Hacker News
1Google API keys weren't secrets, but then Gemini changed the rules
- Security researchers discovered that Google API keys originally intended for public services like Maps can now access private Gemini AI data without user notification. They found nearly 3,000 exposed keys on websites that could allow attackers to access uploaded files, cached data, and charge API usage to victim accounts. Google has acknowledged the issue and is working on fixes including scoped defaults and leaked key blocking.
Google's API key security vulnerability
Google AI Studio encourages deploying apps with API keys that aren't truly secret, creating billing abuse risks. When Gemini API was enabled, existing "public" keys retroactively gained access to expensive AI features without user awareness.Billing protection and spending caps
Users report massive unexpected bills (like $80k) from leaked Gemini keys. Unlike other providers, Google lacks hard spending caps, only offering delayed email alerts, creating potential for unlimited charges from compromised keys.Google's institutional competence decline
Commenters express shock that Google's security review processes failed to catch such an obvious flaw, with some suggesting the company has become "a shell of what it used to be" despite its talent and resources.
2Never buy a .online domain
- A developer purchased a free .online domain from Namecheap for a small browser app project. Weeks later, the site was flagged as unsafe by browsers and put on serverHold by the registry due to Google Safe Browsing blacklist. This created a catch-22 where Google required domain verification to remove the flag, but verification was impossible since the domain wouldn't resolve due to serverHold status.
Corporate verification loops
Users complain about endless, broken verification processes by large companies with misaligned incentives. Examples include Apple dev account transfers requiring business cards (obsolete for 20 years) and impossible document requirements that favor scammers over legitimate users.Google Safe Browsing power
Discussion centers on how Google's Safe Browsing list has become a de facto censorship tool, with registrars automatically suspending domains based on Google's blacklisting. This creates monopolistic power where Google Search Console registration becomes mandatory.Alternative TLD reputation issues
Users debate problems with newer/cheaper TLDs like .online, .tech, .fun being associated with scams due to low costs attracting fraudsters. This creates blanket blocking by security systems and email providers, making these domains unreliable for legitimate use.
3New accounts on HN more likely to use em-dashes
- Analysis of Hacker News comments reveals potential bot infiltration, with newly registered accounts 10x more likely to use em-dashes and symbols (17.47% vs 1.83%) and more frequently mentioning AI/LLMs (18.67% vs 11.8%) compared to established users, suggesting automated content generation.
Em-dashes and typographical conventions corrupted by AI
Users lament that good typography practices like em-dashes, proper punctuation, and formatting have become suspicious markers of AI-generated content, forcing humans to adopt deliberately sloppy writing to appear authentic.Bot detection patterns and statistical analysis
Discussion of data showing new accounts use AI-associated words like "actually," "real," "built" at significantly higher rates, plus identification of formulaic commenting patterns and rapid posting behaviors that reveal bots.Threat to online discourse and potential solutions
Concerns that bot infiltration represents an existential threat to platforms like HN, with proposed solutions including invitation systems, proof of identity, proof of work, or closed communities.
4Jimi Hendrix was a systems engineer
- Jimi Hendrix's innovative guitar sound from songs like "Purple Haze" was created through systematic engineering using analog effects pedals including the Octavia, Fuzz Face, and wah-wah in a complex signal chain that transformed the electric guitar into a voice-like synthesizer.
Feedback loops and controlled chaos in guitar performance
Discussion centers on how Hendrix harnessed feedback as "controlled chaos" in performances like Star Spangled Banner, where commenters hear machine guns, sirens, and war sounds. Users explore how feedback creates unpredictable elements that skilled players can wrangle but never fully control.Guitar as the greatest electronic instrument
Debate over whether electric guitar + tube amp is objectively the best electronic instrument due to its physical expressiveness and complex feedback loops. Counterarguments include synthesizers, turntables, and newer MIDI controllers with polyphonic expression capabilities.Hendrix as artist vs engineer
Discussion questions whether Hendrix was actually a "systems engineer" or simply an artist experimenting naturally. Users argue he made pragmatic decisions rather than systematic technical reasoning, comparing it to over-analyzing symbolism in literature that authors never intended.
5Tell HN: YC companies scrape GitHub activity, send spam emails to users
- A user received unsolicited marketing emails from YC company Run ANywhere and Voice.AI after they apparently scraped his GitHub activity to identify potential customers. The emails were sent without consent, potentially violating GDPR since the recipient is in Europe. He has complained to the companies, GitHub, and YC Ethics but hasn't received responses yet.
