MurphyA/hacker-news huggingface dataset:
by Sophira | 2025-06-05 13:56:50+00:00
I can give an example of this; I found such a vulnerability a few years ago now in an application I use regularly.

The target application in this case was trying to validate incoming POST requests by checking that the incoming MIME type was "application/json". Normally, you can't make unauthorized XHR requests with this MIME type as CORS will send a preflight.

However, because of the way it was checking for this (checking if the Content-Type header contained the text "application/json"), It was relatively easy to construct a new Content-Type header that bypasses CORS:

Content-Type: multipart/form-data; boundary=application/json

It's worth bearing in mind in this case that the payload doesn't actually have to be form data - the application was expecting JSON, after all! As long as the web server doesn't do its own data validation (which it didn't in this case), we can just pass JSON as normal.

This was particularly bad because the application allowed arbitrary code execution via this endpoint! It was fixed, but in my opinion, something like that should never have been exposed to the network in the first place.
by ben_w | 2025-06-05 13:57:24+00:00
> Honestly, the best thing for Tesla would be to evict Musk as a leader, install someone who can focus on excellent delivery (like SpaceX), and create a separate R&D org for Musk to lead.

I suspect it's too late for that.

Musk, like Jobs before him, has a reality distortion bubble; this is how the Tesla P/E ratio is now… 189.49? Huh, it went up since I last checked.

Anyway, point is that number would be 30 even in an agressive growth scenario (which no longer seems plausible given their shinies are now being done better by others), and BMW's P/E is 7.41.

If Tesla stock price reduced to realistic (i.e. not Musk-boosted) levels, that's a factor reduction of 189.49/7.41 ~= 25.6, which reduces them to about 13 USD.

I've heard Musk has a lot of loans with Tesla stock as collateral, where margin calls will trigger sales if the price goes under about $240.

I have no idea what happens when you mix that combination of margin call, price shock, corporate debt, etc.
by jfengel | 2025-06-05 13:57:49+00:00
It does seem odd that they'd choose to follow these specific obligations at a time when they are flagrantly violating so many others. What could the US do besides a strongly worded letter?

A possibility: maybe they didn't even possess hangers for these planes. Not that they couldn't; they just didn't when they were at least pretending to make nice. And then they didn't think to build hangers when they had so much else to do.
by strogonoff | 2025-06-05 13:58:01+00:00
Among the probably most important and universally relevant measurements offered by air quality monitors is carbon dioxide/monoxide. Humans are not really built for realising when these are elevated, other than feeling sleepy and generally experiencing reduced mental capacity, which by its self-referential nature is not conducive to understanding that you are experiencing reduced mental capacity or being motivated to take measures about it (such as opening windows).

These are all of the ways in which air monitoring information is actionable for me:

— Excessive carbon dioxide: as mentioned, it’s a call to open windows and possibly doors, depending on wind direction and window/door configuration in the flat and the building. It can reach surprising, and in my case unsafe by at least one country’s standards, levels overnight if your flat has decent insulation and little airflow. Besides, it just feels nice to have more oxygen knocking about your internals.

— Excessive (which should really mean non-zero, but in today’s ecology let’s say “elevated”) PM2.5 means I should close windows (usually this pollution comes from outside) and ramp up air filtering, and potentially postpone exercise while particulate matter is too high. I have a separate cheap air filter but lately it turned out that a Mitsubishi dehumidifier does a great job at this—which, by the way, I have realized only thanks to an air monitor.

— If both carbon dioxide and particulate matter are high, I’d most likely open the windows first to lower the former then close the windows and run air filtering while hanging out at the office or having a walk (potentially with an N95 mask on if it’s really bad outside).

— VOC, which often originate from chemicals used in furniture or flooring, if your monitor measures those, could probably be addressed by adding activated carbon layer to your air filter (and by opening windows). I think they are filtered slowly and this might take months, but my monitor did not measure VOCs so I don’t have first-hand experience. An air quality monitor could help you understand whether you are wrong or right in thinking your new floor made your air full of VOCs when all you can go by otherwise is just a vague chemical smell.

