Feed aggregator

Back Me Up is a tiny science-ish machine that finds published papers that back your argument. It stemmed from a conversation with a friend around life sciences, where we kind of landed at "surely there’s a paper confirming most arguments", i.e. coffee is bad, coffee is great, etc.

You enter a claim, e.g. "drinking wine is good for the heart" -> the system does a semantic search across a corpus (PMC, bioRxiv, medRxiv and arXiv) -> pulls in relevant quotes if they fit your claim, and gives you a verdict.

Frontend was done with a combination of Sol + Opus, I spent a bit of time exploring different designs and landed on this slightly ridiculous printer that spits out your evidence.

Some notes: - I have no accuracy evals, this was a throwaway thing I built, so no clue on reliability. It does pass the vibe test, so give it a whirl! - Initially built a RAG for a tiny set of PMC, but scaling that up seemed like a lot of work for an evening project. Luckily found an API that does the semantic search across the different sources.

Comments URL: https://news.ycombinator.com/item?id=49709678

Points: 1

# Comments: 0

Article URL: https://skyforceui.com/

Comments URL: https://news.ycombinator.com/item?id=49709677

Points: 1

# Comments: 0

Article URL: https://ethfata.com/

Comments URL: https://news.ycombinator.com/item?id=49709672

Points: 1

# Comments: 1

What started as a joke (as I had the domain) turned into an MVP. Usefulness is... so far, questionable? But there are use cases where this kind of spec could come in handy.

My own spec lives at https://spec.md/allan. Add .md to the end and you will get the markdown version. Shareable with AI agents to give them context about you or the people you work with.

Feedback welcome!

Comments URL: https://news.ycombinator.com/item?id=49709631

Points: 1

# Comments: 0

Article URL: https://mceglowski.substack.com/p/trying-to-understand-freedom

Comments URL: https://news.ycombinator.com/item?id=49709625

Points: 2

# Comments: 0

Bitrefill is a legitimate company that sells gift cards for popular stores like Amazon, Deliveroo, Apple, Nintendo, and thousands of others. They also sell eSIMs, and mobile top-ups. You can pay on their website for all of these with cryptocurrency.

The scam is designed to catch people searching for Bitrefill or something it sells, like a gift card. Victims see a search result that appears to lead to Bitrefill but actually points to a lookalike domain. The fake site then takes them through what appears to be a normal purchase. The fake sites are not operated by or affiliated with Bitrefill; scammers have copied its branding and checkout process.

The victim chooses an amount and a cryptocurrency before receiving a QR code and payment address. But instead of paying Bitrefill, they send the cryptocurrency directly to an address controlled by the scammers. They receive nothing in return, and recovering the payment is extremely unlikely.

Why fake crypto checkouts work so well

Phishing typically involves several steps. First, an attacker has to steal a password. Then, they may have to get past two-factor authentication (2FA), log in to the account without tripping a fraud check, and find some way to turn account access into money. Plenty of scams fall apart somewhere in that chain.

This payment scam avoids those hurdles by persuading victims to send money directly to the scammers. There is no account to break into and no stolen card to use. The victim sends cryptocurrency straight to an address the scammers control, and cryptocurrency payments generally cannot be reversed or charged back.

The payment request also fits the situation. A demand for cryptocurrency might look suspicious on many websites, but Bitrefill genuinely accepts it. On a convincing copy of its checkout, paying with cryptocurrency appears completely normal.

All this may explain why we found a cluster of fake sites rather than a single page, with checkouts allowing payments of up to $1,990.

What the fake checkout looks like

The site we examined is a close copy of Bitrefill’s checkout, hosted on a domain built by bolting a word onto the brand name. Everything a customer would expect is present. The branding is right, the layout matches, the page is quick and polished, and the payment flow behaves exactly the way the real one does.

The fake checkout asks for an email address and links to terms of service and a privacy policy, helping it look legitimate.

You’re asked for an email address for order updates, with links to terms of service and a privacy policy. You then choose how to pay, from a list offering Bitcoin, Ethereum, USDC, USDT, Solana, and Litecoin. The site also offers card payments for a small surcharge.

The fake checkout offers several cryptocurrencies and appears to support card payments.

Next, you pick an amount, with preset buttons and a maximum of $1,990, although inconsistent currency symbols offer a small clue that something is wrong.

The fake checkout accepts payments of up to $1,990.

Finally, you reach a payment screen showing a QR code, an address marked for one-time use, the amount converted into your chosen cryptocurrency, and a countdown clock giving you just under an hour to send the funds.

The final screen provides a cryptocurrency address and QR code, along with a countdown timer .

None of those elements is a red flag on its own. Unique addresses, expiry timers, and currency conversion are all normal for crypto checkouts, which is exactly why the copy is convincing. Every pressure cue on the page is borrowed from legitimate payment systems.

