MurphyA/hacker-news huggingface dataset:
by cnych | 2025-04-12 14:00:01+00:00
MCP, as a bridge connecting AI models with development environments, certainly faces complex security challenges. The permission model mentioned in the article needs detailed design, requiring thorough consideration of protocol layer security, transport layer encryption, and permission boundary control. For developers looking to implement MCP, understanding existing server implementations can be very helpful. This MCP servers directory https://www.claudemcp.com/servers collects various implementation options, allowing you to compare different security models and choose an implementation that fits your specific needs. The security audit points discussed in the article are on target, but I believe we should also add dynamic filtering of model outputs and pre-execution validation. Developers need to find the balance between convenience and security, as excessive restrictions affect development experience, while loose policies may introduce security vulnerabilities.

How should we define the security interaction boundary between LLMs and development environments? This question has different best practices in various application scenarios, and is worth our continued exploration.
by consumer451 | 2025-04-12 14:00:03+00:00
Disclaimer: As it turns out, predicting the future is somewhat difficult.

However, in isolationist MAGA, the US military is just a jobs program. This is plain facts, is it not?

The other major power of the USA, post-WWII, was "soft power." That has now been cancelled. So, I am really not sure what is happening.

I once thought that "may you live in interesting times" was a blessing. I now believe that this saying is a curse.
by jeroenhd | 2025-04-12 14:00:11+00:00
You can't apply all of the hacks C programmers apply, like calling private methods, because Rust's internal ABI is different in some annoying spots.

Of course you shouldn't do that, but it's a problem rust-to-c conversion would solve.

Another reason I could think of is the desire to take something licensed in a way you don't like, written in Rust, for which you'd like to call into the private API in your production code, but don't want the legal obligations that come with modifying the source code to expose the methods the normal way.

I don't think either use case is worth the trouble, but there are theoretically some use cases where this makes sense.

It's also something I might expect someone who doesn't know much about Rust or FFIs outside of their own language might do. Not every language supports exporting methods to the C FFI, and if you're coming from one of those and looking to integrate Rust into your C you might think that translation is the only way to do it.

Most likely, it's a way rust haters can use rust code without feeling like the "other side" has won.
by jononor | 2025-04-12 14:00:13+00:00
At least having good integrated support in the package manager for an allow-list of packages would be good. Then one could maintain such lists in a company or project. And we could have community efforts to develop shared curated lists that could be starting points. If that really catches on, one could consider designating one of them as a default.

Might also want to support multiple allow lists, so one can add to a standard list in a project (after review). And also deny, so one can remove a few without exiting completely from common lists.
by gavinhoward | 2025-04-12 14:00:17+00:00
Copyright reserves most rights to the author by default. And copyright laws thought about future changes.

Copyright laws (in the US) added fair use, which has four tests. Not all of the tests need to fail for fair use to disappear. Usually two are enough.

The one courts love the most is if the copy is used to create something commercial that competes with the original work.

From near the top of the article:

> I agree that the dynamic of corporations making for-profit tools using previously published material to directly compete with the original authors, especially when that work was published freely, is “bad.”

So essentially, the author admits that AI fails this test.

Thus, if authors can show the AI fails another test (and AI usually fails the substantive difference test), AI is copyright infringement. Period.

The fact that the article gives up that point so early makes me feel I would be wasting time reading more, but I will still do it.

Edit: still reading, but the author talks about enumerated rights. Most lawsuits target the distribution of model outputs because that is reproduction, an enumerated right.

Edit 2: the author talks about sunstantive differences, admits they happen aboit 2% of the time, but then seems to argue that means they are not infringing at all. No, they are infringing in those instances.

Edit 3: the author claims that model users are the infringing ones, but at least one AI company (Microsoft?) had agreed to indemnify users, so plaintiffs have full right to go after the company instead.
by earthnail | 2025-04-12 14:01:37+00:00
That was actually the case in music until a decade ago or so. Led to ridiculous lawsuits (for example Ed Sheeran’s).

