MurphyA/hacker-news huggingface dataset:
by w10-1 | 2025-04-16 18:56:42+00:00
> This is just getting to be a bit much, seems like they are > trying to cover for the fact that they haven't actually done much

Or perhaps they're trying to make some important customers happy by showing movement on areas the customers care about. Subjectively, customers get locked in by feeling they have the inside track, and these small tweaks prove that. Objectively, the small change might make a real difference to the customer's use case.

Similarly, it's important to force development teams to actually ship, and shipping more frequently reduces risk, so this could reflect internal discipline.

As for media buzz, OpenAI is probably trying to tamp that down; they have plenty of first-mover advantage. More puffery just makes their competitors seem more important, and the risk to their reputation of a flop is a lot larger than the reward of the next increment.

As for "a bit much", before 2023 I was thinking I could meaningfully track progress and trade-off's in selecting tech, but now the cat is not only out of the bag, it's had more litters than I can count. So, yeah - a bit much!
by duxup | 2025-04-16 18:56:43+00:00
Congress is in the midst of a break but with budget talks ongoing among the GOP. They're busy trying to pass vague bills, one from the senate, one from the house that so far have been incompatible even as far as just the GOP is concerned.

I suspect this might be a sort of silly proposed rallying point for them to agree on and maybe move forward ... and they might think this provides some level of credibility to the executive branch who has been busy cutting unilaterally, arguably unconstitutionally.
by cjs_ac | 2025-04-16 18:57:16+00:00
Royal Armouries Ms. I.33[0] was also used for colouring practice by children, e.g., in folii 2r - 8v as shown on Wiktenauer[1].

[0] https://en.wikipedia.org/wiki/Royal_Armouries_Ms._I.33

[1] https://wiktenauer.com/wiki/Walpurgis_Fechtbuch_(MS_I.33)
by burntsushi | 2025-04-16 18:57:55+00:00
He also posts threads on reddit and then deletes everything:

https://old.reddit.com/r/programming/comments/1jra9y0/introd...

https://old.reddit.com/r/programming/comments/1jpk8sw/krep_a...

https://old.reddit.com/r/commandline/comments/1jqhssc/krep_b...
by ygjb | 2025-04-16 18:58:09+00:00
This illustrates a misunderstanding of how CVE functions. It's a repository of data about disclosed vulnerabilities (even if some disclosures are embargoed and not yet published - if anyone but the bughunter and dev team that owns the fix knows about it, it's disclosed :P). The actual vulnerability discovery process is external and done by individual researchers, teams and businesses who report vulnerabilities to the appropriate groups called CVE numbering authorities (CNA) who manage the assignment and publication of CVE data through their scopes. There is not much technical advantage in terms of advance disclosure since the CNA controls what data goes to CVE.

As an example, a CNA like Mozilla, Apple, or Microsoft is unlikely to disclose vulnerability data via CVE until they have remediated the issue or have public guidance, and their embargo processes are likely separate from CVE publication.
by JimBlackwood | 2025-04-16 18:58:15+00:00
> My dad still calls my terminals a "DOS window" and doesn't understand why I don't use GUIs like a normal person. He has his own business. He absolutely cannot just roll out a CA for secure comms with his local printer or whatever. He literally calls me to help with buying a PDF reader

This is fair. I assumed all small businesses would be tech startups, haha.
by lucb1e | 2025-04-16 18:58:18+00:00
> 47 [is?] arbitrary, but 1 month, + 1/2 month, + 1 day are not arbitrary values...

