MurphyA/hacker-news huggingface dataset:
by arimb00r | 2025-07-04 07:12:23+00:00
I've been working on an open source tool designed for incident response (IR) and case management, aimed at helping folks in forensics, IR, or part of a SOC handling security incidents and breaches.

I wanted the backend to be compatible with Microsoft Excel spreadsheets—specifically the infamous "Spreadsheet of Doom"—so that even if you don’t use the tool, the data remains accessible and usable.

Kanvas is an IR case management tool with an intuitive desktop interface, built in Python. It provides a unified workspace for investigators who rely on spreadsheets, help manage cases and complete key workflows without switching between different Apps.

Would love feedback, contributors, or just to hear how others are solving this problem.
by eran- | 2025-07-04 07:12:31+00:00
Exactly, the two statements aren’t contradictory. The fix was super simple, and Filippo (whom I don’t know personally) just went ahead and did it.

Also, bringing up Project Zero’s 30-day disclosure policy while complaining about someone sharing what they thought was a vulnerability report for visibility feels off. If it’s not a security issue, then there’s no reason it needs to be kept quiet. Grow up.

Let’s not turn harmless fixes into drama.
by ZYbCRq22HbJ2y7 | 2025-07-04 07:12:40+00:00
IMO, this is more ranting about people who meet the metrics of the platform.

You're a platform drone, you have no mind, yada. Yet, we are reading the author's blog.

The author may hate LLMs, but they will lead to many people realizing things they never were aware of, like the author's superficial ability to take information and present it in a way that engages others. Soon that will be a thing that is known. Not many will make money sharing information in prose.

What the author refers to as "LLMs" today, will continually improve and "get better" at everything the author has issues with, maybe in novel ways we can't think of at the moment.

Alternative take:

"Popular culture" has always been a "lesser" ideal of experience, and now that ontological grouping now includes the Internet, as a whole. There are no safe corners, everything you experience on the Internet, if someone shared it with you, is now "Popular culture".

Everyone knows what you know, and you are no longer special or have special things to share, because awareness is ubiquitous.

This is good for society in many ways.

For example, with information asymmetry, where assholes made others their food, it will become less common that people are food.

Things like ad-driven social networks will fade away as this realization becomes normalized.

Unfortunately, we are at the very early stages of this, and it takes a very long time for people to become aware of things like hoaxes.
by Eikon | 2025-07-04 07:13:11+00:00
This is not true,

1. Operator correctly runs: cat /dev/urandom > seed.bin

2. Filesystem corruption fills seed with nulls/spaces (happens in production)

3. Sunlight silently generates predictable keys from corrupted seed

4. CT log operates "normally" - valid signatures, no errors

5. Anyone knowing about corruption can recreate the private keys

What other "end-user" crypto-related app runs with a user-produced seed to generate key pairs on the fly?
by thelastbender12 | 2025-07-04 07:13:14+00:00
Sorry, I think this comparison is just unfair. Odin might have "shipped" but are there are any projects with significant usage built on it? I can count at least 3 with Zig - Ghostty, Tigerbeetle, and Bun.

Programming languages which do get used are always in flux, for good reason - python is still undergoing major changes (free-threading, immutability, and others), and I'm grateful for it.
by lovich | 2025-07-04 07:13:50+00:00
> agent constructions

> But this article is based on a model of LLM code generation from 6 months ago which is simply no longer true, and you can't gaslight your way back to Q1 2024.

You’re ahead of the curve and wondering why others don’t know what you do. If you’re not an AI company, a faang, or an AI evangelist you likely haven’t heard of those solutions.

