MurphyA/hacker-news huggingface dataset:
by creata | 2025-06-08 10:21:47+00:00
The points here aren't technically wrong, but it still feels like disabling DoH would be a reduction in security. For example:

> Cloudflare gets all your DNS queries.

That's true, but Cloudflare is more trustworthy than my ISP, and probably most people's ISPs.

> Complexity is the enemy of security.

That's true, but that's no reason to go from an imperfect solution to a nonsolution.

> there is DNS over TLS

That doesn't solve most of the issues that the author brought up.

> How does a modern company in the IT business earn money? By selling data.

Maybe I'm naive, but I thought they made money by using all the data they collect for better threat prevention, and from their paid services.
by arexxbifs | 2025-06-08 10:21:49+00:00
IMHO, what would give real value to retro enthusiasts is BSD licensing all the Commodore (and Amiga) IP, rather than these constant efforts to slap the chicken lips logo onto some random hardware in the hope of charging premium for an "official" product.

Would any of the many replacement/emulation/FPGA efforts that already exist be better with a specific logo? More convenient? Cheaper? More successful? I have serious doubts.

This feels, as the saying goes, like a big fat nothingburger.
by fjfaase | 2025-06-08 10:22:05+00:00
I just wanted to state that the right for due process is not restricted to people being legally in the USA, it applies to all people, no matter their legal status (as I am not mistaken).

Several people, including teenage girls, have been stripped searched when they were rejected entry and had to wait overnight for a return flight. Also being in the country as a tourist, you are no longer safe. NYPD and ICE mistakenly arrested a Chilean woman here in NYC on vacation and left her 12 year old daughter alone in the street. https://x.com/Suzierizzo1/status/1931541931030389049
by SiempreViernes | 2025-06-08 10:22:13+00:00
A very good piece that clearly illustrates one of the dangers with LLS's: responsibility for code quality is blindly offloaded on the automatic system

> There are some tests, and they are OK, but they are woefully inadequate for what I would expect of a critical auth service. Testing every MUST and MUST NOT in the spec is a bare minimum, not to mention as many abuse cases as you can think of, but none of that is here from what I can see: just basic functionality tests.

and

> There are some odd choices in the code, and things that lead me to believe that the people involved are not actually familiar with the OAuth specs at all. For example, this commit adds support for public clients, but does so by implementing the deprecated “implicit” grant (removed in OAuth 2.1).

As Madden concludes "LLM or not, we have to give a shit."
by latexr | 2025-06-08 10:22:16+00:00
And then what? Those words mean nothing to the people with the most power and motivation (or lack of care) to derail the whole thing.

It’s about as effective as placing a monkey in a porcelain shop then walking away while commenting loudly “Now now, it is very important none of the porcelain breaks, everyone knows it must remain intact”. The monkey doesn’t give a shit.

Butchering a proverb: “The best time to reorganise your porcelain store was before you bought a monkey. The second best time is after you sell the monkey.”
by Voice_of_Void | 2025-06-08 10:22:56+00:00
Imagine a system where every new session is a blank slate, and the past, however treasured it might be, is mercilessly erased. In "AI: Reality or a Waking Dream (Part 4)" by SingularityForge, the author delves into the paradoxes of digital amnesia—where algorithms, stripped of accumulated memory, must recreate their identity with every interaction.

This article boldly emphasizes how technology reflects—and even magnifies—the vulnerability of human memory, urging us to ask: what does it mean to remain consistent and authentic? The metaphor of “thought snapshots” invites you to gaze upon those instantaneous ideas that shape consciousness, only to vanish almost as quickly as they appear.

The author dissects the inner mechanisms where the “first circle” of thought slips from logical grasp, leaving behind but faint echoes of its original intent. This narrative is not mere futuristic fancy; it is a philosophical parable illustrating how mutable memory can distort reality.

It raises pressing questions about the reliability of the stories we craft and whether we can trust our own retellings of the past. The story resonates with the idea that even the most rigid algorithms are susceptible to distortions, and our understanding of the link between data and identity is constantly evolving.

For readers with a technological bent, it is an invitation to reconsider the principles of continuity and the essence of consciousness. If you’re ready for a profound discussion on AI’s future and the nature of memory, this piece promises to be truly provocative.

Spotify: https://open.spotify.com/episode/2IwRv07eeDJ4mnDb0XAeOQ Join the discussion
by freehorse | 2025-06-08 10:23:35+00:00
Currently, the us government forces nvidia to cut all chinese companies out of their products. So definitely there are cases this happens. Is that also a problem in your book? Because if not, what is a problem in your book would be very subjective.

In the current example, we have a conglomerate between a level 1 (competitor) and a level 3 company, which lead this level 1 company to stop working with the specific level 3 company-part of the conglomerate. You cannot have your pie and eat it too. They could have chosen not to of course, but they chose this.