— Elevated background radiation means you should probably just move, usually it is building materials or something not easily removable anyway.

I would say that with these numbers available there is a danger you’d stress over and min/max them. It’s probably better to just use the measurements to understand the patterns and see if something is really out of ordinary or elevated for prolonged periods of time. I did that first (and did not expect to see how quickly carbon dioxide builds up, how quickly everything deteriorates with any cooking, including when done by a neighbour if I open windows and the wind blows the wrong way, the speed with which outside pollution permeates the indoor space, how effective my air filtering is, etc.), now my air monitor is broken and I am not overly concerned until I have to move to a new place.
by jonchurch_ | 2025-06-05 13:58:03+00:00
This is missing important context. You are correct that preflight will be skipped, but there are further restrictions when operating in this mode. They don't guarantee your server is safe, but it does force operation under a “safer” subset of verbs and header fields.

The browser will restrict the headers and methods of requests that can be sent in no-cors mode. (silent censoring in the case of headers, more specifically)

Anything besides GET, HEAD, POST will result in an error in browser, and not be sent.

All headers will be dropped besides the CORS safelisted headers [0]

And Content-Type must be one of urlencoded, form-data, or text-plain. Attempting to use anything else will see the header replaced by text-plain.

[0] https://developer.mozilla.org/en-US/docs/Glossary/CORS-safel...
by Amezarak | 2025-06-05 13:59:08+00:00
I may be betraying my ignorance here but I don’t understand what you mean when you say the stars look the same everywhere on earth. You can definitely determine latitude from what stars are visible in the night sky along with their position in the sky, as, for example, the Southern Cross is only visible in the southern hemisphere; the converse is famously true for the North Star. It makes sense to me you don’t gain anything from having a compass (assuming clear nights) though, since you have the celestial north.

Google claims that human-based celestial navigation done correctly can be accurate to 1 nautical mile, which seems good enough for navigation but not for any weapons targeting. Definitely way worse than GNSS. I would assume there are automated systems out there that can reduce the sources of error together get it down to less than that but probably not several orders of magnitude.
by goosejuice | 2025-06-05 13:59:13+00:00
Copilot pales in comparison to Cursor Pro. I've trialed it three or four times in the last two years and stopped using it after a few days each time. Honestly, I have no idea why anyone pays for it given the alternatives.

My only wish is that Cursor had partnered with Zed. vscode isn't enjoyable.
by SpaceL10n | 2025-06-05 13:59:53+00:00
> who has control of your data

As frustrating as it is, the answer seems to be everyone and no one. Data in some respects is just an observation. If I walk through a park, and I see someone with red hair, I just collected some data about them. If I see them again, perhaps strike up a conversation, I learn more. In some sense, I own that data because I observed it.

On the other other hand, I think most decent people would agree that respecting each other's right to privacy is important. Should the owner of the red hair ask me to not share personal details about them, I would gladly accept, because I personally recognize them as the owner of the source data. I may possess an artifact or snapshot of that data, but it's their hair.

In a digital world where access controls exist, we have an opportunity to control the flow of our data through the public space. Unfortunately, a lot of work is still needed to make this a reality...if it's even possible. I like the Solid Project for it's attempt to rewrite the internet to put more control in the hands of the true data owners. But, I wonder if my observation metaphor is still possible even in a system like Solid.
by sandworm101 | 2025-06-05 13:59:59+00:00
>> a front brake light provides an essential visual cue that a car is slowing down or preparing to stop. When the light is extinguished, it indicates that a stationary vehicle might initiate movement

Written by someone who does not drive a manual transmission, or live in the mountains. Brakelights, at best, state that a car is undergoing some degree of braking forces. Anything more is a very dangerous assumption. Cars can accellerate with thier brakes on, and can remain stopped with them off. (Also, every motorcycle on a flat surface uses their feet to stay stopped at long lights.)

