MurphyA/hacker-news huggingface dataset:
by motorest | 2025-05-26 06:48:38+00:00
> For the most simple use case of an client auth state; you want to be able to revoke auth straight away if an account is compromised. This means you have to check the auth database for every request anyway, and you probably could have got whatever else was in the claim there quickly.

I fail to see the relevance of your scenarios regarding JWTs. I mean, I get your frustration. However, none of it is related t JWTs. Take a moment to read what you wrote: if your account is compromised, the attacker started abusing credentials the moment he got them. The moment the attacker got a hold of valid credentials is not the moment you discovered the attack, let alone the moment you forced the compromised account to go through a global sign-off. This means that your scenario does not prevent abuse. You are revoking a token when it was already being abused.

Also, as someone who implemented JWT-based access controls in resource servers, checking revocation lists is a basic scenario. It's very often implemented as a very basic and very fast endpoint that provides a list of JWT IDs. The resource server polls this endpoint to check for changes, and checks the list on every call as part of the JWT check. The time window between revoking a token and rejecting said token in a request is dictated by how frequent you poll the endpoint. Do you think, say, 1 second is too long?

> Same with roles; if you downgrade an admin user to a lower 'class' of user then you don't want it to take minutes to take effect.

It's the exact same scenario: you force a client to refresh it's access tokens, and you revoke which tokens were issued. Again, is 1 second too long?

Also, nothing forces you to include roles in a JWT. OAuth2 doesn't. Nothing prevents your resource server from just using the jti to fetch roles from another service. Nevertheless, are you sure that service would be updated as fast or faster than a token revocation?

> So then all you are left with is a unified client id format, which is somewhat useful, but not really the 'promise' of JWTs (I feel?).

OAuth2 is just that. What's wrong with OAuth?

Also, it seems you are completely missing the point of JWTs. Their whole shtick is that they allow resource servers do verify access tokens locally without being forced to consume external services. Token revocation and global sign-offs are often reported as gotchas, but given how infrequent these scenarios take place and how trivial they are to implement (periodically polling an endpoint hardly changes that.
by roenxi | 2025-05-26 06:49:06+00:00
> The rants weren’t breaking news to anyone who was familiar with PyTorch or adjacent communities.

How many people in the PyTorch and adjacent communities are trying to port the stack to AMD cards? I'd guess less than 100. That is a pretty small community. They don't do that much in the way of publicity (and, case in point, George does and he attracts a certain number of haters).

George is probably the first public reference I saw who wasn't pointing at CUDA as the problem but tagging kernel & hardware bugs on AMD cards as the blocker. Those are really different things; CUDA isn't that complicated to implement as a half-baked thing. I can implement naive matrix multiplication if I need to and it'd be a fun month of reading academic papers to learn better techniques. But that does nothing to work around hardware and firmware bugs which are an order of magnitude harder to deal with and not something I want to deal with.

I'm happy to buy in to bad software libraries. I don't want a bar of hardware bugs.
by AngryData | 2025-05-26 06:50:03+00:00
I think South Korea is just a horrible example for almost everything in general anyways. There are South Koreans still alive that remember when it was still 90% peasant farmers living a 15th century lifestyle, that basically did a single skip through industrialization, and it is now one of the most technologically advanced countries on Earth. And it is still plainly evident by all the fairly unique major social and cultural problems they face today.
by jen20 | 2025-05-26 06:50:19+00:00
While I agree this is largely a "skill issue", I'm not so sure it's in the direction you seem to think it is.

Almost nothing written using Go uses an IoC container (which is what I assume you're meaning by DI here). It's hard to argue that "larger projects" cannot or indeed are not built using Go, so your argument is simply invalid.
by steveharrison | 2025-05-26 06:50:25+00:00
I'm building an app to do this, will let you know when it's in beta. :) Meanwhile, some of the similar apps that store data locally I've come across are: - https://copilot.money/ (nice UI; partly local—think it might use CloudKit for syncing) - https://ufincs.com/ - https://actualbudget.org/

I feel like http://monarchmoney.com is still the best UI I've come across, but I can't believe how common it is for all these providers to store your transactions in their cloud... seems like a fundamental security flaw to me, no matter how much they claim to lock down access to customer support agents/etc.
by otabdeveloper4 | 2025-05-26 06:51:34+00:00
> and very appealing to us

Yes, because anthropomorphism is hardwired into our biology. Just two dots and an arc triggers a happy feeling in all humans. :)

> of practical application and real value

That is debatable. So far no groundbreaking useful applications have been found for LLMs. We want to believe, because they make us feel happy. But the results aren't there.
by liaopeiyuan | 2025-05-26 06:51:35+00:00
This is my sentiment too after trying to get a Blackhole to run a recent VLM (like Pixtral) over the weekend. Not just unit tests, but actual training loops. I write a lot of JAX in my day job to train large models but I used to do a bit of ML compiler development, which I guess also puts me in the dumb people crowd. I'm equally impressed by how smooth the lower-level setup is and frustrated by how little progress I was able to make towards the seemingly last mile of "just rewrite the code a little bit more bro I just need to get rid of this one hlo op because it's not supported."