Previously, artists needed to prove they hadn’t heard the song that they were accused of infringing. That was virtually possible because there’s a lot of music you could hear anywhere, even just a car driving by. Artists continuously lost these court cases.

Nowadays the burden of proof is luckily no longer on the defendant. But I think that only changed a decade ago or so, thanks to some efforts by music industry lawyer Damien Riehl. I know, ridiculous.
by metadat | 2025-04-12 14:01:45+00:00
It's cool the source code really is open and available:

https://github.com/VERT-sh/VERT

AGPL licensed, which seems perfect for this kind of product:

The AGPL (Affero General Public License) is a type of free software license developed by the Free Software Foundation. It is similar to the GPL (General Public License) but with one key difference:

Network Use Clause: If you modify AGPL-licensed software and use it over a network (like a web app or API), you must also release your source code to the users who interact with it.

In other words, with GPL, you have to share your code only when you distribute the software. With AGPL, you have to share your code even if users are just accessing it over the internet (like using a SaaS product). AGPL was created to close the "SaaS loophole" in the GPL.

Further reading: https://opensource.stackexchange.com/questions/7578/what-are...
by nolok | 2025-04-12 14:01:47+00:00
When talking about fundamental rights (like say, the freedom of speech or the freedom of religion or ...), I don't understand the thinking that only some people should have them based on some legal criteria. I'm talking out of my ass here but it feels like the kind of legacy that is carried by having stuff like slavery and the like where humans were not equals.

I guess this is why in France we call those fundamental rights human rights and not citizens rights.

My point being: I don't see how the difference you give provides anything other that than the ability to abuse some groups, I don't see any advantage from it.
by re-thc | 2025-04-12 14:02:10+00:00
> not Singapore or Australia

These only have 10% reciprocal tariffs applied so I used it as the example. Paying 10% is a lot easier than dealing with the Canada and Mexico deal, which is more likely to change.

> It is unclear how removing U.S. components from products would reduce U.S. tariffs.

US components need to pay tariffs since the US cannot produce that component whole in the US completely. Removing them makes it cheaper.

> it is clear to me that China is losing in such a scenario, since they cannot tariff the non-Chinese components anymore

Why do they want that? Who wants tariffs? Every economist says that random use of tariffs has an adverse impact.

China hasn't been paying tariffs to the US either. Most proper engagements have been re-routing. Only US small businesses suffer (since re-routing is harder for small businesses).
by aredox | 2025-04-12 14:02:21+00:00
>On your second point, undocumented immigrants also count in the census

Except immigrants choose where they want to live.

The prisoners are where they are because the party in power (usually Republican, borderline neo-Confederate) creates laws that lead to extensive incarceration (such as "three strikes") and is the one which decides where to build prisons, which results in biased elections in their favor. Which reeks of the pre-civil war rules that slaves count for political weight.
by Retr0id | 2025-04-12 14:02:49+00:00
There clearly is a point when a compressed jpeg becomes a transformation, even if the precise point is ambiguous.

Take 'The Bee Movie at 3000% speed except when they say "bee"', for example - https://www.youtube.com/watch?v=7apltfVJBwU. It hasn't been taken down for over 5 years so I'm going to assume it's considered acceptable/transformational use.

Personally, I'd say what matters is whether you'd plausibly use the transformed/compressed version as a drop-in substitute for the original. ChatGPT can probably reproduce the complete works of shakespeare verbatim if prompted appropriately, but is anyone seriously going to read it that way?
by aqme28 | 2025-04-12 14:03:21+00:00
I disagree. The game is not meant to be played looking for one specific item/room. It drip-feeds you clues and progress. Every run pretty much I get something that helps. If you’re beelining for just one thing it doesn’t really work.

Also, for your example, I think you missed that you get a major permanent bonus when you got the room after using the other room.
by microtherion | 2025-04-12 14:04:12+00:00
It's true that niches have their jargon, but I tend to be suspicious when the jargon makes its way into marketing pitches.

