Feed aggregator

Google is evolving beyond search in an effort to better protect its users from hoaxes.

Article URL: https://www.cnbc.com/2025/05/07/meet-amazons-robot-vulcan-the-first-with-a-sense-of-touch.html

Comments URL: https://news.ycombinator.com/item?id=43928429

Points: 1

# Comments: 0

Article URL: https://www.theverge.com/news/663166/apple-siri-audio-recording-lawsuit-payout-applications

Comments URL: https://news.ycombinator.com/item?id=43928424

Points: 1

# Comments: 1

Article URL: https://www.bleepingcomputer.com/news/security/kickidler-employee-monitoring-software-abused-in-ransomware-attacks/

Comments URL: https://news.ycombinator.com/item?id=43928405

Points: 1

# Comments: 0

I’m building a system to run small LLMs on-device (mobile, IoT, on-prem servers) and would love to hear how others have tackled the challenges.

Context:

Use cases: offline chatbots, smart cameras, local data privacy

Models: 7–13B parameter quantized models (e.g. Llama 2, Vicuna)

Constraints: limited RAM/flash, CPU-only or tiny GPU, intermittent connectivity

Questions:

What runtimes or frameworks are you using (ONNX Runtime, TVM, custom C++)?

How do you handle model loading, eviction, and batching under tight memory?

Any clever tricks for quantization, pruning, or kernel fusions that boost perf?

How do you monitor and update models securely in the field?

Looking forward to your benchmarks, war stories, and code pointers!

Comments URL: https://news.ycombinator.com/item?id=43928377

Points: 2

# Comments: 1

Sales teams often struggle with limited visibility into their calls, reviewing only 5-10% manually, which leads to missed opportunities. We built an AI-powered voice analytics tool that transcribes, indexes, and analyzes 100% of calls, turning them into actionable insights. In one case, this helped a SaaS client grow sales by 120% in 12 months.

What the tool does

We aimed to provide non-intrusive, automated QA at scale. So the key features include: - 100% call transcription: using ASR for accurate, fast transcriptions. - Searchable database: indexed transcripts for easy keyword and phrase tracking. - Customizable reports: automated manager reports, grouped by agent or team. - CRM integration: syncs data to tools like Salesforce and Zoho.

Limitations: currently lacks real-time alerts, sentiment analysis, and emotion scoring (planned for future updates).

Architecture overview - Audio capture: integrated VoIP or manual uploads. - ASR pipeline: transcribes calls via cloud-based speech-to-text. - Transcript indexing: elasticSearch stores and retrieves data efficiently. - Keyword matching: flags important terms like pricing or CTAs. - Reports: automated generation of weekly summaries.

Real-world impact. One SaaS client improved - 120% sales growth over 12 months. - 35% increase in close rate by identifying high-performing patterns. - 5-day reduction in sales cycle due to consistent messaging. - Churn dropped from 15% to 6% through better objection handling.

This was achieved without expanding the team — simply by leveraging the power of data.

Challenges & lessons learned - Keyword rules: over-flagging terms led to alert fatigue, so we customized per-client keyword sets. - ASR model issues: addressed by adding pre-filtering for noisy inputs and fallback models. - CRM integration: built middleware to adapt to varying CRM structures across clients. - Manager overload: simplified reports to highlight top deviations, avoiding information overload.

Next steps: what's coming

- Trend detection: analyzing keyword frequency over time. - Conversation templates: auto-tagging calls (intro, demo, pricing). - Call quality scoring: identifying poor audio or incomplete conversations.

Key takeaways - Focus on basics: transcription + search + simple flags bring massive value. - Human-in-the-loop: insights are most useful when actionable in real-time. - Scalability = simplicity: focused, simple solutions deliver better results. - Data ≠ insight: reports need to be curated and actionable for managers.

Conclusion AI is a powerful tool for sales teams, but success comes from turning raw data into actionable insights. By building scalable systems and avoiding complexity, we were able to achieve real business growth — and this approach is adaptable across industries.

Comments URL: https://news.ycombinator.com/item?id=43928374

Points: 1

# Comments: 1

Article URL: https://www.nature.com/articles/s41467-025-58359-4

Comments URL: https://news.ycombinator.com/item?id=43928364

Points: 1

# Comments: 0

Article URL: https://samwho.dev/reservoir-sampling/

Comments URL: https://news.ycombinator.com/item?id=43928315

Points: 6

# Comments: 0

A few months ago, I got laid off unexpectedly while trying to migrate a legacy codebase. Since then, I’ve been applying to jobs, diving deeper into Rust, and building side projects. But there's one project I’ve put months of love into: Potatoe Squeezy.

