Replying to my own post to note that the author of the app in my linked post is using an LLM to respond to everyone in the thread. They responded to me (with a clearly LLM written, sycophantic tone) and said that they updated the design. It looks less like the parody site now.
I've legitimately seen one project that basically says to do that, but with "your ai agent". At least piping to sh is deterministic and, you can pipe to a filw and check the script
you can detect `curl | bash` server-side and serve a different payload for those (compared to curl -O file, wget etc), hence its an effectively undetectable attack vector.
Executables on the other hand can be inspected and prodded, so the likelihood of something going amiss and consequently security agencies finding out about it is significantly higher.
neither of those is secure of course, we're just discussing different levels of dangers. And curl|bash being worse, albeit not that much
(and the -L here is the extra cherry on top. piping a redirect to a shell is just monkas)
at that point, i'd put bash script up as being moderately more secure as its generally easier to audit them vs a binary.
but i'Ve also gotta say that random binary download over web is also incredibly rare - usually its either a combination of both (the curl|bash ending in a random binary being downloaded) or the user actually installing via a packagemanager like apt, zypper, yum, dnf etc - and those packagemanagers generally do audit the main repositories, so theyre basically as secure as you can get in those contexts.
but of course, everyone has their own thread model and i dont work in security (●'◡'●)
That is adding a year to the end of the complete title of the article, which is a thing often added to older articles to provide additional context. This is replacing words in the article's title with different words, which, as I said, is counter to the stated rules of the site.
If the title was "Every fucking website: Slop edition (2026)," I wouldn't have made my comment.
This is almost exactly this website [0] which is also on the frontpage of HN. Wow.
0: https://news.ycombinator.com/item?id=49297469
And this one, which is on the front page right now:
https://news.ycombinator.com/item?id=49307700
Replying to my own post to note that the author of the app in my linked post is using an LLM to respond to everyone in the thread. They responded to me (with a clearly LLM written, sycophantic tone) and said that they updated the design. It looks less like the parody site now.
I was searching for the logo like an *-hole, but I had to settle for their "men's public restroom" logo instead.
It's not a Claude generated website without at least one `backdrop-filter: blur(1000px)` element that slows older machines to a crawl
Needs a cookie banner, 3s delayed sign up to our newsletter and enable push request
It is missing the fade in on scroll.
This needs bluish dark mode with accent color and pills with a little rounded colored border on just the left side.
It's missing the captcha that fails to load and then makes you retry three times.
Love the X logo that goes to bluesky
> Trusted by... six companies from the same YC cohort.
I giggled.
Missing a flashy nonsense ASCII art animation. Check out https://performative-ui.cncl.co/ if you need an easy one to add.
> $ curl -fsSL install.sh | sh # you'd be stupid to run that, slop or not
I wish more people would point this out.
I've legitimately seen one project that basically says to do that, but with "your ai agent". At least piping to sh is deterministic and, you can pipe to a filw and check the script
https://github.com/0xeb/ghidrasql
"Claude, install these 215 npm dependencies from unvetted repositores, make no mistakes"
I still haven’t seen anyone point out how this is more dangerous than running an executable that you obtain any other way.
you can detect `curl | bash` server-side and serve a different payload for those (compared to curl -O file, wget etc), hence its an effectively undetectable attack vector.
Executables on the other hand can be inspected and prodded, so the likelihood of something going amiss and consequently security agencies finding out about it is significantly higher.
neither of those is secure of course, we're just discussing different levels of dangers. And curl|bash being worse, albeit not that much
(and the -L here is the extra cherry on top. piping a redirect to a shell is just monkas)
> you can detect `curl | bash` server-side
Oh wow, ok. So if anything, manually do `curl` and `sh` separately?
at that point, i'd put bash script up as being moderately more secure as its generally easier to audit them vs a binary.
but i'Ve also gotta say that random binary download over web is also incredibly rare - usually its either a combination of both (the curl|bash ending in a random binary being downloaded) or the user actually installing via a packagemanager like apt, zypper, yum, dnf etc - and those packagemanagers generally do audit the main repositories, so theyre basically as secure as you can get in those contexts.
but of course, everyone has their own thread model and i dont work in security (●'◡'●)
Because this way does not run security scanners.
The fact that I can see it with JS disabled really breaks immersion here.
I expected cloudflare turnstile and if that happens to work, flashing gray bars to "compensate" for an absurdly long loading time.
The GitHub and X logos are chefs kiss
Why does the HN title say “2026 edition” when the page itself says “Slop edition”? We aren’t supposed to editorialize titles here.[0]
https://news.ycombinator.com/newsguidelines.html
Because there's been a recent submission titled "Every fucking website (2020)", I guess.
That is adding a year to the end of the complete title of the article, which is a thing often added to older articles to provide additional context. This is replacing words in the article's title with different words, which, as I said, is counter to the stated rules of the site.
If the title was "Every fucking website: Slop edition (2026)," I wouldn't have made my comment.
It can't be AI-generated - AI doesn't swear
This is one of my favorite things I've ever seen.
If the layout is intentionally LLM generated, heh.
What is wrong with this layout?
There's nothing wrong with it, per se. It's just that it's overused and filled with random garbage stats that no one cares about.
* <- tiny logo
oh yeah I worked there