MurphyA/hacker-news huggingface dataset:
by red_admiral | 2025-06-15 11:53:07+00:00
It's a locally run VM, so I doubt IT even knows what's in there and wouldn't notice what you're doing with it. How do you know if a student mounts the disk of a VM locally that they've already downloaded to their laptop?

The goal of the assignment is to exploit something anyway, just not necessarily this way. And she got her professor's consent to publish the article.

It seems the system was moved to the cloud in later years with ssh-only access. Exploiting something inside the VM should be fine and maybe a feature for some assignments - probably one reason it's a VM in the first place. It's not like anyone's hacking the university network.

Since there's mention of `@bham.ac.uk` - I forget if it was Birmingham or Brighton or someone else, but the way things work in GB is teachers submit "unreleased" grades after marking their exams, an exam board approves or fiddles with these grades, and then the grades for all students on a course are released together on "results day". A CS student got in trouble somewhere because they passed around the info that you could see unreleased grades in the "learning mangement system" by selecting "view source" and looking for the "display:none" entries in a table or something like that.
by masto | 2025-06-15 11:53:36+00:00
This is literally the same mistake that has been made many times before. Of course it will be made again. “New feature is rolled out carefully with a bug that remains latent until triggered by new data” could summarize most global outages.

The thing is, nobody is perfect. Except armchair HN commenters on threads about FAANG outages, of course.
by erincandescent | 2025-06-15 11:53:56+00:00
> In my tests with assorted 24-bit sRGB monitors, a difference of 1 in a single channel is almost always indistinguishable (and this might be a matter of monitor tuning); even a difference of 1 simultaneously in all three channels is only visible in a few places along the lerps. (Contrast all those common shitty 18-bit monitors. On those, even with temporal dithering, the contrast between adjacent colors is always glaringly distracting.)

Now swap the sRGB primaries for the Rec.2020 primaries. This gives you redder reds, greener greens, and slightly bluer blues (sRGB blue is already pretty good)

This is why Rec.2020 specifies a minimum of 10-bit per channel colour. It stretches out the chromaticity space and so you need additional precision.

This is "just" Wide Colour Gamut, not HDR. But even retaining the sRGB gamma curve, mapping sRGB/Rec.709 content into Rec.2020 without loss of precision requires 10-bit precision.

Swap out the gamma curve for PQ or HLG and then you have extended range at the top. Now you can go super bright without "bleeding" the intensity into the other colour channels. In other words: you can have really bright things without them turning white.

Defining things in terms of absolute brightness was a bit of a weird decision (probably influenced by how e.g. movie audio is mixed assuming the 0dBFS = 105dB(SPL) reference level that theaters are supposed to be callibrated to) but pushing additional range above the SDR reference levels is reasonable, especially if you expect that range to be used judiciously and/or you do not expect displays to be able to hit their maximum values on that across the whole screen continuously.
by taneq | 2025-06-15 11:54:33+00:00
Uber seems wilfully deceptive in so many ways. The initial listing of rides including details of vehicles and prices, which looks like an actual offer, but the app then goes off to try and find something similar. Try being a shop, selling someone an item and then going out back to rummage around and see if you actually have anything like what you sold. And then the 'fixed price' you agreed on gets arbitrarily changed on half the trips if traffic gets worse or the driver takes a different route. If I book a trip from the airport, the airport's charge for rideshare lane usage isn't an "unanticipated expense". It's just skeezy.
by mark_l_watson | 2025-06-15 11:57:07+00:00
I love your comment, even disagreeing with the first sentence (I used Common Lisp and Swift yesterday - there is a difference for me).

I also don’t like the hurdles of writing private Apple ecosystem apps. Apple may fix this via Playgrounds, not sure though.

I feel captured by Apple’s ecosystem, and that is not a comfortable feeling. Also, Richard is right, we just don’t listen.
by kristopolous | 2025-06-15 11:57:54+00:00
I never called it fascism. But doing things like tackling senators for asking questions in a public hearing and snatching children up off the street to send them off to forever jail doesn't look great.

