MurphyA/hacker-news huggingface dataset:
by elric | 2025-05-08 12:46:15+00:00
> Municipalities are attempting to create safe and comfortable transit systems in the face of climate change.

Citation needed. Over here, municipalities are trying to find further ways of reducing the cost of public transport. Spending money on comfort is simply not going to happen. Belgium's 2nd largest city's transit system has famously malfunctioning escalators (some of which have been broken for half a decade). The offering is reduced year after year, while prices go up.

I wish things were different.
by klabb3 | 2025-05-08 12:46:37+00:00
The big picture incongruence in the thread is using terms as patriotic, allegories to US states, which imo is but a US-centric projection. Even proponents don’t think of the EU to be a supreme government with federated states, and they certainly don’t think of ”Europeans” as a unified demographic. At best, the EU protects against stupid shit from other EU countries (tariffs, freedom of movement) and stupid shit against the outside, such as bullying by superpowers like Russia, China and recently also the US, or extremely large corporations who can take on smaller nation states.

The EU is more similar to NAFTA or five eyes, and culturally the loyalty is more similar to the US vs the anglosphere, like how Americans think of Australia, UK and Canada. Well, again, until recently. Things are changing fast.
by cadamsdotcom | 2025-05-08 12:46:51+00:00
Even then, the existence of many thinking machines helps humans reason about the more complex machines. Think of it as solving a bootstrapping problem.

It is not and never will be a monoculture. Not at the level of which machine is which and not at the level of which machine can help understand the workings of which other machine. It’ll be many machines augmenting our capabilities in many ways.

A pencil is a powerful tool that is horrendously complex thing to make - so many steps to create one. Yet they’re plentiful and we take them for granted.
by aredox | 2025-05-08 12:46:55+00:00
> They tore down Greek and Roman temples to build churches on the ruins. They stripped the Coliseum for parts. They made soup out of mummies and traded grave goods as baubles.

And yet they/we changed, and have preserved countless artifacts that even their original cultures are only now interested in. Not to forget that the very promotion of those foreign artifacts played a big role in making Westerners recognize the value of those other cultures and how much we have destroyed!
by istjohn | 2025-05-08 12:47:05+00:00
I think you have the consequences of AI exactly backwards. AI provides virtual headcount and will vastly increase the ability of small teams to manage sprawling codebases. LLM context lengths are already on the order of millions of tokens. It takes a human days of work to come to grips with a codebase an LLM can grok in two seconds.

The cost of working with code is much lower with LLMs than with humans and it's falling by an order of magnitude every year.
by gr4vityWall | 2025-05-08 12:47:55+00:00
I'm willing to use a new project like that if there's a commitment to not introduce breaking changes unless absolutely necessary.

ESLint introduced a new configuration format a while ago which rendered almost all existing guides online obsolete, and I don't see the benefit for the end users. I assume the devs had a good reason. But god, it's painful.
by kylegalbraith | 2025-05-08 12:47:55+00:00
Glad this got posted. It's an excellent article from the Wiz team.

GitHub Actions is particularly vulnerable to a lot of different vectors, and I think a lot of folks reach for the self-hosted option and believe that closes up the majority of them, but it really doesn't. If anything, it might open more vectors and potentially scarier ones (i.e., a persistent runner could be compromised, and if you got your IAM roles wrong, they now have access to your AWS infrastructure).

When we first started building Depot GitHub Actions Runners [0], we designed our entire system to never trust the actual EC2 instance backing the runner. The same way we treat our Docker image builders. Why? They're executing untrusted code that we don't control.

So we launch a GitHub Actions runner for a Depot user in 2-5 seconds, let it run its job with zero permissions at the EC2 level, and then kill the instance from orbit to never be seen again. We explicitly avoid the persistent runner, and the IAM role of the instance is effectively {}.

For folks reading the Wiz article. This is the line that folks should be thinking about when going the self-hosted route:

> Self-hosted runners execute Jobs directly on machines you manage and control. While this flexibility is useful, it introduces significant security risks, as GitHub explicitly warns in their documentation. Runners are non-ephemeral by default, meaning the environment persists between Jobs. If a workflow is compromised, attackers may install background processes, tamper with the environment, or leave behind persistent malware.

