MurphyA/hacker-news huggingface dataset:
by nailer | 2025-05-06 20:28:59+00:00
It's all sides of government.

Edit: all links now fixed.

____

(generated, but with references)

# U.S. government guidance on memory-safe languages

Here's the list of links to U.S. government documents recommending memory-safe programming languages for cybersecurity.

1. *White House ONCD - "Back to the Building Blocks" (Feb 2024)* - Encourages developers to use memory-safe languages like Rust, Python, Java, C#, Go, Swift to reduce vulnerabilities. - Link: https://bidenwhitehouse.archives.gov/wp-content/uploads/2024...

2. *CISA, NSA, FBI, and partners - "Memory Safe Roadmaps" (Dec 2023)* - Recommends memory-safe languages (C#, Go, Java, Rust, Ruby, Swift) and roadmaps to eliminate memory issues. - Link: https://www.cisa.gov/resources-tools/resources/case-memory-s...

3. *NSA - "Software Memory Safety" (Nov 2022)* - Advises using memory-safe languages like C#, Go, Java, Ruby, Swift to avoid C/C++ vulnerabilities. - Link: https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI...

4. *CISA - "Urgent Need for Memory Safety" (Sep 2023, updated Dec 2023)* - Promotes memory-safe languages as part of the Secure by Design campaign. - Link: https://www.cisa.gov/news-events/news/urgent-need-memory-saf...

5. *White House press release - "Future Software Should Be Memory Safe" (Feb 2024)* - Calls for memory-safe languages to reduce cyberattack surfaces. - Link: https://bidenwhitehouse.archives.gov/oncd/briefing-room/2024...

6. *NIST - "Safer Languages" (updated Oct 2022)* - Highlights memory-safe languages like Rust and Ada to prevent common vulnerabilities. - Link: https://www.nist.gov/itl/ssd/software-quality-group/safer-la...
by frainfreeze | 2025-05-06 20:29:25+00:00
Exactly what I wanted to get across. That's why I have 3 personal pages/blogs and a separate forum. Only people very close to me know for all of them. Otherwise people get weird about you doing so many, so varied things. Here I m not talking even about work related relationships, on a personal basis people feel insulted and as if it is a competition if you list what you do when they ask you to. I have super focused, 16h days at the lab/office, of course I ll get a lot done... https://supermemo.guru/wiki/Planning_a_perfect_productive_da...
by mystraline | 2025-05-06 20:30:24+00:00
I'm a moderate fan of LLMs.

I will ask for all claims to be backed with cited evidence. And then, I check those.

In other cases, of things like code generation, I ask for a test harness be written in and test.

In some foreign language translation (High German to english), I ask for a sentence to sentence comparison in the syntax of a diff.
by badlibrarian | 2025-05-06 20:30:24+00:00
Interesting reading in the linked article beyond the quote.

"In the Reagan administration’s attempt to slash $1.5 billion from children’s nutrition funding, school lunch program requirements were worded (whether deliberately or not) so as to conceivably allow for designating ketchup as a vegetable..."

https://en.wikipedia.org/wiki/Ketchup_as_a_vegetable
by hadlock | 2025-05-06 20:30:48+00:00
There's a number of standard APIs already, OpenAI supports Anthopic's MCP, LM studio supports both their proprietary API as well as OpenAI's API. OpenAI has open sourced their realtime API (https://github.com/openai/openai-realtime-console/tree/webso...) and others. Most local clients just have a https://URL:port and then a drop down box for which RESTful API you want to use (for 88% of use cases they all support the same stuff, for realtime it's not quite settled yet), plus a field for an API key if needed.
by IIsi50MHz | 2025-05-06 20:30:48+00:00
> and they offer opt-in (not automatic) refund.

Please consider whether they can authenticate a user based on an HN comment and HN profile. The request for the user contact the company directly makes sense.

> Also controversial, like, if it's a bug, why isn't the refund automatic in the first place.