Cars start moving with brakelights on all the time, especially with automatic transmissions where it can take significant force to keep the transmission in check. And hills. A better light might be one that changes in intensity with brake pedal force, so pedestrians can see when an inattentive driver is about to take thier foot off the brake.
by nxobject | 2025-06-05 14:00:00+00:00
My second bet is on Google (for general-purpose LLMs in general) - not because of any technical advantage, but because they have a captive audience of large organizations using GSuite that would be happy to just get Gemini on top to satisfy need for AI tools, instead of having to jump through the hoops of finding another provider. Sales, sales, sales.
by Kon-Peki | 2025-06-05 14:00:22+00:00
Thank you for the link to the actual text!

So, the NYT asked for this back in January and the court said no, but asked OpenAI if there was a way to accomplish the preservation goal in a privacy-preserving manner. OpenAI refused to engage for 5 f’ing months. The court said “fine, the NYT gets what they originally asked for”.

Nice job guys.
by 1123581321 | 2025-06-05 14:00:28+00:00
Nice idea. I’m in the habit of watching for wheels to start rolling when I’m worried someone will unexpectedly pull out in front of me. A brake light is easier to see. Another scenario is an oncoming car braking which could help notice an animal entering the road or that the car has lost control ahead of you (sudden ice, for example.)

Why green instead of red? Would it be an inverse brake light (green appears when foot lets off the brake?) I don’t see how any color light is easy to retrofit.

> The innovative design of front brake lights adds another layer of practicality. These lights would emit a green glow rather than the traditional red, easily integrating into current vehicle frameworks without extensive modifications.
by kortilla | 2025-06-05 14:00:50+00:00
Performance on these scores frequently hits plateaus because the style of technology is just unfit for the task.

We are quite far into the development cycle of LLMs. Literally billions of dollars have been poured into them. The rate of improvements over the last 6-12 months has slowed, not accelerated.

There hasn’t been any hint on AGI breakthroughs, so we’re dealing with the tools to help herd stochastic parrots (i.e. agents) for the foreseeable future. And those tools are to just help with how much LLMs hallucinate, it doesn’t make them more creative in a way to improve these scores.
by Reubachi | 2025-06-05 14:01:05+00:00
The person you're replying to/insulting spelled/realized out the normal operations of a mature capitalist economy based on publicly owned/traded companies. I'm not being "conspiracy theorist" here, it's how it is and how the economy insulates itself from shock/swings.

To your point on "investors not being ignorant", have you followed the last 5 years of tesla stock valuation, and the constant signal that "this company P/E is disconnected from reality?" Meaning, despite no sales growth, consumer goodwill, etc. investors continued to dump money in? We see the reverse effect now, a slow massive draw down on stock value.

Anyway.

In the real world, a board(and also in particular the finance director) is more like to completely write off the unsold fleet, as it would allow both tax insulation and a more clean financial statement for auditing, investors. Mazda recently did this with the entire MX-30 program to signal to investors "this was actually intended from the beginning and allowed us EV research."

This happens in every single industry every day. Where Tesla to just mark the trucks down, that instantly signals to investors (note: not experts.) that there is a cash problem at the firm. There is nothing worse to signal as a public company.
by taeric | 2025-06-05 14:01:17+00:00
Having grown very happy with the radar for my bicycle, I'm growing more and more curious why we don't have more of those on our cars. I've seen the nice visibility affordances on some high end cars when you do reverse. Seems that the parts and sensors needed for that have grown considerably without people knowing?

Direct to this, I'm surprised the light would reduce accidents by so much. That said, I don't see any reason not to explore it more.
by 542354234235 | 2025-06-05 14:01:21+00:00
An interesting paper just published about the current state of AI in Ukrainian and Russian drones on the battlefield [1].

"Promises of an immediate AI/ML drone revolution are premature as of June 2025, given that both Russian and Ukrainian forces will need to allocate more time, testing, and investment to deploy these drones on the frontlines en masse. Russia and Ukraine will continue improving their ML and machine vision capabilities while training and testing AI capabilities. Russia and Ukraine will then need to tackle the issue of scaling the production of the new AI/ML drones that will require additional time and resources to facilitate. Russia and Ukraine may start to use some AI/ML drones to carry out specific tasks in the meantime, such as striking certain types of targets like armored equipment or aircraft, before learning to fully operate on the battlefield. AI/ML drones are also unlikely to fully replace the need for the mass of tactical FPV drones over the coming months because the latter are cheaper to produce and adapt to the current battlefield conditions at the current state of technology."

