04-03 00:01 · AI,技术,HackerNews,AI
Tailscale's new macOS home
Tailscale should feel nearly invisible when it's connecting you and all your devices together. But on some MacBooks, for a time, it could be a little too invisible. We have two fixes for it: one small and slightly quirky, and another really useful one, available now on macOS.
The small, quirky fix might soon become a thing of the past for the vast majority of Tailscale users on Macs. I wanted to document it here: to help other developers, to mark this moment in time, and quietly crow about our windowed macOS interface now being generally available.
So here's the issue we had with Tailscale's icon slipping into darkness, its little work-around, and then our greater solution.
At its debut on macOS, Tailscale was a command-line tool and a menu bar utility. Some MacBooks, starting with 2021 MacBook Pro models, have a notch in the top-middle of their display. And depending on how many other apps with menu bar icons are running, the Tailscale app’s icon can be hidden inside that notch.
Apple, a company that traditionally favors simple functionality over dense settings, does not offer users, or developers, a path out of the darkness. If there are more menu bar icons then there is space to the right side of the notch, the menu bar items simply disappear into the notch-y ether. If you don’t see it, you can’t click it. There is no notification to the user, no overflow section, no options to rearrange the menu bar items.
As of this writing, Apple has some indirect work-arounds, like pushing more of its own system icons into a revamped Control Center, and offering a somewhat inelegant “Scale to fit below camera” option. Third-party menu-bar-managing apps like ICE and Bartender can help, but they add complications and overhead.
“We don’t have any control over where things get rendered in the menu bar,” said one Tailscale engineer, who asked to go nameless so as to share their honest opinion. “You just say, ‘I want to be a menu bar app.’ They shove it up there, and that’s it, you end up where you end up.”
Given this there-or-not-there behavior, Tailscale developers received a number of bug reports from users when, after the notched MacBooks' debut, their Tailscale icons fell into the middle-screen distance. "They were like, 'Actually, I can't find my Tailscale. It's gone. It didn't start," the engineer said. "We're like, 'No, it's there, it's just hiding behind the notch.' But we kind of got sick of that."
Mac menu bar icons may not know they are trapped inside the no-pixel phantom zone, but they can report that something is blocking them. Using data from occlusionState
, the Tailscale app can see that its icon is in mid-bar limbo.
And while it cannot move, it can speak. Specifically, a pop-up message can say:
This affable warning is not perfect, by any means. The notch warning can be inadvertently triggered by other display quirks, like opening and closing the MacBook lid, moving between monitors, or some combination of the two. But it helped triage the "Where are my Tailscale settings?" issue for a while.
Apple could certainly make some changes to prevent this being an issue at all. The system could prevent menu bar icons from rendering in the notch area at all. An overflow mechanism could stack the icons that would otherwise drop into a negative notch zone. Or developers could be given more information and tools about icons' notch-itive states.
In the meantime, here’s a look at the Swift code that let our app know it should chirp a bit when hidden. It should be unnecessary with the new windowed app—unless you enable the “Hide Dock icon” option in the windowed client options, in which case it might still call out its hidden nature.
self.visibilityObserver = NotificationCenter.default.addObserver(
forName: NSWindow.didChangeOcclusionStateNotification,
object: statusItemButton.window,
queue: .main
) { [weak self] _ in
guard let self, statusItem.isVisible else { return }
isIconOccluded = statusItem.button?.window?.occlusionState.contains(.visible) == false
}
As we noted at its September beta release, a windowed version of Tailscale’s macOS app doesn’t replace the menu bar app, but runs alongside it. It can be pulled up from the Dock or a Spotlight search, and makes a lot of Tailscale data and features more accessible.
The windowed interface, enabled by default starting with version 1.96.2 of our macOS client, offers:
- A searchable list of tailnet devices and their connection status
- Easily ping, copy IP addresses, and send files through Taildrop to devices
- Easy access to exit nodes, searchable and with one recommended based on latency, performance, and location
- A red dot on the Dock icon to note critical errors
- A “mini player” that shrinks Tailscale down to the bare minimum
- A product tour of all these things upon installing/updating
Let us know what you think of the new interface so we can make it better. We’re working on a comparable UI for Windows devices. And we’re always looking for ways to bring a little bi
▸ 展开全文
04-03 00:01 · AI,技术,HackerNews,大模型,AI
Lemonade by AMD: a fast and open source local LLM server using GPU and NPU
Refreshingly fast
on GPUs and NPUs
Built by the local AI community for every PC.