Have they known about the bug before? For how long? Perhaps it's not an automatic refund because they need to confirm the underlying issue, figure out which users are affected, and only then get management to to sign off on it.
by raydiak | 2025-05-06 20:30:57+00:00
I'm glad! :) I do actually feel some less exaggerated version of what I wrote, but the excess in the verbiage was largely comedic. If you look it up pretty much anywhere, you'll find that there's a very large camp of us Clippy haters who never recovered. I was doing some amount of IT support at the time, and one of the main problems was all the popping up and asking questions confused people in various ways, and if you hid it the obvious way it'd just pop up again. Back when computers were still a new and novel thing for many people, having constant offers of "help" popping up when you're just trying to type a letter introduced counterproductive amounts of cognitive load for some frustrated users I got to deal with.
by onlyrealcuzzo | 2025-05-06 20:31:10+00:00
2.5 pro seems like a huge improvement.

One area I've still noticed weakness is if you want to use a pretty popular library from one language in another language, it has a tendency to think the function signatures in the popular language match the other.

Naively, this seems like a hard problem to solve.

I.e. ask it how to use torchlib in Ruby instead of Python.
by renegat0x0 | 2025-05-06 20:31:52+00:00
Nice project! Good job!

Now somebody might also find interesting what I have done.

- I decided that implementing RSS reader for 100x time is really stupid, so naturally I wrote my own [0]

- my RSS reader is in form of API [1], which I use for crawling

- can be installed via docker. User has to only parse JSON via API. No need to use requests, browsers, status codes

- my weapon of choice is python. There is python feedparser package, but I had problems in using in parallel, because some XML shenanigans, errors

- my reader, serves crawling purpose, so I am interested in most basic elements, like thumbnails, so all nuance from RSS is lost

- detects feeds from sites automatically

Links

[0] https://github.com/rumca-js/crawler-buddy/blob/main/src/webt...

[1] https://github.com/rumca-js/crawler-buddy
by lytedev | 2025-05-06 20:32:06+00:00
The idea with rust is that you _can_ have safety with no performance cost if you need it, but depending on what you're building, of course, that may imply extra work.

The pragmatism of Rust means that you can use reference counting if it suits your use case.

Unsafe also doesn't mean throwing out the Rustiness of Rust, but others have written more extensively about that and I have no personal experience with it.

> The problem with Rust is that it tries to force safety but doesn't have good ways for devs to tell the compiler code is safe...that is a fundamental weakness.

My understanding is that this is the purpose of unsafe, but again, I can't argue against these points from a standpoint of experience, having stuck pretty strictly to safe Rust.

Definitely agree that there are issues with the language, no argument there! So do the maintainers!

> if I need to manage memory then I would look elsewhere atm

Haha I have the exact opposite feeling! I wouldn't try to manage memory any other way, and I'm guessing it's because memory management is more intuitive and well understood by you than by me. I'm lazy and very much like having the compiler do the bulk of the thinking for me. I'm also happy that Rust allows for folks like me to pay a little performance cost and do things a little bit easier while maintaining correctness. For the turbo-coders out there that want the speed and the correctness, Rust has the capability, but depending on your use case (like linked lists) it can definitely be more difficult to express correctness to the compiler.
by mdasen | 2025-05-06 20:32:21+00:00
The article also doesn't say that it's $3B in cash that OpenAI is spending. They might be giving Windsurf $3B worth of OpenAI shares - paying an inflated value for Windsurf with their own inflated value.

OpenAI just had a fundraising round that put them at $300B. Maybe they're just giving Windsurf 1% of OpenAI. Maybe they're even giving less than 1% - if OpenAI was worth $300B at the end of March and $150B last October, maybe they're worth $400B now. Maybe Windsurf is getting 0.75% of OpenAI that's "valued" at $3B.
by mystified5016 | 2025-05-06 20:33:09+00:00
Those loads aren't nearly as intermittent. Your furnace likely runs for tens of minutes at a time. These datacenters are looking at second-to-second loads.

Drawing high intermittent loads at high frequency likely makes the utility upset and leads to over-building supply to the customer to cope with peak load. If you can shave down those peaks, you can use a smaller(cheaper) supply connection. A smoother load will also make the utility happy.

Remember that electricity generation cannot ramp up and down quickly. Big transient loads can cause a lot of problems through the whole network.
by go_elmo | 2025-05-06 20:33:09+00:00
How cool! Thanks for sharing! :) yeah the fever / infection sessions as kids were intense experiences - super interesting insights in what the mind can produce - super valuable insights imo.