[1] https://understandingwar.org/backgrounder/battlefield-ai-rev...
by arp242 | 2025-06-05 14:01:46+00:00
> Meanwhile, evolving resistance also comes at a cost. We don’t know that directly, but we can infer it pretty well. If resistance to tetrodotoxin were cheap and easy, everything would evolve it. [..] We don’t know, but we’re pretty sure there must be something. We know that garter snakes outside of the Pacific Northwest are much less resistant to tetrodotoxin. They’ll drop dead from doses that their Oregon cousins simply ignore. So evolving the resistance must have some cost or drawback.

I'm not so sure that's really the case; it's more that for many animals there simply isn't any pressure to evolve (or retain) this trait.

It's not like the natural selection process has a feature list it can tick off. It operates with zero foresight and an incredibly dumb principle: whatever helps procreation.

Cows are not dying due to tetrodotoxin poisoning in significant numbers, as far as I know, so there is no reason for them to evolve resistance to it. The same applies to most animals, including the snakes outside that area.

Your dog can synthesise their own vitamin C and will never develop scurvy. Most animals can do this – humans and some other primates are the exception. An ancestor lost the trait for vitamin C synthesis by chance, and because these primates were living in trees eating lots of fruit with vitamin C, evolution simply didn't notice. There is no disadvantage to being able to synthesise vitamin C, and no advantage in dropping the trait. It didn't affect procreation (at the time). Now we're all stuck with it.

Now, maybe all of this does have a cost for the snakes. But it's far from a given that there is one.
by yodon | 2025-06-05 14:01:58+00:00
Prior to reading this post, my biggest concern about LLM-assisted activities was I never felt like I was hitting a flow state when using an LLM, regardless of how productive I was able to be using the LLM. That lack of flow state left me feeling like I wasn't bringing 100% of what I could bring to the effort.

This article feels like useful insights into how to help myself get into a proper flow state when working with an LLM.
by andruby | 2025-06-05 14:02:23+00:00
I'm curious what your setup looks like. Do you use an IDE like Cursor or Windsurf, an editor like Zed or more directly an agent like Claude Code?

Have you used tidewave.ai? The demo from Jose looks fun, but I've yet to play with it.

What use-cases have LLMs shined in for you? I've really enjoyed using it to reduce the learning curve, eg to use Svelte and LiveSvelte on a small side-project.

(I've been using Rails for 20 years, Erlang & Elixir for ~10, but spend more time on the product side nowadays.)
by jfengel | 2025-06-05 14:02:28+00:00
Anecdote to back that up: I caught a BBC podcast this morning, about native vs immigrate skilled workers, which suggested that £50,000 ($68k US) was an ordinary salary for a software developer in the UK.

That's better than the median UK salary, but not exactly a huge draw. The average in the US is six figures.

The methodologies that produce those numbers are always dubious so I wouldn't take that as definitive. But it does support your assertion that UK tech salaries aren't great, at least compared to the US.
by david-gpu | 2025-06-05 14:02:29+00:00
Decision-making in the armed forces is always performed by a "warrior class". The people who operate heavy war machinery are also career soldiers; conscripts are light infantry.

And there is a very real economic cost to mandatory military service. It only makes sense in the context of a small country (in terms of population) bordering a large aggressive neighbor, such as Finland or (possibly) Canada.
Ask HN: Balancing AI-Assisted Development with Deep Learning as a Founder
by dennisy | 2025-06-05 14:02:32+00:00
I’m a software developer and repeat founder who’s genuinely excited about what AI can do for our industry. In past projects, I’ve relied on AI coding assistants (e.g., GitHub Copilot, ChatGPT, Claude Code) to help me write boilerplate, generate suggestions, and speed up routine tasks. But every time I lean on these tools, I notice myself understanding concepts less deeply and becoming a bit “lazy” about fundamental problem-solving. To counter that, I’ve habitually limited my AI usage—kind of like how I allow myself only 30 minutes per day on Hacker News.