I’ve been trying to keep up with AI developments, and only learned about MCP and agentic workflows 1-2 months ago and I consider myself failing at keeping up with cutting edge AI development

Edit:

Also six months ago is Q1 2025, not 2024. Not sure if that was a typo or a need to remind you at how rapidly this technology is iterating
by a_tartaruga | 2025-07-04 07:14:12+00:00
Blockchain people consider Ligero as a modern construction worth using. At least last I checked 6 months ago. This work isn't reinventing the wheel and appears to be targeting a nice problem in service of a practical system. The author's country of origin also makes the work seem more legit because everyone knows Italians are the best at zk.
by simonw | 2025-07-04 07:14:17+00:00
The more time I spend using LLMs for code (and being impressed at how much better they are compared to six months ago) the less I worry for my career.

Using LLMs as part of my process helps me understand how much of my job isn't just bashing out code.

My job is to identify problems that can be solved with code, then solve them, then verify that the solution works and has actually addressed the problem.

An even more advanced LLM may eventually be able to completely handle the middle piece. It can help with the first and last pieces, but only when operated by someone who understands both the problems to be solved and how to interact with the LLM to help solve them.

No matter how good these things get, they will still need someone to find problems for them to solve, define those problems and confirm that they are solved. That's a job - one that other humans will be happy to outsource to an expert practitioner.

It's also about 80% of what I do as a software developer already.
by lmm | 2025-07-04 07:14:24+00:00
> You seem to have a fundamental misunderstanding about what docker actually does, and how it's achieving it

On the contrary, I understand what it actually does (or tries to) for very well, you're hung up on what its proponents say it's meant to do (or perhaps retreat to in motte-and-bailey fashion).

> The artifact is the image. Which itself is only a zip file of a linux filesystem, basically. This will behave the same, no matter when you downloaded it.

But it won't. It's architecture-specific, it may rely on other interfaces that are ultimately moving targets, and you'll face things like certificate expiration. And modifying it in place is not sustainable, you need to be able to rebuild it.

> if you made a new image, you can then test the exact same deployment in another environment. You do not need to e.g. run apt update on prod and pray to the gods that nothing breaks. Instead you build the image, deploy to test, see that nothing breaks and then deploy to prod.

That's not nothing but it's something decent language deployment systems already had for years. Build your structured app image, it's a stable artifact, and you can deploy it any number of times and places.

> But supports other backends too

But they're all using that same model of unpack some random unmanaged bytes and try to run them as a Linux executable, right? Yes you can swap out the implementation, but the interface is fundamentally at the wrong level of abstraction.
by tgv | 2025-07-04 07:14:56+00:00
> Tech never ever prevents people who really want to hone their skills from doing so

Even though that is a generalization that you cannot prove, you implicitly admit that it will prevent everybody else from gettings any skills. Which is quite a bad outcome.

> powerlifting is a thing

Those people have a different motivation: looks, competition, prestige, power. That doesn't motivate people to learn to draw.

Your easy dismissal is undoubtedly shared by many, but it is hubris.
by yorwba | 2025-07-04 07:15:03+00:00
The end-user is unlikely to know which part of the context is relevant, and it may also change from moment to moment depending on who is speaking to whom. Of course you could imagine an AI interpreter that has cameras for situational awareness and asks for clarification if anything important is unclear while smoothing over minor stuff without interrupting, but you could equally easily imagine an AGI, so it's not clear that this could be built to a reasonable quality standard with current technology.
by arp242 | 2025-07-04 07:15:58+00:00
I have some projects "used by Google" as a dependency. Can I now expect someone posting three threads here in a day using deceitful title if I'm not nice enough to you? Will my words now be misrepresented as "Google said [..]"?

You lied to whip up outrage so you can piss an open source maintainer in the face, seemingly just to get revenge? Well done. Good job. 10/10 contributing.
by skwashd | 2025-07-04 07:17:13+00:00
I'm starting to sense a pattern with this project.

They've squashed the history to hide their earlier "error". This isn't compliant with section 5a of the GPLv3[1].

"sketchy at best" is a polite description of this pattern of behaviour.

[1] https://www.gnu.org/licenses/gpl-3.0.en.html#section5
by georgeecollins | 2025-07-04 07:17:16+00:00
To quote the article: >> But also… why do you care? Why would someone using a really cool tool that makes them more productive… feel compelled to sneer and get defensive at the mere suggestion that someone else isn’t doing the same?

