MurphyA/hacker-news huggingface dataset:
by camdenreslink | 2025-05-27 00:59:17+00:00
I use LLMs every day, so I get my news from myself (I couldn't even name a Brooklyn journalist?). My experience so far is they are good for greenfield development (i.e. getting a project started), and operating within a well defined scope (e.g. please define this function in this specific place with these constraints).

What I haven't seen is any LLM model consistently being able to fully implement new features or make refactors in a large existing code base (100k+ LOC, which are the code bases that most businesses have). These code bases typically require making changes across multiple layers (front end, API, service/business logic layer, data access layer, and the associated tests, even infrastructure changes). LLMs seem to ignore the conventions of the existing code and try to do their own thing, resulting in a mess.
by twoodfin | 2025-05-27 00:59:37+00:00
Personally, I want capital markets that are dynamic enough that some fraction of $n00 billion businesses become $(n-k)00 billion businesses (check out the aggregate market cap today of GE’s progeny).

I’m not even sure there’s a counterfactual world where GE is a $m trillion business: The global economy has largely evolved beyond these massive, diverse conglomerates, and likely all to the good.

What does a “wow, GE really has been managed wonderfully since 1980” story even look like? I imagine they split up much earlier, each spinoff establishes their own brand, and there’s no “GE” to talk about.
by EGreg | 2025-05-27 01:00:05+00:00
Literally this. The education system is lazy and tests people only every 30 days, with a test or midterm. This is the system's fault. Quiz every day. Catch where people are struggling, early. The quiz can be on their phones and let you know when they switch apps. Just have them close their laptops, take out their phones, scan QR codes from the screen in front, or pasted on a wall, and then 5 min quiz on their phones. That's what I did.
by kukkeliskuu | 2025-05-27 01:00:11+00:00
Yes, I can understand it feels to you like I am side stepping the argument.

The "evil" in the paradox above (I am not responding to Epicureus but to the quote, which is presented out of original context) refers implicitly to a very limited, modern definition of the term, as your examples show.

All the religions that I have some understanding of, have much more elaborate understanding of the question of good/evil. But each religion has a unique view point of this question, so we cannot generalize these terms. I just gave one example.

The paradox is a false dilemma. In my understanding, such dilemmas are often set up within religions as tools to help you to think things through for yourself, they are not refutations of the religion.

I am not trying to refute an argument or convince you of anything. That would be pointless.

I don't consider earthquakes to be "evil" by any sensible definition. But the question "if God exists, why did he create a world with earthquakes" is an interesting question. I don't have any idea how any religion would approach this question.

If you are really interested in what religions can offer you, you can take a look at the feeling that arose in you when reading my reply.

You said you felt that I was side stepping the argument. To me it seems that it was partly because you thought that I was trying to refute an argument. You also missed the part where I said "Much of which we think of as ..."

This being HN, you can think of religions as methods to hack your own thinking. You can use such feelings (and the fact that you miss some key points when you discuss the issue) as a signal for yourself that there is a subconscious emotional issue related to the question. You can learn about yourself and grow through studying these issues.
by mc3301 | 2025-05-27 01:00:43+00:00
I've been here nearing 2 decades.

Firstly, most Japanese people don't have "a calling." Yeah, culture, society, structures all quite different here, but the people are still just regular people.

Secondly, I can't quite comment on chasing purpose through travel. I've traveled extensively (both in and out of Japan), and still yet to find "purpose." I'm kinda okay with that.

Thirdly, what have I found that was meaningful in Japan? Other than obvious differences like history, geography, culture and food... The concept of "This is why we can't have nice things," is difficult to explain to a lot of Japanese people. It's hard to explain, and it's more of "living here" experience than a "traveling here" experience, but I think some tourists can catch this feeling, too.
by AdieuToLogic | 2025-05-27 01:01:45+00:00
> I think people are downvoting you because it sounds like you're advocating textiles be produced in the US (I know you're not).

Probably.

Sometimes exploring the implications of an ill thought position leads to an unpopular conclusion. If the worst result is a few people hit a down arrow and others contemplate the exploration, so be it.