Lemonade exists because local AI should be free, open, fast, and private.
Works with great apps.
Lemonade is integrated in many apps and works out-of-box with hundreds more thanks to the OpenAI API standard.
Built for practical local AI workflows.
Everything from install to runtime is optimized for fast setup, broad compatibility, and local-first execution.
Native C++ Backend
Lightweight service that is only 2MB.
One Minute Install
Simple installer that sets up the stack automatically.
OpenAI API Compatible
Works with hundreds of apps out-of-box and integrates in minutes.
Auto-configures for your hardware
Configures dependencies for your GPU and NPU.
Multi-engine compatibility
Works with llama.cpp, Ryzen AI SW, FastFlowLM, and more.
Multiple Models at Once
Run more than one model at the same time.
Cross-platform
A consistent experience across Windows, Linux, and macOS (beta).
Built-in app
A GUI that lets you download, try, and switch models quickly.
One local service for every modality.
Point your app at Lemonade and get chat, vision, image gen, transcription, speech gen, and more with standard APIs.
Always improving.
Track the newest improvements and highlights from the Lemonade release stream.
▸ 展开全文
04-02 00:01 · AI,技术,HackerNews,AI
The OpenAI graveyard: All the deals and products that haven't happened
InJanuary, OpenAI’s CEO of applications Fidji Simo defended OpenAI’s spaghetti-at-the-wall product approach—ads, shopping, health, a social network, browser, physical devices, video generation and an App Store-like marketplace—as variations on the same theme. “AI is going to transform everything,” Simo told Forbes at the time. “And so we don’t really think of these as completely separate bets.”
But just two months later, OpenAI reversed course on its flashiest initiative yet: its once-viral, beloved-by-some Sora video model and app, and a “landmark” licensing deal with Disney that was set to include a $1 billion equity investment. The retreat points to a strategic shift toward more financial discipline within the company. Facing pressure to build products that actually make money ahead of a potential upcoming IPO — and with rival Anthropic gaining steam — OpenAI has been shedding so-called “side quests” left and right. With $13 billion in 2025 revenue but still deeply unprofitable, the company is now refocusing on areas where demand is already proven: coding and enterprise productivity tools.
Every startup pivots if things aren’t working. “We will make some good decisions and some missteps, but we will take feedback and try to fix the missteps very quickly,” CEO Sam Altman wrote in a blog post about Sora in October.
But OpenAI’s reversals have felt like whiplash. And with many other projects and deals announced but not yet realized — like an AI hardware product designed by famed Apple designer Jony Ive, whose company OpenAI acquired for more than $6 billion in (mostly unvested) stock, or a secretive social network based on people’s biometrics — it’s not clear which of Altman’s many promises will turn into reality.
Here are all the products and deals that OpenAI announced which haven’t lived up to the hype, whether it’s because they’re dead, delayed or still to be determined.
Products:
Sora and Disney
In December, OpenAI announced what it called a “landmark” deal with Disney where the media giant agreed to invest $1 billion and license 200 of its iconic characters for use in the AI startup’s video generation app Sora. In return Disney would stream Sora-generated videos on Disney+ and build new applications using OpenAI’s models. At the time, Altman lauded Sora as key to the future of human-computer interaction, calling it the “ChatGPT for creativity” moment.
Disney’s then-CEO Bob Iger (he stepped down in mid-March) was sold on Sora, too. He lauded Altman’s ability to “look around corners” and his “respecting the value” of intellectual property. “I believed in it as an investment,” Iger told Forbes in February.
In March, OpenAI announced it was shuttering the product and scrapping the deal. Adoption of Sora, which was guzzling compute and burning an estimated $15 million a day at its peak, had fallen off a cliff. Sensor Tower and Appfigures both estimated that Sora’s lifetime in-app revenue amounted to less than $3 million. OpenAI will also discontinue Sora’s associated AI models.
“As the nascent AI field advances rapidly, we respect OpenAI’s decision to exit the video generation business and to shift its priorities elsewhere,” Disney spokesperson Mike Long told Forbes.
NSFW mode in ChatGPT
Altman first proposed the idea of allowing verified adult users to have sexual conversations with ChatGPT in October. After facing intense pushback from internal staff as well as investors, the plans have been put on hold “indefinitely,” the Financial Times reported in March. The company had previously delayed the launch due to technical issues that come with training an AI model that forays into erotica without creating illegal content, like child sexual abuse material. OpenAI confirmed the report and said it wants to do long-term research on the effects of sexually explicit chats on users before making a decision.