>> It feels like the same attitude that happened with Bitcoin, the same smug nose-wrinkling contempt. Bitcoin is the future. It’ll replace the dollar by 2020. You’re gonna be left behind. Enjoy being poor. Sure thing, Disco Stu!
by robertritz | 2025-07-04 07:17:16+00:00
Meh I took a serious left turn after college and my first few jobs. Much happier now.

Work on Capitol Hill for less than a year then tech outsourcing then consulting. Realized it was boring, useless, and mind numbing and moved across the world. Now have multiple businesses, more than 30 employees across those business, and I get to have fun. It's stressful sometimes but I think we've kicked the stress finally (at 37). Now it's just fun and we get to see what we can pull off when we want to.

Most people simply quit or aren't willing to do the uncomfortable things. It's uncomfortable to be unbothered. But I certainly didn't follow my interests. I used my interests to get better at what was in front of us. Gotta pay the bills and give people what they want, I just put my own spin on it.
by sirwhinesalot | 2025-07-04 07:18:03+00:00
I think your last point is very reductionist. Nearly every country ends up in a voting situation where only 2 parties can realistically win. A diverse parlament results in paralysis and the fall of government (happened in my home country multiple times).

The two parties that end up viable tend to be financed quite heavily by said wealthy, including being proped by the media said wealthy control.

The more right wing side will promise tax cuts (also for the poor that don't seem to materialize) while the more left wing side will promise to tax the rich (but in an easily dodgeable way that only ends up affecting the middle class).

Many people understand this and it is barely part of the consideration in their vote. The last election in the US was a social battle, not really an economic one. And I think the wealthy backers wanted it that way.
by ninetyninenine | 2025-07-04 07:19:55+00:00
>People will write lengthy and convoluted explanation on why LLM isn't like calculator or microwave oven or other technology before. (Like OP's article) But it really is.

You generally don't need a lengthy explanation because it's common sense. When someone doesn't get it then people have to go into lengthy convoluted explanations because they are trying to elucidate common sense to someone who doesn't get it.

I mean how else do I elucidate it?

LLMs are different from any revolutionary technology that came before it. The first thing is we don't understand it. It's a black box. We understand the learning algorithm that trains the weights, but we don't understand conceptually how an LLM works. They are black boxes and we have limited control over them.

You are talking to a thing that understands what you say to it, yet we don't understand this how this thing works. Nobody in the history of science has created anything similar. And yet we get geniuses like you who can use a simple analogy to reduce the creation of an LLM to something like the invention of a car and think there's utterly no difference.

There is a sort of inflection point here. It hasn't happened yet but a possible future is becoming more tangible. A future where technology surpasses humanity in intelligence. You are talking to something that is talking back and could surpass us.

I know the abundance of AI slop has made everyone numb to the events that happened in the past couple of years. But we need to look past that. Something major has happened, something different then the achievements and milestones humanity has surpassed before.
by betasilly | 2025-07-04 07:20:10+00:00
Hello fellow J programmer. In statistic you can estimate the population size by coloring fishes that you put in a lake and some time later you fish in that lake, the proportion of colored fishes allow you to estimate the size of the population. Four month ago I posted some J identities [1] and you were the only one which commented, that means that in this capture I only got one fish and it was the colored fish. This imply that there must be very few J programmers HN, or more precisely, very few of them that post J related material.

The parent's comment (also mine) has a style that was designed not to scare non J programmers. One should also consider that some people dislike J code so downvotes are the usual result except when the post provides some additional insight.

Finally, thank you for this small J lesson, is a pleasure to find here fellow J programmers.