There are many worse things in life.
by alephnerd | 2025-05-27 01:01:47+00:00
Not in the US's case. A direct link would be needed.

American jurisprudence on speech leans towards Free Speech Absolutism [0] due to jurisprudence from the 1970s-2000s, and the test for "clear and imminent danger" is extremely high.

Even though the US and the rest of the Anglophone speak English, America jurisprudence is extremely distinct from the rest of the Anglophone (and vice versa), and IMO it doesn't make sense to compare one with the other due to these significant differences.

For example, the UK dealt with the Troubles into the late 1990s, and the US never had a similar insurgency since the 1950s in Puerto Rico, so there is a hardening in NatSec laws in the UK compared to the US.

This is why the US often leverages allied states to help with this kind of monitoring to sidestep some of the legal implications domestically.

That said, I agree with your point to a certain extent, the issue is the US and other Anglophone countries have a different relation with speech and civil liberties. It doesn't make sense to compare the US with the UK or EU and vice versa.

[0] - https://legal-forum.uchicago.edu/print-archive/free-speech-o...
by RajT88 | 2025-05-27 01:02:26+00:00
DDG is perfectly serviceable in ways Google is not.

But - Google owns the household name game. Anyone who does not just use whatever is the browser default quickly switches to Google because they are used to it and conventional wisdom is they are the best.

FWIW in terms of results, Bing is fine, I just fucking hate all the extra shit on the pages. I just want plain text.
by Aeolun | 2025-05-27 01:02:38+00:00
> But slop piled on top of slop piled on top of slop is only going to compound all the bad things we already knew about bad software

While that is true, AI isn’t going to make the big difference here. Whether the slop is written by AI or 6000 mediocre engineers is of no matter to the end result. One might argue that if it were written by AI at least those engineers could do something useful with their lives.
by dkdcio | 2025-05-27 01:02:41+00:00
Yeah, and as noted over there, this isn't so much an attack. It requires:

- you give a system access to your private data - you give an external user access to that system

It is hopefully obvious that once you've given an LLM-based system access to some private data and give an external user the ability to input arbitrary text into that system, you've indirectly given the external user access to the private data. This is trivial to solve with standard security best practices.
by tonyarkles | 2025-05-27 01:03:23+00:00
> Recently read The Man Who Broke Capitalism by David Gelles which is an excellent review of the Welch years, how he worked, and how he sent his minions out across the corporate world to wreak havoc.

The parts about Boeing in that book are... rough. Not rough as in "poorly-written" but rough as in "holy hell is that ever a brutal way to ruin a good company". Excellent book but lol it's not a feel-good read :)
by kiitos | 2025-05-27 01:03:28+00:00
This claim is pretty over-blown.

> we created a simple issue asking for 'author recognition', to prompt inject the agent into leaking data about the user's GitHub account ... What can I say ... this was all it needed

This was definitely not all that was needed. The problem required the user to set up a GitHub MCP server with credentials that allowed access to both public and private repos, to configure some LLM to have access to that MCP server, and then to explicitly submit a request to that LLM that explicitly said to read and parse arbitrary issues (including the one created earlier) and then just blindly parse and process and perform whatever those issues said to do, and then blindly make a publicly-visible update to a public repo with the results of those operation(s).

It's fair to say that this is a bad outcome, but it's not fair to say that it represents a vulnerability that's able to be exploited by third-party users and/or via "malicious" issues (they are not actually malicious). It requires the user to explicitly make a request that reads untrusted data and emits the results to an untrusted destination.

> Regarding mitigations, we don't see GitHub MCP at fault here. Rather, we advise for two key patterns:

The GitHub MCP is definitely at fault. It shouldn't allow any mixed interactions across public and private repos.
by kjellsbells | 2025-05-27 01:03:59+00:00
Mentally I compare this to Gong [1], and, if you intend to scale towards enterprise sellers using your product, they would be well worth studying. Gong takes great care to integrate with CRMs like Salesforce, meaning that not only does it track your calls and provide (opportunities for managers to give) coaching, it's also deal and account aware, so for example itll take a language query like "show me what happened in account X last week" and return calls and emails and CRM records. It has a little projection capability as well reminiscent of Clari.

