MurphyA/hacker-news huggingface dataset:
by dkersten | 2025-06-10 17:27:42+00:00
> Less Vulnerable Code

> But now, advanced models like ChatGPT o3 or Gemini 2.5 Pro are very good at finding vulnerabilities in code, even though they don’t advertise themselves as “security tools.” Without even trying, they’ve become better at security than many tools made by security companies.

Yeah, but its also CREATING far more vulnerable code at a far faster pace than we did before, and my experience with AI-assisted coding is that they largely fail at finding their own bugs and mistakes.

Also, in terms of testing, my experience with AI's testing code is that they write a lot of easy superficial tests and when they fail, they tend to patch over it (ie change the tests until they pass, rather than actually fixing the bugs causing the failures -- or worse: mark the tests as "skip").

So I don't buy it. I think that AI is causing (and will continue to for at least the next few years) more vulnerable code, not less, and it does it at a faster pace than we were doing before.
by 9rx | 2025-06-10 17:27:52+00:00
To be fair, it is unlikely that Go would have a static type system at all if they had figured out how to achieve the performance expectations without. It was made abundantly clear that it is intended to be like a dynamically-typed language, but faster. Thinking of it as being a statically-typed language is a bit flawed, and shows a gross misunderstanding of what the language was created for.

While you could try to argue that dynamically-typed languages in general are a poor fit for everything, the reality is that people there are typically using Python instead – and the best alternative suggestions beyond Go are Erlang and Elixer, which are also dynamically typed, so that idea doesn't work. Dynamic typing is what clearly fits the problem domain.
by GeekyBear | 2025-06-10 17:29:21+00:00
> The controller part of the SSD is in the CPU. For “reasons” I guess

Probably because Apple spent half a billion dollars for the patent portfolio of a company building enterprise SSD controllers a decade ago. People seem to like data storage integrity.

> Anobit appears to be applying a lot of signal processing techniques in addition to ECC to address the issue of NAND reliability and data retention. In its patents there are mentions of periodically refreshing cells whose voltages may have drifted, exploiting some of the behaviors of adjacent cells and generally trying to deal with the things that happen to NAND once it's been worn considerably.

Through all of these efforts, Anobit is promising significant improvements in NAND longevity and reliability.

https://www.anandtech.com/show/5258/apple-acquires-anobit-br...
Show HN: FreeMyCash – A simple, privacy-first, back end-optional expense tracker
by _tqr3 | 2025-06-10 17:29:35+00:00
I wanted a simple way to track my expenses without connecting to my bank or handing over personal data or dealing with upsells and ads. I started with an Excel sheet, but updating it on my phone wasn’t intuitive.

Free My Cash is a single-file-based finance tracker that runs entirely in the browser. You can create or upload a JSON file of transactions, then edit, categorize, and visualize them. When you're done, just download the file and take it with you.

There are some experimental features too — like importing CSVs from bank exports, and an optional backend that versions your data file on each update. I personally use it with a basic JSON backend.

Try it: https://www.freemycash.com (Click “Try a demo” to test it out)

GitHub: https://github.com/neberej/freemycash
by gjsman-1000 | 2025-06-10 17:29:59+00:00
I love the optimism, but I'm a pessimist. Even at the first paragraph:

> "The original promise of personal computing was a new kind of clay—a malleable material that users could reshape at will. Instead, we got appliances: built far away, sealed, unchangeable. When your tools don’t work the way you need them to, you submit feedback and hope for the best. You’re forced to adapt your workflow to fit your software, when it should be the other way around."

I already have objections: User and businesses overwhelmingly voted with their wallets that they want appliances. The big evil megacorps didn't convince them of this - Windows was a wildly malleable piece of software in the 90s and 2000s, and it didn't exactly win love for it. The Nintendo Switch sold 152 million units, the malleable Steam Deck hasn't broken 6.

Software that isn't malleable is easier to develop, easier to train for, easier to answer support questions for, and frequently cheaper. Most users find training for what's off-the-shelf already difficult - customizing it is something that only a few percent would even consider, let alone do. Pity the IT Department that then has to answer questions about their customizations when they go wrong - user customizations can easily become their own kind of "shadow IT."