I don't think anyone is seriously training an NN on TT hardware at the moment and I think that's an issue. I think tinygrad works not only because geohot is one hell of an engineer but also because comma dogfoods it. TT's engineers are absolutely brilliant (from reading their commits) but I think they are stretched too thin. Bounties are not gonna work - you can't expect an outsider with no internal access/bandwidth/knowledge to suddenly make e.g. Mixtral work as the issue spans at least across tt-xla/tt-mlir. And to agree with ^ training is a kind of artifact where good CX can only be derived from strong leadership and a leaner view of the stack. NVIDIA accumulated that over the decades and the rest are trying to catch up by aggressive hiring (not to say that hiring is necessary). e.g. Annapurna has a presence on the CMU campus when I was there and has the Anthropic team to test it out.

I'm an incredibly excited third-party developer as I think the pitch appeals a lot to grad students (who do model research) who need to run small experiments within the 13B range and reasonably scale them up to draw the first half of the scaling curve.

I lose too much productivity to abstractions and incomplete e2e support in TT's current shape. I'd love to give it another go in 6 months.
by popol12 | 2025-05-26 06:53:08+00:00
After all these years I fail to understand how people seemingly versed in the subject are still spelling Etherium with an "i" instead of an "e". I wonder if all the occurrences of the error are made by people of the same linguistic origin. Out of pure curiosity, I wonder if you could share if you're an English native ? If so, it would rule out this hypothesis. If you are not an English native, would you share your mother tongue with me ? I myself am (an admittedly nosey) French.
by gspr | 2025-05-26 06:53:33+00:00
> If merely choosing Debian is sufficient reason enough for the user to assume that Debian as the distributor acts as a middleman in all sorts of ways, how exactly is that different from an app store?

Because you decide the power of the middleman on your system. And you have full freedom to change whatever the middleman delivers. Neither is typically true of app stores.

> After all you choose to buy an iPhone or use the Google Play store, so if the argument is that consent, given exactly once invalidates any concern, that applies to any platform, nobody's ever been held at gunpoint to install an operating system.

Pray tell, what other choices do I have in the phone market? And how are my choices in the PC market, again?

> I think what would help is indeed if maintainers make significant changes that the user is informed about that very visible during the installation process.

OK. Then I don't think Debian is for you.
Ask HN: Openrouter Free Models
by spapas82 | 2025-05-26 06:53:59+00:00
Hey friends. It's interesting to me that openrouter offers a bunch of completely free models, for example: https://openrouter.ai/mistralai/devstral-small:free ... What's the point of these models ? Who is hosting them and offering these resources for free? What are the disadvantages of these? I understand that they are not the best but they seem good enough to me. Why would I pay to use the OpenAI API when I can use these for free ?
by robocat | 2025-05-26 06:54:42+00:00
> So in practice, even selling it off would produce zero or negative monetary return once debts were settled

In New Zealand that shouldn't happen, because directors are legally required to keep a company solvent.

* cashflow solvency: pay company debts as they become due

* balance sheet solvency: company assets exceed liabilities (including contingent liabilities).

* directors might become personally liable if the company's solvency test is screwed up
by Andaith | 2025-05-26 06:54:57+00:00
I thought this was all history, but:

> Develop and deploy global MISSILE DEFENSES to defend the American homeland and American allies, and to provide a secure basis for U.S. power projection around the world.

> Control the new “international commons” of space and “cyberspace,” and pave the way for the creation of a new military service - U.S. Space Forces - with the mission of space control.

They really just kept at it, huh. Although this part is interesting:

> The Joint Strike Fighter, with limited capabilities and significant technical risk, is a roadblock to future transformation and a sink-hole for needed defense funds.