It's one thing if your software vendor writes the software in Haskell, but if their pitch to you is that the software has 40 patent protected monads and is entirely dotless and lambda lifted, you're probably being taken for a ride.
by dijksterhuis | 2025-04-12 14:04:20+00:00
from my comment

> at the same time, i could totally see myself scanning through a README and going “yep, sounds like what i need” and making the same mistake (i need other people checking my work too).

yes, us humans have similar issues to the magic black box. i’m not arguing humans are perfect.

this is why we have human code review, tests, staging environments etc. in the release cycle. especially so in safety/security critical contexts. plus warnings from things like register articles/CVEs to keep track of.

like i said. don’t blindly trust the untrusted output (code) of these things — always verify it. like making sure your dependencies aren’t actually crypto miners. we should be doing that normally. but some people still seem to believe the hype about these “magic black box oracles”.

the whole “agentic”/mcp/vibe-coding pattern sounds completely fucking nightmare-ish to me as it reeks of “blindly trust everything LLM throws at you despite what we’ve learned in the last 20 years of software development”.
by junto | 2025-04-12 14:04:35+00:00
This is a spot on analysis. Bluesky and Mastodon are full of people that felt and continue to feel disenfranchised and excluded. They embraced Bluesky because it reminded them of what Twitter used to be and had found themselves what they felt was a relatively safe space.

Companies like Adobe and other major tech players have enabled the hostile environment we see growing every day. It’s no wonder that disingenuous posts like this from predatory companies receive such a backlash.
by numpad0 | 2025-04-12 14:04:52+00:00
To build tokenizers that use hashed identifiers rather than identifiers as plain English?

e.g, "NullPointerException" can be a single kanji. Current LLM processes it like "N, "ull", "P", "oint", er", "Excep", "tion". This lets them make up "PullDrawerException", which is only useful outside code.

That kind of creativity is not useful in code, in which identifiers are just friendly names for pointer addresses.

I guess real question is how much business sense such a solution would make. "S in $buzzword stands for security" kind of thing.
by omneity | 2025-04-12 14:05:29+00:00
We are actually solving this problem by building the Huggingface Hub[0] for browser automations -automatically tested and updated around the clock, and a homegrown distributed automation framework [1] that can leverage your own browser, your community’s or your team’s up to millions of orchestrated browsers.

It’s not just for AI, we created a custom package format[2] for automations that can run in CLI as a one-off, a REST API server, an MCP server with a single command..

0: https://herd.garden/trails

1: https://herd.garden

2: https://herd.garden/docs/trails-automations
by freen | 2025-04-12 14:06:48+00:00
He has refused his Assent to Laws, the most wholesome and necessary for the public good.

He has made Judges dependent on his Will alone, for the tenure of their offices, and the amount and payment of their salaries.

He has erected a multitude of New Offices, and sent hither swarms of Officers to harrass our people, and eat out their substance.

For cutting off our Trade with all parts of the world:

For imposing Taxes on us without our Consent:

For depriving us in many cases, of the benefits of Trial by Jury.

For transporting us beyond Seas to be tried for pretended offences.
by bdw5204 | 2025-04-12 14:06:50+00:00
This is just another reason why dependencies are an anti-pattern. If you do nothing, your software shouldn't change.

I suspect that this style of development became popular in the first place because the LGPL has different copyright implications based on whether code is statically or dynamically linked. Corporations don't want to be forced to GPL their code so a system that outsources libraries to random web sites solves a legal problem for them.

But it creates many worse problems because it involves linking your code to code that you didn't write and don't control. This upstream code can be changed in a breaking way or even turned into malware at any time but using these dependencies means you are trusting that such things won't happen.

Modern dependency based software will never "just work" decades from now like all of that COBOL code from the 1960s that infamously still runs government and bank computer systems on the backend. Which is probably a major reason why they won't just rewrite the COBOL code.