Not related to certificates specifically, and the specific number of days is in no way a security risk, but it reminded me of NUMS generators. If you find this annoyingly arbitrary, you may also enjoy: <https://github.com/veorq/numsgen>. It implements this concept:

> [let's say] one every billion values allows for a backdoor. Then, I may define my constant to be H(x) for some deterministic PRNG H and a seed value x. Then I proceed to enumerate "plausible" seed values x until I find one which implies a backdoorable constant. I can begin by trying out all Bible verses, excerpts of Shakespeare works, historical dates, names of people and places... because for all of them I can build a story which will make the seed value look innocuous

From http://crypto.stackexchange.com/questions/16364/why-do-nothi...
by daveguy | 2025-04-16 18:58:37+00:00
Have any of the models been deprecated? It seems like a deprecation plan and definition of timelines would be extraordinarily helpful.

I have not seen any sort of "If you're using X.122, upgrade to X.123, before 202X. If you're using X.120, upgrade to anything before April 2026, because the model will no longer be available on that date." ... Like all operating systems and hardware manufacturers have been doing for decades.

Side note, it's amusing that stable behavior is only available on a particular model with a sufficiently low temperature setting. As near-AGI shouldn't these models be smart enough to maintain consistency or improvement from version to version?
by Imustaskforhelp | 2025-04-16 18:58:48+00:00
Why do I feel so specifically targeted by this.

Though maybe I am of the philosophy of prototyping as I like to code for problems that I am facing right now in real life and wish like damn... wish someone could build something cool & though I use AI quite hard. Its actually because I am currently in school and I just don't have the time to code but I face some issues which I genuinely feel need to be solved right now. (Maybe even as just a proof of concept) so that I can later write good readable code later on when I go into university.
by dhorthy | 2025-04-16 18:58:58+00:00
THIS so much. People are like "why human supervision when we can have agent supervsion" and always respond

> look if you don't trust the LLM to make the thing right in the first place, how are you gonna PROBABLY THE SAME LLM to fix it?

yes I know multiple passes improves performance, but it doesn't guarantee anything. for a lot of tool you might wanna call, 90% or even 99% accuracy isn't enough
by taylodl | 2025-04-16 18:59:15+00:00
Ireland has its advantages, such as a favorable tax environment, supportive government initiatives, and being part of the EU, but being on the continent allows for better alignment with neighboring countries like Germany, Belgium, and France, providing easier collaboration and market penetration. Continental Europe has a higher concentration of cities with strong educational institutions and tech hubs, making it easier to attract and retain top talent.

This Irish American would recommend going Dutch! :)
by ty6853 | 2025-04-16 18:59:34+00:00
If you look at real life reality though -- the argument for stuff like public schooling almost always a dominating piece is "we will educate the kids so society can get a good ROI." That not only the kids are better off, but the people around them will be too. Sure it's nice that the kid gets something out of it, but public schooling would not get as much support as it does were it not for what society gets out of it.

Society never actually holds themselves to the moral standards they demand upon parents. But people are people, people respond to incentives, and individual parents are no different than society in this regard. The position now, and the mass rejection of parenthood, I think in part reflects the outcome of this hypocrisy and doublespeak.
by cryptoz | 2025-04-16 18:59:47+00:00
I've taken to pasting in the latest OpenAI API docs for their python library to each prompt (via API, I'm not pasting each time manually in ChatGPT) so that the AI can write code that uses itself! Like, I get it, the training data thing is hard, but - OpenAI changed their python library with breaking changes and their models largely still do not know about it! I haven't tried 4.1- series yet with their newer cutoff, but, the rest of the models like o3-mini (and I presume these new ones today) still write openai python library code in the old, broken style. Argh.
by dhorthy | 2025-04-16 19:00:03+00:00
i try not to take a hard stance on any tool or framework - the idea is take control of the building blocks, and you can still bring most of the cool LLM ops / LLM observability techniques to bear.

I could see one of the twelve factors being around observability beyond just "whats the context" - that may be a good thing to incorporate for version 1.1
by mcpherrinm | 2025-04-16 19:00:19+00:00
I'm on the team at Let's Encrypt that runs our CA, and would say I've spent a lot of time thinking about the tradeoffs here.

Let's Encrypt has always self-imposed a 90 day limit, though of course with this ballot passing we will now have to reduce that under 47 days in the future.