> To reduce the attack surface, organizations should isolate runners by trust level, using runner groups to prevent public repositories from sharing infrastructure with private ones. Self-hosted runners should never be used with public repositories. Doing so exposes the runner to untrusted code, including Workflows from forks or pull requests. An attacker could submit a malicious workflow that executes arbitrary code on your infrastructure.

[0] https://depot.dev/products/github-actions
by ldjkfkdsjnv | 2025-05-08 12:48:01+00:00
You are talking about current capabilities versus what is probably possible. Sure, its not possible to write proofs with an LLM right now.

Somewhere inside openai is a reinforcement learning loop that looks like:

current_code = read(code_base_from_file.txt)

modify_prompt = "some prompt to modify code with expected outcome"

result = model.run(modify_prompt, current_code)

if check(result):

provide_positive_feedback(model)

else:

provide_negative_feedback(model)

and its clear that not only does this work, it maybe the future of what unravels software engineering.

the current models are being trained for coding, but theres no reason this couldnt be tried for other domains, like pure math.
by xiaohanyu | 2025-05-08 12:48:04+00:00
Typst is a pretty good alternative to LaTeX and I agree all pros in your comment, with only one major deal breaker now: its CJK support is not mature enough and not producation-ready yet.

I wrote a post half year ago explained the details for my decision between LaTeX and Typst: https://blog.ppresume.com/posts/on-typesetting-engines#typst
by vidarh | 2025-05-08 12:48:41+00:00
For me it's exactly the opposite, and there lies probably the reason why you don't understand why anyone would do this. I'm much more comfortable at home, and I don't want to run into people most of the time, or have a bunch of stranger around me when I'm relaxing. And I don't want to feel I have to eat by a dining table - I might eat while working, or while watching TV.

When I go out to eat, the experience needs to have sufficient redeeming qualities to overcome what to me is the substantial detriment of not being at home.
by bradlys | 2025-05-08 12:49:01+00:00
Yep. It’s weird to call out motorcycles when typically any good mountain roads frequented by motorcyclists are more commonly used by cars. Especially at night when any noise would be most disturbing. Motorcyclists don’t typically ride very fast on dark mountain roads at night (headlights on motorcycles barely illuminate anything) but auto enthusiasts certainly will.

I’ve had both “loud” bikes and cars (all legal - stock, in fact). The cars easily have 10x the mileage.

The one thing I’d say is - you can’t really control sound of the external world. Cities are infinitely louder. I live in nyc right now and live off a major avenue near the Lincoln tunnel. Whatever annoyances people here have with loud bikes, trust me - my noise is 1000x worse on a daily level. Yet, I’m not perturbed by it unless I open the window cause I chose a place that used quality windows and insulation.
by BrainQuanta | 2025-05-08 12:49:03+00:00
Thank you so much!

It's a very valid point! I always wanted to add pricing information to the website. However, I have two concerns here:

1. I'm experimenting with pricing a lot, especially in the very beginning. Having 3 places (App Store, Google Play, website) to update prices complicates things.

2. Prices are different for different countries and I'm not sure how to represent this on the website. On the App Store it's clear - you just see your country's pricing automatically, but how do I achieve this in a website? Well, technically, it's of course, possible, but it looks like a huge complication as well.

Do you have any suggestions?
by bluGill | 2025-05-08 12:49:09+00:00
No doctor tells you to never go outside in normal situations. If there are high pollution or severe weather events they will tell you stay inside for the duration. I'm sure there are others, but they are not common so it doesn't matter that I can't think of them.

However many people only go outside in the context of walking from their car to the door of wherever they are going, and some who work from home can go for weeks without going outside at all. This is a bad thing, you need exercise (though it could be inside), but realistically many people are not getting enough.
by pc86 | 2025-05-08 12:49:29+00:00
That place didn't have any European operations so no GDPR concerns¹, but for what its worth it was completely.. pseudonymous I think is the term we want? You couldn't link a server entry to an actual user account by any means² but you could group distinct server calls together as coming from the same person. These weren't "server logs" in the same of IPs or user agents or that kind of thing. More like application logs w/ scrubbed/obfuscated user data just stored in gigantic text files.