However, I’m now pulling together a new startup, and the stakes have changed. Speed-to-market isn’t just a fun challenge anymore; it’s a competitive necessity. If I don’t use AI to accelerate development, I risk falling behind. At the same time, I worry that over-reliance on AI will stunt my learning curve and leave me unable to debug tricky issues or refactor in a meaningful way. Has anyone else experienced this tension between “true learning” and “rapid launch”?

I’m not advocating for an “AI doom” mentality far from it. I want to embrace AI’s productivity gains, but I also want to make sure I’m still learning, able to debug, able to build robust architecture and improving as an engineer. If you’ve navigated this trade-off (particularly in a high-stakes startup environment), I’d love to hear: - What concrete strategies or workflows you put in place. - How you measure your own “proficiency” so you know you’re not losing the fundamentals. - Any pitfalls you ran into by either over-relying or under-relying on AI tools.

Thanks in advance for sharing your experiences and advice!
by dylan604 | 2025-06-05 14:03:42+00:00
>I use a humidifier, but don’t want the humidity going up past 60%

out of curiosity, what part of the globe do you live (or when was your home built) that you need a humidifier? I have a dehumidifier as it is quite often > 50% humidity in my home, easily as much as 65%, but that's due to the high humidity outside where it can easily be 85%. Just looked at my sensor, it is currently 81% outside and 55% inside. That 55% is where it really starts to become uncomfortable. I struggle to keep it <50% inside. At these indoor humidity levels, it limits some of the things that I can do indoors as it has a negative affect on things I make/do. So adding humidity is just one of those things that makes me tilt my head sideways and go huh? like a dog because it is so out of my experience.
by throwawaymaths | 2025-06-05 14:03:46+00:00
i hate to denigrate penrose, but his quantum consciousness proposition is basically "we dont understand consciousness and quantum mechanics is magic therefore consciousness must be quantum"... totally elides the biggest challenge which is that we dont have a definition much less a test for consciousness.

will say though that the long range coupling between microtubules that got discovered is interesting for its own reasons.
by 9rx | 2025-06-05 14:05:36+00:00
> You have things the wrong way around.

No. You have not considered what is going on around you.

> A developer uses Result because T and E are exclusive.

A programming language may be designed around that premise, but that is not the case in the real world (faults in the real world are never binary), and it is certainly not aligned with the design of Go.

> The idiomatic Go approach makes no provision for such distinctions at all.

Naturally. It logically can't because T and E are both considered to be always valid per the fundamentals of the language. The idioms emerged as an extension of those core principles. As before, other languages may take different view, but Go isn't those languages.

That's what makes this changing error handling business so hard. If Go were a completely different language then it would be easy to adopt something like monads, but for the Go we have things like that just don't logically fit and it is not yet clear what does.
by belter | 2025-06-05 14:05:41+00:00
Instead of answering on the technical merits of an argument, you went for an ad hominem so...? I ask again...do you use NIFs ?

"If the entire computer crashes, you're screwed. you can't really do fault tolerant computation from one machine."

- Joe Armstrong

And the reason for the quote above is to remind you Erlang/BEAM gives you tools for fault containment and recovery, but not immunity from failure.

Say: Well-designed Erlang systems can fail gracefully and self-heal locally...but they’re only as fault-tolerant as their distributed architecture and ops discipline allows...And we will conclude in a nice agreement. :-)
by vladstudio | 2025-06-05 14:05:51+00:00
Yes, something like that. As probably many of you, I spent way too much time switching between agentic apps, switching between models inside these apps, and tweaking system prompts for these models.

When Ampcode took it all away from me, I found I enjoyed the actual AI-assisted coding much more than configuring. Of course, largely because it just worked. Granted, I had enough experience with other AI tools to manage my expectations.