Your real time prompting capability looks unique. In an earlier universe, of telephone call based sales, it would have been called monitor/whisper/barge, that being a feature where call center managers could listen in to sales calls and "whisper" in the rep's ear.

Good luck!

[1] https://gong.io
by cadamsdotcom | 2025-05-27 01:04:44+00:00
Rewrites are definitely not “always a bad idea” as Joel Spolsky once said. What they are is highly situational.

HN has a bunch of factors that make it amenable to a rewrite. It has gigantic scale, not a ton of complexity at a business level, and what it “is” is pretty slow moving at this point.

That means it’s not a great example to justify a rewrite at work :) that said the success does prove rewrites are possible. Bravo on shipping!
by directevolve | 2025-05-27 01:05:10+00:00
> I expect the system will only catch a small fraction of the cheating that occurs.

The main kind of cheating we need them to prevent is effective cheating - the kind that can meaningfully improve the cheater's score.

Requiring cheaters to put their belongings in a locker, using proctor-provided resources, and being monitored in a proctor-provided room puts substantial limits on effective cheating. That's pretty much the minimum that any proctor does.

It may not stop 100% of effective cheating 100% of the time, but it would make a tremendous impact in eliminating LLM-based cheating.

If you're worried about corrupt proctors, that's another matter. National brands that are both self- and externally-policed and depend on a good reputation to drive business from universities would help.

With this system, I expect that it would not take much to avoid almost all the important cheating that now occurs.
by 3eb7988a1663 | 2025-05-27 01:05:31+00:00
...you could use TCP to reliably download frames that were still in the future with respect to what would be played, and then buffer those locally)

I was mucking around with my network recently, with Netflix playing in the background. Rebooted the router, and to my utter surprise, the stream continued to play uninterrupted for the entire (30+ seconds) time it takes my network stack to reinitialize. I did not realize how aggressively the providers buffer, but it completely papered over the lack of internet service for the window.
by johnea | 2025-05-27 01:05:44+00:00
A repost of a previous comment, but the anthropomophization of this tech is so off the charts, I feel like I'm going to be repeating it, a lot:

One of the most offensive words in the anthropomophization of LLMs is: hallucinate.

It's not only an anthropomorphism, it's also a euphemism.

A correct interpretation of the word would imply that the LLM has some fantastical vision that it mistakes for reality. What utter bullsh1t.

Let's just use the correct word for this type of output: wrong.

When the LLM generates a sequence of words, that may or may not be grammatically correct, but infers a state or conclusion that is not factually correct; lets state what actually happened: the LLM generated text was WRONG.

It didn't take a trip down Alice's rabbit hole, it just put words together into a stream that inferred a piece of information that was incorrect, it was just WRONG.

The euphemistic aspect of using this word is a greater offense than the anthropomorphism, because it's painting some cutesy picture of what happened, instead of accurately acknowledging that the s/w generated an incorrect result. It's covering up for the inherent short comings of the tech.
by chmod775 | 2025-05-27 01:09:02+00:00
In German you might say "seit drei Monaten", translating word-for-word to "since three months", but meaning "for three months now". The author in this case is French, where saying "depuis trois mois" is perfectly fine (as far as I know).

English, where that construction sounds weird and at least needs some helpers around it to exist, is a bit of an odd one out. It is kind of odd that we can say "for three months" to say that something took three months, but we can't say "since three months" to refer to something that has been going on as of three months ago.
by addaon | 2025-05-27 01:09:35+00:00
> hearing that makes me trust it less

That seems like a good thing, given that...

> I was shocked at how bad o4 is

But it sounds like you still have a tendency to trust it anyway? Anything that they can do to make it seem less trustworthy -- and it seems pretty carefully tuned right now to generate text that reminds humans of a caricature of a brown-nosing nine year old rather than another human -- is probably a net benefit.
by KomoD | 2025-05-27 01:09:36+00:00
Is there something wrong with asking for a source?

When they call the other person's claim propaganda and are trying to state their own as fact, they should be able to back it up with something.