¹ To those who would say it doesn't matter, I'd say that laws aren't laws if they can't be enforced and there's no enforcement mechanism for some EU bureaucrat to fine a company with no operations outside of the US.

² I'm sure the technical means existed to do it especially if you already had access to the logs but the point is we weren't explicitly storing any PII or data that was linked to a real account. Just actions throughout the apps.
by wongarsu | 2025-05-08 12:49:32+00:00
Depends on what you mean by "these days". If you ask "why do white people need sunscreen" a large part of the reason is that we evolved this skin tone in a Europe that was completely covered in forest until agriculture became widespread. If you ask "why do people wear more sunscreen than in the 50s" the answer is risk awareness. And especially in the last 10 years a much bigger awareness of the effects of skin aging.
by vidarh | 2025-05-08 12:50:33+00:00
None of the places I would like food from are within a 2 minute, or 10 minute bike ride. Maybe a 30 minute one. And uphill most of the way back.

Google Maps seems to me like an awful hassle vs. searching for the dish I want and picking a restaurant based on what they serve rather than where they are based.

Also, Deliveroo rarely combines orders, but if you have a problem with that (can happen for very popular locations) you can pay for priority, so that part isn't an issue with them in my experience.
by networked | 2025-05-08 12:52:08+00:00
Why do you say that duck typing is simplified structural typing? Its relationship with structural typing is on a different axis. Duck typing is its dynamic-typing counterpart.

Python does support structural typing through protocols introduced in version 3.8. They are documented in https://typing.python.org/en/latest/spec/protocol.html.

As a demo, here is part of https://www.typescriptlang.org/play/typescript/language/stru... translated to Python:

from dataclasses import dataclass from typing import Protocol class Globular(Protocol): diameter: float class Spherical(Protocol): diameter: float # In Python, we need to define concrete classes that implement the protocols. @dataclass class Ball: diameter: float @dataclass class Sphere: diameter: float ball: Globular = Ball(diameter=10) sphere: Spherical = Sphere(diameter=20) # These assignments work because both types structurally conform to the protocols. sphere = ball ball = sphere class Tubular(Protocol): diameter: float length: float @dataclass class Tube: diameter: float length: float tube: Tubular = Tube(diameter=12, length=3) tube = ball # Fail type check. ball = tube # Passes.

This is what Pyright says about it:

Found 1 error. /scratch/structural.py /scratch/structural.py:37:8 - error: Type "Ball" is not assignable to declared type "Tubular" "Ball" is incompatible with protocol "Tubular" "length" is not present (reportAssignmentType) 1 error, 0 warnings, 0 informations

Edit: And this is ty:

error: lint:invalid-assignment: Object of type `Ball` is not assignable to `Tubular` --> structural.py:37:1 | 35 | tube: Tubular = Tube(diameter=12, length=3) 36 | 37 | tube = ball # Fail type check. | ^^^^ 38 | ball = tube # Passes. | info: `lint:invalid-assignment` is enabled by default Found 1 diagnostic
by mschuster91 | 2025-05-08 12:52:15+00:00
> On March 16, 2016, AP reported that in February 2009, secretary of state Hillary Clinton also wanted a secured BlackBerry like the one used by Obama, but that NSA denied that request. A month later, Clinton began using a private server, located in the basement of her home, to exchange e-mail messages with her top aides through her regular, non-secure BlackBerry. Later it came out that this rather risky solution was also used for sensitive messages.

A good reminder how IT departments need to provide solutions that actually work and are accessible to everyone. If not, "shadow IT" will emerge, rather sooner than later.

And Clinton was Secretary of State, not some low level clerk.
Enrich local LLMs with local PDFs?
by anotherpaul | 2025-05-08 12:52:20+00:00
Now that we've had LLMs for a while is there already ready to run solutions so I one prepare a folder of papers as PDFs and then have a chatgpt like chat that I can query about them or chat about a topic and have it quote from those sources when appropriate?

