MurphyA/hacker-news huggingface dataset:
by andy99 | 2025-07-08 21:46:13+00:00
You'd need a different architecture, not just training. They already train LLMs to separate instructions and data, to the best of their ability. But an LLM is a classifier, there's some input that adversarrially forces a particular class prediction.

The analogy I like is it's like a keyed lock. If it can let a key in, it can let an attackers pick in - you can have traps and flaps and levers and whatnot, but its operation depends on letting something in there, so if you want it to work you accept that it's only so secure.
by DaSHacka | 2025-07-08 21:46:14+00:00
> That means it's actually not like in country. Once you have an ID card, you don't need anything else (only very rarely the birth certificate).

We could just increase the amount of places that need a Passport for verification, then.

> That would in our country mean no phone, no driver's license, no electricity, no bank account, you can't be employed, etc., so really not something anyone could do for a longer time and lead a normal life.

I don't know about phone plans or electricity, but you can't get a driver's license without being a citizen in most states (a few blue ones are the exception), and without a social security number you can't open a bank account or get legally employed (employers need your SSN to pay you), but the issue is some employers knowingly hire illegal immigrants and pay them under the table, oftentimes in cash and without reporting it to the IRS, because they like the cheaper labor. This is illegal, but oftentimes unenforced.

> Offer them a clear path to legalize their status.

Why should we have to legalize them? We have a path to legal immigration in this country, and they decided not to go through it. Reagan legalized all illegal immigrants in the past, and that turned out horribly, and set an awful precedent.

> Create a system where it's not possible to live a nearly whole life this way.

Why should we have to? We've been around for ~250 years, this hasn't been a big problem the entire time. Clearly, it's possible to fix this without it.

> This is clearly a systemic problem and needs a systemic solution, not one that can be created or cancelled on the whim of a president.

It's not just the Executive, the BBB passed the Senate and House too, and deporting illegal immigrants has large bipartisan support [0] (though not to the extent the current administration is doing it, unfortunately)

[0] https://www.pewresearch.org/race-and-ethnicity/2025/03/26/am...
by e9a8a0b3aded | 2025-07-08 21:47:15+00:00
I wouldn't wrap it with any additional prompting. I believe that this is a "fail fast" situation, and adding prompting around it only encourages bad practices.

Giving an LLM access to a tool that has privileged access to some system is no different than providing a user access to a REST API that has privileged access to a system.

This is a lesson that should already be deeply ingrained. Just because it isn't a web frontend + backend API doesn't absolve the dev of their auth responsibilities.

It isn't a prompt injection problem; it is a security boundary problem. The fine-grained token level permissions should be sufficient.
by FakeFind_ai | 2025-07-08 21:47:16+00:00
Fakespot paved the way — respect to 9 years of helping shoppers stay informed. At FakeFind, we’re building on that mission with AI that digs even deeper into review authenticity across Amazon, Walmart, eBay, and more. The fight against fake reviews isn’t over. If your interested: https://fakefind.ai
by jezze | 2025-07-08 21:47:21+00:00
Yeah I am not advocating creating a new seperate register, even though that would be nice. Like the poster below said, there are usually some unpreserved registers to choose from but if you for some reason cant spare a register you could instead write the error code to any virtual address instead, or send a signal, a message or anything else you could come up with. Just some way that does away with this intermix of return types and error types.
by sincethebbsera | 2025-07-08 21:47:36+00:00
You're quite possibly right - but you couldn't implmenet something so poorly if the tech didn't allow for it. You couldn't deploy skype this way - it was made to communicate, only microsoft could take it down. And for me - How much work should it require ... it feels like being dropped into a jungle and needing to find your way into a field.
by socalgal2 | 2025-07-08 21:48:04+00:00
SVG can be color responsive (change color based on the user's dark/light prefs). It can also be size responsive (change based on max width or aspect). Video can't

https://jsbin.com/nohamuguze/edit?html,css,output

edit: sigh.... Works in Firefox and Chrome. Has issues in Safari - I'm sure I could futs with it more and get it to work everywhere but still, sadness
by windexh8er | 2025-07-08 21:48:37+00:00
Even given all of the historical abuses of Google on Android you still believe an app permission is acting in good faith when Google has hooks elsewhere into the OS?