Instant Checkout for Shopping
In October, Walmart and OpenAI announced a deal that would allow customers to shop for 200,000 Walmart products directly within ChatGPT through a feature called Instant Checkout. But it turns out people aren’t so keen on chatbot shopping.
Sales through ChatGPT were disappointing, a senior Walmart executive told Wired, and Walmart said that conversion rates — percentage of shoppers that actually buy products shown within ChatGPT — were three times lower than those that require a user to click out to Walmart’s website. Other retailers like Shopify and Etsy also made products available for people to buy within ChatGPT, but only limited items were available for Instant Checkout, and descriptions weren’t always up-to-date and accurate.
In early March, OpenAI pulled the plug, discontinuing the Instant Checkout feature. Instead, shoppers can now browse and buy products from dedicated apps within ChatGPT, including from Walmart’s own chatbot Sparky. OpenAI said it wants to focus on helping people browse and search for products and give sellers control over checkout. “We’ve found that the i
▸ 展开全文
04-02 00:01 · AI,技术,HackerNews,AI
Windows 95 defenses against installers that overwrite a file with an older one
Back in the days of 16-bit Windows, many system components were redistributable, meaning that programs that used those components could include a copy of those system components and install them onto the system as part of the program’s installer. The guidance for installing the system components was that if the installer finds a copy of the system component already on the system, then they should compare the version number of the existing file with the version number of the file being installed and then overwrite the file only if the file being installed has a higher version number. if the existing file has a higher version number, then it should be left alone.
This rule relies on the fact that Windows maintains backward compatibility, so the newer version still works even if used by an older program.
This doesn’t mean that installers actually followed this guidance.
It was common for program installers to overwrite any file that was in their way, regardless of the existing file’s version number. When these installers ran on Windows 95, the replaced the Windows 95 versions of the components with the Windows 3.1 versions. You can imagine how much of a disaster this caused to the rest of the system.
Windows 95 worked around this by keeping a backup copy of commonly-overwritten files in a hidden C:\Windows\
Basically, Windows 95 waited for each installer to finish, and then went back and checked its work, fixing any mistakes that the installer made.
An earlier design simply blocked the installer’s attempt to overwrite the file, but this ended up creating more problems. Some installers declared the installation to be a failure and gave up. Otherwise displayed an error message to the user and asked the user what to do next. (Like the user knows what to do next.) You even had installers that took even more extreme measures and said, “Okay, fine, I can’t overwrite the file, so I’m going to reboot the system and then overwrite the file from a batch file, see if you can stop me.”
Redirecting the write to a dummy file didn’t work because some installers had a validation step where they checked that the files on disk have the correct checksum, so they would notice that their attempt to overwrite the file was unsuccessful and error out.
The way that worked best was to let the installer overwrite anything it wanted and then go back and try to clean up the mess.
Bonus chatter: Some components addressed this problem by providing their own installer for the component, and telling installers, “You are not allowed to install these component file directly. Instead, you must run our custom installer. Yes, this disrupts your installer’s UI, but you installer authors have shown that you can’t be trusted to install files on your own. It’s your own fault.”
▸ 展开全文
04-02 00:01 · AI,技术,HackerNews,AI
Obfuscation is not security – AI can deobfuscate any minified JavaScript code
It's April 1st, but this post is not a joke.
The internet is on fire over Claude Code's (NPM CLI to be precise) "leaked" source. 512,000 lines! Feature flags! System prompts! Unreleased features! VentureBeat, Fortune, Gizmodo, The Register, Hacker News — everyone covered it. A clean-room Rust rewrite (to dodge the DMCA) hit 100K GitHub stars in nearly a day — a world record. 110K now and counting.
Here's what nobody's saying: all of that was already public! On npm. In plaintext. For years. Open unpkg.com/@anthropic-ai/claude-code/cli.js right now — that's the entire Claude Code CLI, one click away, readable in your browser. No leak required.
What "leaked" was a source map file that added internal developer comments on top of code that was never protected in the first place, plus a directory/source structure.
What Actually Happened
A .map
source map file — meant for internal debugging — was accidentally included in version 2.1.88 of the @anthropic-ai/claude-code
package on npm. Security researcher Chaofan Shou spotted it, posted on X, and the internet did the rest.