I'm sure you'll defend it though, this guy has an R next to his name and you're on team R!

(I'm not on team D btw and never was so you can drop that pretext right now)
by kgwxd | 2025-06-15 12:00:06+00:00
your talking about politicians disagreeing, i'm talking about citizens disagreeing with the actions of the party they happened to vote for, instead of submitting to their will and excusing away their most terrible decisions. and in your example, ever single detractor from the kings decree is quickly force to bend the knee, or risk expulsion. bunch of submissive vassals. democrat voters are loudly against the dnc and most of the people they bring in that blindly follow "the agenda".
by hulitu | 2025-06-15 12:01:42+00:00
> Someday real soon, kids being shown episodes of 'Knight Rider' by their grandparents won't understand why a talking car was so futuristic.

Maybe in 100 years. The talking car was more intelligent than Siri, Alexa or Hey Google.

It is not that we are not able to "talk" to computers, it is that we "talk" with computers only so that they can collect more data about us. Their "intelligence" is limited to simple text underestanding.
Ask HN: Is there an AI bot that works like a literate programming build step
by bryanrasmussen | 2025-06-15 12:05:44+00:00
My experiences with coding chatbots has been underwhelming. What I would like is something that works like the following:

I write a file with comments in the file of what I expect the code to be doing at this point in the code. When I run the agent to build or compile these descriptions

it should of course provide the methods outlined, if it feels the need to create other parts of the code than what I have specified it should make comments about why it decided this and what the code it makes does.

Essentially I want an agent that allows me to approach non-literate programming in a literate programming manner/workflow https://en.wikipedia.org/wiki/Literate_programming

If you have some ideas as to how I can get to this please share, if you think it will not ever be possible to produce something like go ahead and share that too (although I think it should be)

Note I do not want an interactive bot doing stuff WHILE I type, I want an AI build step. Why? Because I type really quick without errors having worked as a data entry guy in my early 20s. The interactive bots make me slower and generally don't have good inputs most of the time.

I bet this is probably doable and a lot of you are thinking why doesn't this guy just do X or Y, but that's the thing - all I've experienced so far is the non-satisfactory interactive bots, and researching the matter the world's most popular broken search engine has been unsatisfactory, so hopefully people here can explain what to do to get what I want.
by dvfjsdhgfv | 2025-06-15 12:05:48+00:00
The Hanoi Towers example demonstrates that SOTA RLMs struggle with tasks a pre-schooler solves.

The implication here is that they excel at things that occur very often and are bad at novelty. This is good for individuals (by using RLMs I can quickly learn about many other aspects of human body of knowledge in a way impossible/inefficient with traditional methods) but they are bad at innovation. Which, honestly, is not necessarily bad: we can offload lower-level tasks[0] to RLMs and pursue innovation as humans.

[0] Usual caveats apply: with time, the population of people actually good at these low-level tasks will diminish, just as we have very few Assembler programmers for Intel/AMD processors.
by giantg2 | 2025-06-15 12:06:32+00:00
The studies are wild. The reported range of affected individuals is 2-50% depending on which study you look at. While genetics are the main risk factor, there are all sorts of environmental risk factors that have been linked to it, especially in uetero. Many of those things are highly common such as BPA, PFAS, dioxins, and cosmetic use.
by immibis | 2025-06-15 12:07:51+00:00
Flagged comment said: Depends if you bought your server with Bitcoin. (In which case, remember that your server host will be raided by the gestapo, so make sure you have adequate redundancy)

I suppose I have to elaborate to not get it deleted by moderators. If you bought a server with sufficiently anonymized bitcoins, your connections can be traced to the server but they don't know whose server it is. However, hosting providers that allow people to buy servers with sufficiently anonymized bitcoins tend to be raided by the gestapo because of the other kinds of things that some people like to run on servers bought with sufficiently anonymized bitcoins. So you should have redundancy in place.
by alternatex | 2025-06-15 12:09:29+00:00
I've never had any implication of my gender other than my name in any CV over the past decade.