The send off is also not reassuring:

> "When the people living or working in a space gradually evolve their tools to meet their needs, the result is a special kind of quality. While malleable software may lack the design consistency of artifacts crafted behind closed doors in Palo Alto, we find that over time it develops the kind of charm of an old house. It bears witness to past uses and carries traces of its past decisions, even as it evolves to meet the needs of the day."

If you think this is okay, we've already lost. People simply will not go back to clunky software of the 2000s, regardless of the malleability or usability.
by syntex | 2025-06-10 17:30:13+00:00
I didn't downvote. T the problem with the paper is that it asks the model to output all moves for, say, 15 disks 2 ^ 15 - 1 = 32767

32767 moves in a single prompt. That's not testing reasoning. That’s testing whether the model can emit a huge structured output without error, under a context window limit.

The authors then treat failure to reproduce this entire sequence as evidence that the model can't reason. But that’s like saying a calculator is broken because its printer jammed halfway through printing all prime numbers under 10000.

For me o3 returning Python code isn’t a failure. It’s a smart shortcut. The failure is in the benchmark design. This benchmark just smells.
by nkmnz | 2025-06-10 17:30:14+00:00
The problem with the article is that they did not make the point you are conveying here.

They say: 1. QF cares only about direct utility 2. $saving a life brings $100,000 of INdirect utility for society and/or the person who's life is saved 3. we (again: who?!) don't care about the direct utility in this case

I have no idea how you can wrap your head around the idea that this is a good representation of any valid critique.

Btw, I think QF is stupid, but that's not the point here.
by ChadNauseam | 2025-06-10 17:31:03+00:00
Support for FileSystemWritableFileStream has been added! It's exciting to me because lack of Safari support was the #1 biggest pain point to using the Origin Private File System. (See my recent Ask HN for more details about the OPFS [0], but the short version is that it gives websites access to a private directory on your computer, that they can write to and read from later.)

I haven't yet been able to verify that it works as expected, but if so, it's very exciting because it means the Origin Private File System is much more usable now.

One reason that the OPFS is so useful is that, unlike other web abstractions for persisting data, the concept of writing and reading files also makes a lot of sense natively. This is an area that's exciting to me because it opens up the possibility of having one codebase that can run natively (using normal file operations) or on the web (using OPFS). This is the approach I took for my in-browser vector database [1], which is powered by an open-source abstraction layer that does just that [2].

[0]: https://news.ycombinator.com/item?id=44197134

[1]: https://github.com/not-pizza/victor

[2]: https://crates.io/crates/opfs
by chubot | 2025-06-10 17:31:19+00:00
It also fixes the problem with eval that is shared with ssh:

ysh-0.29$ eval ls $dir eval ls $dir ^~~~ [ interactive ]:11: 'eval' requires exactly 1 argument

And it fixes word evaluation

YSH Doesn't Require Quoting Everywhere - https://www.oilshell.org/blog/2021/04/simple-word-eval.html

https://oils.pub/release/latest/doc/simple-word-eval.html
by mananaysiempre | 2025-06-10 17:31:23+00:00
Unfortunately, modern cryptographers refuse to design systems for confidentiality of store-and-forward communications, motivated by the fact that one can provide better security in instant messaging[1] (which in most cases implies vendor lock-in). Age is one of the few systems that could accomodate email, and its author’s “solution”[2] is for the user do ASCII armor/dearmor like a caveman, which handily loses to PGP/MIME in just about every email client that supports the latter. So, until somebody does better, PGP email it is.

[1] https://blog.cryptographyengineering.com/2014/08/13/whats-ma...

[2] https://github.com/FiloSottile/age/issues/93
by thorum | 2025-06-10 17:32:00+00:00
Constraints make the specific goal (moon landing) harder, but force technological development. If landing on the moon had been 'easy' with existing tech and not required that massive investment of resources, progress on everything else is delayed. Material science, engines, batteries, solar, radios, integrated circuits, even PCs and smartphones - sure it would all have happened eventually but the key innovations were made when they were because of constraints.
by gffrd | 2025-06-10 17:32:44+00:00
… but people _do_ care about consistency.

They're willing to accept a certain amount of "specialization" for things they care about deeply / use all the time / demand unique approaches, but people like things to look and behave the same when they're pure utility. Which most things are.