Shorter lifetimes have several advantages:

1. Reduced pressure on the revocation system. For example, if a domain changes hands, then any previous certificates spend less time in the revoked state. That makes CRLs smaller, a win for everyone involved.

2. Reduced risk for certificates which aren't revoked but should have been, perhaps because a domain holder didn't know that a previous holder of that domain had it, or an attack of any sort that led to a certificate being issued that wasn't desired.

3. For fully short-lived certs (under 7 days), many user-agents don't do revocation checks at all, because that's a similar timeline to our existing revocation technology taking effect. This is a performance win for websites/user-agents. While we advocate for full certificate automation, I recognize there are cases where that's not so easy, and doing a monthly renewal may be much more tractable.

Going to shorter than a few days is a reliability and scale risk. One of the biggest issues with scale today is that Certificate Transparency logs, while providing great visibility into what certs exist (see points 1 and 2), will have to scale up significantly as lifetimes are cut.

Why is this happening now, though? I can't speak for everyone, and this is only my own opinion on what I'm observing, but: One big industry problem that's been going on for the last year or two is that CAs have found themselves in situations where they need to revoke certificates because of issues with those certificates, but customers aren't able to respond on an appropriate timeline. So the big motivation for a lot of the parties here is to get these timelines down and really prove a push towards automation.
by notengoemail | 2025-04-16 19:01:38+00:00
Vulnerability database is a great example of something that should be IMO democratized, blockchain-based or otherwise, and never allowed to be politized/militarized/weaponized, as in the end, there's vast potential for ordinary citizens to suffer if it ever happened.

The opportunity is there not only for the EU, but pretty much anyone who demonstrates good will/intent. I hope we end up with a consensus on something that won't be abusable by individual countries
by peterldowns | 2025-04-16 19:01:43+00:00
TL;DR the article concludes that the only real viable way to training frontier models as your primary business is to provide agents built on top of them — everything else is a race to the bottom as tokens and intelligence become commoditized.

I'm curious what secret sauce the author thinks is going on with agentic development flows where one of these labs is going to be capable of delivering significantly better agents than their competitors. As I understand it, agents are prompts with control structures and memory. I guess that's the opportunity — come up with something gigabrain? As in literally AGI?

And somehow make the models good enough and accessible enough through your agentic workflows that your API clients don't compete with you by offering similar functionality?
by zelon88 | 2025-04-16 19:01:51+00:00
> These results come from our field telemetry, which represent real-world web usage on all types of hardware and websites.

I wonder what the speedup would be without field telemetry. Also what is the electrical consumption for all the telemetry-related packets hopping around the internet? What would the speedup be like for the internet itself if we stopped using telemetry on everything.
by iandanforth | 2025-04-16 19:01:56+00:00
o3 failed the first test I gave it. I wanted it to create a bar chart using Python of the first 10 Fibonacci numbers (did this easily), and then use that image as input to generate an info-graphic of the chart with an animal theme. It failed in two ways. It didn't have access to the visual output from python and, when I gave it a screenshot of that output, it failed in standard GenAI fashion by having poor / incomplete text and not adhering exactly to bar heights, which were critical in this case.

So one failure that could be resolved with better integration on the back end and then an open problem with image generation in general.
by donnachangstein | 2025-04-16 19:02:48+00:00
> Our internally provided certs of various CAs have a TTL of 72 hours and should be renewed every 48 hours.

Do you promise to come back and tell us the story about when someone went on vacation and the certs issued on a Thursday didn't renew over the weekend and come Monday everything broke and no one could authenticate or get into the building?
by pixl97 | 2025-04-16 19:02:59+00:00
So I asked GPT-o4-mini-high

"On what date will the new moon occur on in August 2025. Use a tool to verify the date if needed"

It correctly reasoned it did not have exact dates due to its cutoff and did a lookup.

