun­try solv­ing a prob­lem every non-Eng­lish-speak­ing na­tion will face: how do you build AI that re­flects your lan­guage, your cul­ture and your his­tory? AI needs cus­to­di­ans, not just builders.

Some se­crets are too im­por­tant to trust to one per­son, and too im­por­tant to lose if that per­son dis­ap­pears.

A com­pany wants three of­fi­cers pre­sent be­fore the mas­ter key is used. A fam­ily wants ac­count re­cov­ery to need more than one en­ve­lope. A team wants a backup that sur­vives a miss­ing mem­ber with­out hand­ing any­one the whole thing.

Adi Shamir (the S in RSA), pub­lished a way to do this in 1979. Split a se­cret into pieces so that some num­ber of them can re­cover it, and any smaller num­ber re­veals noth­ing at all. Not “is hard to crack.” Reveals noth­ing.

The core idea fits on a page.

Two points make a line

Start with some­thing you al­ready know: two dis­tinct points de­ter­mine ex­actly one straight line.

A sin­gle point does not. Infinitely many lines pass through one point, and each line crosses the ver­ti­cal axis some­where dif­fer­ent.

Now hide a se­cret where a line crosses the ver­ti­cal axis. Say the se­cret is the num­ber 7. Draw a ran­dom line through that height. The slope is not im­por­tant. It is just ran­dom­ness that hides the se­cret.

Give each per­son one point from the line. Nobody gets the line it­self.

A per­son with one point can draw many pos­si­ble lines through it. Each line im­plies a dif­fer­ent se­cret. Their share is com­pat­i­ble with every pos­si­ble an­swer, so it tells them noth­ing use­ful by it­self.

Put two points to­gether and the line is fixed. Once you know the line, you can read the se­cret from where it crosses zero.

That is a 2-of-n se­cret shar­ing scheme. You can cre­ate as many points as you want, but any two are enough to re­cover the line.

More peo­ple means more bend

For a higher thresh­old, use a curve with more bend.

A parabola needs three points to de­ter­mine it. So if the se­cret is hid­den where the parabola crosses the ver­ti­cal axis, any three shares can re­cover the se­cret and any two can­not.

In gen­eral, a thresh­old of k uses a poly­no­mial of de­gree k - 1.

2 shares: a line

3 shares: a parabola

4 shares: a cu­bic

Real im­ple­men­ta­tions use fi­nite-field arith­metic rather than graph pa­per, but the shape of the idea is the same. The se­cret is the value at zero. The ran­dom co­ef­fi­cients hide it. Each share is one point on the poly­no­mial.

The use­ful part is not that the se­cret is hard to com­pute from too few shares. It is that too few shares con­tain no in­for­ma­tion about the se­cret. With one share miss­ing, every pos­si­ble se­cret is still pos­si­ble.

Why we care

We use this idea in Ente’s Legacy Kit.

Although, our prob­lem was not just “how do we split a se­cret?”, but also “how do we make re­cov­ery pos­si­ble with­out turn­ing the split se­crets into a per­ma­nent re­cov­ery key?”

Legacy Kit uses Shamir’s scheme as one layer in­side a larger flow. The cards don’t carry the re­cov­ery key. They re­con­struct a sep­a­rate se­cret lo­cally, which then par­tic­i­pates in a server-me­di­ated re­cov­ery — so is­sued cards can be re­voked, and a lost card is not a per­ma­nent li­a­bil­ity.

This post is only the math be­hind the “any two, never one” part.

Further read­ing

Adi Shamir’s “How to Share a Secret”

Bruce Schneier’s “Sharing Secrets Among Friends”

Max Levchin’s PayPal story

Ente’s source code