[1] https://news.ycombinator.com/item?id=42859077
by Laremere | 2025-07-04 07:20:26+00:00
The computer is a machine, and modern ones are complicated. When I am programming, I want to precisely control that machine. For me, simplicity is measured in how complicated it is to get the machine to do what I want it to do. So, eg, having several different operators for adding two integers sounds complicated. However there is simplicity in not having to reach far to actually get the correct behavior, and there is some simplicity in the process of being forced to make that choice as it irons about what behavior you actually want.
by 0xCE0 | 2025-07-04 07:21:35+00:00
Getting disgusted by seeing unnecessary complex and obfuscated code, and seeing how my own naive most obvious and intentfully explicit code describes the program execution like a story.

Oh, and if you have opportunity to start the codebase from scratch, making one semantic change per version control commit is insanely powerful explainer of how/why your code became as it is. They are like chapters/paragraphs in a story.

Also, separation of concerns: having clear separation of libraries and your "own" code. Including not mixing "business logic" (changing human rules/parameters/requirements) with technical non-human machinery.
by eviks | 2025-07-04 07:22:17+00:00
> or they suggested an elaborate and tedious workaround that would technically solve the problem (but introduce new ones).

There is no value in randomly choosing an API that exists. There is value in choosing an API that works.

When LLM makes up an API that doesn't even exist it indicates that it's not tied to the reality of the task of fetching a working API, so filtering out nonexistent APIs will not help the other results match better. But yes, they'll compile.
by benatkin | 2025-07-04 07:23:39+00:00
This is trying to use the word agent to make it sound cool, but it doesn't make a case for why it's particularly about agents and not just basic level AI stuff.

> The agent code is nothing more than a Python script that relies on the openai-agents-python library to run an AI agent backed by an LLM served via an OpenAI-compatible API.

The openai-agents-python code is useful for writing agents but it is possible to use it to write code that isn't very agentic. None of the examples are very agentic.
by chrismorgan | 2025-07-04 07:23:44+00:00
> Like, just to calibrate here: you know how some code editors will automatically fill in a right bracket or quote when you type a left one? You type " and the result is "|"? Yeah, that drives me up the wall. It saves no time whatsoever, and it’s wrong often enough that I waste time having to correct for it.

I have not yet figured out why anyone would choose this behaviour in a text editor. You have to press something to exit the delimited region anyway, whether that be an arrow key or the closing delimiter, so just… why did the first person even invent the idea, which just complicates things and also makes it harder to model the editor’s behaviour mentally? Were they a hunt-and-peck typist or something?

In theory, it helps keep your source valid syntax more of the time, which may help with syntax highlighting (especially of strings) and LSP/similar tooling. But it’s only more of the time: your source will still be invalid frequently, including when it gets things wrong and you have to relocate a delimiter. In practice, I don’t think it’s useful on that ground.
by kashunstva | 2025-07-04 07:24:54+00:00
> So.. America can't protect American interests when deciding who should be in the country?

Free speech is (was?) an American interest. Further, the country contains multitudes of different, opposing interests, not just those of the current regime.

For all its grandstanding over “cancel culture” this regime’s unusually thin skin when it comes to opposing views would be laughable, were it not so dangerous and abusive.
by exe34 | 2025-07-04 07:25:32+00:00
https://www.scientificamerican.com/article/climate-science-p...

https://www.vice.com/en/article/the-uns-devastating-climate-...

Old articles. Nowadays I'd say there's an even stronger current against "doomerism", which acts as a force suppressing sufficiently bad news. Don't look up!
by ggm | 2025-07-04 07:25:39+00:00
I keep asking if the model is homomorphic encryption with trusted intermediary which is what the CSIRO and the Australian Privacy Commission recommended.

No clear sign yet, if anyone knows I'd welcome it.

Like others, my google account is now over 20 years old, at one remove evidence of continuous use should have some value. That's not homomorphic, Google know what I'm doing but you would think given that, even in privacy mode they know it's me and from wallet have KYC 100 points data.
by hobofan | 2025-07-04 07:25:44+00:00
One part that I don't understand yet: How does the system ensure "sybil resistance"? (not sure if that's the right term in that context)

By providing both attestation of individual attributes combined with "unlikability", how would even a single verifying party ensure that different attestations don't come from the same identity?