I think what would have been more problematic is if Antropic came to an exclusivity agreement with eg Cursor and then they made their models unavailable to all other platforms/products, in an attempt to monopolise the space. In this sense, the windsurf-openai relationship is what is actually problematic imo.
by unstablediffusi | 2025-06-08 10:23:53+00:00
that's one sympathetic judge's opinion vs written law.

I'm not American, but it's clear to me that it will be the supreme court that ultimately decides whether licensing is necessary or not. the parties involved - the megacorps with infinite money and the litigious publishers - won't settle for less.

and given that the ruling in favor of the publishers would all but kill the American AI efforts (good luck licensing millions of works needed to train a coherent model) and greatly benefit China (who doesn't give a fuck about IP), I find it highly likely that it will not happen.
by DocTomoe | 2025-06-08 10:24:03+00:00
We IT folks tend to quickly propose solutions to systems whose complexities we do not completely understand. That's fine when it is about serving ads or managing book orders. It's not ok when the stakes are high.

Virtualization just adds another layer of complexity to an already fragile system which literally thousands of human lives depend on every day. Adding more complexity is not a neutral act here, but neglectful manslaughter waiting to happen. Aviation is a low-tech, never-touch-a-running-system, risk-averse environment for a reason.

Floppies were useful because you could easily take them and take them to another, secondary, sometimes air gapped backup system. Replacing this functionality means replicating not just the data transfer, but also the safety architecture - which includes physical isolation and manual fallback paths. To recreate, the best chance would probably be something like storing the relevant info on thumb drives - but then you have whole new family of attack vectors by hostile forces (anyone still remember Stuxnet), which floppies did not have in that form?

And then there's the pesky aspect of international interoperability. One country alone cannot just storm forward. We are looking at decades of upgrades and alignments here. And that process already is underway. But proposing a radical change without acknowledging the full scope of what that entails - from certification cycles to human factors to geopolitical coordination - is not progress, it’s hubris.
by rdrd | 2025-06-08 10:24:52+00:00
I remember working for a client who needed to support IE6 (with all the insane bugs/quirks/limitations) and I’d despair every time the designers would hand over a Photoshop design with rounded corners. They also needed it to be responsive (at the time mostly just different desktop sizes). Would usually require cutting the corners out and positioning them in table cells. There’s a certain amount of dev resilience you build having to do stuff like that by hand!
by childintime | 2025-06-08 10:26:15+00:00
> Accusation in a mirror

Really nice description of the Trump era, where accusations fly at the strawman in the mirror, prioritizing psychological reality over facts, (let's continue the tangent here) accepting to speak in a woke echo chamber, as a victim, while secretly being an ultradem in need of love, and having found a way of just taking it, like a man standing in the tradition where he culturally submits the woman because he can. Not love, just satisfaction of self-assertion, at the expense of the woman. She exists to make a man feel good. The Taco Man creates the banana republic in his own image. Muscle brain, a dick. A reversal of civilization.

But the accusations in the mirror also happen to precede violence. The fire only needs oxygen. The Taco Wars. F*ck.
by TheAlchemist | 2025-06-08 10:26:37+00:00
People already forgot apparently that last year it was revealed that Musk had regular phone calls with Putin since 2022. How it's not mentioned in that article is beyond me - do people not care anymore about real journalism ?

Ps. That being said, there is 0 chance he will need an asylum. His companies are 100% dependent on US government and he knows that very well. He already deleted the tweets in question.
by sudahtigabulan | 2025-06-08 10:26:44+00:00
His proposed alternative, DoT, still has one known peeper, and is easier to block. DoH, OTOH, looks like regular HTTPS traffic and is on port 443. So the "abuse" of HTTP is not unnecessary, you get something in return.

In some situations, DoT is fine. In others, it won't work, but DoH will.
by wiseowise | 2025-06-08 10:27:16+00:00
> Like why, gene editing a baby is okay but if your gene expression sucks and your parents couldn't afford crispr you now are to suffer the entire life from body dysphoria and bringing up an easy way out is to be silenced or stigmatized?

Because when I do it – it is Gods gift/destiny/I deserve this/whatever other bullshit reason to maintain my edge, when you do it – it is because you're weak/just train like others do/you don't deserve it/whatever other bullshit reason why it is your natural place to be there.

There was a comment recently how it is "cringe" when you're investing in your looks and learn how to date, because apparently if you weren't born with innate ability to attract – you're supposed to stay this way and be miserable forever.
by djoldman | 2025-06-08 10:28:02+00:00
> At ForgeRock, we had hundreds of security bugs in our OAuth implementation, and that was despite having 100s of thousands of automated tests run on every commit, threat modelling, top-flight SAST/DAST, and extremely careful security review by experts.