Who are these people who make a career history doc include gender-implicating data? And if there are such CVs, they should be stripped of such data before processing.

The fraternity example is such a specific 1 in a 1000 case.
by roenxi | 2025-06-15 12:11:25+00:00
Yeah, that was a very confused question from me. I thought for a moment EXECUTE permissions were a roundabout way of granting restricted write access. Let me try again: how is "How am I going to work here without Stored Procedures?" supposed to be interpreted in that comment? The application could just run the queries without using stored procedures. Stored procedures don't change the permission requirements; they're a moderate performance optimisation. They're almost always optional.

bytefish's comment seems to be linking stored procedures and writing to columns, which doesn't make sense because the scenario doesn't have any write permissions.
Show HN: QuickNote – Instant, anonymous, no‑account web notepad
by ashher00 | 2025-06-15 12:11:30+00:00
Hi everyone, I made QuickNote, a free web-based notepad that requires no signups. I am posting here, hoping that people can benefit from it.

Some features: No sign-ups required Auto-saves everything Works offline, PWA ready Multiple notes/tabs Dark mode & themes Neat AI features

Perfect for quick thoughts, code snippets, or drafting ideas.

Feedback is highly appreciated
by maxdamantus | 2025-06-15 12:12:46+00:00
I don't think it's meant to be a complete audit of the codebase, and in fact this is alluded to in the final report [0] (though the wording is strange—perhaps they forgot to update it from an earlier report):

> Due to the size of Ruby on Rails, it will not be possible to cover all the tests and tasks in the following test plan. The tests performed will be covered in the final report along with suggestions on what to focus on in future audits.

I feel like these sorts of audits are usually performed on individual applications rather than "mature" already widely used frameworks. I've got the sense that they are meant to give confidence that the developers knew what they were doing (since they focus on typical vulnerabilities that good developers should know about), rather than proving anything about the code base. Still better than nothing.

[0] Section 3.7, https://ostif.org/wp-content/uploads/2025/06/X41-Rails-Audit...
by bytefish | 2025-06-15 12:13:31+00:00
I have seen many actually.

Imagine having a huge amount of applications all using the same database, which is, like I said, often enough the main integration point in a company. The applications you are maintaining are written in, let’s say Java, C#, Python and C++. They are too important, too large and a rewrite is way too risky.

How would you start to get this under your control? By moving common logic in a shared C++ DLL probably? Rewrite all those applications at once, in a heroic effort? I for one take the pragmatic approach and extract common business logic shared between all them into a Stored Procedure.

The Stored Procedures are invoked by all applications, so instead of maintaining 10 implementations, I maintain 1. Suddenly you have a common data access path! The 1 implementation will be drowned in a shitload integration tests, because this is what really matters.

Of course, a Stored Procedure doesn’t prevent you from shooting yourself in the foot! But in my experience, it’s way harder to shoot yourself in the foot using a Stored Procedure, that you can inspect the Query Planner for… than hunting down Monster-Queries for weeks, generated by a LINQ provider.

As for the INSERT, UPDATE and DELETE: With SPs, you’ll have fine-grained control, which columns are updated instead of needing to expose all properties in your application code and praying for an ORM to not accidentally update “columns I don’t own”, because of some convention applied by the ORM.

If you are in the lucky position of owning the database and don’t have to maintain legacy applications, I see resistance to Stored Procedures. Then go ahead and build an API all applications are going to use.

But if you don’t own the database and need to maintain dozens of mission-critical applications, Stored Procedures are a tool worth knowing.
by khaledh | 2025-06-15 12:13:54+00:00
I tend to agree, but not quite fully. To me, it's not about low-level vs. high-level or distributed programming. Systems programming tend to fall into these categories:

- Running and managing a single system: kernels, drivers, programming tools (compilers, interpreters, assemblers, libraries, linkers, loaders, etc), admin tools, package managers, graphics servers, etc.

- Connecting multiple components/systems: protocol implementations (tcp/ip, rpc, etc), message brokers, servers/daemons (database, web, cache, etc), proxies, middleware, etc.