What started as a small birthday idea evolved into a platform for tipping open-source developers using crypto. It's designed to be borderless, crypto-native, and frictionless. On GitHub, maintainers tag issues with a bounty, and contributors get paid automatically when they close the issue. On the web app, anyone can tip anyone without needing any crypto knowledge.

The problem it solves is simple: GitHub sponsorships are slow and gated, and bounty platforms feel overengineered. Potatoe Squeezy allows devs worldwide to receive crypto tips effortlessly.

But, with the layoff, I can't keep the project alive. So, I’ve decided to sell it. The project is live and fully functional, with well-structured code, a GitHub bot, web app, and deployment guides. Despite some traction (top 1 in Web3 on Product Hunt), the project is still in its early stages.

If you're interested in taking it to the next level, I’m open to offers and will provide code, docs, and a smooth handoff. You can reach me via Twitter, email, or check the project out at https://potatoesqueezy.xyz/.

I’m also actively looking for new opportunities. Feel free to check out my portfolio and GitHub profile.

Thanks for reading — you’ve earned a virtual high five! And hey, if you want to sponsor or fund me, I’m always open, like the Burj Khalifa or the sun from afar, hard to miss!

Comments URL: https://news.ycombinator.com/item?id=43928313

Points: 1

# Comments: 0

Article URL: https://github.com/EnigmaLabsAI/multiverse

Comments URL: https://news.ycombinator.com/item?id=43928305

Points: 1

# Comments: 0

The relentless battle against online fraud is a constant evolution, a digital chase where security teams and malicious actors continually adapt. The increasing sophistication of attacks is blurring the lines between legitimate user behavior and impersonation attempts.

The campaign we are exposing today is a reminder that even the most advanced security technologies do not dissuade threat actors. We discovered a new phishing kit targeting payroll and payment platforms that aims to not only steal victims’ credentials but also to commit wire fraud.

Our investigation began with a fraudulent search ad for Deel, a payroll and human resources company. Clicking on the ad sent employees and employers to a phishing website impersonating Deel.

Beside stealing usernames, passwords and circumventing two factor authentication, we identified malicious code capable of performing additional nefarious actions unbeknownst to the victim. Using a fully authenticated web worker, this phishing kit is using a legitimate hosted web service called Pusher with the intent of manipulating sensitive profile data fields related to banking and payment information.

While we were working this case, the FBI issued a public service announcement (PSA250424) warning people that cyber criminals are using search engine advertisements to impersonate legitimate websites and expanded to target payroll, unemployment programs, and health savings accounts with the goal of stealing money through fraudulent wire transactions or redirecting payments.

The Google ad was taken down quickly, and we have informed Deel and MessageBird (Pusher’s parent company) about the misuse of their respective platforms.

Search results ad targets Deel

Deel is a US-based payroll and human resources company founded in 2019 Deel whose platform is designed to streamline the complexities of managing a global workforce, offering solutions for payroll, HR, compliance, and more.

We first identified a malicious Google Search ad for Deel in mid April for the keywords ‘deel login‘. The top link is a sponsored search result, appearing just above the organic search result for Deel’s official website.

The URL in the ad (deel[.]za[.]com) uses the .ZA.COM subdomain of .COM targeting South Africa, essentially an alternative to the .CO.ZA extension. That URL is used as a redirect only, allowing the threat actors to use cloaking in order to redirect clicks to decoy websites (white page) or phishing domains they can rotate.

Phishing portal and 2FA

The first phishing domain we saw was login-deel[.]app but at the time we checked it did not resolve. Shortly thereafter, the same Google ad URL pointed to a new domain, accuont-app-deel[.]cc.

The phishing page is a replica of Deel’s login page with one minor difference: the Log in using Google and Continue with QR code options are disabled, only leaving the user name and password fields for authentication.

After entering their credentials, victims are social engineered by the crooks to type a security code that was sent to their email address. While two-factor authentication is a great added security feature, we can see that it can be rendered useless when victims authenticate into the wrong website.

On the surface, this looks just like another phishing site, until you look deeper and discover more intriguing code.

Traffic analysis

To better understand how this phishing kit works, we recorded a network capture showing the web requests sent and received. This allowed us to identify several interesting components that make this phishing campaign unique.

Of particular interest are several JavaScript libraries, namely pusher.min.js, Worker.js and kel.js.

The phishing kit uses anti-debugging techniques to prevent us from stepping through its code. This is a common practice to hide malicious intent and makes analysis more time consuming.

Scripts analysis

Looking at the files that the anti-debugger is trying to conceal, we see that only one is human readable, while the other two are heavily obfuscated using obfuscator.io. The pusher.min.js JavaScript file is a legitimate library from Pusher, a hosted web service that uses APIs, developer tools and libraries to manage connections between servers and clients using technologies like WebSockets.