Wonder why it wasn't cancelled then? Change of mind, or just too many greased palms?
by burnt-resistor | 2025-05-26 06:55:41+00:00
W wanted "righteous revenge" for 9/11 and Cheney wanted profits from military contracts. Those were the most direct interests. (Phantom) WMDs, human rights, and oil were the other oblique excuses. Reaffirmation of the supremacy of American imperialism was another purpose. It lead to $10T of wasted treasure and 500k lives snuffed out for the egos and ambitions of foolish and crooked leaders.
by rorylaitila | 2025-05-26 06:56:27+00:00
Thank you! I've written a web application (I call the adverdex) to assist the process and automatically publish to the site. Magazines are inventoried, then camera images taken for each ad. Each image is cleaned up and cropped, then I use OpenAI to extract the brand, product, tagline and other details. Then I manually review and add more details for the published version. Only full page ads are currently being published but I intend to catalog every ad I encounter.
by AStonesThrow | 2025-05-26 06:56:29+00:00
Anyone with a Google Account who uses Google Maps can submit edit suggestions, but they are all reviewed before publication. You can inform them if the business doesn't exist, has a different address, new website, existing website doesn't work, new business hours; all sorts of things. Not limited to businesses: includes bus stops and train stations, historic landmarks, basically anything where you can drop a pin and see a database entry.

This is probably linked to the process for Search. It's called "crowdsourcing".

https://support.google.com/business/answer/3038311

The article mentions having control of the Google Business Profile. It was sometimes called "Google My Business". You can register and verify that you're the owner, and then you'll have tools to reply to reviews and manage your own Maps entry, etc.

https://business.google.com/us/business-profile/
by arnsholt | 2025-05-26 06:56:53+00:00
Many people, when they say math, mean continuous math.

At work, my colleagues are almost entirely statisticians and actuaries, and I sometimes joke that my only math course at university was Calculus 1. I have of course done lots more math, but it’s all CS type stuff like logic and discrete structures like graphs and trees which is a very different world from continuous stuff.
by TeMPOraL | 2025-05-26 06:56:54+00:00
*clap clap clap*

Though the whole "What I find fascinating is that people still take anything ${A PERSON} says seriously after his trackrecord of non-stop lying, scamming and bllsh*tting right in people's faces for years" routine has been done to death over the past years. It's boring AF now. The only fun aspect of it is that the millions of people who do this all seem to think they're original.

I kindly suggest finding some new material if you want to pursue Internet standup comedy as a career or even a hobby. Thanks!
by jokoon | 2025-05-26 06:57:01+00:00
Maybe the war on terror required to have a foothold in the middle east.

The us was not going to invade Iran or Saudi Arabia. Fighting militias is difficult.

Having troops there allowed to get the enemy (jihadists) where it was, so troops would serve as a lightning rod.

Iraq was probably the place that was the easiest to invade without to many consequences, where nobody would cry about Saddam going away.

I'm trying to see what strategy it was, of course geopolitics are ugly.
by ygouzerh | 2025-05-26 06:57:09+00:00
Peope are living and staying healthy for longer than they used to --> mostly impactful for middle/upper class and above. There is a correlation between life expectancy and job level/wealth: https://pmc.ncbi.nlm.nih.gov/articles/PMC7792745/ .

With retirement at 70, manual labours can already stop dreaming of taking a rest before dying.
by ValentinPearce | 2025-05-26 06:57:10+00:00
> Would you prefer taxes go up instead?

Yes. Looking at my country, we've applied economic liberalism without any positive results at scale. I would prefer we go back to taxing companies more, go back to taxing the rich on their assets and crack down on fiscal fraud (20B€ estimate, about 6% of the national retirement cost).

Instead the government privatizes services that used to bring a steady income and defunds hospitals, education and public research.
by pseudony | 2025-05-26 06:57:13+00:00
> I would even make a stronger claim: People decide to use popular technologies because it makes them happy, and this happens far more often in load-bearing situations than the Obscure Weekend Technologists do. Furthermore, popularity serves as a sort of immunity to further technical inquiry

Spot on. Could not have articulated it better if I tried.

I'll add a data point though: https://flownet.com/gat/jpl-lisp.html

From description AND observed results, this is a case where a team was successful in a challenging situation with lisp and then failed to deliver, first with c++, then java - the indistry-standard languages of the day.
by popol12 | 2025-05-26 06:57:59+00:00
You mixed it up, the guy who lost his finger was a well off co-founder of a crypto company but not super duper rich himself, he was however the friend of a super rich of his co-founders. The goal was to extract money from this other person by hurting his friend.

There was however another case with the french familly of a Dubaï expatriated influencer, with a happier ending this time.
by rjprins | 2025-05-26 06:58:06+00:00
A REST framework for FastAPI and SQLAlchemy, creatively called "fastapi-alchemy". A bit on the ambitious side, but I had the opportunity to open-source work I did for an employer. It is running in production, but it needs extensive documentation and testing still before I'll package it and offer it to PYPI.

https://github.com/rjprins/fastapi-alchemy
by hunglee2 | 2025-05-26 06:58:33+00:00
agree in sentiment, but this is not what is actually happening.

the optimal political system would variably reward / penalise voters based on their voting behaviour, not aggregate all voters (and non-voters for that matter) and apply the consequences to the entire group.

right now, non-Trump voters will suffer just the same amount as pro-Trump voters, leading to widespread (and justified) disillusionment with US style democracy
by tossandthrow | 2025-05-26 06:58:35+00:00
I am curious: From where did you get that it owes you that?