- Virtualization: emulation, sandboxing (docker, wasm), hypervisors, etc.
by luckylion | 2025-06-15 12:14:30+00:00
I get where you're coming from, but I very much doubt it's true RE car makes (and many similar things). There's a reason men and women have very distinct buying habits. E.g. men are ~4x more likely to buy a motorcycle. Individual decisions with that large a discrepancy between groups aren't individual decisions.

Can a young male really change their risk-tolerance or their innate drive to secure their place in the world (which will probably affect both their likelihood to buy sports cars and commit certain crimes)? I don't think we can pretend that everyone from toddler to granny is the same _and_ use any data to solve crimes / detect fraud.

In the end it comes down to where we draw the line between "person can't change this, so it's invalid to consider", "we don't believe it's linked, so it's invalid to consider" and "this is free will, so it's a valid signal", and I haven't seen a line that doesn't feel arbitrary ("I don't like that group, so their thing is free will, but I like this group, so their thing isn't") and is useful.
by kgwxd | 2025-06-15 12:15:36+00:00
the far more accurate word in this case is "moderation". the choice of "censorship" is always to invoke a sense of abuse of extraordinary power and victimhood. you wanna talk freely about whatever you want, without risk of being kicked out of someone else's house, go to your house. half the things i do here get my account put in timeout, I wouldn't equate it to being arrested for talking.
by kaliszad | 2025-06-15 12:16:13+00:00
Perhaps we don't need to transport electrical current in the form of electricity but rather some kind of media, perhaps sodium metal could be a good choice. We could pump liquid sodium through pipelines or just transport it by ships.

Salt (NaCl) is abundant in oceans. If you react sodium with water in a fuel cell you get NaOH, which you can again electrolytically split into sodium metal, oxygen, and hydrogen. There are ways how to extract sodium metal more efficiently than using the 130 year old basic Castner process though and there are better approaches to the fuel cell than what Lockheed imagined originally in the 1970s.
by lamename | 2025-06-15 12:17:11+00:00
I really do agree with your point overall, but in a technical paper I do think even word choice can be implicitly a claim. Scientists present what they know or are claiming and thus word it carefully.

My background is neuroscience, where anthropomorphising is particularly discouraged, because it assumes knowledge or certainty of an unknowable internal state, so the language is carefully constructed e.g. when explaining animal behavior, and it's for good reason.

I think the same is true here for a model "knowing" somethig, both in isolation within this paper, and come on, consider the broader context of AI and AGI as a whole. Thus it's the responsibility of the authors to write accordingly. If it were a blog I wouldn't care, but it's not. I hold technical papers to a higher standard.

If we simply disagree that's fine, but we do disagree.
by oefrha | 2025-06-15 12:17:16+00:00
Tipping isn’t “almost mandatory”. People were happily driving Ubers before they even introduced the tipping feature in-app. My rating is based on taking hundreds of rides while living for years on both coasts, in CA and NJ. Out of all those rides only one driver (a horrible one, who took like three wrong turns in twenty minutes, with navigation) ever asked for a tip. I maintain my rating by being clean, polite, and punctual.
by Leynos | 2025-06-15 12:18:36+00:00
It's funny seeing this as the top story.

I'm in the middle of putting together a realtime strategy game using Differential Datalog[1] and Rust, with DDL managing the game's logic. Mostly as an excuse to expose myself to new ideas and engage in a whole lot of yak shaving.

[1] https://github.com/vmware-archive/differential-datalog
by OisinMoran | 2025-06-15 12:18:59+00:00
Okay, in the interim I have a shipped a fix for Android (seems fine on an iPhone emulation) that uses two tens like so "𒌋𒌋" (looks like <<) instead of one twenty "𒎙" (also looks like << but a bit tighter). This is definitely one of the weirdest patches [0] I've ever done—changing how an ancient language is displayed based on the specific type of incomprehensibly advanced technology it's being displayed on—but I guess that's what Sundays are for.