There seems to be two different types of sessions, based on the functions named createBankSession and createCardSession. When attempting to login into the phishing site, we see a session_type value of “bank” which belongs to the former function.

The kel.js and Worker.js files are both used for authenticating the victim into the real Deel website while a web worker communicates with the threat actor’s infrastructure for processing the credentials and to receive the OTP code to get past two-factor authentication.

WebSockets are a persistent communication protocol that allows for full-duplex communication between a user’s browser and a server. This means data can be pushed from the server to the client in real-time without the client having to constantly request it.

Here’s an example of a WebSocket communication where the user provided the wrong login credentials:

The conversation begins with a pusher:connection_established message, confirming a successful connection to the Pusher real-time service and providing a unique socket_id and an activity_timeout of 120 seconds.

Next, a pusher:subscribe message shows the client requesting to listen for events on a specific channel identified by a unique session ID, indicating a desire to receive real-time updates for that session.

The server then acknowledges this request with a pusher_internal:subscription_succeeded message for the same channel, confirming that the client is now successfully subscribed and will receive broadcasts.

Finally, an events message is received on that session channel, carrying data indicating a “wrongLogin” event has occurred and instructing the client-side application to “Show” something, likely an error message to the user in real-time.

Additional targets

This phishing kit is unique and can be tracked with the following characteristics:

• Obfuscator.io
• Pusher WebSockets
• Worker.js library
• kel.js/otp.js/auth.js/jquery.js library

We identified several other targets, related to payroll, HR, billing, payment solutions and even commerce platform Shopify. The earliest use we could find goes back to July 2024, but it appears to have flown under the radar.

Justworks: Payroll, benefits, HR, and compliance — all in one place.

Marqeta: End to end credit and payment solutions integration into business processes

Shopify: Commerce platform

OmniFlex (Worldpay): online point of sale solution

Conclusion

The FBI’s PSA highlights several key measures businesses can adopt to protect users related to the following:

• Domain spoofing: Brand impersonation is a real problem that companies need to proactively lookout for.
• Notifications: Victims need to be alerted in several different ways in a timely manner.
• Education: Phishing is getting more sophisticated and users need to be aware of how to best protect themselves.

In that same report, the FBI advises consumers to check the URL to make sure the site is authentic before clicking on an advertisement. This is usually a sound practice, but as we have documented it on this blog many times, URLs within ads can be spoofed also.

Ultimately, the discovery of this phishing kit, with its advanced capability to interact with financial data, reinforces a critical message: online security is a shared responsibility. Users must exercise caution and critical thinking in their online interactions while enhancing their security with available tools; platforms must remain committed to detecting and preventing abuse.

Browser extensions such as Malwarebytes Browser Guard will block ads but also the scams or malware sites associated with these schemes.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

Indicators of Compromise

Redirect

deel[.]za[.]com

Phishing domains

login-deel[.]app
accuont-app-deel[.]cc
justvvokrs-login[.]cc
vye-starr[.]net
maqreta[.]com
ctelllo[.]com
angelistt[.]com
account[.]datedeath[.]com
account[.]turnkeycashsite[.]com
admin-shopffy[.]cc
biilll[.]com
app-parker[.]com
shluhify[.]com
login-biil[.]net
founderga[.]com
admin-shoopiffy[.]com
access-shupfify[.]com
virluaterminal[.]net

Worker.js (SHA256)

56755aaba6da17a9f398c3659237d365c52d7d8f0af9ea9ccde82c11d5cf063f

kel.js/otp.js/auth.js/jquery.js (SHA256)

72864bd09c09fe95360eda8951c5ea190fbb3d3ff4424837edf55452db9b36fb
6fb006ecc8b74e9e90d954fa139606b44098fc3305b68dcdf18c5b71a7b5e80f
908a128f47b7f34417053952020d8bbdacf3aed1a1fcf4981359e6217b7317c9
5dadc559f2fb3cff1588b262deb551f96ff4f4fc05cd3b32f065f535570629c3
0ef66087d8f23caf2c32cc43db010ffe66a1cd5977000077eda3a3ffce5fa65f
95d008f7f6f6f5e3a8e0961480f0f7a213fa7884b824950fe9fb9e40d918a164
3e4e78a3e1c6a336b17d8aed01489ab09425b60a761ff86f46ab08bfcf421eac
a37463862628876cecfc4f55c712f79a150cdc6ae3cf2491a39cc66dadcf81eb
15606c5cd0e536512a574c508bd8a4707aace9e980ab4016ce84acabed0ad3be
81bcf866bd94d723e50ce791cea61b291e1f120f3fc084dc28cbe087b6602573
1665387c632391e26e1606269fb3c4ddbdf30300fa3e84977b5974597c116871
c56e277fd98fc2c28f85566d658e28a19759963c72a0f94f82630d6365e62c4f

Hello HN, this is my first "completed" project since I took on this coding journey.