I had funny imagination while having fever as a kid as well. Could imagine a surface switching from being satin-smooth to edgy and rough in a perfect transition - maybe some form of texture-halucination..? anyways, the way it would "feel" to the touch is how it felt emotionally as well - super hard to describe but an interesting link to experience somehow :)
by KennyBlanken | 2025-05-06 20:33:12+00:00
Keep in mind the script was from a top-shelf writer who worked on it for ages. It's established earlier in the film that the crew think it's completely plausible a computer dating service would set the two of them up.

"...Fellas. Fellas, look at this man's trash. He's not looking for "buff." The man who folded this tube of Crest...is looking for someone...meticulous. Refined. Anal. ...What?"

I think Cosmo's comment - note he's extremely vain, how he dresses, his office is practically a modern art gallery, he's got the organization's Cray sitting on display, etc - just further shows how vain he is, thinking someone as attractive as Liz couldn't possibly be a good match for a nerd like Werner, when it's established that they're actually quite alike/compatible.

One could imagine that Liz also obeys all speed limits and comes to complete stops at every stop sign...
by nailer | 2025-05-06 20:33:44+00:00
Why is HN downmodding this? We're programmers, surely we all agree memory safety is a thing? Infosec people surely all agree that foreign actors have been exploiting vulnerabilities for the last three decades?

I'm not complaining about the downmods, I'm just weirded out - it's like a music forum disagreeing that flutes are real.
by jsight | 2025-05-06 20:35:20+00:00
It was just an example. It used to be fairly common for people to sync some of their dotfiles via git, and from time to time someone would leak a directory that contained sensitive data without them realizing it. I'd guess things like tokens used by cli tools were more common than whole .ssh directories, but I'm sure both happened.

Not quite the same thing, but also a leak: https://blog.gitguardian.com/github-exposed-private-ssh-key/

I guess all these folks saying professionals would never make a mistake like this will also have insulting names for github engineers. :shrug
by chasil | 2025-05-06 20:35:53+00:00
Suprisingly, POSIX has recently adopted the find -print0 | xargs -0 idiom, so the gears do turn, but very slowly.

The latest standards for POSIX.2 utilities are here:

https://pubs.opengroup.org/onlinepubs/9799919799/utilities/

I do agree with you that UNIX userland would be miles ahead of where we are now if the POSIX.2 standard could be cajoled out of the '80s.
by aziaziazi | 2025-05-06 20:37:18+00:00
I responded in a sibling thread. Just note that your usage of "almost anything" here is probably the objectively right way to use absolute quantifiers, however it doesn't seems to me you're trying to be pedantic but instead want to discuss the meaning itself. In that sense we could say something like:

"You really can't say 'anything' about almost everything without a proximity quantifier like 'almost'".
by tczMUFlmoNk | 2025-05-06 20:37:24+00:00
You can write a Rust function that returns `i32` where a negative value indicates an error case. Nothing in Rust prevents you from doing that. But Rust does have facilities that may offer a nicer way of solving your underlying problem.

For instance, a common example of the "integer on error" pattern in other languages is `array.index_of(element)`, returning a non-negative index if found or a negative value if not found. In Rust, the return type of `Iterator::position` is instead `Option<usize>`. You can't accidentally forget to check whether it's present. You could still write your own `index_of(&self, element: &T) -> isize /* negative if not found */` if that's your preference.

https://doc.rust-lang.org/std/iter/trait.Iterator.html#metho...
by kelnos | 2025-05-06 20:37:36+00:00
I still have a hard time adopting a language/ecosystem that was originally tied to a particular platform, and is still "owned" by the owners of that platform.

Sun actually did it right with Java, recognizing that if they mainly targeted SunOS/Solaris, no one would use it. And even though Oracle owns it now, it's not really feasible for them to make it proprietary.

Apple didn't care about other platforms (as usual) for quite a long time in Swift's history. Microsoft was for years actively hostile toward attempts to run .NET programs on platforms other than Windows. Regardless of Apple's or MS's current stance, I can't see myself ever bothering with Swift or C#/F#/etc. There are too many other great choices with broad platform and community support, that aren't closely tied to a corporation.
by ActorNightly | 2025-05-06 20:37:56+00:00
>I'm getting the impression that the field is over-saturated, with new research being published on a daily basis

The research being published is mostly about optimizations of transformer models.

