MurphyA/hacker-news huggingface dataset:
by teddyh | 2025-06-23 08:28:01+00:00
> 1) That would do nothing to fix resolvers that had already cached NSEC responses lacking type maps.

The TTL for NSEC records are presumably way lower than the TTL for the DS records.

> 2) That presumes the wildcard record was superfluous and could have been replaced with a simple A record for a single or small number of records. Would love to see a citation supporting that.

It’s theoretically possible that it would not have worked for all cases, but that is, in my experience, very unlikely.

> Any way you slice it, there was no quick way to fully recover from this bug once they hit it

The bug seems to me to have been reasonably easy to mitigate, but their problem was that Slack did not know what they were doing. Thu bug itself was minor, but Slack tried to fix it by stopping to serve DNSSEC-signed DNS data, while long-TTL DS records were still being unexpired in the world. This is the worst possible thing you could do.

> Of the top 100 domains -- the operators you would assume would be the most concerned about DNS response poisoning -- *six* have turned DNSSEC on.

1. That number used to be zero, as tptacek liked to point out.

2. The huge operators often have fundamentally different security priorities than regular companies and users.

3. People said the same about IPv6 and SSL, which were also very slow to adopt. But they are all climbing.
by udev4096 | 2025-06-23 08:28:26+00:00
That looks cool. So, with project satyr, you are hoping that attackers would access your honeypot proxies from their actual IP? I find that hard to believe. Most of them either use a reputed VPN or Tor as their first point of entry so you are just hoping for low hanging fruits here, which makes for a shitty threat intel
by arkey | 2025-06-23 08:29:23+00:00
This keeps getting repeated all around the comments, but it's absolutely false.

Christians, Jews and Muslims are monotheistic and all claim to be the religion of the One God, yes.

But the Jews rejected the God the Christians believe in, and the Muslims describe/portray a god that is absolutely incompatible with the Christian God.

So essentially no, they can't possibly all believe in the same God.
by yorwba | 2025-06-23 08:30:55+00:00
It's not like AI hardware acceleration is some niche field that nobody would be researching if there were no sanctions. Academics started flocking towards hardware for AI workloads as soon as it became a trendy topic to be working on (of course back then it was mostly convnets). Maybe recent sanctions have increased the total funding pool, but that's not something you can infer by just gesturing at a single paper.
by Someone | 2025-06-23 08:33:04+00:00
FTA (emphasis added): “Chris Lattner mentioned that Python can actually CALL Mojo code now”

So, the message is that it is possible to create nice Python bindings from Mojo code, but only if your Mojo code makes the effort to create an interface that uses PythonObject.

Useful, but I don’t see how that’s different from C code coding the same, as bindings go.

Both make it easier to gradually move Python code over to a compiled language.

Mojo presumably will have the advantage that porting from Python to Mojo is much closer to a copy paste job than porting Python to C is.
by kzrdude | 2025-06-23 08:33:05+00:00
The free plan on overleaf only allows collaboration between 2 people. If you have 3 students in your report assignment then you can't use overleaf for free.

That sounds like a sign that overleaf is struggling, that they had to make that change.

And Typst is more generous there, you can collaborate 3 people with no problem.
by melodyogonna | 2025-06-23 08:33:17+00:00
From Chris Lattner on Modular discord few days ago:

Yep, that's right. Int behaving like a machine integer is very important for systems performance. Leaving the "int" namespace untouched allows us to have a object-based bigint in the future for compatibility with python. As others have mentioned above, it is still a goal to be compatible with python in time, just not a short term priority
by alt227 | 2025-06-23 08:34:15+00:00
> Knowing your value

This is, in my experience, the biggest aspect of the whole process. If you go into a raise negotitation undervaluing yourself, you are always going to come out short. By looking at my role, how I help the company, and what it would take for them to replace my skillset (including training and learning company policies/procedures etc) I have massively improved my confidence in this area and been able to consistently negotiate much bigger raises.