Anthropic confirmed the mistake: "This was a release packaging issue caused by human error, not a security breach." The package was pulled, but by then it had already been mirrored everywhere.
The funny part? This is the second time. A nearly identical source map leak happened in February 2025. Same product, same mistake, thirteen months apart.
The Internet Lost Its Mind — In One Day
What happened next was genuinely impressive. In a single day:
-
Code dumps appeared on GitHub — like nirholas/claude-code, which was DMCA'd by Anthropic within hours but not before being forked hundreds of times.
-
Claw Code — a full Rust rewrite of the Claude Code architecture — hit 50,000 GitHub stars in 2 hours, making it the fastest repo in history to reach that milestone. It's now being actively developed as an open-source AI coding agent framework.
-
ccleaks.com popped up — a fully designed breakdown site cataloging every unreleased feature, hidden command, and build flag found in the source. Complete with shareable cards for discoveries like "BUDDY" (an AI companion pet), "ULTRAPLAN" (30-minute remote planning mode), and 44 other feature flags:
- Dozens of analysis articles on DEV Community, YouTube, and tech blogs dissecting every detail.
All of this. In one day. Software gets crazy in the AI era.
But the Code Was Already There
Here's what most of the coverage missed: Claude Code ships as a single bundled JavaScript file — cli.js
— distributed via npm. It's 13MB, 16,824 lines of JavaScript. And it's been sitting there, publicly accessible, since the product launched.
We analyzed this file at AfterPack as part of a deobfuscation case study. What we found: it's minified, not obfuscated.
Here's the difference. Minification — what every bundler (esbuild, Webpack, Rollup) does by default — shortens variable names and removes whitespace. It makes code smaller for shipping. It was never designed to hide anything.
Obfuscation encrypts strings, flattens control flow, injects dead code, adds anti-tamper mechanisms. It's designed to make reverse engineering computationally expensive.
Claude Code has the first. Zero of the second.
All 148,000+ string literals sit in plaintext. Every system prompt, every tool description, every behavioral instruction — right there in the JavaScript, readable with a text editor. No source maps needed.
We Asked Claude to Deobfuscate Itself
Here's where it gets interesting. We didn't need source maps to extract Claude Code's internals. We asked Claude — Anthropic's own model — to analyze and deobfuscate the minified cli.js
file.
It worked. Extremely well.
Using a simple AST-based extraction script, we parsed the full 13MB file in 1.47 seconds and extracted 147,992 strings. After categorizing them:
- 1,017 system prompts and instructions
- 431 tool descriptions
- 837 unique telemetry event names (all prefixed with
tengu_
— Claude Code's internal codename) - 504 environment variables controlling the product's behavior
- 3,196 error messages
- Hardcoded endpoints, OAuth URLs, a DataDog API key, the complete model catalog
Every single string. Extracted in under 2 seconds. No decryption. No deobfuscation. Just parsing.
And we're not the only ones who figured this out. Geoffrey Huntley published a full "cleanroom transpilation" of Claude Code months before this leak — using LLMs to convert the minified JavaScript into readable, structured TypeScript. His key insight: "LLMs are shockingly good at deobfuscation, transpilation, and structure-to-structure conversions."
The source maps didn't reveal the code. The code was already revealed. Source maps just added comments and a source tree structure on top.
What Source Maps Actually Added
To be fair — source maps did surface some genuinely sensitive information that wasn't easily extractable from the minified bundle:
Internal code comments. Developer notes, TODOs, rationale for decisions. The kind of thi
▸ 展开全文
04-02 00:01 · AI,技术,HackerNews,AI
InspectMind AI (YC W24) Is Hiring
InspectMind AI • San Francisco • Full-time
$120K – $220K + Equity
The Mission
Every building is designed using drawings that often contain hundreds of mistakes.
These mistakes lead to costly delays, rework, and sometimes unsafe structures.
We’re building the AI Plan Checker — a system that reviews full construction plan sets (drawings, specs, calculations) in PDFs and finds issues before anything gets built.
Our goal is simple: every construction project in the world gets checked by AI before permitting and construction. Faster approvals. Fewer mistakes. Safer buildings.