There is a lot more research in other areas. For example, everyone seemed to forget about MuZero, but that was one of the most important breakthroughs in the last decade, because it was a model that could recursively search.

So if you think about tasks like driving a car, a model that can predict the evolution of a physical system (much like MuZero can predict the evolution of the game board), and make a decision, is going to perform much better than any of the vision based transformer models that are in cars today.

But there are other areas of research as well, namely in hardware with specific instructions for general compute.
by Workaccount2 | 2025-05-06 20:37:57+00:00
Software will change to accommodate LLMs, if for no other reason than we are on the cusp of everyone being a junior level programmer. What does software written for LLMs to middleman look like?

I think there is a total seismic change in software that is about to go down, similar to something like going from gas lamps to electric. Software doesn't need to be the way it is now anymore, since we have just about solved human language to computer interface translation. I don't want to fuss with formatting a word document anymore, I would rather just tell and LLM and let it modify the program memory to implement what I want.
by TuringNYC | 2025-05-06 20:38:14+00:00
I agree with you it isnt guaranteed to be inevitable, and also agree there have been plenty of journeys which were on a trajectory only to fall off.

That said, IMHO it is inevitable. My personal (dismal) view is that businesses see engineering as a huge cost center to be broken up and it will play out just like manufacturing -- decimated without regard to the human cost. The profit motive and cost savings are just too great to not try. It is a very specific line item so cost/savings attribution is visible and already tracked. Finally, a good % of the industry has been staffed up with under-trained workers (e.g., express bootcamp) who arent working on abstraction, etc -- they are doing basic CRUD work.
by skybrian | 2025-05-06 20:38:28+00:00
Good article. Yeah, I wouldn’t expect a full explanation, just some kind of “here be dragons” caveat. Perhaps a hyperlink alone is a bit too subtle since readers aren’t always going to dereference it. (And there’s some irony there, given the subject of the linked article.)

The types in Go’s template/html package are a pretty interesting example of using types tactically to indicate validity. The HTML type is used to turn off HTML escaping when it’s already been done. It’s using a type as a loophole. It’s still very useful to have a type like that when reviewing code for security bugs, because you know where to look for problems. Unsafe sections in Rust serve a similar purpose.

Types are about creating trust, and this trust is often short-lived. When data crosses a security boundary, the validation has to done again.
by anon291 | 2025-05-06 20:38:37+00:00
Unfortunately, child selling is the 'default' state of humanity. Our current regime in which we prioritize children staying with their birth family (which is correct, in my opinion) is novel and an aberration in the grand scheme of history. Despite all the claims that things are getting worse, we should always remember that things today are so insanely better than they were just a few decades ago that we cannot even IMAGINE how bad things used to be within living memory.

I'm quite conservative politically, but I will admit to bristling anytime anyone idolizes the 50s and the surrounding times. It was actually pretty awful.
by sitkack | 2025-05-06 20:38:48+00:00
If you have a synology, of course bypass. But do not buy Synology with the goal of using this bypass. One it continues to support Synology and these practices, and two you have no guarantee it will continue to function. A firmware update could destroy your array.

> With the 2025 generation of NAS models, Synology has officially crossed into locked-down territory. No more plug-and-play flexibility. Unless your hard drives are on a short list of approved models, mostly Synology’s own rather expensive models, DSM throws up warning messages and disables key features like the ability to install DSM and get started with using your NAS.

> Moreover, unsupported drives do not have access to drive health stats and can't be used to create new storage pools. But the worst part is that Synology will refuse technical support for using incompatible drives. It’s not about performance or reliability — it’s about control. The company claims that technical support claims arising out of incompatible hard drives are not worth the hassle, so Synology wants to turn your NAS into a walled garden. The same company that once encouraged customization now wants to sell you overpriced, rebranded drives or penalize you for going elsewhere. If that sounds harsh, it is, and I say that as someone who has invested thousands of dollars in Synology hardware.