Most companies would much rather throw $10-20k at a small problem to make it go away, instead of going through the hassle of a new hire and everything that goes with it.
Show HN: Tuisic – A simple TUI online music streaming application
by dark-kernel | 2025-06-23 08:34:23+00:00
Hi HN,

I built Tuisic, a terminal-based online music player.

It’s probably the first of its kind — a minimal CLI app where you can search, stream, and download music from multiple online platforms without ever touching a browser. No ads, no distractions.

+ Features: - Works with YouTube, SoundCloud, JioSaavn, Last.fm, ForestFM (YouTube Music coming) - Clean terminal UI built with FTXUI - Vim-like controls and keyboard shortcuts - Favorites list, easy sharing, and downloading - Optional MPRIS (DBus) support for `playerctl`, media keys, etc. - Lightweight and doesn't depend on Electron or a GUI

There's also a basic "daemon mode" (press `w`) for leaving it running in the background.

+ GitHub: https://github.com/Dark-Kernel/tuisic

+ AUR package: `tuisic-git`

Would love feedback or testing, especially from CLI lovers and Linux users. Contributions welcome — even better if you help bring Apple Music or Spotify support one day :)

– Sumit Patel (Dark-Kernel)
by tiniuclx | 2025-06-23 08:35:10+00:00
The advice in here is really good, and it's helped me personally quite a lot.

One thing to bear in mind is that the negotiation process _does not start at the offer stage_. It starts as soon as a recruiter/hiring manager gets in touch with you. Really, do not be the first one to name a number. I did that to a recruiter once & it came back to bite me at the offer stage as there was wiggle room in the budget that I could not really ask for as I'd already compromised my negotiation position.

Thankfully I got another offer a few days after which I _did_ negotiate properly - and it was a step up in all the ways that matter.
by willvarfar | 2025-06-23 08:35:27+00:00
Could some of the paths result in insecure ciphers and those moments of insecurity lead to a broader compromise?

E.g. the program goes through a state that is effectively 2DES which enables a meet-in-the-middle attack which allows an attacker to jump into the path at that point and dramatically reduce the search space for the next or preceding block etc?
by john-h-k | 2025-06-23 08:35:32+00:00
> You stated to "feel" generally intelligent (A's don't feel and don't have an "I" that can feel) - Your nuanced, subtly ironic and self referential way of formulating clearly suggests that you are not a purely algorithmic entity

This is completely unrelated to the proof in the link. You have to clearly explain what reasoning in your argument for “AGI is impossible” also implies human intelligence is possible. You can’t just jump to conclusions “you sound human therefore intelligence is possible”
by sometimes_all | 2025-06-23 08:37:16+00:00
It depends on the country and the company. For example, here in India:

- if you're negotiating with a US tech giant (FAANG, etc) from a position of strength (more than one offer, very good interview and past credentials), you can get away with almost anything, since they want great developers, and they don't mind paying above market. If you barely passed the interview, or you don't have a strong position, they'll just say take the offer or we won't go ahead.

- If you're negotiating with US-based startups or EU companies, then they might not want / be able to go very far with respect to salary (equity is doubly risky for the candidate if they aren't in the US), you can negotiate for great health insurance, more time off, fewer working hours, other benefits.

- If you're negotiating with Indian companies, they'll just hop on to the next candidate who passed the interview and is more desperate than you are. Most Indian companies tend to believe neither in fair wage, nor work life balance, so they won't negotiate properly on either. An employee is not just a replaceable cog, she cannot be allowed to exercise any sort of negotiation lest their current employees start getting ideas.
by ciphernomad-org | 2025-06-23 08:38:16+00:00
Let's clarify.

1. CVM State: It's an internal 32-byte register, not pre-shared. For each operation, it's initialized from a unique nonce (e.g., enc_nonce). This nonce is transmitted publicly with the ciphertext as part of a structured payload. The CVM's subsequent state evolution is secret, as it depends on the master key and operational history. It's an input to the round key derivation, not the round key itself.