GitHub email scraping and spam
Martin from GitHub confirms scraping emails from commits violates ToS and results in account bans. Users report mixed enforcement success. GitHub offers no-reply email addresses to protect privacy, but many developers still receive spam from companies scraping their public commit data.YC company ethics concerns
Discussion highlights multiple YC-funded companies engaged in questionable practices including email spam, surveillance software, and other ethically dubious business models. Some users now automatically filter emails mentioning YC funding due to negative experiences.Developer recruitment spam experiences
Users share numerous examples of unsolicited emails from companies like Aden, Backdrop, and Cactus Compute that scraped their GitHub emails. Many view this as counterproductive marketing that actively harms brand reputation among developers.
6Anthropic ditches its core safety promise
- Anthropic, an AI safety-focused company, is loosening its core safety principles to remain competitive, replacing binding guardrails with a flexible framework. The change comes amid pressure from the Pentagon, which threatened to blacklist the company over AI safeguards, and increased competition in the AI market.
Discussion moderation
The discussion appears to be a duplicate that was heavily discussed in another thread, with moderators moving comments to consolidate the conversation and avoid fragmentation across multiple posts.
7Banned in California
- California has banned or heavily regulated most industrial processes needed to manufacture modern products like smartphones, electric vehicles, and warships. Existing facilities operate only because they were grandfathered in before current environmental regulations took effect. New manufacturing of semiconductors, batteries, automotive paint, steel work, and chemical processes is nearly impossible to permit, forcing companies like Tesla to build new facilities in other states instead.
Environmental trade-offs and externalities
Discussion centers on whether California's strict environmental regulations simply push pollution to poorer regions rather than eliminating it. Commenters debate the choice between local clean air/water and global responsibility, with some arguing for tariffs on products made with dirty processes.Regulatory burden vs safety
Debate over whether California's permitting process is unnecessarily hostile to manufacturing or appropriately protective. Comments discuss the balance between preventing pollution disasters (citing Superfund sites) and maintaining economic competitiveness through reasonable regulations.Manufacturing competitiveness and location
Discussion of how regulatory complexity affects where companies choose to locate facilities. Examples include Tesla moving battery production to Nevada and various industrial processes being deemed too difficult to permit in California, with debates over whether this represents overregulation or proper safety standards.
8US orders diplomats to fight data sovereignty initiatives
- The Trump administration has ordered US diplomats to lobby against foreign data sovereignty laws, particularly targeting Europe's GDPR regulations. Secretary of State Marco Rubio's diplomatic cable argues such laws disrupt global data flows and limit AI services. This marks a more confrontational approach as European countries seek greater control over how US tech companies handle their citizens' data, citing privacy and surveillance concerns. The move reflects growing tensions between the US and EU over digital regulation.
Data sovereignty vs US surveillance laws
Discussion centers on the CLOUD Act allowing US authorities to access data stored by US companies anywhere globally. Users debate whether countries should avoid US tech services, with comparisons between EU/US privacy protections and concerns about extraterritorial enforcement.European alternatives and tech independence
Users share experiences of organizations pivoting away from US services like Cisco, AWS, and Google. Discussion covers challenges of building European tech alternatives, the role of capital/IP dominance, and opportunities for companies like Mistral in the AI space.US diplomatic failures and confrontational approach
Comments criticize US diplomats as donor appointees rather than professionals, highlighting recent incidents where ambassadors interfered in local politics. Discussion questions how the US expects business cooperation while being increasingly confrontational.
9Following 35% growth, solar has passed hydro on US grid
- US electricity consumption rose 2.8% in 2025, with solar power growing 35% and surpassing hydroelectric generation for the first time. Coal use increased 13% due to higher natural gas costs and export competition, while solar and wind expansion is expected to continue in 2026 with 43 GW of new solar capacity planned.
Solar vs hydro power statistics
Discussion clarifies that solar surpassed utility-scale hydro generation in 2025, with some confusion over timing and measurement methods. Data shows solar at 295 TWh vs hydro at 247 TWh, though total solar including rooftop reaches 383 TWh.Geopolitical energy transitions and empire theory
Users debate whether energy source mastery determines global power, comparing historical transitions from wind (Dutch) to coal (British) to oil (US) to solar (China). Discussion includes concerns about US falling behind and corruption blocking adoption.DIY solar installation and technical advice
Community shares practical guidance on off-grid solar setups, battery storage options, and installation costs. Recommendations include Will Prowse's YouTube channel, LiFePO4 batteries, and DIY approaches to reduce electrician costs.