I feel like something like this should exist but can not find it immediately, so I thought I ask here.
by achrono | 2025-05-08 12:52:41+00:00
The point is, the self-policing is needed because there isn't a better policing mechanism outside of oneself for something so fundamental, so much at the frontier.

As the AI leaders themselves admit [1], they are doing what they're doing (i.e. capability-maxxing without caring deeply about actual risks this opens up for humanity) because they can and because the other guy's doing it, so why should they be left behind?

They're asking for some external force to bring the morality that they agree on paper ought to exist. There is a segment among them that are even okay with millions of people dying before the risk of AI gets taken seriously. [2]

[1] https://www.youtube.com/watch?v=wrESBnPYoZU, seek to 2:45 [2] same as above, seek to 3:25
by mschuster91 | 2025-05-08 12:52:42+00:00
Indeed wrong thread. I got about 200 tabs open, must have confused the tab with https://news.ycombinator.com/item?id=43892786.

As for "shadow IT" - that's a phrase I have used a few times in the past [1] and that's also relatively frequent on HN [2]. Next time, please don't accuse someone of something without doing at least a cursory search.

[1] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

[2] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
by Alifatisk | 2025-05-08 12:52:45+00:00
Very cool and I am quite thankful for Jetbrains free contribution! I understand peoples concern with telemetry but I can understand that there is some kind of trade-off from a free product, my wish is that they do the same with RubyMine.

Another thing I would like to discuss is this (it's kind flimsy so bear with me), Jetbrains IDEs are good and clean. One thing I dislike with these IDEs is that they do a lot in the background that feels like is outside of my control. I can't really point my finger exactly to where this feeling is coming from but I only get that impression when I use these heavy IDEs.

Say I want my development environment / settings / workspace config to be easily replicated and configured when someone new joins the project, will their Jetbrains IDE recognize it and prompt the user to adapt? Because that is one thing I enjoy with vscode, EVERYTHING is under my control and I can see what everything does. The buttons that runs different tasks can easily be viewed on .vscode/tasks.json, all config is within the .vscode folder!

In Jetbrains IDEs, some things are local only and you have to ask the peers to screenshare which config they had. I don't want that, I want the whole workspace to be easily replicated and shared.

I know Jetbrains is working on Fleet, I've been trying it out a couple of times and I like it, I hope they take this into their consideration.
by matkoniecz | 2025-05-08 12:53:17+00:00
ad blocker addon affects display of content on my computer (changes how content send to my computer is interpreted)

this tool exists to spoil gaming for other players (changes and damages content for other players)

to preanswer: yes, I am fine with trying to detect adblockers and refusing to show content if ads are not shown. Yes, I am fine with paying for content or sponsoring people who create content I like or helping them otherwise. Yes, I will take any ethical steps that I can take to not see ads.

This includes ad blockers, taking steps to makes ads illegal and taking steps toward destruction of physical ads that were illegally placed in my vicinity - such as reporting them to local government so they can be destroyed or removing them myself if viable.

And I am fine with limited shops signs and ads in media that I am not obligated to see. But billboards, highly visible screens etc should not exist.
by agos | 2025-05-08 12:53:33+00:00
just a few months ago they closed a question of mine that I posted in 2010 (!), which in the meanwhile had gathered more than 1000 votes, nearly one million views, and 20 or so answers. I get it that it does not meet their most recent criteria, but closing a question after 15 years telling me to edit my question and read the comments on how it could be improved (there were none) sounds tone deaf and unnecessarily bureaucratic
by orwin | 2025-05-08 12:54:37+00:00
It was too complex to steal, and Ottomans historical alliance with France, while disturbed by Napoleon, was still strong after his coup ended (France had sovereignty over a lot of small territories in the Ottoman empire due to their "protector of the Church" status).

