MurphyA/hacker-news huggingface dataset:
by dwattttt | 2025-07-09 09:43:29+00:00
Are you sure that if you don't attempt to set any affinities, Windows won't schedule 64+ threads over other processor groups? I don't have any system handy that'll produce more than 64 logical processors to test this, but I'd be surprised if Windows' scheduler won't distribute a process's threads over other processor groups if you exceed the number of cores in the group it launches into.

The referenced text suggests applications will "work", but that isn't really explicit.
by egozverev | 2025-07-09 09:43:35+00:00
Academic researcher here working on this exact issue. Prompt engineering methods are no sufficient to address the challenge. People in Academy and Industry labs are aware of the issue and actively working on it, see for instance:

[1] Camel: work by google deepmind on how to (provably!) prevent agent planner from being prompt-injected: https://github.com/google-research/camel-prompt-injection

[2] FIDES: similar idea by Microsoft, formal guarantees: https://github.com/microsoft/fides

[3] ASIDE: marking non-executable parts of input and rotating their embedding by 90 degrees to defend against prompt injections: https://github.com/egozverev/aside

[4] CachePrune: pruning attention matrices to remove "instruction activations" on prompt injections: https://arxiv.org/abs/2504.21228

[5] Embedding permission tokens and inserting them to prompts: https://arxiv.org/abs/2503.23250

Here's (our own) paper discussing why prompt based methods are not going to work to solve the issue: "Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?" https://arxiv.org/abs/2403.06833

Do not rely on prompt engineering defenses!
by knorker | 2025-07-09 09:43:51+00:00
To be clear, I don't just mean opening a physical office. I also mean the cost of having your first remote worker who lives and works from another state.

For employee relocation, that's definitely true. Even moving from Hawaii to Alaska is less of a life change than Spain to Poland. Or hell, probably even Spain to Portugal.

I'm surprised to hear you say selling would be that hard, though. It'd be interesting to see a comparison. And there's also both B2C and B2B.
by TeMPOraL | 2025-07-09 09:45:39+00:00
The point is, there is no hard boundary. The LLM too may know[0] following instructions in data isn't part of transcription task, and still decide to do it.

--

[0] - In fact I bet it does, in the sense that, doing something like Anthropic did[1], you could observe relevant concepts being activated within the model. This is similar to how it turned out the model is usually aware when it doesn't know the answer to a question.

[1] - https://www.anthropic.com/news/tracing-thoughts-language-mod...
by mixedbit | 2025-07-09 09:45:56+00:00
When I was working on my first HTTP-based API 13 years ago, based on many comments about true REST, I decided to first study what REST should really be. I've read Fielding's paper cover to cover, I've read RESTful Web Services Cookbook from O'Reilly and then proceeded to workaround Django idioms to provide REST API. This was a bit cargo cult thinking from my end, I didn't truly understand how REST would benefit my service. I took me several more years and several more HTTP APIs to understand that in the case of these services, there were no benefits.

The vision of API that is self discoverable and that works with a generic client is not practical in most cases. I think that perhaps AWS dashboard with its multitude of services has some generic UI code that allows to handle these services without service-specific logic, but I doubt even that.

Fielding's paper doesn't provide a complete recipe for building self-discoverable APIs. It is an architecture, but the details of how clients should really discover the endpoints and determine what these endpoints are doing is left out of the paper. To make truly discoverable API you need to specify protocol for endpoints discovery, operations descriptions, help messages etc. Then you need clients that understand your specification, so it is not really a generic client. If your service is the only one that implements this client, you made a lot of extra effort to end up with the same solution that not REST services implement - a service provides an API and JS code to work with the API (or a command line client that works with the API), but there is no client code reuse at all.

I also think that good UX is not compatible with REST goals. From a user perspective, app-specific code can provide better UX than generic code that can discover endpoints and provide UI for any app. Of course, UI elements can be standardized and described in some languages (remember XUL?), so UI can adapt to app requirements. But the most flexible way for such standardization is to provide a language like JavaScript that is responsible for building UI.
by pjmlp | 2025-07-09 09:47:09+00:00
The consumer protection laws are so bad the other side of Atlantic.