Traction
• 100%+ month-over-month growth
• Hundreds of paying customers
• Thousands of projects processed
• Engineers finding hundreds of real issues per project
• Fully self-serve product
This is already being used in real workflows. So far, InspectMind AI has been used to check drawings across projects in data centers, universities and K–12 schools, hospitals and clinics, large multifamily and senior housing, energy infrastructure (battery storage, utility terminals), commercial spaces, and more, supporting architects, engineers, contractors, owners and developers across the US, Canada, Europe, South America, and Asia.
The Problem
Our AI can already find a lot of issues.
Now we’re focused on what matters most:
• Turning thousands of raw issues into clear, high-signal insights
• Reducing false positives and noise
• Making results trustworthy and actionable
• Driving repeat usage and team adoption
This is a hard technical problem across computer vision, AI agents design, and system design.
What You’ll Do
• Build core product features end-to-end (frontend, backend, AI)
• Improve accuracy and signal-to-noise of results
• Work directly with users (engineers, architects, contractors, developers)
• Own major parts of the product from idea to production
• Ship fast and see immediate real-world impact
What We’re Looking For
• 2–5+ years of experience shipping production code
• Our product is built entirely by AI. You need to use coding agents like Claude Code and Codex effectively to ship quickly while maintaining code quality and security.
• High velocity and strong ownership
• Strong intrinsic motivation to learn and grow
• Good product instincts and user empathy
• Excited by ambiguity and hard problems
Tech stack
AWS + NextJS
Why This Is Special
Your work will directly impact real buildings and real safety. If we succeed, every construction project globally will run through systems you helped build.
Team
• Ex-Google, Airbnb, Berkeley, CMU
• Former founders and early engineers
• YC W24, AI Grant, top VCs
Small team, high ownership, fast execution.
How We Work
• Fast-moving, product-focused
• Direct access to users
• No bureaucracy
Interview Process
• Intro call
• Technical interviews
• Trial project
• Offer
Apply
If you want to build something that matters and push AI into the real world, we’d love to talk.
InspectMind AI is building AI plan-checking software for the construction industry. We help engineers, architects, contractors, and consultants catch coordination issues, code-related risks, and costly errors across drawings, calculations, and specifications before they turn into delays, RFIs, and rework. We are a fast-moving startup focused on bringing modern software and AI into one of the world’s largest and most important industries, with the goal of making project review faster, smarter, and more reliable.
▸ 展开全文
04-02 00:01 · AI,技术,HackerNews,AI
AI for American-produced cement and concrete
- Meta is continuing its long-term roadmap to help the construction industry leverage AI to produce high-quality and more sustainable concrete mixes, as well as those exclusively produced in the United States.
- Concurrent with the 2026 American Concrete Institute (ACI) Spring Convention, Meta is releasing a new AI model for designing concrete mixes – Bayesian Optimization for Concrete (BOxCrete), as well as the foundational data used to develop award-winning concrete mixes.
- Meta’s open source model for sustainable concrete is available today on GitHub.
Every year, the United States pours roughly 400 million cubic yards of concrete, enough concrete to pave a two-lane highway that circles the Earth multiple times. It’s the backbone of our bridges, data centers, highways, and homes. However, while we produce most of our ready-mix concrete domestically, we import nearly a quarter of the cement that makes it. Meta’s AI is helping change that.
Concrete consists of a mix of cement and cementitious materials, aggregates, water, and chemical admixtures. Concrete suppliers have to design concrete mixes to meet competing requirements: strength, speed, ease of handling, cost, and sustainability. Traditional concrete mix design relies heavily on trial-and-error in the lab, engineer intuition, and decades of accumulated knowledge—a workflow that is slow and expensive to adapt.
Cement is a key element of concrete, thus imported cement can have a significant impact on U.S. suppliers, stifling U.S. manufacturing, jobs and investments. While ready-mix concrete is typically produced domestically, the cement required for it is heavily imported, with roughly 20-25% of U.S. cement consumption met by imports. Additionally, cement made in the U.S. complies with U.S. performance and environmental standards that are not consistent internationally.
At the same time, ensuring products are produced domestically—a process often called reshoring — generally increases manufacturing jobs in the United States. Reshoring and related foreign direct investment (FDI) have brought over 1.1 million jobs back to the U.S. since 2020, and manufacturing has one of the highest economic multipliers; with every $1.00 spent in manufacturing adding $2.69 to the U.S. economy. The cement and concrete sector alone contributes more than $130 billion annually and supports roughly 600,000 jobs — yet imports still supply about 23% of total domestic demand. To capture more of that value at home, U.S.-based concrete producers want to incorporate more U.S.-made materials in their mixes.