2. Path Determination: The path is determined by the ciphertext chunk. During decryption, the ciphertext is used with the key and current state to find the path before it's decrypted.

3. Path Collision: This is critical because it implies a state collision. Since round keys are derived from the state, a state collision at the same Labyrinth node would cause catastrophic key reuse. The state ratchet is designed to make this negligible.
by rcxdude | 2025-06-23 08:38:30+00:00
Note that the page file is essentially a datastructure which maps addresses to other addresses, but it also resides in the same physical memory. If you were to try to map every byte of a system to different physical address, it would need significantly more memory than the system had! Further, the datastructure needs to allow efficient lookup of data because the pagefile mapping occurs on every memory access (results are cached in the Translation Lookaside Buffer (TLB) and the speed and accuracy of this cache is often a limiting factor in the speed of the CPU). This all biases towards the mapping wanting to be quite coarse, in fact 4kB is probably already not optimal on today's systems with gigabytes of memory.
by jeroenhd | 2025-06-23 08:38:31+00:00
I'm surprised they did a hardware check within the app rather than just restrict the app on the iOS app store side. Surely they should've marked your phone incompatible before you wasted your time downloading the app?

I do wonder what makes older phones incompatible, though. Others are complaining about the performance, so it could be that the low amounts of RAM Apple puts in their phones is starting to catch up, or it could be as simple as them not having trained their AI models for some older phones yet.
by Cthulhu_ | 2025-06-23 08:39:33+00:00
That's what investor money will do; in western Europe, the same thing has happened with office buildings. At one point, 40% of all office space in the Netherlands was vacant. Investors prefer to invest in office space over housing because it's less parties to interact with, higher rent, 10 year lease contracts, and 100 year lifespan.
by mrob | 2025-06-23 08:39:47+00:00
Comfort can be improved by using a dedicated ebook reader. It's lighter than a paper book, makes it easier to turn the page, and the text can be configured so that every book uses identical typography (the most legible typography is the typography you're used to).

Eye strain suggests you probably need corrective lenses of some type. If so, fixing this will improve your quality of life in more than just reading books. Good lighting is also important. E-paper has the advantage that it can be used in bright lighting, e.g. outdoors. For indoor reading you might want a desk lamp positioned to shine extra light on the ebook reader.
by leptons | 2025-06-23 08:40:36+00:00
Instead of offering to replace the batteries, or making a phone with an easy to replace battery, Apple chose the shady move and hid their "solution" from the public and just slowed down older phones.

>"In March, Apple agreed to pay up to $500 million to settle claims of intentionally slowing down older phones."

They got slapped on the wrist. This resulted in them making the batteries slightly easier to replace, but their batteries are still impossible to replace by the average iPhone owner.
by fc417fc802 | 2025-06-23 08:41:24+00:00
I agree with your general sentiment of regulatory dysfunction. But I'd like to point out that it's not so straightforward to purchase a lot of that stuff in the US either. Perhaps not quite as legally involved as the EU but still not simple.

You can also just make most things yourself. It isn't cost effective for a commercial entity (due to wages for highly educated professionals) but for a hobbyist, who cares? That of course calls into question the bulk of the regulatory approach. When I can pull up a youtube video of someone making solid rocket fuel with a plastic jug and a phone charger what was the point of requiring all the paperwork?

If you're lucky the recommended videos will even have footage of someone getting arrested for misusing something substantially similar.
Show HN: Mobile app that creates Manga-style images from text
by mirzemehdi | 2025-06-23 08:41:36+00:00
My friends are a big manga fan and I wanted to make them something cool for their birthday — something creative where they could make manga-style scenes easily. That's why I created Mangii app.

I used OpenAI’s new image generation, but just writing a prompt didn’t work well out of the box. I had to experiment a lot to get the manga look right.

Eventually, I ended up turning it into a small app that always keeps the manga style and lets you try different ideas.