The only meaningful difference is the address the money goes to, and by the time the victim sends the cryptocurrency, getting it back is extremely unlikely.

How people are reaching these pages

The distribution here does not appear to rely on email. Bitrefill has said publicly that sites copying its checkout and using similar names have been turning up in search engine results, and that its security team has been working with takedown specialists to have them removed.

The site’s configuration supports that. The fake checkout hands visitors back to a second domain in the same family, and the link it uses carries a parameter naming a search engine, suggesting the operators are tagging incoming traffic by where it came from.

There’s a detail here that deserves more attention than it usually gets. The fake checkout has commercial analytics software installed on it, the same kind of product a legitimate e-commerce team uses to measure how many visitors abandon a cart. Its presence suggests the operators want to measure and improve the number of visitors who complete a payment.

These campaigns are not opportunistic one-offs thrown together by someone hoping for a lucky hit. They’re run as businesses, measured and tuned like any other funnel, with the victim in the role of the customer.

A brand name is not a destination

The domains in this cluster use several tricks to make their addresses look convincing. Some swap one letter for a visually similar character, making the brand appear correct unless you look closely. Others add a plausible word such as pay or gift, producing addresses that resemble official payment sites. Some do both.

Several use internationalized domain names, which can contain characters from different alphabets or accented versions of Latin letters. Browsers translate these domains into an ASCII format beginning with xn--, known as Punycode. To the eye, the displayed versions can be almost indistinguishable from the genuine name.

Different domain names display as variations of “Bitrefill,” while their Punycode versions begin with xn--.

The answer is not simply to become better at spotting tiny differences. These domains are designed to defeat visual inspection, and they can be especially difficult to recognize on a phone screen. Recognizing a company name somewhere in a web address does not tell you who owns it.

Remember, seeing the right company name in a URL is not enough. Check that the actual domain is exactly the one the company uses.

What to do

• Start at the website you already trust. Use a saved bookmark or carefully enter bitrefill.com yourself. If you are already making a purchase on the legitimate site, stay within that session instead of opening a checkout page from a separate search.
• Treat search results for payment and checkout pages with suspicion. Scammers can buy search ads or manipulate their sites into appearing prominently. The first result is not necessarily the safest one.
• Check the address bar before you send. Cryptocurrency payments generally cannot be reversed or charged back. Confirm that the main domain is exactly bitrefill.com before approving a payment.
• Be wary of domains containing a brand followed by an extra word. A legitimate subdomain would place the additional wording before the company’s main domain, as in pay.example.com. An address such as example-pay.com is a completely separate domain that anyone could register.
• Don’t approve wallet requests on a site you have not verified. Simply connecting a wallet does not normally transfer funds, but a fraudulent site may ask you to sign a transaction or grant token permissions that allow assets to be stolen.
• If you have already sent funds, act quickly, although recovery is unlikely. Report the destination address to the exchange or wallet provider you used, report the incident to your national fraud reporting service, and notify Bitrefill so it can add the domain to its takedown efforts. Recovery services that promise to retrieve stolen cryptocurrency for an upfront fee are often follow-up scams.

Check before you click

The simplest protection against a page like this is to avoid reaching it. Malwarebytes Browser Guard is a free browser extension that blocks known scam and phishing sites, along with malicious ads and search results that lead to them.

Got a screenshot or URL of a suspected scam? Upload it to Scam Guard—built into Malwarebytes Premium Security on Windows, Mac, iOS, and Android—and you’ll get a verdict and safety tips in seconds.

Indicators of compromise (IOCs)

Domains:

biterflll[.]com

bitigift[.]com

bitrefall[.]com

bitrefill-payments[.]com

bitrefill-pays[.]com

bitregift[.]com

bitregill[.]com

bitretill[.]com

bitrgift[.]com

bitrgifts[.]com

bitrnfill[.]com

bitruflli[.]com

butrefill[.]com

pay-bitregill[.]com

pay-bitrgift[.]com

pay-bitrgifts[.]com

pay-butrefill[.]com

pay-bitigift[.]com

xn--bitrefll-71a[.]com

xn--bitrefll-h2a[.]com

xn--bitrefll-pay-kfb[.]com

xn--bitrefll-pay-xfb[.]com

xn--bitrefll-q2a[.]com

xn--bitreill-cz9c[.]com

xn--bitreill-pay-yq4f[.]com

xn--btrefill-l2a[.]com

xn--pay-bitrefll-fgb[.]com

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Technology has changed dramatically in the last 60 years - but the principles underlying its successful use in enterprises remain constant

I upgraded to iOS 27 yesterday. I had Siri turned off.

After the upgrade, Siri is now enabled.

Is this a bug or intentional? Wasn't able to find any supporting information.