Google has already been successfully sued this year in CA for siphoning off data from phones that are idle and the remainder of states is in process [0].

[0] https://www.androidauthority.com/google-314-million-verdict-...
by sophacles | 2025-07-08 21:48:37+00:00
The person you replied to didn't say that you had to bypass safe. This bug is orthogonal to type and memory safety, its a different issue.

The git bug in question could be written in 100% safe rust using as much or as little of the type system[1] as you want. It's a logic error when parsing a string.

I dev rust full-time, and I've spent a lot of time writing protocol parsers. It's easy to forget to check this or that byte/string for every possible edge case as you're parsing it into some rust type, and happens all the time in rust, just like it did in C or python or go when I used those languages. This bug (if anything) is the type of thing that is solved with good tokenizer design and testing, and using more small, independently tested functions - again not at all related to the type system.

[1] Although in rust you can arrange your types so that this sort of bug is harder to implement or easier to catch than in most languages... but doing that requires an up-front understanding that logic bugs are just as possible in rust as in other languages, as well as some experience to avoid awkwardness when setting the types up.
by chowells | 2025-07-08 21:48:53+00:00
I, uh... What? Did you mean to respond to some other post there?

I can't see how anything you said is a response to anything I said. My statement was very simple: if two models predict the same result, you can use either of them. As far as we have worked out so far, continuous and discrete spacetime give the same results for every experiment we can run. If you have an experiment where they don't, physicists would really love to see it.
by robocat | 2025-07-08 21:49:25+00:00
What a sham.

> Their exploitation of Microsoft Exchange Server was at the forefront of a massive campaign targeting thousands of computers worldwide

I would love to blame Microsoft here.

But really the fault lies with those responsible for the regulations regarding security and the lack of financial penalties (to incentivise the behaviour we need from Microsoft).

Microsoft is a corporation that needs to be correctly incentivised. It has no feelings, and if it is not correctly incentivised then who is to blame?

Every software engineer knows how good Microsoft security has always been, and why that is the result of ongoing incentives.

Too many people on HN try to blame engineers for everything.

We mostly seem to accept systematic failures (or we complain but lack authority or ability to fix there systems).

People are the root cause, and we have individual incentives, but we never penalise those that create the systematic failure points (only victimise some rando workers on the front-line doing a job for their government).
by atommachinist | 2025-07-08 21:49:29+00:00
This actually works fine a lot of the time. There are just cases where that isn't the window I want to switch to. I wanted to find a solution that would cover more of these cases. One example is when my computer starts I have a some applications that automatically run. I don't want to tab through the Alt + Tab list to get it in the right order, I want it to be ready to go.
by scubakid | 2025-07-08 21:50:00+00:00
Thanks. For a while there, it wasn't clear to me which side of the line I was walking.

Something that stuck with me from Poor Charlie’s Almanack is that low expectations are a cornerstone of a happy life. I built this for myself first, so when people actually signed up and paid, it was incredibly motivating. I was thrilled to spend my free time treating those early customers like royalty and building more of what they wanted.

If I had instead come into this with the expectation of quick success, I doubt I would have made it through those early years.

And cheers from one bootstrapper to another. It's not easy, but I can't imagine a more rewarding way to build.
by detaro | 2025-07-08 21:50:31+00:00
Except the foundations mission statement isn't turtle-saving, that's just what you think is clearly the most important part of their work that they should solely focus on, in your opinion. And it's not wrong of you to want to be able to donate towards the parts that you care about, but it's an obvious disconnect from the reality of what their stated goals are (and hence you blame decision makers for decisions that are actually fully in line with the mission statements).

Mozilla Foundation never was the Firefox Development Foundation, as much as some of us want it to be. Wikimedia never was the Wikipedia Development and Operations Foundation. If you dislike that, donate to entities with narrower goals (I personally prefer directing money towards OSM and KDE for example)
by ValentineC | 2025-07-08 21:51:21+00:00
> you don't need to stay on the latest version

Homebrew only provides support for Apple-supported macOS versions though.