Still early, but fun to play with. Would love any thoughts!
by bubblyworld | 2025-06-23 08:42:58+00:00
I find the mathematics in this paper a little incoherent so it's hard to criticise it on those grounds - but on a charitable read, something that sticks out to me is the assumption that AGI is some fixed total computable function from the fixed decision domain to a policy.

AIs these days autonomously seek information themselves. Much like living things, they are recycling entropy and information to/from their environment (the internet) at runtime. The framing as a sterile, platonic algorithm is making less and less sense to me with time.

(obviously they differ from living things in lots of other ways, just an example)
by bonoboTP | 2025-06-23 08:43:15+00:00
MSN wasn't social media, there were no likes and as I remember, most chats were 1on1. You didn't post publicly, there was no algorithmic feed etc. It was just chatting, basically texting. And actually yeah, texting was already a thing on dumb phones, remember all the abbreviations, emoticons, etc. Teens were glued to that too, especially girls, as well as guys texting with girls. But that's absolutely different from the fomo and "keeping up" and public likes and algorithms thing today. I think as millennial we don't really appreciate how deeply ingrained it is, compared to back then.
by izacus | 2025-06-23 08:44:21+00:00
> My mistake early on was trying to give people the best possible offer out of the gate that I could possibly justify. Many people took it because it was a big raise for them or they understood what we had discussed. However, you could tell when someone was reading a compensation negotiation guide because it was like the number did not actually matter. The only thing they cared about was getting something extra added on top of it. Some people would be so tunnel visioned on this idea of getting the extra bump that they’d threaten to walk from an excellent offer over something trivial like a $5K bump

This reminds me on my experience selling things on local version of eBay. No matter how good of a price it was for a used item, people would still try to lower it... until I just started setting higher prices from the get go and then selling for more after some arbitrary small drop in price after "negotiating". Wierd how people work.
by kzrdude | 2025-06-23 08:45:48+00:00
One relatively optimistic prediction would be that a few will accept Typst, but latex export from Typst will gradually get more mature, until we end up with a charade where more people use other frontends like Quarto or Typst that output to latex rather than latex themselves for submission into journals - in certain fields. Somewhere after that time, Typst will break through and be generally accepted itself.
by ciphernomad-org | 2025-06-23 08:46:15+00:00
You are correct from a formal perspective. Any finite state machine is periodic.

In cryptography, "aperiodic" means the period is computationally unreachable. We use a 256-bit state, making the probability of a collision negligible (on the order of 2^256). This is a parameter of the CVM; it could be increased to 512 bits or more if required.

This is the standard security model for all modern hash-based constructions.
by pjc50 | 2025-06-23 08:47:03+00:00
> Finally, he seems to draw a pretty hard boundary between literary and “genre” fiction that I’m not sure always exists

The litfic people would never agree with this, but litfic is also a genre. It has its tropes, and especially it has its snobbery. I think part of its decline may be exactly that: the social circle which values litfic for exclusionary snob value was always small, but now it has been eclipsed. Apart from specific fandoms like Joyce; the Joyceans are closest to SF fans in the way their fandom operates. They even have conventions.
by goless | 2025-06-23 08:47:31+00:00
Sorry, I am not familiar with Rust. Although I try hard to understand this library, I cannot say that I understand it.

I have two questions here:

1. How to express uncertain state in type. In my example, it is implemented by union (enum) + Witness https://github.com/sdzx-1/polystate-examples/blob/fecaffb5b7...

2. I don't seem to see the possibility of combining state machines
by phoronixrly | 2025-06-23 08:47:36+00:00
Source if you wish to skip the clickbait, blogspam and toxic comments: https://bugs.launchpad.net/ubuntu/+source/intel-compute-runt...

I also propose the title here be changed to 'Security mitigations in intel-compute-runtime no longer needed, disabling brings 20% boost' because as it currently is it misleads that Canonical is reopening the Spectre vulnerability in the GPU for performance's sake. It's not. While there, I'd say update the link to point to the source.