You could say as a counterargument that operating systems often include breaking changes as well. Which is true but you don't update your operating system on a regular basis. And the most popular operating system (Windows) is probably the most popular because Microsoft historically has prioritized backward compatibility even to the extreme point of including special code in Windows 95 to make sure it didn't break popular games like SimCity that relied on OS bugs from Windows 3.1 and MS-DOS[0].

[0]: https://www.joelonsoftware.com/2000/05/24/strategy-letter-ii...
by Xiali | 2025-04-12 14:07:12+00:00
Through its carefully designed three-dimensional consistency architecture, SeaTunnel successfully solves the critical data consistency issues in enterprise-level data synchronization. This design supports both high-throughput batch data processing and ensures precision in real-time incremental synchronization, providing a solid foundation for enterprise data architecture.

SeaTunnel's consistency guarantee philosophy can be summarized as:

End-to-end Consistency: Full-chain guarantee from data reading to writing Failure Recovery Capability: Able to recover and continue synchronization even under extreme conditions Flexible Consistency Levels: Choose appropriate consistency strength based on business requirements Verifiable Consistency: Verify data integrity through multiple mechanisms These features make SeaTunnel an ideal choice for building enterprise-level data integration platforms, capable of handling data synchronization challenges from TB to PB scale while ensuring enterprise data integrity and accuracy.
by josephg | 2025-04-12 14:07:34+00:00
Also let’s not forget that windows 11 puts random news stories in the start menu. Here in Australia, a lot of them are clickbaity scams. I really can’t believe Microsoft is endorsing whatever horrible choice of news provider they’ve teamed up with. It really spoils their brand image.

There’s a way to remove it, of course, by running some obtuse console command. But normal people have no idea how to do stuff like that.
by jeroenhd | 2025-04-12 14:07:53+00:00
Tools like those exist. The problem with them is that they use unsafe blocks a lot, and the code usually isn't very idiomatic. Translating global variable state machines into more idiomatic Rust state machines based on things like named enums, for instance, would be very difficult.

With the help of powerful enough AI we might be able to get a tool like this, but as AI still very much sucks at actually doing what it's supposed to do, I don't think we're quite ready yet. I imagine you'd also need enough memory to keep the entire C and Rust code base inside of your context window, which would quickly require very expensive hardware once your code grows beyond a certain threshold. If you don't, you end up like many code assisting LLMs, generating code independently that's incompatible with itself.

Still, if you're looking to take a C project and extend it in Rust, or perhaps slowly rewrite it piece by piece, https://c2rust.com/ is ready for action.
by olalonde | 2025-04-12 14:08:08+00:00
Do you think Sam will follow through with this?

> Therefore, if a value-aligned, safety-conscious project comes close to building AGI before we do, we commit to stop competing with and start assisting this project. We will work out specifics in case-by-case agreements, but a typical triggering condition might be “a better-than-even chance of success in the next two years.”
by ToValueFunfetti | 2025-04-12 14:08:22+00:00
Calling congresspeople critters (or swamp people, reptiles, snakes, clowns, vermin, etc) is not a lurch towards fascism; it's the status quo. Dehumanizing congress has been a national pastime since congress started getting dysfunctional in the late 20th century. "Congresscritter" has been part of the vernacular since at least the 70s (https://en.wiktionary.org/wiki/congresscritter)
by staunton | 2025-04-12 14:09:25+00:00
> while random non-certified letters are, apparently

They kind of are. Somebody would have to go and steal the physical letter and then read/scan it to make any use of it. That excludes pretty much all attacks on the process --- at least such where criminals might hope to make a larger profit than most other criminal enterprises available to them.

Whether that makes the letters a good idea is a different discussion...
Fall Detection, Suspiciously Only Available on Pricey Smartwatches
by xchip | 2025-04-12 14:10:14+00:00
Fall detection could be a lifesaver for our aging parents.

Smartwatches already have the sensors to detect activities like running, cycling, and swimming. Yet, detecting falls is somehow deemed too challenging—and only shows up in expensive models.