I found out the hard way when a brew upgrade on Mojave (the last macOS version to support 32-bit apps) took hours to complete, because it was compiling plenty of stuff from source.

This isn't a complaint. I understand that it doesn't make much sense to provide precompiled binaries for obsolete macOS versions that are likely to have security vulnerabilities.
by simonw | 2025-07-08 21:51:40+00:00
That's a different issue - it's two things:

- exposure to untrusted input

- the ability to run tools that can cause damage

I designed the trifecta framing to cover the data exfiltration case because the "don't let malicious instructions trigger damaging tools" thing is a whole lot easier for people to understand.

Meanwhile the data exfiltration attacks kept on showing up in dozens of different production systems: https://simonwillison.net/tags/exfiltration-attacks/

Explaining this risk to people is really hard - I've been trying for years. The lethal trifecta concept appears to finally be getting through.
by Velorivox | 2025-07-08 21:52:29+00:00
> I think your point still stands

Thanks.

> its not nearly as fabulous an investment as you are suggesting

In case it wasn't clear, I'm not trying to give investment advice (my comment is very focused on what happened, not what will happen). I am however, implying that a lot of people made bad financial decisions by misapprehending their situation and consuming the wrong "content". I believe many people can be spared significant regret if they double-check, disbelieve, or replace much of what they’re told by the internet.
by 90s_dev | 2025-07-08 21:52:50+00:00
I can only post a couple times per day now, and I've already posted a few times today, so I don't know if this will go through. Thanks Tom. But I'll try anyway.

I fully agree that software has gotten substantially more complex. There seem to be far too many levels of abstractions on top of abstractions. I do miss the days of QBasic, and that's why I'm working on the product I legitimately need to release before the end of the month.

But not every layer has the same level of low quality. For example, you brought up lazy loading. It actually can take a lot more work to properly support lazy loading, unless your framework supports it. I'm not sure what Slack uses beyond just Electron, but even in vanilla JS it's not easy to get lazy loading working properly, although the animations are very easy to get wrong with canned code.

On the note of Electron, I'm very happy to report that the last time I checked the size of my Release build for my pure Win32 app, it was sitting at 312 kb total, as a single standalone .exe file. It will of course be a bit bigger than this when I finally release it, but still, there's something so satisfying about making something with such extreme minimalism.
Ask HN: Who here uses a productivity system daily?
by cristinon | 2025-07-08 21:52:52+00:00
I'm building a small productivity peer group for people who actually use productivity systems to stay focused and reach their goals. This isn’t for people who have just watched one video about Notion on YouTube, or casual interest, it’s for people who already track their work (startup, learning, coding, etc.) and want a few peers to share progress, workflows, and feedback with.

There is no monetization, no self-promo, no “coaching” allowed. It ruins the incentive to freely share knowledge.

This is also not a "community" with thousands of people who are inactive and do not contribute, it is a small personal "group", like a group chat. For this reason it will be capped at 10 members.

Some things we’d do: - Share weekly goals, progress, and reflections - Compare systems/tools (Obsidian, custom setups, etc.) - Give high quality advice and feedback

If you’re the kind of person who: - Already uses a system (daily review, weekly plan, second brain, whatever) - Is working toward something big (startup, deep learning, long-term goals) - Values feedback and real accountability over content

Fill out this short application: https://form.typeform.com/to/uVz3sGPI

Happy to answer questions in the comments.
by saurik | 2025-07-08 21:53:02+00:00
(EDIT: THIS WAS WRONG.) [[FWIW, I definitely can imagine that (and even described multiple ways of doing that in a lightweight manner: pattern whitelisting and fine-grained permissions); but, that isn't what everyone has been calling an "agent" (aka, an LLM that is able to autonomously use tools, usually, as of recent, via MCP)? My best guess is that the use of "agent code" didn't mean the same version of "agent" that I've been seeing people use recently ;P.]]