Different cements have different chemistries, and a mix that works perfectly with one cement might fail entirely with another. As a result, producers need a way to rapidly explore and validate new formulations without spending months in the lab.
Real-World Impact Across the U.S.
Meta and its partners have already received a number of awards for these innovations in concrete design, including a 2025 Building Innovation Award for Best Partnership (shared with Amrize) and a Slag Cement Award in 2025 for Sustainable Concrete Project of the Year (shared with Amrize and the University of Illinois at Urbana-Champaign). But the impact of this model is also being felt through on-the-ground collaborations in several states through partnerships with large-scale concrete manufacturers and software companies.
Illinois
Meta has been partnering closely with the University of Illinois at Urbana-Champaign and Amrize, the largest cement and concrete manufacturer in North America, headquartered in Chicago, IL., on the implementation of AI for sustainable and domestically-produced concrete. Amrize operates 18 cement plants, 141 cement terminals and 269 ready-mix concrete sites across North America. Their scale makes them an ideal partner for demonstrating how AI can transform mix design at industrial volumes. Amrize recently launched a Made in America cement label, which guarantees the cement meets rigorous U.S. standards and was manufactured in the U.S. by a domestic workforce with American materials. The company also recently announced close to $1 billion of capital investments in 2026 in part to increase domestic cement production.
Meta and Amrize will be presenting at the American Concrete Institute (ACI) Spring Convention, along with researchers from the University of Illinois Urbana-Champaign to further showcase our partnership leveraging AI for lower-emission, domestically-produced concrete.
Alongside the event, Meta is releasing a new AI model for designing concrete mixes, Bayesian Optimization for Concrete (BOxCrete). BOxCrete improves over Meta’s previous models with more robustness to noisy data as well as new features including the ability to predict concrete slump (an important indicator of concrete workability).
Coupled with BOxCrete, Meta is releasing the foundational data used to develop the novel concrete mix used in our Rosemount, MN data center. This foundational data is the best
▸ 展开全文
04-01 00:01 · AI,技术,HackerNews,AI
Why the US Navy won't blast the Iranians and 'open' Strait of Hormuz
American taxpayers could be forgiven if recent events have left them wondering why the largest and most expensive Navy in the world is sitting well outside the Strait of Hormuz, watching powerlessly as the Iranians decide which ships they will allow to transit the waterway.
After all, they must wonder, why can’t the Navy simply blast the Iranians away and re-open the strait, sending life and the global economy back to normal?
Alas, the days of omnipotent U.S. sea power as a power projection instrument close to well defended shorelines are coming to an end. This change raises questions about the future of navies and the wisdom of investment in these extremely expensive instruments of national power. A brief review of American naval history shows how this shift came about — and casts doubt on whether Washington is ready for the future of naval war.
Past as prologue
At the beginning of the 20th century, aspirant powers like Germany and the United States saw navies as essential to achieving “great power status” and as important instruments to exert influence over friends and rivals alike.
Drawing upon this logic and the experiences of the once mighty British Royal Navy, the United States built the largest fleet in history drawing upon the era’s virtually unlimited industrial capacities. During World War II, America used its Navy to prosecute and decisively win the war in the Pacific against the Japanese, while also winning the U-boat war in the Atlantic that enabled moving the Army to Europe — and thereby prevented all of Europe from becoming part of the Soviet empire. (Without the U.S. Army's arrival, the Soviets may well have advanced past Germany and brought western Europe under their dominion, as many historians argue.)
Both of these victories decisively influenced the direction of the 20th century and the resulting consolidation of America’s global power and hegemony.
At the time, navies had the great advantage of being able to deliver land forces to virtually any shoreline in the world. America’s seemingly ubiquitous aircraft carriers also gave sea-borne forces striking power over several hundred miles along any shorelines to pound enemies at will.
This approach perhaps found its best expression during the Vietnam War. U.S. carriers spent much of the conflict 90 miles off the coast of Vietnam in an area dubbed “Yankee Station.” From there, U.S. forces launched air assaults that pummeled North Vietnam — albeit at great expense in lost pilots and hardware.
Dawn of the anti-access area denial age
In the 1990s, when the U.S. held a position of unquestioned global naval supremacy following the end of the Cold War, the Navy sailed it carriers into the Persian Gulf with impunity to help the Air Force police no-fly zones over Iraq and to indirectly assist in the enforcement of the United Nations trade embargo on Iraq.