E.g. In the case of age attestation a single willing dissenting identity could set up a system to mint attestations for anyone without it being traceable back to them, right? Similar to how a single of-age person could purchase beer for all their under age friends (+ without any feat of repercussions.
by ZYbCRq22HbJ2y7 | 2025-07-04 07:25:48+00:00
> every single LLM interaction is wrong/not useful

I think it is defense mechanism, you see it everywhere, and you have to wonder, "why are people thinking this way?".

I think those with an ethical or related argument deserve to be heard, but opposite of that, it seems like full blinders, ignoring the reality presented before us.
by hcfman | 2025-07-04 07:26:08+00:00
Doesn't this happen all the time with Ultralytics yolo code? They use an AGPL license, which to my understand means that anything that links with this code also becomes AGPL.

Please correct me if I'm wrong, but is the license also viral if there's a network connection involved? i.e. I run the code in a container with a little network interface added ?

And yet Microsoft have release code with different licenses that make's use of Ultralytics code.

I potentially would be interested in using these wildlife detection models in a commercial (Not open source) context but simply don't trust the claim that it would be okay to do so, sounds like a big business risk to me.

What is the opinion of the community of the MIT licenses associated with PyTorch wildlife from Microsoft okay to use in a closed source commercial context? Microsoft have put an MIT license on this, but their code does imports of ultralytics libraries, which I thought were AGPL.

Note: The GPL 3 license from the official yolov9 differs in this, it must be possible to run the same code on the platform, but your usage may be closed source.
by tpm | 2025-07-04 07:26:30+00:00
> We can make laws and change systems, a serious good faith solution would be to propose changes to the due process

No, a serious good faith solution would be to establish an actual working immigration/citizenship system with clear rules and then enforce them, because the current situation endangers everyone.

I'm from a different country. We have ID cards. You strictly need an ID card (or a different proof of citizenship or right to residence) from the age of 18 (or even sooner if you are attending schools, using the health system etc) to do basically anything. It's not possible to live here your whole life as a full member of the society without that. When I read how someone lives 60 years in the US without actual legal basis to do that I just shudder. People should be forced to resolve their legal situation one way or another much sooner. And I am pro-immigration, but also there should be order in that.

Once you have a clear, fast proof of right to reside in a country, you don't need to touch due process because it can go fast.
by tkcranny | 2025-07-04 07:26:59+00:00
I agree the underlying technology doesn’t ultimately matter, but as user of a lot of fairly modern rust-based cli tools there definitely is something in the air worth mentioning.

I suspect it’s a couple of things. A new generation of programmers are hitting the scene, wanting to do things in new ways. Not inherently good or bad, but the new tools sure usually are at least very _pretty_, and have a lot of affordances and usability improvements over the ancient tools that can never be changed for the sake of compatibility. Rust and Go make this nicer, and are the languages de jour with good cli ecosystems and performance characteristics around them.

I genuinely do like most of my replacements. ripgrep for grep, eza for ls, zoxide for cd, fd for find, podman for docker, and a few more. Developer tooling is a rich and interesting space to be in, but there’s plenty of bandwagons I’m not getting on, like this or zellij for tmux, or jj for git.
by handsclean | 2025-07-04 07:27:14+00:00
The actual issue seems to be that some tools ask the user to provide a random seed, then accept anything non-empty, even if it’s too short or otherwise obviously not random. The reporter argues this is a critical security vulnerability, Google argues this is just a usability issue. Google subsequently added additional validation to make sure it’s also the right length.

Personally, I think usability issues can have security implications. Taken to the extreme, look at RSA: technically possible to use securely, but widely considered insecure because everybody screws it up. Modern crypto libraries are all about achieving better security by fixing footguns. This issue isn’t RSA, but I bet fully fixing this issue would make a small but tangible number of insecure users secure. I think Google should have a clear and spelled out policy re usability issues with security implications, and should give this guy at least some reward, even if it’s not the “critical vulnerability” he makes it out to be.