EDIT TO CORRECT: Actually, no, you're right: I can't imagine that! The pattern whitelisting doesn't work between two LLMs (vs. between an LLM and SQL, where I put it; I got confused in the process of reinterpreting "agent") as you can still smuggle information (unless the queries are entirely fully baked, which seems to me like it would be nonsensical). You really need a human in the loop, full stop. (If tptacek disagrees, he should respond to the question asked by the people--jstummbillig and stuart73547373--who wanted more information on how his idea would work, concretely, so we can check whether it still would be subject to the same problem.)

NOT PART OF EDIT: Regardless, even if tptacek meant adding trustable human code between those two LLM+MCP agents, the more important part of my comment is that the issue tracking part is a red herring anyway: the LLM context/agent/thing that has access to the Supabase database is already too dangerous to exist as is, because it is already subject to occasionally seeing user data (and accidentally interpreting it as instructions).
by evil-olive | 2025-07-08 21:53:10+00:00
what real-world problem, if any, does 10x faster UUID generation solve?

from your readme, `guid.New()` is 6~10 ns, so presumably the standard UUID package takes 60-100 ns?

say I generate a UUID, and then use that UUID when inserting a row into my database, let's say committing that transaction takes 1 msec (1 million ns)

if I get a speedup of 90 ns from using a faster UUID package, will that even be noticeable in my benchmarks? it seems likely to be lost in the noise.

honestly, this seems like going on a 7-day road trip, and sprinting from your front door to your car because it'll get you there faster.
by jrs235 | 2025-07-08 21:53:13+00:00
The home value didn't triple. Their equity did. Put $60,000 down on a $300,000 home. Live in it three years. Sell it for $540,000. Just made $240,000 in three years by investing $60,000. Granted there's also costs associated with carrying the home and mortgage one needs to count against the full profit and return.
by poisonborz | 2025-07-08 21:53:44+00:00
Eg. when you live in a premium apartment. For even moderately nice houses 20 years of rent would pay a third of the home's value at the start of the renting period. And rent will never increase as much as the property value, no taxes and maintenance. It's much cheaper AND simpler, especially if you are unsure how long you stay.
by rucikir | 2025-07-08 21:53:52+00:00
Playing with MSVC's typeof, I've just discovered that its docs [1] have an example that has never worked with any released version of MSVC... MSVC doesn't support `typeof` applied on function types and function pointers! (bug report [2] [3]). Is there anyone from the compiler team around here? :)

[1]: https://learn.microsoft.com/en-us/cpp/c-language/typeof-c?vi... [2]: https://developercommunity.visualstudio.com/t/Support-for-ty... [3]: https://gcc.godbolt.org/z/Kn51qrj99
by bruce511 | 2025-07-08 21:54:11+00:00
It's a good practice to question the premise of the question when writing an answer. (In this case interpreting the question as "how do I make money on the side.")

There are indeed other reasons for side gigs, but the parent question here does seem to be focused on the financial side of things.

I would agree that work-related progress is likely to be more profitable in the long run. IF (and it's a big IF) there is a route at work to more compensation then that is likely the best use of your time.

Of course not all jobs offer that path, and in some organizations it can take a bit of detective work to find out where things pay better, or where more value can be recognized.
by alganet | 2025-07-08 21:54:30+00:00
You're putting up a show for others to read.

So am I. Mine is designed to discourage people from trusting charlatans. I said it from the very beginning, quite honestly.

I don't need to be right, and people don't need to follow my example. They just need to think "wait, why am I reading this thing? why does it feel compelling? am I being tricked?".

Maybe you're not used to skepticism in your life, and you usually get the things you want by putting up a show. That's actually not bad, but I'm not going to apologize for attempting to increase awareness of how charlatans work.
by jazzyjackson | 2025-07-08 21:54:48+00:00
Punkt has a phonen using a fork of grapheneos out of switzerland with some cloud services like VPN attached to make it a completely degoogled 'secure phone', called ApostrophyOS

https://mc02.punkt.ch/en/mc02-5g-secure-phone/

https://www.apostrophy.ch/

Can't vouche for it, I just use a flip phone.
by gck1 | 2025-07-08 21:55:12+00:00
All that this will result in is Cloudflare starting to demand payment from humans to browse the web, eventually. It already became impossible to browse the Cloudflare-dominated web if you use VPN and/or any browser that resists fingerprinting.