Most European countries, have their own version of consumer protection agencies, usually any kind of complaint gets sorted out, even if takes a couple months.

If they fail for whatever reason, there is still the top European one.

Most of the time I read about FTC, it appears to side with the wrong guys.
by pmontra | 2025-07-09 09:48:22+00:00
You write about mitigations and I'm afraid that you are correct. Can any method be more than just a mitigation? When we give read access to something to somebody we can expect that only loyalty (or fear, or... but let's stick with loyalty) prevents that person from leaking information to other parties.

Improvements to prompting might increase the LLM equivalent of loyalty but people will always be creative at finding ways to circumvent limitations.

The only way not to lower security seems to be giving access to those LLMs only to the people that already have read access to the whole database. If it leaks all the the data to them, they could more easily have dumped it with traditional tools. This might make an LLM almost useless but if the LLM might be equivalent to a tool with superuser access, that's it.
by panick21_ | 2025-07-09 09:48:41+00:00
Sun had some funny stories around this too. When they came up with their multi-core system, and they used code from 10-15 years earlier for traces. And then said 'well, nobody actually uses floating code' so we don't need it. Of course over those 10 years Floating point became much more common and stand. Leading to a chip that had one FPU for 8 cores, basically meaning, even minimal floating point would destroy concurrency. Arguably Sun had already lose the chip war and this was just making them fall behind further. They did market it in quite well.

And a lesser known thing that I couldn't find much information on is that Sun also worked on VLIW chip during the 90s. Apparently Bill Joy was convinced that VLIW was the future so they did a VLIW chip, and the project was lead by David Ditzel. As far as I am aware this was never released. If any Sun veterans have any idea about this, I would love to know.
by andybak | 2025-07-09 09:48:56+00:00
> Traditional frameworks hydrate entire pages with JavaScript. Even if you've got a simple blog post with one interactive widget, the whole page gets the JavaScript treatment. Astro flips this on its head. Your pages are static HTML by default, and only the bits that need interactivity become JavaScript "islands."

I guess I'd argue "Traditional Frameworks" were the ones that never stopped doing this. Laravel, Django, Rails etc. Then the SPA frameworks came along and broke everything.

Also - what on earth is "f*"? I originally assumed it was shorthand for "fuck" but is "fuck dream" a common expression? And wouldn't you normally write it as "f***"?
by Dylan16807 | 2025-07-09 09:49:33+00:00
They're either wrong or thinking about windows 7/8/10. That page is quite clear.

> starting with Windows 11 and Windows Server 2022 the OS has changed to make processes and their threads span all processors in the system, across all processor groups, by default.

> Each process is assigned a primary group at creation, and by default all of its threads' primary group is the same. Each thread's ideal processor is in the thread's primary group, so threads will preferentially be scheduled to processors on their primary group, but they are able to be scheduled to processors on any other group.
by TeMPOraL | 2025-07-09 09:49:36+00:00
> Overall I agree with your message, but I think you're stretching it too far here. You can make code and data physically separate[1].

You cannot. I.e. this holds only within the abstraction level of the system. Not only it can be defeated one level up, as you illustrated, but also by going one or more levels down. That's where "side channels" come from.

But the most relevant part for this discussion is, even with something like Harvard architecture underneath, your typical software systems is defined in terms of reality several layers of abstraction above hardware - and LLMs, specifically, are fully general interpreters and can't have this separation by the very nature of the task. Natural language doesn't have it, because we don't have it, and since the job of LLM is to process natural language like we do, it also cannot have it.
by vladvasiliu | 2025-07-09 09:49:58+00:00
> I’m not sure I see any particular conflict between them.

I don't have DT under hand to check, but there are two controls which, if active at the same time, will produce a warning along the lines of "wb is already set in [the other control]".

edit: I think [0] describes the issue

[0] https://discuss.pixls.us/t/white-balance-applied-twice/34949
by lelanthran | 2025-07-09 09:51:26+00:00
> REST-API's then are especially suited for acting as a gateway to a database, to easily CRUD and fetch lists of information.

I don't disagree, but I've found (delivering LoB applications) that they are not homogenous: The way REST is implemented, right now, makes it not especially suitable for acting as a gateway to a database.