"The new moon in August 2025 falls on Friday, August 22, 2025"

Now, I did not specify the timezone I was in so our timing between 22 and 23 appears to be just a time zone difference at it had marked an time of 23:06 PDT per its source.
by mindcrime | 2025-04-16 19:03:18+00:00
Not the person you asked, but I've gone down this rabbit hole recently and can maybe add something. First, let me say that I don't find much value in the stdio transport stuff and really only care about the http/sse side.

Given that, I found that the docs at modelcontextprotocol.org are somewhat lacking. They seem to assume that you want to use stdio and don't have much meat on setting up sse.

The good news is, the official Python SDK repo has examples of both scenarios. Between the actual "example servers" in the examples/ dir[1], and comments sprinkled around some of the various module files[2][3] themselves, everything you need to write an sse based server/client pair (in Python at least) is there. Note that most of what I just said is true mainly if you want to use the lowlevel / "vanilla" SDK. Using FastMCP makes things a lot simpler and faster.

If you're interested, I keep a repo with some of my experiments and samples as I'm learning this stuff. Feel free to poke around there and see if any of those examples help:

https://github.com/mindcrime/MCPSandbox

I've got FastMCP and "vanilla SDK" examples of sse server/client pairs, and a stdio based example mostly cribbed from the "quickstart guide".

My next step is going to be to start working with the Java SDK, so some Java samples will probably show up there soon'ish.

[1]: https://github.com/modelcontextprotocol/python-sdk/tree/main...

[2]: https://github.com/modelcontextprotocol/python-sdk/blob/main...

[3]: https://github.com/modelcontextprotocol/python-sdk/blob/main...
by mgdev | 2025-04-16 19:03:28+00:00
I've had a really terrible experience with codex so far.

It tries to code by issuing patches.

The problem is the patches are always wrong, so they never apply.

It just spins and spins and spins and spins...

AND you have to press 'y' for every. single. little. diff.

Patch fails. Missing the right directory structure. Create the directory. Approve the patch again. Maybe it succeeds. Next tile. Approve patch. Patch fails. Missing the right directory structure. Create the directory. Approve the patch again.

Again.

Again.
by procaryote | 2025-04-16 19:03:30+00:00
If this is causing you pain, certbot with Acme DNS challenge is pretty easy to set up to get you certs for your internal services. There are tools for many different dns providers like route53 or cloudflare.

I tend to have secondary scripts that checks if the cert in certbots dir is newer than whatever is installed for a service, and if so install it. Some services prefer the cert in certain formats, some services want to be reloaded to pick up a new cert etc, so I put that glue in my own script and run it from cron or a systemd timer.
by Avamander | 2025-04-16 19:03:32+00:00
> Can someone point me to specific exploits that this key rotation schedule would have stopped?

It's not only key mismanagement that is being mitigated. You also have to prove more frequently that you have control of the domain or IP in the certificate.

In essence it brings a working method of revocation to WebPKI.

> but not low enough to prevent significant numbers of people from being compromised if there is a compromised key.

Compared to a year?
by MetaWhirledPeas | 2025-04-16 19:03:47+00:00
> A factory worker making cutlery or light bulbs will generate less money for the economy than the average Costco employee.

The good news is that we don't need to calculate the value of an employee, because the market itself makes it loud and clear: wages. The higher the wages, the higher the value. In any sane company, the less valuable an individual is to the bottom line, the less they get paid.

So then, if the wages of a factory job start to eclipse that of other fields, that's all the evidence we need of higher productivity/value/whatever-you-want-to-call-it.
by celsoazevedo | 2025-04-16 19:03:52+00:00
Just my personal experience, but I've recently upgraded from a MBP with the M1 Max to a new MBP with the M4 Max and it does get hotter when doing heavy tasks (eg: video transcoding). It gets to 95-100ºC faster, uses more power, and the default fan curve is also more aggressive, something that Apple usually avoids doing.