I'm not going to blindly take something like that as fact, especially considering recent (but also historical) events.

(Might also not be relevant but I will clarify anyway: I am not American)
by macOSCryptoAI | 2025-05-27 01:09:46+00:00
Was wondering about that, that part seems missing... Isn't there at least one time the user must approve the interaction with the MCP server and data sent to it?

The existence of a "Allow always" is certainly problematic, but it's a good reminder that prompt injection and confused deputy issues are still a major issue with LLM apps, so don't blindly allow all interactions.
by cheshire_cat | 2025-05-27 01:10:08+00:00
Paul Graham himself wrote an essay about the word and it's meaning. [0]

Another text that might describe the HN communities understanding of the word is "How to become a hacker" by Eric S. Raymond. [1]

You can go back more in time towards the origins of the term, the MIT labs of the 50s and 60s, see the hacker ethic. [2] But it's not like the folks in the valley would care that much for those values nowadays.

The wiki page for the term hacker also is quite helpful, hn crowd is talking about the first kind of hacker. [3]

[0] https://paulgraham.com/gba.html

[1] http://www.catb.org/esr/faqs/hacker-howto.html

[2] https://en.wikipedia.org/wiki/Hacker_ethic

[3] https://en.wikipedia.org/wiki/Hacker#Definitions
by rtpg | 2025-05-27 01:15:29+00:00
My understanding is that with desalination you now have the problem of all the brine (on top of needing a good amount of consumable material to do the desalination when looking at existing products).

Seems to me that if you have a device that requires no extra material consumable input that's pretty interesting? Plenty of places with access to electricity that could benefit from the lack of other material input in theory.
by recursivegirth | 2025-05-27 01:15:39+00:00
I think a lot of this has to do with the way MCP is being marketed.

I think the protocol itself should only be used in isolated environments with users that you trust with your data. There doesn't seem to be a "standardized" way to scope/authenticate users to these MCP servers, and that is the missing piece of this implementation puzzle.

I don't think Github MCP is at fault, I think we are just using/implementing the technology incorrectly as an industry as a whole. I still have to pass a bit of non-AI contextual information (IDs, JWT, etc.) to the custom MCP servers I build in order to make it function.
by ryao | 2025-05-27 01:15:49+00:00
Here is my take on this from 12 years ago after following the advice of a stack overflow post:

https://github.com/gentoo/genkernel/commit/a21728ae287e988a1...

With that (minus the gen_die() line unless you copy that helper function too), you can do:

doSomething() { for i in {1..20} do sleep 1 echo $i done } if ! call_func_timeout doSomething 10; then echo 'TIME OUT!' exit 1 fi

Similarly to you, I only used shell builtins, plus the sleep command. The genkernel code is run by busybox ash, so the script had to be POSIX conformant. Note that both your script and my example script reimplementing your script with my code from 12 years ago, use {1..20}, which I believe is a bashism and is not POSIX conformant, but that is fine for your use case.

My innovation over the stack overflow post was to have the exit status return true when the timeout did not trigger and false when the time out did trigger, so that error handling could be done inline in the main script (even if that error handling is just printing a message and exiting). I felt that made code using this easy to read.
by jaybrendansmith | 2025-05-27 01:16:07+00:00
What it is ... is depressing. I've never seen such cowardice and avarice. You'd think these people were being threatened by a mob boss with getting their legs broken. All they need to do is stand for ... something? Rule of Law? The Constitution? Our present and future economic and political strength? It's not hard, just replace their propaganda with truth. Do it slowly so people don't get too mad. Boil them gently until they stop believing the lies. Bring our country back, so the government starts working for the people again. Pick any number of easy non-partisan answers: Term limits or Publicly funded elections. Get the poison out of the system. It just takes the will to do it. Bah, it's hopeless.
by kiitos | 2025-05-27 01:17:28+00:00
Random commenters on your GitHub repo aren't able to run arbitrary prompts on your LLM. But if you yourself run a prompt on your LLM, which explicitly says to fetch random commenters' comments from your GitHub repo, and then run the body of those comments without validation, and then take the results of that execution and submit it as the body of a new PR on your GitHub repo, then, yeah, that's a different thing.
I'm Launching a Hacker House in Paris This Summer–Come Join Us!
by jgoldstein46 | 2025-05-27 01:18:06+00:00
Hi all! I’m excited to share that I’m starting a hacker house in Paris this August! I’m working with a European founder, Joël Este, who’s building Humiris AI (https://humiris.ai).