When you're free of constraints (i.e. greenfield application) you can do better (ITO reliability, product feature velocity, etc) by not using a tree exchange form (XML or JSON).

Because then it's not just a gateway to a database, it's an ill-specified, crippled, slow, unreliable and ad-hoc ORM: it tries to map trees (objects) to tables (relations) and vice versa, with predictably poor results.
by theSherwood | 2025-07-09 09:51:33+00:00
Our lives are already nearly fully dependent on technology. Some of the projections for casualties in the months following a high-altitude EMP (or solar flare) are pretty staggering. Just losing computers means that most people die of starvation within a few months as global supply chains completely collapse.

And you're being unnecessarily adversarial. The comment you're replying to didn't say anything about disregarding the well-being of life on Earth. Interpreting it that way is uncharitable.
by Bluestein | 2025-07-09 09:51:43+00:00
> Out of thousands of people being kicked out these days, surely many of them were working on correcting defects

Very good point, actually. Hadn't connected both situations.-

PS. I am just waiting for MS to downright ToS/T&C at some point the spare capacity of their installed userbase rented out to commercial loads, AI included.-

(And, ads. Lots of ads. AI-genne'd ads ...)
by gr4vityWall | 2025-07-09 09:51:44+00:00
> Then what is it good for? Just simple apps?

It fits the niche of people who have legacy applications written in Flash, and want to rewrite them in a modern stack. There's a battle tested, free, cross-platform implementation of the Flash API called OpenFL. For people who were familiar with that stack, Haxe offers a natural path to migrate.

So, tl;dr its typical use cases are game development and making legacy Flash projects maintainable.

The C++, JS and Hashlink VM targets are generally well maintained. The situation with libraries is meh, mostly due to being a not-so-mainstream programming language that is almost 20 years old. So, there are a lot of libraries that weren't updated in a decade. Some of them may work on new Haxe versions, some won't. Some have been consistently maintained for very long, but are a one man show and the documentation is often subpar. Ceramic is one of such libraries, although the documentation for it is better than the usual for Haxe, IMO.

Overall I find the language itself amazing and pleasant to use. Kinda wish the C# target was still a thing with first-class support, so we could enjoy their hot reloading.
by shadag | 2025-07-09 09:52:32+00:00
You're so right it's not about the tool it's about the culture and focus on excellence which translates to writing excellent internal docs for engineers to get things done. I'm not quite sure how recording everything would work. The real things we need are docs that are updated when there are issues with CI/CD after people read logs etc... recording things might work for more business or commercial teams but for us we just need people to keep everything up to date and well written.
by dspillett | 2025-07-09 09:53:35+00:00
> Does it even say what the product or service is?

Do you really need spoon-feeding that directly?

The whole site is about the product. Much more information about it is literally a click-or-two away. Describing it specifically on that page, given how much information is already around it on directly linked pages, would seem superfluously wordy (even to me, someone who just used “superfluously” instead of “overly”).

> Or is it self-congratulatory spam?

Largely, yes. But no more than so people having anniversary parties are showing off, do you begrudge that sort of thing too?

I much prefer that to a self-aggrandising comment essentially stating “I'm better than them because I wouldn't post something like that” (yes, as some may be wondering, I am self-aware enough to acknowledge the strong touch of hypocrisy in that comment!).
by Bewelge | 2025-07-09 09:55:15+00:00
To be fair, for me at least, that weird chat bot only appears on https://help.shopify.com/ while the technical documentation is on shopify.dev/.

Everytime I land on help.shopify.com I get the feeling it's one of those "Doc pages for sales people". Like it's meant to show "We have great documentation and you can do all these things" but never actually explains how to do anything.

I tried that bot a couple of months ago and it was utterly useless:

question: When using discountRedeemCodeBulkAdd there's a limit to add 100 codes to a discount. Is this a limit on the API or on the discount? So can I add 100 codes to the same discount multiple times?

answer: I wasn't able to find any results for that. Can you tell me a little bit more about what you're looking for?