Navy sailors flocked into ports in Bahrain, the United Arab Emirates, and Qatar until late in the decade, when American intelligence detected active and ongoing construction work on Iran’s Abu Musa and Tunbs islands just inside the Strait of Hormuz, as well as on the coastline of Bandar Abbas, which border the strait. Upon closer examination, planners realized that Iran was installing anti-ship missiles into concrete and steel-reinforced bunkers, giving it the ability to easily target any ships passing near the strait. By the end of the 1990s, the Navy began reducing the transit of its carriers through the strait, and today those carriers are steaming well offshore outside the range of Iranian missiles.
The era of shore-based anti-access and area denial had arrived in the Persian Gulf. The balance between shore- and sea-based weapons had shifted in favor of shore-based weapons — particularly missiles. No more Yankee Stations were possible in areas where enemies had invested in arsenals of cheap, accurate cruise and ballistic missiles.
Iran’s steps to secure the Strait of Hormuz did not go unnoticed. The Chinese immediately grasped the implications of what Iran had accomplished and set about constructing its own “anti-Navy” system designed around missiles that could target U.S. Navy vessels that presumably would come to Taiwan’s aid in case of any cross-strait attack from the Chinese mainland. Today, China boasts various families of accurate ship-killing systems, notably the DF “Dong Feng” series of missiles that can track and target U.S. ships thousands of miles away while underway at sea. Many wargames today conclusively demonstrate that the United States Navy would take serious and perhaps unacceptable losses from these missiles in any war against China.
Back in the Persian Gulf today, the Navy grasps the reality of the circumstances, recognizing that it simply can’t sail into the strait without risk getting blown to smithereens by Iran’s missiles. Today, its carriers are stationed well outside the Gulf and the ranges of Iranian missiles.
These steps have imposed additional costs on war prosecutio
▸ 展开全文
04-01 00:01 · AI,技术,HackerNews,AI
I Traced My Traffic Through a Home Tailscale Exit Node
I set up Tailscale years ago but only used it for “reach my own devices” use cases. This week I finally set up a proper home exit node: a tiny dedicated LXC on my Proxmox box (1 vCPU, 512 MB RAM, basically just Tailscale).
To verify it worked, I pinged my home servers and they worked. But I wanted to
understand this deeper, so I turned to traceroute
.
The 7th hop is where the cogs in my brain began turning. That’s my home ISP. So this is like a VPN, right? Or is it different?
What is an exit node for?
Without an exit node, Tailscale sends traffic to my Tailscale devices, but normal web traffic goes out through my local network or ISP (exit nodes docs).
With an exit node enabled, my device changes its default internet path to a chosen device, which then sends traffic to the internet for me.
For internet traffic, an exit node behaves like a traditional VPN gateway, with a caveat: Tailscale isn’t always a VPN tunnel for all traffic, but the exit-node mode is.
Without an exit node, we just have discoverability for services that we have exposed on Tailscale. With an exit node, our device is effectively in a full-tunnel VPN mode for internet traffic.
The traffic to the exit node is encrypted, and websites we access see the exit node’s public IP, not the IP of the ISP we are currently connected to on our device.
Under the hood
Before getting into routing, I want to cover how Tailscale connects devices in the first place. I’ve been comparing it to a VPN, but Tailscale is really a mesh network with a control plane on top of WireGuard.
WireGuard by itself is mostly the data plane. Tailscale adds the control plane on top: identity/SSO, peer discovery, NAT traversal coordination, ACL distribution, route distribution (including exit node default routes), MagicDNS, and fast device revocation. We can run our own WireGuard tunnels, but then we’d have to build and operate most of that control-plane machinery ourselves.
When two devices connect, the flow looks like this:
- Both devices (client + exit node) authenticate to Tailscale’s control plane.
- Control plane shares each peer’s reachable endpoints (public/DERP candidates) and keys.
- Both peers send UDP packets to each other to do NAT hole-punching.
- If punch-through succeeds, they establish a direct WireGuard-encrypted path.
- If direct fails, they fall back to DERP relay (still end-to-end encrypted).
Imagine your phone in a cafe and your home server are both behind routers. NAT is like a front desk that tracks who went out, but does not let random outsiders walk in directly. Hole-punching tries to make both sides “step out” at the same time so their routers allow a path back in. If that timing or mapping fails, DERP acts as a neutral meeting point; it forwards ciphertext between peers but cannot decrypt it.