Relevant quote:

> After discussion between Intel and Canonical’s security teams, we are in agreement that Spectre no longer needs to be mitigated for the GPU at the Compute Runtime level. At this point, Spectre has been mitigated in the kernel...
by oneeyedpigeon | 2025-06-23 08:48:16+00:00
I know this is a joke, but as soon as I saw:

06/22/2025

I backed away very quickly. I assume actual Windows uses the locale, so my eyeballs wouldn't be assaulted with this abomination.

For Linux/Mac users who are happy to stick with ls, but want a slash-formatted date, you can get something that is sane for you (whether or not it is sane for the rest of us) by running:

ls -l -D '%x'

Where -D specifies a custom date format and %x means 'the date in your locale'.
by bonoboTP | 2025-06-23 08:49:21+00:00
I think you can also get addicted to constantly refreshing the news, the live coverage of the current big thing (it's the Iran thing right now).

I think it's the constantly available Internet in your pocket.

If you have a smartphone without internet and put 10 ebooks on it, that won't cause this kind of thing.

Though there are also much more addictive mobile games now, compared to grays ale snake we grew up with. The visual flashes and dings...
by aa-jv | 2025-06-23 08:49:41+00:00
For most of the latter part of the 80's, I used Quarterdeck Desqview as my 'terminal', which allowed me to have 4 independent concurrent MSDOS sessions running on my 386, each of which with its own video and network connectivity, so that I could telnet into my MIPS Magnum pizzabox and do some work.

At the beginning of the 90p's, I was on the hunt for an alternative to the MSDOS part when, eventually, I tried minix instead .. and that led to replacing it with Linux as soon as it was available on funet. Multiple runs to Fry's to get more RAM and some CPU upgrades later, and I was soon compiling an X/Windows setup on my brand new 486 with 16 Megabytes of RAM .. and about a week after that, I replaced my Quarterdeck setup with a functioning Linux workstation, thorns and warts and all. That was a nice kick in the pants of the operators who were threatening to take away my pizzabox, but it was short-lived joy, as not long thereafter I was able to afford an Indy, which served great for the purpose all through the 90's - and my Linux systems were relegated off the desktop to function as 'servers', once more.

But I always wondered about Quarterdecks' Desqview/X variant, and whether that would have been an alternative solution to the multi-term problem. It seems to me that this was available in 1987/88, which is odd given the articles' claims that X workstations weren't really widespread around that period.
by imtringued | 2025-06-23 08:49:50+00:00
"Fusing im2col with matrix multiplication" is a confused way of saying that the convolution operation should be implemented directly in hardware.

There are two arguments in favor of im2col.

1. "I don't want to implement a dedicated software kernel just for convolutions" aka laziness

2. "I don't want to implement dedicated hardware just for convolution"

The former is a sham, the latter is motivated by silicon area constraints. Implementing convolutions requires exactly the same number of FMAs, so you would end up doubling your chip size and automatically be cursed with 50% utilization from the start unless you do both matrix multiplication and convolutions simultaneously.

When you read answers like this: https://stackoverflow.com/a/47422548, they are subtly wrong.

"Element wise convolution performs badly because of the irregular memory accesses involved in it." at a first glance sounds like a reasonable argument, but all you're doing with im2col is shifting the "irregular memory accesses" into a separate kernel. It doesn't fundamentally get rid of the "irregular memory accesses".

The problem with the answer is that the irregularity is purely a result of ones perspective. Assuming you implement im2col in hardware, there is in fact nothing difficult about the irregularity. In fact, what is considered irregular here is perfectly predictable from the perspective of the hardware.

All you do is load x pixels from y rows simultaneously, which is extremely data parallel and SIMD friendly. Once the data is in local registers, you can access it any way you want (each register is effectively its own bank), which allows you to easily produce the im2col output stream and feed it straight to your matrix multiplication unit. You could have implemented the convolution directly, but then again you'd only get 50% utilization due to inflexibility.