Comments URL: https://news.ycombinator.com/item?id=49708233

Points: 1

# Comments: 0

Article URL: https://github.com/Pivotick/Pivotick/releases/tag/v2.0.0

Comments URL: https://news.ycombinator.com/item?id=49708232

Points: 1

# Comments: 0

Article URL: https://www.atlasobscura.com/articles/cryptid-tourism-across-america

Comments URL: https://news.ycombinator.com/item?id=49708213

Points: 1

# Comments: 0

Article URL: https://openjdk.org/projects/jdk/27/

Comments URL: https://news.ycombinator.com/item?id=49708209

Points: 1

# Comments: 0

This is timelapse of a 3D city simulation based on your Git history, files are buildings and height is based on LOC. Weather can determines if the repo is quiet or active during a span of time.

Just a fun visual to get the momentum overview of your project. I've been working a lot in 1 repo for the past few months and got a handsome amount of commits, so I decided to make something visually appealing to 'appreciate' my work somehow.

Based on the ideas of: CodeCity (Richard Wettel & Michele Lanza) and Gource (Andrew Caudwell, 2009). Instead of static city like CodeCity or 2D tree like Gource, chronocity is an 3D interactive city and you can even drive car in there lol.

All in the browser, TypeScript + three.js, isomorphic-git in a Web Worker, WebCodecs for the video.

It scans your .git folder (all client-sided, nothing uploaded) and through the main branch (downscaled to 2000 steps for big repos), compares files, LOC with previous step. three.js renders all the buildings in one instanced mesh, and height is the square root of LOC. The weather is not random: the sky follows the local time (their time zone) of people that commited, fog indicates quiet stretches, rain means a burst of changes in a short window.

Try your own project straight in my GitHub page, drop your Git cloned repo there (containing .git folder, all in your browser, your repos are stored in YOUR cache, this is serverless).

Comments URL: https://news.ycombinator.com/item?id=49708188

Points: 1

# Comments: 0

Article URL: https://docs.google.com/forms/d/e/1FAIpQLSfPFxrCgOrq80huInb1PdY_BvFUOBqTqnxRVUVA-XijlGiyIg/viewform?usp=publish-editor

Comments URL: https://news.ycombinator.com/item?id=49708173

Points: 1

# Comments: 0

Article URL: https://theconversation.com/planting-trees-in-the-wrong-places-is-not-a-climate-solution-290796

Comments URL: https://news.ycombinator.com/item?id=49708169

Points: 1

# Comments: 0

Article URL: https://clickhouse.com/blog/clickhouse-streaming-http-api

Comments URL: https://news.ycombinator.com/item?id=49708076

Points: 1

# Comments: 1

About a year and a half ago I started my writing journey by beginning to work on my first novella. During this time, I felt the need for different tools, like a timeline editor, a character sheet and so on, features that were not available on normal text editors. Later I discovered that I needed an Epub exporter, cover designer and more. I also wanted something AI-free, something private. It is important for me as a debut author to know that it is my writing, not an AI's and that it wont be used for AI training. So most cloud services were an instant "NO" from me.

Being a software engineer by day, I decided that instead of paying hundreds of dollars for the needed tools, I could just make them the way I wanted them to be. Eventually I decided to bundle them together, polish them and add more feature. So, this is how Chronicle was born.

Chronicle is a complete writing and authoring tool for writers. It offers features that other companies charge tens or even hundreds of dollars, while delivering (in my opinion) and inferior experience.

I also wanted Chronicle to work fully offline, not use Gen AI in the writing process, and provide a privacy-first experience.

Among the features are: - full-featured text editor with comments supports - timeline editor - character sheet - locations codex - Epub reader and exporter (including editing Epub Metadata) - Cover designer - Fully-local TTS using KokoroJS Text-to-Speech for help in proofreading - Themes - Private Cloud-storage support with WebDAV - and many more

And I made Chronicle not only free, but fully open-source. You can check the source code on Github, launch the online editor which supports almost all features, or download the app for both Windows and MacOS.

I would love to hear feedback.

Disclaimer: In the development process I did use AI. The app is NOT made entirely by AI, but being a back-end developer mostly, I did use AI for parts related to the user interface, themes, fix some bugs and to bridge knowledge gaps I had.

Comments URL: https://news.ycombinator.com/item?id=49708069

Points: 2

# Comments: 2

Article URL: https://lamport.azurewebsites.net/pubs/pubs.html

Comments URL: https://news.ycombinator.com/item?id=49708053

Points: 2

# Comments: 0

Article URL: https://books.google.com/books/about/The_Analytic_Art.html

Comments URL: https://news.ycombinator.com/item?id=49708043

Points: 1

# Comments: 0

An unauthenticated attacker can exploit CVE-2026-76461 to execute arbitrary commands on the underlying OS with root privileges.

The post Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation appeared first on SecurityWeek.