Build your own (not hard) or go QNAP

https://www.qnap.com/en-us/product/ts-432x
by 0cf8612b2e1e | 2025-05-06 20:38:57+00:00
One solution is to rely on backup power supplies and batteries to charge and discharge, providing extra power quickly. However, much like a phone battery degrades after multiple recharge cycles, lithium-ion batteries degrade quickly when charging and discharging at this high rate.

Is this really a problem for an industrial installation? I would imagine that a properly sized facility would have adequate cooling + capacity to only run the batteries within optimal spec. Solar plants are already charging/discharging their batteries daily.
by rock_artist | 2025-05-06 20:39:02+00:00
While very different, it was already tricky in the past to make Apple silicon (on iPhones as well) perform reasonable.

Ableton engineers already evaluated this in the past: https://github.com/Ableton/AudioPerfLab

While I feel for the complaints about the Apple lack of "feedback assiting" The core issue itself is very tricky. Many years ago, before being an audio developer, I've worked in a Pro Audio PC shop...

And guess what... interrupts, abusive drivers (GPUs included) and Intels SpeedStep, Sleep states, parking cores... all were tricky.

Fast forward, We got asymmetric CPUs, arm64 CPUs and still Intel or AMDs (especially laptops) might need bios tweaks to avoid dropouts/stutters.

But if there's a broken driver by CPU or GPU... good luck reporting that one :)
by IIsi50MHz | 2025-05-06 20:39:05+00:00
> don't claim that it is intended and "I do understand how this may be unexpected".

This is why companies end up having PR people. An attempt to sound understanding can can easily be scuttled by an unfortunate choice of words. If the programmer had shortened that sentence to "I do understand.", there would not have been a chance to construe an attempt at downplaying the situation.
by mike210 | 2025-05-06 20:39:35+00:00
As seen on r/LocalLlaMA here: https://www.reddit.com/r/LocalLLaMA/comments/1kfkg29/

For what it's worth I pasted this into a few tokenizers and got just over 24k tokens. Seems like an enormously long manual of instructions, with a lot of very specific instructions embedded...
by hadlock | 2025-05-06 20:39:43+00:00
CoreOS (now part of redhat) offered "fleet" which was multi-computer container orchestration, and used systemd style fleet files and raft protocol to do leader election etc (back when raft was still a novel concept). We ran it in production for about a year (2015) before it became abundantly clear (2016) the future was Kubernetes. I think the last security update Fleet got was Feb 2017 so it's pretty much dead for new adoption, if anyone is still using it.

But TL;DR we've already done systemd style container orchestration, and it was ok.
by RobinL | 2025-05-06 20:39:51+00:00
How long ago was that? 6 months ago I switched from VS Code to Cursor, which at the time was FAR superior to Copilot. Around a month ago I switched back to VS Code, and found there's not much difference any more. Autocomplete in VS Code is still less good, but the agent mode in VS Code feels pretty similar to Cursor's (albeit a little slower, perhaps).

To be honest I think both are quite limited by context length (in that they try to limit the context they send to the LLM and hence cost), and so I find myself using Gemini 2.5 in AI studio with the 1m context length, and asking it to generate instructions for Copilot (which seems to work pretty well)
by robocat | 2025-05-06 20:41:06+00:00
Perhaps paraphrasing is specific to New Zealand? Students are very strongly encouraged here to rewrite everything into "their own words" and they are penalised if they don't (plagiarism detection software has been used for years to detect sentences that were not paraphrased by students).

Auckland University https://learningessentials.auckland.ac.nz/writing-effectivel... says:

Direct quotes from other sources should only be used when absolutely necessary. It is best to paraphrase the quote or summarise the ideas when you use other people’s writing.

Massey University https://owll.massey.ac.nz/referencing/paraphrasing-and-summa... says:

in your assignment, you need to ensure that there is enough difference in form between the original [words] and your own summarised version. This may be achieved by simplifying the ideas, as well as using a different sentence structure or sentence order to present those ideas.

Equivalent examples from all NZ universities: https://duckduckgo.com/?q=site%3Aac.nz+paraphrase

Students are forced to do it here in NZ. I find it dishonest and pointless. Although generally I'm rather cynical about the value of university education here.

Searching for "paraphrase" comes up with other suggestions which demonstrate that students are searching for tools to do it for them. That isn't a recent development with LLMs.