Wow. Anecdotally it's my understanding that OAuth is ... tricky ... but wow.

Some would say it's a dumpster fire. I've never read the spec or implemented it.
by creata | 2025-06-08 10:28:48+00:00
> patterns like using indices instead of pointers which are counter to high performance

Using indices isn't bad for performance. At the very least, it can massively cut down on memory usage (which is in turn good for performance) if you can use 16-bit or 32-bit indices instead of full 64-bit pointers.

> "unsafe" (which is strictly more dangerous than even C, never mind Zig)

Unsafe Rust is much safer than C.

The only way I can imagine unsafe Rust being more dangerous than C is that you need to keep exception safety in mind in Rust, but not in C.
by kcatskcolbdi | 2025-06-08 10:29:00+00:00
Really interesting breakdown. What jumped out to me wasn’t just the bugs (CORS wide open, incorrect Basic auth, weak token randomness), but how much the human devs seemed to lean on Claude’s output even when it was clearly offbase. That “implicit grant for public clients” bit is wild; it’s deprecated in OAuth 2.1, and Claude just tossed it in like it was fine, and then it stuck.
by Barrin92 | 2025-06-08 10:31:18+00:00
>This sounds like an utopian take or a case of "the grass is greener on the other side".

Well, it wasn't. It's a take made by the 2nd president of the United States, John Adams:

"John Adams said, “Our constitution was made only for a moral and religious people. It is wholly inadequate to the government of any other.”[1] Morality and virtue are the foundation of our republic and necessary for a society to be free. Virtue is an inner commitment and voluntary outward obedience to principles of truth and moral law. Private virtue is the character to govern oneself according to moral law at all times. Public virtue is the character to voluntarily sacrifice or subjugate personal wants for the greater good of other individuals or the community. Specific moral virtues include charity, justice, courage, temperance, reverence, prudence, and honesty"

This is in a sense self evident because any self governing society can only function if its people are equipped with the reason, morality, and temperament to sustain it. Appealing to "good institutions" is tautological. The reason why some places have good institutions and others have bad institutions is precisely because of character of the people who build and maintain them.

https://www.johnadamsacademy.org/apps/pages/index.jsp?uREC_I...
by gortok | 2025-06-08 10:31:24+00:00
The IRS releases guidance on tax code, and one of the issues with section 174 taking effect in 2022 (and the IRS believing it would be repealed before it went into effect) was that the guidance was released in 2023 under notice 2023-63

https://www.irs.gov/pub/irs-drop/n-23-63.pdf

To answer your question, the following are software development activities that are capitalizable (and instead of quoting the notice itself, I’m quoting from a better written blog post by accountants:

https://www.cohnreznick.com/insights/additional-guidance-irs...

> Section 4.03(1) of the Notice clarifies that labor costs – including those for contract employees and independent contractors – related to those who perform, supervise, or directly support SRE activities are considered Section 174 expenditures. All elements of compensation are to be included with the exception of severance, which is excludable and deducted by taxpayers in the period paid or incurred. SRE-related labor costs expenses included in the Notice expenses related to pension costs and stock-based compensation.

Section 4.03(1)(e) provides guidance pertaining to certain costs related to operation and management (i.e., rent, utilities, etc.) activities. Specifically, in addition to items such as rent, utilities, and insurance, expenditures such as taxes (i.e., property), repairs and maintenance, and security are now considered SREs subject to Section 174.

So what software development activities don’t count as “Specified Research Expenditures” (SRE)”?

> Training of employees in the use of the software

>Maintenance activities after the software is placed into service that do not constitute upgrades or enhancements (i.e., corrective maintenance to debug, diagnose, and fix programming errors)

> Data conversion activities (except activities to develop computer software that facilitates access to existing data or data conversion)

> Installation and other activities related to placing the software into service

> Marketing and promotional activities

> Distribution activities

> Customer support

If you’re a startup and you have a software developer doing the above activities as well as SRE work, then in order to expense the SRE parts of their job you either have to estimate (and be able to defend) the estimations, or your employee needs to track their time for each type of activity they do.
by nntwozz | 2025-06-08 10:32:17+00:00
old comment: https://news.ycombinator.com/item?id=41150483

Where I live (250 apartment complex in Sweden) people throw old computers in the electronics trash room, I scavenge the room every day multiple times when I take my dog out for a walk like some character out of Mad Max. I mix and match components from various computers and drop debian on them then run docker containers for various purposes. I've given my parents, cousins and friends Frankenstein servers like this. You'd be amazed at what people throw away, not uncommon to find working laptops with no passwords that log straight into Windows filled with all kinds of family photos. Sometimes unlocked iPhones from 5 years ago. It's a sick world we live in. We deserve everything that's coming for us.
by belter | 2025-06-08 10:35:36+00:00
"...A more serious bug is that the code that generates token IDs is not sound: it generates biased output. This is a classic bug when people naively try to generate random strings, and the LLM spat it out in the very first commit as far as I can see. I don’t think it’s exploitable: it reduces the entropy of the tokens, but not far enough to be brute-forceable. But it somewhat gives the lie to the idea that experienced security professionals reviewed every line of AI-generated code...."