So, I completely agree with most things you say. The core here is: Just don't work 40+ years for a retirement.

Take sabbaticals along the way.

Change your career when it is stale.

The counter for this: Don't buy into the hype. You cannot afford sabbaticals if you need two new cars every 4 years and a house that stretches your finances.
by cryptonector | 2025-05-26 06:59:51+00:00
> My specific concern is that by having logical semantics in a language you can represent non-deterministic ambiguous computations

As I understand it the verse calculus can only represent non-deterministic unambiguous computations, and that follows from confluence. The point is that it's the non-determinism that's useful, not ambiguity. Am I understanding correctly?
by usgroup | 2025-05-26 06:59:55+00:00
>frequentism largely pretends that it doesn't exist. The ongoing replication crisis shows why this is not merely pedantry, but the single most urgent issue in science.

If you mean that Frequentist methods have no way of dealing with parameter uncertainty then your statement is false.

If you mean that some people who use Frequentist methods don't deal with parameter uncertainty then it may sometimes be the case.
by doug_durham | 2025-05-26 07:00:03+00:00
Up until now large software systems required thousands of hours of work and efforts of bright engineers. We take established code as something to be preserved because it embeds so my knowledge and took so long to develop. If it rots then it takes too long to repair or never gets repaired.

Imagine a future where the prompts become the precious artifact. That we regularly `rm -rf *` the entire code base and regenerate it with the original prompts perhaps when a better model becomes available. We stop fretting about code structure or hygiene because it won't be maintained by developers. Code is written for readability and audibility. So instead of finding the right abstractions that allow the problem to be elegantly implemented the focus is on allowing people to read the code to audit that it does what it says it does. No DSLs just plain readable code.
by 4gotunameagain | 2025-05-26 07:00:06+00:00
Having lived in Denmark for quite a while, I will say that it is the societal coherence, and an attitude of working together for all which must have been influenced with the difficulty of surviving in that landscape in the past.

Societal coherence has been aided by the isolation, and here is the hot take: this cannot exist in "diverse" societies. Not because of bullshit genetic superiority justifications, but because no diverse society has so far demonstrated the capacity to have a shared purpose, coherence and high degrees of trust.

And yes, I do find monoculture societies (including denmark) very boring, and I believe diversity has other great benefits. But societal stability and long term prosperity in that sense? Doesn't look like it.

Before someone mentions the US as a counterexample, do not forget that all the prosperity of the US came from basically seizing an underutilised (in the industrial sense) resource rich continent, and now it is falling apart by internal divide.
by steveharrison | 2025-05-26 07:00:18+00:00
I'm working on yet another spending analysis app. How will this one be different?

- Stores transactions locally in a SQLite database, so in theory you could build your own Front End if mine didn't do everything you wanted. Think someone who wants to do a fancy "year end summary" visualisation. And if you want to do a complex filter, can just write an SQL query to the database itself.

- Has a great UI.

- Allows you to write your own import connector and mix 'n' mash between locally-saved CSV/OFX files and APIs, rather than going down the standard route of only supporting Plaid. Current solutions leave users high and dry if the Plaid connector doesn't work well / they want to import old data (Plaid only gives the last 2 years I think).
by jll29 | 2025-05-26 07:00:22+00:00
Nice to see an entirely new category of program, based on the core data type "thought", which is what I would call pre-organized information. A spontaneous thought could become a task or a whole project plan, a project or product, once refined, or a memo, even a book. The value proposition is to capture early where other tools force more orgnization before or at capture. So one problem you solve is losing a nucleus of a thought before having time to enter it in a program that requires more metadata. A second way you provide value is that despite being pre-organized, your "thoughts" are already somewhat actionable - this is what using an LLM gives you.

Personal information management is flooded with useless "TO DO" apps that offer little value over plaim text files (which is what I use for tasks), but it appears you have put something together that caters to the informal side of knowledge management in the same sense that Google catered to informal (unstructured) Web pages, overcoming the world of relational databases and forced categorization of library card catalogs.

My recommendation would be to offer APIs and plain text import/export capabilities to grow your app into an ecosystem that can accommodate playing with enterprise tools or homegrown solutions.

I wish you a huge success with this app!
by zeristor | 2025-05-26 07:01:43+00:00
One key question is that with the construction of the Elizabeth line, and this being a known issue how was that designed and built differently to solve this problem, assuming it has fixed it.

Update:

There’s not a huge amount, but with careful search term tweaking I did find this on the Elizabeth line thermal loads:

https://learninglegacy.crossrail.co.uk/documents/the-design-...