People don't complain about Spotify, because (1) the design feels and performs like something Apple would design, and (2) music is something people have feelings about, and so expect differentiation.
by mgraczyk | 2025-06-10 17:33:38+00:00
What do you mean by this?

> it's completely free to use SnapCalorie, the $79.99 price is a donation to support our research

I just downloaded the app and I don't see any way to use the premium plan without paying 79.99 or 6.67/month. How do I choose not to donate?

Or do you mean it's a required donation? And if that's true, in what sense is the article wrong, given that it says exactly that?
by fzwang | 2025-06-10 17:34:19+00:00
We've experienced this scenario a few times, where someone used AI generated code which had significant bugs or mistakes.

- Telling them about the mistake is not as helpful as you think. It's the same as taking an exam, getting something wrong, and looking at the answer key immediately. You feel like you learned something, but it's not as strong, and you're more likely to make the same mistake in the future. Doing things by hand, although painful, is still a strong check on your understanding of the problem.

- It's very frustrating for the person reviewing the code. Reading someone else's code is not easy, esp when they can't articulate what they were aiming for, or there's a big discrepancy from what they think they wrote vs what's actually written. In many cases, the reviewer is thinking "Why did I even bother with this? I should've just vibe-coded this myself. At least I know what should've been done. This isn't even worth it for mentoring purposes, because they did't actually learn anything."

- Using threat/punishment based incentives create a lot of bad vibes and culture. People are less likely to talk about mistakes and spend more time thinking about how to hide their mistakes.

- Eventually, the consensus converges to the position that the best way to learn is to do things manually and it's better when junior folks didn't rely on these tools from the beginning. It's important to explain to them why or else it can seem hypocritical when more experienced people are allowed to use LLMs more freely.
by nrmitchi | 2025-06-10 17:34:25+00:00
I dont think the math works out in a way such that individual employees are not interchangable. It's based on engineer labor cost as a whole; there is no difference if the 3yr year employee was Jack or Jane.

The net result here seems to be a tax-induced penalty to any (software) organization < 5 years old, as compared to a (software) organization with 5 years of employee history.
by exe34 | 2025-06-10 17:34:36+00:00
> I don't have any overall statistics, probably because they don't exist. But I can anecdotally report that I have heard radical "we need to force them if they dont listen" rhetoric from the LGBTQ-Circles several times already in the past years.

Damn those extremists - don't they know how women got the vote, how racial segregation was ended and how persecution of gays by the police was addressed? They really need some civics lesson!
by alephnerd | 2025-06-10 17:35:32+00:00
Enhanced information retrieval is a good tool to have - at some point close reading does become difficult to scale out.

Building experience on how to use tools to automated expected drudgery like making PPT slides or wordsmithing an NSC memo is a good skill to build.

There is a lot of low hanging fruit in professional tooling that can and should be automated where possible, and some class similar to the "Missing Semester" at MIT except oriented towards productivity tools would be helpful.
by kjkjadksj | 2025-06-10 17:36:30+00:00
Replacing him with kamala was the stupidest thing the dnc has done in recent years. What a vote of no confidence towards your own party when you actually bend to trumps bullshit ageism rhetoric and replace him at the final hour with a pick no one voted for. I just do not understand the logic behind the move for the dnc at all. Especially in hindsight when whatever it was supposed to achieve did not work at all.
by GuinansEyebrows | 2025-06-10 17:37:58+00:00
> People are inherently racist/sexist/classist

this feels like missing the forest for the trees.

racism, sexism, classism etc are structural issues. individual prejudices are fear-based levers that are manipulated by bad actors in order to serve economic goals.

it doesn't appear to be difficult to manipulate people using these levers when you're also responsible for the dogshit economic and social conditions they find themselves in.
by yukIttEft | 2025-06-10 17:38:33+00:00
Had also a look at Denuvo a while ago. Used LLVM to remove the x86 obfuscation and broke it down to VM-Opcodes. Atleast back then, Denuvo seemd to translate gamecode into a stackmachine.