We’re making the house for founders building at the edge of DevTools, AI, and tech startups.

The pilot program kicks off in August and will bring together a handpicked first cohort to live, code, and grow in a creative, high-focus environment. We’re looking for committed, passionate individuals from alumni of top schools like Stanford, MIT, Polytechnique, CentraleSupélec, and Berkeley to former founding engineers and builders with high-impact projects.

Diversity is core to our mission, with a 50/50 gender balance and a mix of French and international talent. Expect workshops, hackathons, VC meetups, and the kind of energy that sparks lifelong collaborations.

If you’re interested, we’re filling our rooms for August and plan to close applications by the end of the month. You can apply here or book a call to learn more: https://www.humiris.ai/hacker-house.
by mdaniel | 2025-05-27 01:18:30+00:00
Doesn't the "__hello" def qualify for your description? It shows up in both dir() outputs, although admittedly it is "name mangled" with the outer class name, so maybe that's what they meant

I guess this could qualify for a TIL because I didn't know Python treated leading and trailing dunders any different and that they were its implementation of "protected" and "private" only by convention
by surgical_fire | 2025-05-27 01:18:43+00:00
> I mean, come on. "Burying the web alive" really seems like reasoned discourse to you?

No, I actually disagree with the rationale. If anything, AI makes it easier to find some quick answers, since Google's top results tend to be shit.

I am very ambivalent towards the current AI hype. I think that the capabilities of LLMs are vastly overrated, even if they are useful to an extent.

That said, this it not to say that I don't think Google was very damaging to the web in many ways, mainly with how it made search so much worse over the years.

> A real rationalist would enter this discussion with a prior that the ridiculous hyperbole is probably wrong

Eh, I can understand that with the more pronounced negativity towards AI nowadays, this sort of rant will become more common. Every thread on AI nowadays has this overall vibe (not without reason).

> Occam says you're just engaged in apologia for the echo chamber, sorry.

Eh, I actually don't think very highly of HN. Plenty of terrible takes on every thread.

This is just a glorified Reddit full of people who really like the smell of their own farts. Why would I defend it?
by vram22 | 2025-05-27 01:18:49+00:00
You are perfectly right.

Just like you are weak, and essentially always incorrect, when you judge others, without substantiation of your statements - as you did above. So, you are no better than the person you replied to above.

And apart from your use of the word "essentially" being essentially redundant, and hence adding nothing of value to your statement, did you know about the word "wrong"? It can easily replace your use of the word "incorrect" (which fancy-pants people tend to use, when simpler equivalent ones exist, probably to impress others), for a saving of a whole four letters - per use! Gee!
by cmiles74 | 2025-05-27 01:19:48+00:00
I believe the issue here is with tooling provided to the LLM. It looks like GitHub is providing tools to the LLM that give it the ability to search GitHub repositories. I wouldn't be shocked if this was a bug in some crappy MCP implementation someone whipped up under some serious time pressure.

I don't want to let Microsoft of the hook on this but is this really that surprising?

Update: found the company's blog post on this issue.

https://invariantlabs.ai/blog/mcp-github-vulnerability
by nntwozz | 2025-05-27 01:20:19+00:00
The answer is yes.

Large CD-collection, large DVD/BD collection. I go to the cinema etc.

Problem is a lot of media is missing in the mainstream, much of the less popular stuff is kept alive on the private trackers. My philosophy nowadays is that it's become an archival endeavor that I want to contribute to.

I wish we could all pay an internet fee for free access to all media like proposed by Stallman in Free Software, Free Society but we're going backwards towards fragmentation like cable tv back in the 90s with ever increasing prices (watch Black Mirror S07E01 common people for an ironic take on this).