Telling it more did not help. To me that seemed like the bot didn't even have access to the technical documentation. Finding it hard to believe that any search engine can miss a word like discountRedeemCodeBulkAdd if it actually is in the dataset: https://shopify.dev/docs/api/admin-graphql/latest/mutations/...

So it's a bit like asking sales people technical questions.

edit: Okay, I should have tried that before commenting. They seem to have updated it. When I ask the same question now it answers correctly (weirdly in German) :

Die Begrenzung von 100 Codes bei der Verwendung von discountRedeemCodeBulkAdd bezieht sich auf die Anzahl der Codes, die Sie in einem einzelnen API-Aufruf hinzufügen können, nicht auf die Gesamtanzahl der Codes, die einem Rabatt zugeordnet werden können. Ein Rabattcode kann bis zu 20.000.000 eindeutige Rabattcodes enthalten. Daher können Sie mehrfach jeweils 100 Codes zum selben Rabatt hinzufügen, bis Sie das Limit von 20.000.000 Codes erreicht haben. Beachten Sie, dass Drittanbieter-Apps oder benutzerdefinierte Lösungen dieses Limit nicht umgehen oder erhöhen können.

~= It's a limit on the API endpoint, you can add up to 20M to a single discount.
by thibaultamartin | 2025-07-09 09:56:24+00:00
I can only approve. To me Astro started as "it's just html and css but with includes."

I used it for my personal website, and recently used it when reimplementing the Matrix Conference website. It's really a no-fuss framework that is a joy to use.

Among the things I love about Astro:

- It's still html and css centric - Once built, it doesn't require js by default - You can still opt-into adding js for interactivity here and there - Content collections are neat and tidy - Astro massively optimizes for speed, and the maintainers know how to do it - It had a very helpful devbar to help you visually figure out what easy fix can make your website snappier (like lazily loading images if it detects them below the fold)

For the "optimize for speed" bit, an example is that the css minifier cleverly inlines some CSS to avoid additional queries. The Image component they provide will set the width and height attribute of an image to avoid content layout shifts. It will also generate responsive images for you.
by diggan | 2025-07-09 09:56:36+00:00
> Traditional frameworks hydrate entire pages with JavaScript. Even if you've got a simple blog post with one interactive widget, the whole page gets the JavaScript treatment. Astro flips this on its head. Your pages are static HTML by default, and only the bits that need interactivity become JavaScript "islands."

Back in my days we called this "progressive enhancements" (or even just "web pages"), and was basically the only way we built websites with a bit of dynamic behavior. Then SPAs were "invented", and "progressive enhancements" movement became something less and less people did.

Now it seems that is called JavaScript islands, but it's actually just good ol' web pages :) What is old is new again.

Bit of history for the new webdevs: https://en.wikipedia.org/wiki/Progressive_enhancement
by Lio | 2025-07-09 09:56:58+00:00
You can use a static analysis tool to check Ruby types ahead of time (still not a compiler) or provide information for tooling.

Alternatively you use them at runtime to check the correctness of data, which I don't think you can usually do with say Typescript where the typing information is for the most part compiled away[1].

1. I may be out of date on this but when I last looked at runtimes that could take Typescript directly they just threw the typing away. You just didn't need to use the tsc compiler first.
by somafet | 2025-07-09 09:57:57+00:00
As a mainly front-end dev my passion lies in creating seamless UX. But sometimes, even the most well-intentioned ideas for enhancing that experience can fail, especially when building in public. I recently had a stark reminder of this truth when I launched a new demo for OnboardJS, our open-source user onboarding engine, and saw a significant disconnect between interest and action. Let me tell you the story of 2.6K views, 0 conversions, and a valuable lesson learned.
by vghaisas | 2025-07-09 09:58:06+00:00
Came across this list in the comments of this discussion, lots of great stories here! https://news.ycombinator.com/item?id=44466030

My personal list of stories of this kind includes:

- Car allergic to vanilla ice cream: https://www.cs.cmu.edu/~wkw/humour/carproblems.txt

- Can't log in when standing up: https://www.reddit.com/r/talesfromtechsupport/comments/3v52p...

- OpenOffice won't print on Tuesdays: https://bugs.launchpad.net/ubuntu/+source/cupsys/+bug/255161...