Are smartwatch brands truly competing against each other, or just holding back features to push high-end sales?
by re-thc | 2025-04-12 14:10:58+00:00
> they took a lot of music and used that to create algorithms that are effective for reproducing real-world music using less data

That's redefining history. MP3 didn't evolve like this. There was a series of studies, experiments etc and it took many steps to get there.

MP3 was not created by dumping music somewhere to get back an algorithm.

> I think a reasonable route is that models shouldn't be copyrightable/patentable themselves

Why? Why can't they just pay. AI companies have the highest valuation and so have the most $$$ and yet they can't pay? This is the equivalent of the rich claiming they are poor and then stealing from the poor.
by manapause | 2025-04-12 14:10:58+00:00
My first job out of college I was hired to follow around an MSP/IT consultant and learn what he did, specifically to cut the expense of having a MCSA/network engineer coming in weekly for basic desktop support.

I met him in the server closet and asked “hey, I’m new here - do you mind if I look over your shoulder?” He turned around and smiled, “if you are here to help, then you should sit down and I’ll walk you through setting up Exchange mailboxes for these doctors.” Before he left, he walked me through a RAM upgrade and gave me his lucky red screwdriver “ you got this, just call me if you have any issues.”

Later in my career, I continue to learn lessons from this interaction; lately the lesson has been one of “don’t be awesome in a vacuum” - a little bit of encouragement to the new guy can go a long way to adding another person to your on-call rotation that you trust.

20 years later, I still have his screwdriver - and I bring it every time we have lunch every once in a while.

Life is too short to not let the people who make life enjoyable for us know so.
by Aurornis | 2025-04-12 14:11:05+00:00
> If the code is there I assume it is running.

This is such a bizarre and dishonest mindset.

Windows also has code to allow automatic login without a password. Do you assume because the feature exists, it’s going to be enabled after an OS update?

What about the code to enable remote access for support purposes? That exists for a while, but people aren’t freaking out about it existing.
by bloppe | 2025-04-12 14:12:01+00:00
Yaml is a sad Icarus parable. The syntax is great but the type inference is too much. I don't see why we have to throw the baby out with the bathwater and settle for toml, though.

Here's how yaml's type inference should work:

- All object keys are strings (with or without quotes)

- Value atoms are parsed the exact same way as in JSON5

I'm kinda shocked this isn't a thing. StrictYAML is cool but a bit too cumbersome IMO.
by trealira | 2025-04-12 14:13:03+00:00
For debugging purposes, there's Debug.Trace, which does IO and subverts the type system to do so.

But with Haskell, I tend to do less debugging anyway, and more time getting the types right to with; when there's a function that doesn't work but still type checks, I feed it different inputs in GHCi and reread the code until I figure out why, and this is easy because almost all functions are pure and have no side effects and no reliance on global state. This is probably a sign that I don't write enough tests from the start, so I end up doing it like this.

But, I agree that doing things in a pure functional manner like this can make Haskell feel clunkier to program, even as other things feel easier and more graceful. Logging is one of those things where you wonder if the juice is worth the squeeze when it comes to doing everything in a pure functional way. Like I said, I haven't used it in a long time, and it's partly because of stuff like this, and partly because there's usually a language with a better set of libraries for the task.
by SilasX | 2025-04-12 14:13:38+00:00
I agree that you should call the output copyright infringement (or not) without regard to how you got there. So, if it produces an identical copy of the text, or of e.g. Indiana Jones, that you then distribute it, sure, that is copyright infringement.

But the mere act of using them for training and producing new works shouldn't be! In fact, until 2022, pretty much no one regarded it as a copyright violation to "learn from copyrighted works to create new ones" -- just the opposite! That's how it's supposed to work!

Only when hated corporations did it with bots, did the internet hive mind suddenly decide that's stealing, and take this expansive view of IP rights (while, of course, having historically screamed bloody murder about any attempts to fight piracy).