Vern is a statically typed scripting language with lots of rough edges.

You can try it out at https://vern.cal31.dev

You can find the source code and some documentation at https://github.com/cal31/vern-lang

Comments URL: https://news.ycombinator.com/item?id=43928297

Points: 2

# Comments: 0

Posted by Jasika Bawa, Andy Lim, and Xinghui Lu, Google Chrome Security

Tech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data. In a tech support scam, the goal of the scammer is to trick you into believing your computer has a serious problem, such as a virus or malware infection, and then convince you to pay for unnecessary services, software, or grant them remote access to your device. Tech support scams on the web often employ alarming pop-up warnings mimicking legitimate security alerts. We've also observed them to use full-screen takeovers and disable keyboard and mouse input to create a sense of crisis.

Chrome has always worked with Google Safe Browsing to help keep you safe online. Now, with this week's launch of Chrome 137, Chrome will offer an additional layer of protection using the on-device Gemini Nano large language model (LLM). This new feature will leverage the LLM to generate signals that will be used by Safe Browsing in order to deliver higher confidence verdicts about potentially dangerous sites like tech support scams.

Initial research using LLMs has shown that they are relatively effective at understanding and classifying the varied, complex nature of websites. As such, we believe we can leverage LLMs to help detect scams at scale and adapt to new tactics more quickly. But why on-device? Leveraging LLMs on-device allows us to see threats when users see them. We’ve found that the average malicious site exists for less than 10 minutes, so on-device protection allows us to detect and block attacks that haven't been crawled before. The on-device approach also empowers us to see threats the way users see them. Sites can render themselves differently for different users, often for legitimate purposes (e.g. to account for device differences, offer personalization, provide time-sensitive content), but sometimes for illegitimate purposes (e.g. to evade security crawlers) – as such, having visibility into how sites are presenting themselves to real users enhances our ability to assess the web.

How it works

At a high level, here's how this new layer of protection works.

Overview of how on-device LLM assistance in mitigating scams works

When a user navigates to a potentially dangerous page, specific triggers that are characteristic of tech support scams (for example, the use of the keyboard lock API) will cause Chrome to evaluate the page using the on-device Gemini Nano LLM. Chrome provides the LLM with the contents of the page that the user is on and queries it to extract security signals, such as the intent of the page. This information is then sent to Safe Browsing for a final verdict. If Safe Browsing determines that the page is likely to be a scam based on the LLM output it receives from the client, in addition to other intelligence and metadata about the site, Chrome will show a warning interstitial.

This is all done in a way that preserves performance and privacy. In addition to ensuring that the LLM is only triggered sparingly and run locally on the device, we carefully manage resource consumption by considering the number of tokens used, running the process asynchronously to avoid interrupting browser activity, and implementing throttling and quota enforcement mechanisms to limit GPU usage. LLM-summarized security signals are only sent to Safe Browsing for users who have opted-in to the Enhanced Protection mode of Safe Browsing in Chrome, giving them protection against threats Google may not have seen before. Standard Protection users will also benefit indirectly from this feature as we add newly discovered dangerous sites to blocklists.

Future considerations

The scam landscape continues to evolve, with bad actors constantly adapting their tactics. Beyond tech support scams, in the future we plan to use the capabilities described in this post to help detect other popular scam types, such as package tracking scams and unpaid toll scams. We also plan to utilize the growing power of Gemini to extract additional signals from website content, which will further enhance our detection capabilities. To protect even more users from scams, we are working on rolling out this feature to Chrome on Android later this year. And finally, we are collaborating with our research counterparts to explore solutions to potential exploits such as prompt injection in content and timing bypass.

Article URL: https://www.teamblind.com/post/ubers-shower-gate-scandal-KpqjYBkP

Comments URL: https://news.ycombinator.com/item?id=43928267

Points: 2

# Comments: 0

Article URL: https://leaddev.com/technical-direction/why-developers-and-their-bosses-disagree-over-generative-ai

Comments URL: https://news.ycombinator.com/item?id=43928265

Points: 1

# Comments: 0

Article URL: https://baransel.dev/post/days-without-habit-tracker-launch/

Comments URL: https://news.ycombinator.com/item?id=43928252

Points: 1

# Comments: 0

The Viola need to overturn a one-goal deficit as they host the La Liga side.

Themes on display at the conference reflected the cybersecurity industry's effort to streamline security operations, while adapting to emerging technologies and threats.