So the exit node connects by becoming a discovered peer and completing WireGuard
handshakes, not by me exposing a normal inbound VPN port. For exit nodes
specifically, the node advertises 0.0.0.0/0
and ::/0
to the control plane,
the control plane tells eligible clients, and the client chooses it. After that,
all internet traffic flows through the encrypted peer tunnel.
How routing changes on your device
At a route level, enabling an exit node usually does the following:
- Tailscale accepts the exit node’s advertised default routes (
0.0.0.0/0
and::/0
). - It installs policy routes so internet-bound traffic goes to the Tailscale
tunnel interface (
tailscale0
on Linux,utun
on macOS,Wintun
on Windows; different labels, same role). - It adds an “escape hatch” route for the exit node’s own public IP via your normal gateway, so the tunnel transport itself doesn’t loop.
- It either keeps or suppresses local LAN routes depending on
allow LAN access
.
A route is just a rule that says “for destination X, send packets to next-hop Y.” The default route is the catch-all rule for normal internet traffic. The “escape hatch” route keeps traffic to the exit node’s real public endpoint on your normal network path so the tunnel does not try to tunnel itself.
The OS-specific plumbing differs, but the user outcome is the same:
- Linux: Tailscale uses kernel policy routing (
ip rule
+ a separate route table) to steer default traffic totailscale0
, while exempting tunnel transport to avoid loops. - macOS / Windows: Tailscale uses the OS VPN framework (Network Extension on macOS, virtual adapter + route priorities on Windows). More of the steering is hidden behind the framework, but the result is the same: a VPN adapter with a default route that captures internet traffic.
How this compares to OpenVPN
Both Tailscale exit-node mode and OpenVPN achieve full-tunnel to one gateway, but the internal mechanics differ. On Linux, the difference is clearest:
- OpenVPN rewrites the main routing table so “almost all destinations” go to
tun0
(commonly using0.0.0.0/1
+128.0.0.0/1
), plus one escape route for the VPN server. - Tailscale uses
ip rule
+ a separate routing table, selecting traffic by poli
▸ 展开全文
04-01 00:01 · AI,技术,HackerNews,AI
OpenAI closes funding round at an $852B valuation
OpenAI on Tuesday announced that it closed a record-breaking funding round at a post-money valuation of $852 billion.
The round totaled $122 billion of committed capital, up from the $110 billion figure that the company announced in February. SoftBank co-led the round alongside other investors, including Andreessen Horowitz and D. E. Shaw Ventures, OpenAI said.
OpenAI kickstarted the artificial intelligence boom with the launch of its ChatGPT chatbot in 2022, and the company has since ballooned into one of the fastest-growing commercial entities on the planet. As of March, ChatGPT supports more than 900 million weekly active users, including more than 50 million subscribers.
"AI is driving productivity gains, accelerating scientific discovery, and expanding what people and organizations can build," OpenAI said in a release. "This funding gives us the resources to continue to lead at the scale this moment demands."
With the close of its latest funding round, OpenAI CEO Sam Altman will be under pressure to justify his company's massive valuation, especially as it gears up for a potential IPO. The startup has been retreating from some hefty spending plans and shuttering certain features and products in recent months, including its short-form video app Sora, as it looks to rein in costs.
OpenAI said Tuesday that it's generating $2 billion in revenue per month. It made $13.1 billion in revenue last year. The company is still burning cash and is not yet profitable.
In February, OpenAI revealed $110 billion of commitments from some of its strategic investors that anchored its funding round. Amazon agreed to invest up to $50 billion in the startup, Nvidia invested $30 billion, and SoftBank invested $30 billion.
The additional $12 billion of capital that OpenAI raised came from a broader pool of investors. OpenAI said it extended participation to investors through bank channels for the first time and raised $3 billion from individual investors.
Microsoft, one of OpenAI's longtime partners, also participated, but OpenAI did not disclose the size of the company's investment in its Tuesday release. As of late last year, Microsoft had invested more than $13 billion in the startup.
"Moments like this do not come often," OpenAI said. "The capital being deployed today is helping build the infrastructure layer for intelligence itself. Over time, that value will flow back into the economy, to companies, to communities, and increasingly to individuals."
— CNBC's MacKenzie Sigalos contributed to this report.
▸ 展开全文