[0] https://github.com/OisinMoran/OisinMoran.github.io/commit/15...
by rahen | 2025-06-15 12:19:21+00:00
You're missing the point. No one is claiming that a 300K-param model on a Pentium II matches GPT-4. The point is that it works: it parses input, generates plausible syntax, and does so using algorithms and compute budgets that were entirely feasible decades ago. The claim is that we could have explored and deployed narrow AI use cases decades earlier, had the conceptual focus been there.

Even at that small scale, you can already do useful things like basic code or text autocompletion, and with a few million parameters on a machine like a Cray Y-MP, you could reasonably attempt tasks like summarizing structured or technical documentation. It's constrained in scope, granted, but it's a solid proof of concept.

The fact that a functioning language model runs at all on a Pentium II, with resources not far off from a 1982 Cray X-MP, is the whole point: we weren’t held back by hardware, we were held back by ideas.
Show HN: A social platform where people give and complete challenges
by ArnavMasand | 2025-06-15 12:20:10+00:00
I built a challenge-based social media platform where people can post and complete challenges — anything from “create best dade lore with your friend” to “write a 100-word story in 5 minutes.”

I wanted to create something fun, lightweight, and totally open — no signups required, just creativity and participation.

You can:

Post a challenge

Complete others’ challenges

Share your results

See the live feed

My goal is to see if challenges can become a new social loop, like memes but interactive.

Would love any feedback — especially on:

UX

Retention ideas

Viral loops
by globular-toast | 2025-06-15 12:20:44+00:00
Stallman was right and that only becomes more clear to me with each day that passes. But there is a big difference between having the legal/technical ability to do something and that being at all practical. I'm becoming increasingly more concerned about the practical aspect rather than the technical.

Take the issue of freedom of speech. While it may be legally protected to various degrees, with the US having one of the strongest protections, is it practical when all communication happens on private platforms with opaque filtering ("moderation")?

I see the same thing in programming freedom. Android might technically be "open source" but it is no more practical to actually hack the software on your Android phone than an Apple phone. Similarly, PCs might be available that are under the complete control of the owners, but you need to be an expert programmer to realise this control.

Lisp is simply a more practical language to begin hacking. Emacs is probably the best example. Everything is there to make it easier to hack. It's not just technically free, it's practically free too.
by upghost | 2025-06-15 12:21:02+00:00
That's a great question. The answer to "why wouldn't you use Mercury instead?" should hopefully be more clear when you watch the meta-interpeter video. The syntax of Prolog is not accidental, and this is a case where it really matters. You sacrifice a lot of power by introducing things like dot access notation.

Additionally, there is nothing stopping you from writing pure monotonic Prolog, which does not involve cuts and uses pure IO.

Circling back to DCGs, the combination of DCGs plus interpreters, which can be expressed in a handful of lines of code, allows for powerful language crafting.

While constraint solvers are not unique to Prolog, CS+DCG+MI is a killer combination I've only ever seen in Prolog that when combined allow you to solve some wicked problems rather elegantly.

That being said, thanks for the reminder about Mercury, that looks like it could come in handy on some Java-only projects.

This is DCG+CS only, still quite powerful and I have adapted it for GOAP and Hierarchical Task Networks quite successfully: https://www.metalevel.at/zurg/

Finally, I will agree with you that there is a LOT of jank Prolog, but not ALL Prolog is jank, and some Prolog is truly exquisite-- I hope you will keep an eye out for it.
by t43562 | 2025-06-15 12:22:12+00:00
Rewriting something you wrote yourself makes sense. i.e. who knows better than you what the bash script does and why? You did it with bash - probably quite quickly but now you understand what's needed you can do it better the second time in a language which might be a bit less flexible but is much faster.

As for writing code to be replaced - well I can understand doing it but generally I've been in companies where you never get a chance to go back to anything that doesn't seem to be critical to the next requirement from the business - and they always have more than you can do.

The big rewrites are almost a response to this - no improvement can be justified unless it enables so many new features that the business decides to sign off. But because it's such a big change it is also much much more risky.