Companies with a lot of money will pay up, smaller companies that depend on crawling for legitimate purposes will struggle, Cloudflare will pocket most of the profits, website owners will get pennies on the dollar and end user experience will get another blow.
by tomasflorian | 2025-07-08 21:55:40+00:00
As someone deep in systems and protocols, I decided to see how human factors affect data transcription. I timed myself typing 32 bytes of random data encoded in formats like binary, hex, Base64, and BIP39 word lists.

Despite longer strings, BIP39’s natural language words made typing faster and less error prone than raw hex or base64.

This shows how patterns can speed up manual data entry in air-gapped or constrained environments where copy-paste isn’t possible.

If you have ever needed to type binary key strings by hand, you might find the results interesting.

Full details and numbers here: https://lab.florian.ca/blog/posts/2025/2025-07-05-Patterns-S...

Open to thoughts, feedback, or similar experiments!
by alexcos | 2025-07-08 21:55:53+00:00
"But a friend told me something, that really stuck with me. He said that everybody has to give up on certain dreams in life. And it’s true. The more people you meet, the more you see in the way of broken dreams. It seems like almost everyone is coming to terms with something they expected to happen, but didn’t. And there’s a comfort in that." https://x.com/humansofny/status/1942629822125216080?t=QrZxAo...
by HappMacDonald | 2025-07-08 21:56:11+00:00
I'm not on pocket because I still don't know what it is. Just that it's yet another in a string of services my various flavors of web browser have tried pitching to me over the decades, and because it's hosted by a third party and apparently piquantly of interest to somebody else that I use it I tend to pass.

Although I am at least morbidly curious: what is it even?

My best hot take guess is "it's bookmarks, but probably even less useful somehow".
by lbeckman314 | 2025-07-08 21:56:16+00:00
Awesome port, playing around with the 3D example now!

Steps to run (in Chrome):

git clone https://github.com/craftlinks/Notebook cd Notebook/particle-lenia node --version # v24.3.0 npm i npm run dev # 2D Example: http://localhost:5173 # 3D Example: http://localhost:5173/gpu_test
by dimal | 2025-07-08 21:58:29+00:00
All that money wasted is the whole point of Mozilla. It’s been captured by Google. The role of Mozilla is to provide a fig leaf of “competition” while using Google money to pay executives who fulfill that duty. Anything that is successful or innovative, like Rust, Servo, or FakeSpot need to be jettisoned because they are a distraction from Mozilla’s true mission.
by jhanschoo | 2025-07-08 21:58:47+00:00
Make no mistake, occupiers can and frequently will use terror tactics.

They don't plow through a crowd with a truck or plant a bomb in an everyday place because they don't need to do that to instill terror, those are tactics of the weak. No, they disappear the people around you, with the same aim, and from a position of power. Which is the greater terror? A truck that detonated downtown or knowing a relative that got killed, locked up, or tortured? Apartheid and genocide are worse terrors than that, and by a stronger oppressor.

Many Palestinians in the West Bank have to pass through military checkpoints daily just to go about their daily lives, and at every point, one wonders if it is on that day that their life goes sideways.
by jfengel | 2025-07-08 21:58:52+00:00
(it's slightly more than 1% of their revenue)

In a lot of industries, 1% revenue is rather a lot. Many domains have profit margins of 5% or even less; that would be fully 20% of your earnings.

Software development is not "many industries", and Mozilla isn't most software development companies. So it's hard for me to say whether that specific CEO salary is appropriate. But I'd rather see his salary described by earnings, rather than revenue, since revenue by itself could just be churn.
Ask HN: Any tool that can auto instrument code and serve as a debugging copilot
by gritlin | 2025-07-08 22:00:05+00:00
I am looking for a tool that can auto instrument my front end , back end (react, python and .net) send the logs somewhere and when a customer reported issue occurs help me debug it (act as a copilot).

If such a tool does not exist what is the closest ?