That we don't know what was traded exactly (some people say it's the Cairo clock, but it is unclear and probably false) doesn't matter. The fact that Champollion already translated the rosetta stone from ancient greek and that hieroglyph could now be translated probably had an impact on this decision, especially since among all the Obelisks in egypt, Champollion singled out this particular one.
by spmurrayzzz | 2025-05-08 12:54:56+00:00
Zed strikes a good balance I think with their non-agentic text threads feature. You use slash commands to add whatever you need to the context (single files, directories, highlighted selections, etc) and interact with a conventional chat interface from there. The prompt library also lets you store convenient system prompts if you have a diverse task domain.

You can of course use their new agentic features which can automate a lot of the context management via tool use, but I find that to be a waste of time and resources for the majority of tasks I care about.

I currently manage my own fork to use a custom FIM completion provider I built, that tends to do most of the heavy lifting for me in terms of anything AI-generated.
by cedws | 2025-05-08 12:56:01+00:00
I’ve been reviewing the third party Actions we use at work and seen some scary shit, even with pinning! I’ve seen ones that run arbitrary unpinned install scripts from random websites, cloning the HEAD of repos and running code from there, and other stuff. I don’t think even GitHub’s upcoming “Immutable Actions” will help if people think it’s acceptable to pull and run arbitrary code.

Many setup Actions don’t support pinning binaries by checksum either, even though binaries uploaded to GitHub Releases can be replaced at will.

I’ve started building in house alternatives for basically every third party Action we use (not including official GitHub ones) because almost none of them can be trusted not to do stupid shit.

GitHub Actions is a security nightmare.
by rkangel | 2025-05-08 12:56:42+00:00
[Answer scope limited to the US]

The problem is that these people want to drive, and don't care about it. They want to drive for sociological reasons - driving is seen as a symbol of American independence and financial stability. Look at the people who get weird reactions because they chose to walk to work, or schools that object on spurious grounds when they walk their kid to school.

The car is seen as an assumption, a bare minimum. And any attempt to replace it is taking away a personal right.
by cubefox | 2025-05-08 12:56:43+00:00
DeepSeek-V3 is not a distilled model, which already disproves the "every" claim. And if you happen to have a model which is better than any other available model, it makes no sense to not use it just because it is allegedly "too slow and expensive". Inference speed is highly unimportant compared to absolute model performance. If inference speed was so important, everyone would use small models. But most people use huge models, the best of the best, like GPT-4o, o3, Claude Sonnet 3.7, Gemini 2.5 Pro. People don't prefer Gemini 2.5 Flash to Gemini 2.5 Pro. And people don't pay for ChatGPT Plus to get more access to faster models, they pay to get access to better, slower models. People want quality from their LLM, not quantity.
by danaris | 2025-05-08 12:56:48+00:00
Yes, it's definitely a sign of increasing inequality, on at least three fronts.

On the high side, there's loads of money sloshing around with—especially since the end of ZIRP—no "safe" place to put it. They "need" ways to guarantee high returns over relatively short periods in order to justify their continued access to a never-ending supply of yachts that have other yachts docked inside them; vulture capitalism is a reliable way to do that for people with absolutely no scruples or understanding of (or care about) long-term effects.

On the low side, much like DangitBobby noted, there's much less money available to either buy the business of someone interested in retiring and passing it along, or to start your own.

The third side is that moneyed interests have captured government to an unprecedented degree—even before the current administration came in, with its "burn down everything that helps people and hand the ashes to the wealthy to sift through for loose change" policies. All the protections that should be stopping private equity from doing these things are reliant on government to step in and actually impose meaningful penalties for harming people and small businesses, and it has been systemically incapable of doing so for far too long.
by hobs | 2025-05-08 12:57:01+00:00
The core problem of SO was the the goal of it (and what made it great) is very much in tension with "I want to ask whatever questions I want."

The original idea of SO was building a knowledge repository, and that meant no duplication and pruning it endlessly to make sure it was useful and up to date (which pretty much failed until recently, until its probably far too late) - this core tenet is something the moderators take seriously, and people using the site as questioners (not searchers) absolutely hate.

You can see they are trying to experiment (again probably too late) with how to make question asking easier, more friendly, etc - but that sort of cuts against the core original goals of SO and that's why the mods and the users seemed to be always in tension.