- Wi-Fi only works when it's raining: https://predr.ag/blog/wifi-only-works-when-its-raining/
by shakna | 2025-07-09 09:58:15+00:00
No, its defined to a series of specifications. [0] Ones that define an underlying structure, in bits.

You have a 16byte random string. Thats great. But it is not a UUID.

[0] https://www.rfc-editor.org/rfc/rfc9562.html

> The UUID format is 16 octets (128 bits) in size; the variant bits in conjunction with the version bits described in the next sections determine finer structure.
by eadmund | 2025-07-09 09:59:59+00:00
I don’t believe that ‘capitalism’ is a good explanation for the behaviour of a charitable organisation with no shareholders.

An issue with private funding for charitable projects is, as you note, appeals to the emotions of private donors.

An issue with the public funding for charitable projects you propose is appeals to the emotions of both legislators and executive agents. Another issue is corruption: a project which can figure out how to both receive money from taxes and influence elections can ultimately write its own meal ticket.
by anuramat | 2025-07-09 10:00:24+00:00
What's your point, we should all wait until an actual genocide is a possibility, before we even acknowledge that a literal purpose-built nazi AI is concerning?

Even if it had nothing autonomous to it, how can "programmatic antisemitism funded by a nazi salute billionaire" ever sound ok?

Also, since when is a concussion just a minor inconvenience you can brush off?
by diggan | 2025-07-09 10:01:10+00:00
"Traditional" always been a measure that depends on when we were born. "Traditional" internet for me is 56kbit modems, vbulletin forums, GTA:VC modding and IRC, while for older people "traditional" internet is probably BBS and such, and for the younger crowd things like Discord is part of the "traditional" internet.

You see the same thing in political conservative/traditional circles, where basically things were good when they were young, and things today are bad, but it all differs on when the person was born.
by akkad33 | 2025-07-09 10:01:34+00:00
As an Indian who moved abroad and comes back occasionally this is the hardest part. As an Indian I always think in multiples of 10: 100,1000,10000, 1 lakh etc, but abroad after a certain point people think in multiples of 1000. 1000, million, then multiples of 10..The Indian system to me is more logically consistent
by mkl | 2025-07-09 10:01:48+00:00
They are different lossless image formats. What is called "raw" is quite a few different formats from different manufacturers, and they contain lossless image data from the camera sensor without significant postprocessing. They usually need some postprocessing to look "good". A "bitmap" is just pixel data, not a file format, but .bmp is a file format, which does support some compression, and usually won't contain raw camera sensor data but something ready to be displayed on a screen.
by xdennis | 2025-07-09 10:02:13+00:00
I'm not quite sure about that. Romania is bigger because it has a bigger population, but look even at this GDP per capita comparison with Romania.

Greece: 31695 (2008), 25756 (2025), 31014 (2030, projected) Romania: 10435 (2008), 21421 (2025), 28809 (2030, projected)

It won't be until 2030 that Greece will recover, and I'm pretty sure it's slow growth is because of its huge debt because of the euro.
by diggan | 2025-07-09 10:02:54+00:00
> - It's still html and css centric - Once built, it doesn't require js by default - You can still opt-into adding js for interactivity here and there

I've never used Astro so forgive my ignorance, but isn't that just creating a .html file, a .css file and then optionally provide a .js file? What does Astro give you in this case? You'd get the same experience with a directory of files + Notepad basically. It's also even more optimized for speed, since there is no overhead/bloat at all, including at dev-time, just pure files, sent over HTTP.

> an example is that the css minifier cleverly inlines some CSS to avoid additional queries

Is that a common performance issue in the web pages you've built? I think across hundreds of websites, and for 20 years, not once have "CSS queries" been a bottleneck in even highly interactive webpages with thousands of elements, it's almost always something else (usually network).
by Orygin | 2025-07-09 10:03:29+00:00
Small sample: https://www.virtru.com/blog/industry-updates/microsoft-data-...

I also can't find the news, but they were hacked a few years ago and the hackers were still inside their network for months while they were trying to get them out. I wouldn't trust anything from MS as most of their system is likely infected in some form