This is how a VM push looks like:

temp[0]=add(mem[e268], fffffffffffffff8) mem[temp[0]]]=mem[e560] mem[e268]=temp[0]

(vmreg_e268 is stackpointer, its decremented and stored in tempreg, then the value of vmreg_e560 is copied to stackpointeraddr, then new stackpointervalue is written back)

But i quickly lost interest when it became MBA galore:

temp[7]=sub(add(add(and(mem[ebe8], b2f7), 3fd8), xor(lshr(mem[ebe8], 1), 2684)), lshr(add(mem[ebe8], b2f8), 1)) temp[d]=or(sub(sub(4ad, temp[7]), xor(and(shl(temp[7], 1), 95c), 95c)), 8000) temp[e]=lshr(temp[d], 1) temp[11]=lshr(add(temp[d], 8001), 1) mem[ebe8]=sub(xor(xor(temp[e], 3fff), temp[11]), shl(and(and(temp[e], 3fff), temp[11]), 1))

(looks like its doing some operation with a constant to vmreg_ebe8, but obfuscated by MBAs and most likely the result won't ever being used, so its just noise to drown out the real operations)

BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ?
by woleium | 2025-06-10 17:38:34+00:00
Russia has systematically used social media to spread propaganda and disinformation within the United States, targeting the general public and specific groups to influence political attitudes, exacerbate divisions, and interfere in electoral processes. These efforts have been well-documented by academic research, U.S. intelligence assessments, and criminal indictments.

https://www.nature.com/articles/s41467-022-35576-9

https://www.cbc.ca/news/world/russia-us-election-interferenc...

https://en.wikipedia.org/wiki/Russian_interference_in_the_20...
by rconti | 2025-06-10 17:38:54+00:00
I think this may be overestimating how often people buy tablets. My wife has an iPad Air 1 or 2, so it's close to 10 years old and mostly sits in a drawer. I had a VERY old iPad 2 that I held off on replacing because I wanted to wait for a multi-user iPad.

I finally gave up and bought a Mini6 a year or two ago, which gets.... also minimal use. And I'm sure not buying ANOTHER tablet we're not going to use.

If they were multi-user I actually think we'd both get more value out of it, and upgrade our one device more often.
by SoftTalker | 2025-06-10 17:39:38+00:00
No but one of the things doctors learn is that when you hear hoofbeats, think horses not zebras.

It's not practical to test for everything right away, and if an adult is overweight and presenting with diabetes you initally treat for type 2, and advise losing weight and changing diet.

Every medical school class has people who graduate near the bottom. The critera for entry, and the filters that you have to pass before you can practice as a physician means that even those people are generally decent doctors.

I'm not saying doctors are never wrong but you're not likely outguess even an average doctor by googling your symptoms. It's very easy to convince yourself you have some rare condition because your symptoms match, but you ignore "rare." The fact that someone has an anecdote to the contrary doesn't change this.
by const_cast | 2025-06-10 17:39:49+00:00
Because the BLM protests WERE peaceful. I went to some - man, we just walked around.

What happened was that people took clips of events in specific cities at specific times and then tried to extrapolate that out. When, in reality, most protests had no violence. Meanwhile, police were shooting rubber bullets at people while the people were just standing there.

Even now, with these "riots", most of the clips I'm seeing are actually from BLM protests years ago. Does anybody know this? Is anybody fact-checking anything? Apparently not. But, for gullible authoritarians that's all it takes. Show them a picture of a car on fire and their mind will hop and skip out of their ear.
by onlyrealcuzzo | 2025-06-10 17:39:50+00:00
Does this imply the secret to success is making your life / business / product space artificially hard?

It seems like you'd do a better job "setting yourself up for success" than making your life as hard as possible, and hoping "that which doesn't kill you only makes you stronger" doesn't, in fact, "kill" you (metaphorically or literally speaking).
by chubot | 2025-06-10 17:39:59+00:00
Ah yes, that's clever:

$ sh -c "$(quote-argv -echo 'file with spaces')" sh: 0: Illegal option -h $ sh -c "$(quote-argv-left -echo 'file with spaces')" sh: 1: -echo: not found

Over ssh:

$ ssh example.com "$(quote-argv-left -dashtest 'file with spaces')" -dashtest file with spaces
by uczekalla | 2025-06-10 17:40:23+00:00
CodeWeavers | St Paul, MN, USA | Toronto, ON, CA | Full Time | ON-SITE | Engagement Manager

https://www.codeweavers.com/about/jobs

CodeWeavers is looking for an Engagement Manager to take point on managing client-facing engagements, with a focus on process—not just deliverables. You’ll be the go-to person for PortJump and ExecMode clients from kickoff through completion and beyond.