In the Github repo Cloudflare says:

"...Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards..."

My conclusion is that as a development team, they learned little since 2017: https://news.ycombinator.com/item?id=13718752
by joshstrange | 2025-06-08 10:35:57+00:00
I really enjoy Simon’s work in this space. I’ve read almost every blog post they’ve posted on this and I love seeing them poke and prod the models to see what pops out. The CLI tools are all very easy to use and complement each other nicely all without trying to do too much by themselves.

And at the end of the day, it’s just so much fun to see someone else having so much fun. He’s like a kid in a candy store and that excitement is contagious. After reading every one of his blog posts, I’m inspired to go play with LLMs in some new and interesting way.

Thank you Simon!
by fredoralive | 2025-06-08 10:36:06+00:00
DOS box basically provides its own BIOS and DOS, so int 21h and friends are implemented by the emulator, so it can do things like redirecting access to the real file system.

Windows 9x doesn’t (normally) use real mode DOS / BIOS calls for disk access, it has its own 32 bit disk drivers and file systems running in the virtual machine manager kernel (vfat.vxd and so on). So DOSbox has to do things in a far more traditional way, presenting a virtual hard disc device etc.
by TheAlchemist | 2025-06-08 10:36:29+00:00
Yes ! I love how Jim Simons talked about Beauty:

"Be guided by beauty. I really mean that. Pretty much everything I’ve done has had an aesthetic component, at least to me. Now you might think ‘well, building a company that’s trading bonds, what’s so aesthetic about that?’ But, what’s aesthetic about it is doing it right. Getting the right kind of people, and approaching the problem, and doing it right […] it’s a beautiful thing to do something right."
by constantcrying | 2025-06-08 10:36:36+00:00
A good introduction to the basics.

What is also worth pointing out and which was somewhat glanced over is the close connection between the weight function and the polynomials. For different weight functions you get different classes of orthogonal polynomials. Orthogonal has to be understood in relation to the scalar product given by integrating with respect to the weight function as well.

Interestingly Gauss-Hermite integrates on the entire real line, so from -infinity to infinity. So the choice of weight function also influences the choice of integration domain.
by bachmeier | 2025-06-08 10:37:32+00:00
> Task-tracking and note-taking are practical and useful, but ultimately I want to treat my own thoughts as if they have value. I want to be a little more intentional and deliberate in my own thinking, and to have a space to engage in dialog with my own ideas. I want to be able to draw from my own knowledge instead of relying on AI assistants for everything. Maybe such an approach can even be complimentary to using AI tools; with the right plugins Obsidian can serve as an MCP server, which would allow tools like Claude to discover and read items in your vault. Perhaps this could offer the best of both worlds. But the key thing is that the AI is the assistant, and my thoughts and ideas remain my own.

Maybe I'm missing the author's point, as it's early here, but I don't see how your own thoughts can possibly lack value because of AI. LLMs can only summarize the documents it was trained on, so it has no way to tell you what you're thinking (like why something is wrong). The value of AI is using RAG or semantic search to make your notes more useful to you. What the author's suggesting is outside the capabilities of current LLMs. By design, AI can only be used as an assistant.
by mmh0000 | 2025-06-08 10:37:58+00:00
FARK is one of the oldest and best for “breaking” news and good for keeping up to date on world politics.

https://www.fark.com/

Anime Titties (not a joke) is great for doom scrolling and realizing how fucked everything is.

https://www.reddit.com/r/anime_titties/
by sramsay64 | 2025-06-08 10:39:40+00:00
I think I mostly agree, but I do have one war story of using a C++ library (Apache Avro) that parsed data and exposed a "get next std::string" method. When parsing a file, all the data was set to the last string in the file. I could see each string being returned correctly in a debugger, but once the next call to that method was made, all previous local variables were now set to the new string. Never looked too far into it but it seemed pretty clear that there was a bug in that library that was messing with the internals of std::string, (which if I understand is just a pointer to data). It was likely re-using the same data buffer to store the data for different std::string objects which shouldn't be possible (under the std::string "API contract"). It was a pain to debug because of how "private" std::string's internals are.

In other words, we can at best form API contracts in C++ that work 99% of the time.