It's still very efficient and doesn't run hot under normal load (right now my CPU average is 38ºC with Firefox and ~15 tabs open, fans not spinning), but it definitely generates more heat than the M1 Max under load. Apple still seems to limit them to ~100ºC though.
by NoMoreNicksLeft | 2025-04-16 19:03:53+00:00
>Hacker News is superior by almost every metric.

In the most narrow of topics, it's semi-superior... and because of bizarre circumstances that aren't easily replicated. We can't do politics here (though that erodes every day, looks like), which keeps the worst shit-shows out of here, but anywhere else that wouldn't ever happen. dang is some sort of minor saint, had this been reddit that would have morphed into "we can't do politics except those I like".

Even in that one topic (tech, software, engineering) we still have these bizarre status quo opinions that you dare not buck.

>Reddit was also way better than 4chan for serious discussion in the years before Trump was elected.

Sure, for a brief period as the reddit population was ramping up, but before ever slack-jawed imbecile showed up thinking it was the new Facebook, it was pretty good. But that was earlier than 2016. Might have to go back to 2012ish. Pre-2010 even.

>The model works as long as the managers are not incompetent.

...

>Federated networks might be the solution here.

Doubtful. Then instead of bans, it's just a bunch of weirdo tiny forums that have all de-federated from each other. Have you checked out Lemmy? The first and biggest instance was a bunch of Stalin-esque commies who camped out on it with the intent of dominating the entire system. See, with reddit, no one quite understood that it might become big, and so no one was eyeing it with the intent od a landgrab. But once it failed, everyone was on the lookout for the next-big-thing, and if there was even a chance of it they set up shop. No technical solution can exist to fix that sort of a problem.
by WalterBright | 2025-04-16 19:04:30+00:00
> Performs for whom?

In the 19th century, the free market resulted in bootstrapping scores of millions of people up out of poverty into the middle class and beyond. The government was not involved in this.

> We have countless examples of innovations that have come through government intervention

We have far more from the free market. Have you ever looked at the number of patents?

As for the internet, that was simply a protocol. There were many other network protocols - Prodigy, RBBS, Bix, AOL, Ethernet, etc. Any time someone had two computers, they were connected with some form of network.

You're overlooking the grandaddy of networks - the telegraphy system. Yes, the first international binary network protocol. All later networks were based on ideas it pioneered. But somehow only the IP is valid?

Did you know that controled, powered flight came from the free market? Did you know that jet engines were developed thanks to funds from the free market, as the military saw no use for jet engines? The government did not get involved until they saw flying jet aircraft?

The free market also invented cars, bicycles, light bulbs, electric power generation utilities, telephones, circular saws, and on and on and on and on?

> I recognize markets and areas where externalities cannot be controlled for and thus require a centralized body to regulate

Externalities, such as pollution, are not free market, and are in the purview of government.
by exceptione | 2025-04-16 19:04:34+00:00
Though provoking article @danabramov, thanks.

I am wondering: What are the gains of RSC over a Fat Resource (with expand, sort, select and filter) where responses for (expand,sort,select) are cached? Most applications are READ-heavy, so even a fat response is easily returned to the client and might not need a refetch that often.

The article briefly mentions that you need $expand and $select then, but why/when is that not a valid approach?

The other point I have is that I really do not like to have JS on my server. If my business logic runs on a better runtime, we have 3 (actually 4) layers to pass:

Storage layer (DB) -> business logic in C# (server) -> ViewModel layer in TS/JS (server) -> React in TS/JS (client).

Managing changes gets really complex, with each layer needing type safety.
by duxup | 2025-04-16 19:05:07+00:00
tariff.set({ "numpy": 50, # 50% tariff on numpy "pandas": 200, # 200% tariff on pandas "requests": 150 # 150% tariff on requests })

These numbers seem less arbitrarily made up that the actual tariffs.

But you probably should arbitrarily adjust the numbers for no apparent reason to fit the theme...