Please see link above for information, compensation, requirements, and how to apply.

Please direct any questions to the email address on our Jobs page.
by senfiaj | 2025-06-10 17:40:30+00:00
https://status.salesforce.com/generalmessages/10001540

"Update 6: Posted Tue, 10 Jun 2025 11:27:51 UTC

The third-party provider disabled a single server, which did not yield a positive outcome. We are continuing our investigations with the provider."

I wonder, do they mean this whole shitshaw was caused by just one fucking third party server?

Even their status page (https://status.heroku.com/) doesn't work normally. This is incredible.
by WarOnPrivacy | 2025-06-10 17:40:53+00:00
From the article: some experts are concerned Chinese vehicles could represent a security risk from hackers and third parties.

Drivers are unsafe now from US and EU vehicle manufacturers - all of which are deeply and continually surveilling drivers and their environments. US/EU corporations are free to exploit the public with that data and are fully devoted to doing so. It is the first priority that needs addressing.

While Chinese corporations are no more trustworthy than their US/EU counterparts, Chinese corps do not have the same access to US/EU citizens. Being out of reach makes US/EU citizens safer.

US/EU citizens should be out of reach of exploitive US/EU corporations but a pervasive dearth of ethics (govs & corps) keeps this off the table.
by aequitas | 2025-06-10 17:41:25+00:00
I have a mid 2015 Macbook Pro 15", also with OpenCore. Running just fine. No issues with Safari and Cloudflake. Only thing is the battery was mostly dead. I replaced it with a iFixit diy battery kit, but that one died completely after just 2 years (out of warranty of course). Probably the controller board, as the cells were nowhere near empty. Now I have the choice to replace it with a cheap battery from unknown source or yet another iFixit one which costs almost the price of this laptop second hand. But I have lost trust in this iFixit product as others seem to have the same problem. Just sucks to have perfectly fine hardware locked behind another expensive battery repair.
by chrismorgan | 2025-06-10 17:41:29+00:00
We used to have such customisation, then it kinda went away for a while because it was too hard and limited development, and then dark mode was hailed as a brilliant new invention.

But it is worth remembering that dark mode does actually get you some things; it’s not all bad: the restrictions do have some value.

Full customisation became paradoxically limiting: when you give too much power to the user, the app is essentially operating in a hostile environment. Of course, a lot of it was laziness on app and UI framework developers’ parts, but it really did limit innovation, too.

Dark mode gets you a pair of themes that you can switch between easily, and an expectation that there are only two themes you need to consider, with well-defined characteristics. This is a much more practical target, a vastly easier sell for app and framework developers.

The funny thing with monochrome icons is that in some ways they were actually a better fit for a full-customisation environment, where you had arbitrary background and foreground colours. Once it’s just mundane light and dark themes, you could more safely have full colour in two variants.

Certainly light mode and dark mode does not mean things need to be monochrome.
by PleasureBot | 2025-06-10 17:41:38+00:00
The most common response I've heard from people who believe the government lied about the COVID vaccine is that they take issue with the word 'vaccine'. They think it should not have been described as a vaccine since you can still get COVID after getting the vaccine, and the vaccine has a certain timeframe after which it loses efficacy because the virus mutates.

Pointing out that other vaccines have these exact same properties just leads to them claiming all of those are not really vaccines and we need to stop recommending them. In their mind if its not a shot you get once, after which there is no possibility of contracting the disease, it is a hoax.

You can see exactly this train of thought in this thread from some people
by lacker | 2025-06-10 17:42:14+00:00
The DFW style is not just "literary", it's dense, full of self-referential hints, critical footnotes, invented acronyms, retellings of the same events from multiple perspectives. I like Rudy Rucker a lot but his work is nothing like it.

The core problem with this book is that it is a great book for people who love both math and Infinite Jest. But, that might be an audience of nobody. Or almost nobody, because it does include me.