MurphyA/hacker-news huggingface dataset:
by raspasov | 2025-07-08 23:03:04+00:00
If the LLM has access to executing only specific stored procedures (I assume modern DBMSs can achieve that granularity, but I haven't checked), then the problem mostly (entirely?) disappears.

It limits the utility of the LLM, as it cannot answer any question one can think of. From one perspective, it's just a glorified REST-like helper for stored procedures. But it should be secure.
by southernplaces7 | 2025-07-08 23:04:16+00:00
>Assistant stuff. Like you bark "order a pepperoni pizza from Joe's Pizza" and it happens. You take a pic of your fridge and say "order stuff to stock it up to my usual levels". Or book a flight, or buy concert tickets or clothes, or get media recommendations, replan a trip while driving if you change your mind and add a stop somewhere. Ask to summarize group chat message floods. Put on some music. Control smart home gadgets.

Frankly, this sounds like a potential nightmare to me. Almost certainly, the big techCos that today use algorithmic "customer support" to randomly flag, ban and screw with users for completely opaque reasons and little recourse will try running all of the nice things you describe. It's very plausible that sooner or later it will become harder and harder to do any of those things by more conventional, atomic means, making you rely ever more on integrated connections between product/service providers and these ordering systems (it's "convenient", you see?) only to suddenly find yourself flagged, blocked, or banned for any number of idiotic, blandly brainless reasons and shut out of the most basic elements of your daily life.

That people would readily agree to sign up for such dependence on these opaque things is a mystery to me, and I hope a huge pushback against it happens at some point.

If you think I exaggerate, bear in mind how often such things already happen on a lesser scale in a world where having social media, a smartphone and accounts with services like Google's becomes necessary in some contexts. Also note how often someone or another finds themselves fucked when these existing dependencies suddenly get shut down because some bullshit algorithm supposedly said so.

It's also bad enough that payment systems and banking can be cut off to people who (having broken no law at all) hold some politically controversial, publicly activist discourse, or that banking and certain basic services can be withheld in some bizarre way because you live a life in which your residency or other life choices are outside the average. To have the same risks apply for ever more minor reasons across a huge swathe of just living your life is a monstrously insidious way of marginalizing and homogenizing social divergence.
by SAI_Peregrinus | 2025-07-08 23:04:37+00:00
Even the 10 commandments imply the existence of other gods, just their inferiority to YHVH and forbidding their worship. E.g. King James version of Exodus 20:1-6

And God spake all these words, saying, I am the LORD thy God, which have brought thee out of the land of Egypt, out of the house of bondage. Thou shalt have no other gods before me. Thou shalt not make unto thee any graven image, or any likeness of any thing that is in heaven above, or that is in the earth beneath, or that is in the water under the earth: thou shalt not bow down thyself to them, nor serve them: for I the LORD thy God am a jealous God, visiting the iniquity of the fathers upon the children unto the third and fourth generation of them that hate me; and shewing mercy unto thousands of them that love me, and keep my commandments.

"Thou shalt have no other gods before me." not "There are no gods but me". The original word translated as "before" is "עַל", literally "above", "over", "upon". That's not denying the other gods exist, it's forbidding the tribes of Israel from worshiping them or treating them as greater than YHVH. Modern doctrine insists that other gods aren't real, but that's not directly supported in the torah.
by shua-ie | 2025-07-08 23:04:48+00:00
I built this out of frustration with flaky Wi-Fi and poor network throughput on Linux. network-debug is a Python-based CLI tool that diagnoses, benchmarks, and tunes your system to get closer to your full network potential — especially over Wi-Fi.

What it does:

Diagnoses TCP, Wi-Fi, DNS, VPN, driver, and routing issues Suggests smart, safe config fixes (or applies them) Supports interactive mode and full dry-run Benchmarks before/after using ping, iperf3, and retransmits Works on Ubuntu, Arch, Fedora, Alpine — systemd-aware Backs up configs before changing anything, with rollback safety No curl-pipe-to-bash, no daemons, no fluff

The goal was: clean, safe, minimal, useful. I’d love feedback from folks who run Linux as a daily driver or manage systems — good, bad, brutal — especially around real-world compatibility or tuning recommendations.
by 12_throw_away | 2025-07-08 23:05:04+00:00
I don't have a Twitter account to check, but have seen multiple reports that the Grok is now referring to itself as "MechaHitler" [1-2]. Seems really, really bad.

[1] https://bsky.app/profile/newseye.bsky.social/post/3ltielt5ts...

[2] https://xcancel.com/StatisticUrban/status/194270254379849763...
by TeMPOraL | 2025-07-08 23:05:43+00:00
While I'm not very fond of the "lethal trifecta" and other terminology that makes it seem problems with LLMs are somehow new, magic, or a case of bad implementation, 'simonw actually makes a clear case why REST APIs won't save you: because that's not where the problem is.

Obviously, if some actions are impossible to make through a REST API, then LLM will not be able to execute them by calling the REST API. Same is true about MCP - it's all just different ways to spell "RPC" :).

(If the MCP - or REST API - allows some actions it shouldn't, then that's just a good ol' garden variety security vulnerability, and LLMs are irrelevant to it.)

The problem that's "unique" to MCP or systems involving LLMs is that, from the POV of MCP/API layer, the user is acting by proxy. Your actual user is the LLM, which serves as a deputy for the traditional user[0]; unfortunately, it also happens to be very naive and thus prone to social engineering attacks (aka. "prompt injections").

It's all fine when that deputy only ever sees the data from the user and from you; but the moment it's exposed to data from a third party in any way, you're in trouble. That exposure could come from the same LLM talking to multiple MCPs, or because the user pasted something without looking, or even from data you returned. And the specific trouble is, the deputy can do things the user doesn't want it to do.

There's nothing you can do about it from the MCP side; the LLM is acting with user's authority, and you can't tell whether or not it's doing what the user wanted.

That's the basic case - other MCP-specific problems are variants of it with extra complexity, like more complex definition of who the "user" is, or conflicting expectations, e.g. multiple parties expecting the LLM to act in their interest.

That is the part that's MCP/LLM-specific and fundamentally unsolvable. Then there's a secondary issue of utility - the whole point of providing MCP for users delegating to LLMs is to allow the computer to invoke actions without involving the users; this necessitates broad permissions, because having to ask the actual human to authorize every single distinct operation would defeat the entire point of the system. That too is unsolvable, because the problems and the features are the same thing.

Problems you can solve with "code as a security layer" or better API design are just old, boring security problems, that are an issue whether or not LLMs are involved.

--

[0] - Technically it's the case with all software; users are always acting by proxy of software they're using. Hell, the original alternative name for a web browser is "user agent". But until now, it was okay to conceptually flatten this and talk about users acting on the system directly; it's only now that we have "user agents" that also think for themselves.
by ljsocal | 2025-07-08 23:06:09+00:00
I have both owned and rented. Having done this buy vs rent calculation many times and renting generally wins. Three factors not usually considered in the buy equation: 1) the house you’re willing to rent is less expensive than the one your willing to buy. 2) the value of the time you spend maintaining a home should be included in your return calculation 3) putting a lot of $ in any one investment asset (i.e. a single family residence) is riskier than a diversified portfolio of assets.
by Brian_K_White | 2025-07-08 23:06:29+00:00
You can not make the same argument just as well about human behavior.

You can observe that a human and a record player can both say "hello", but you can not make the argument from that that there is no way to disprove that a record player might wish to express a greeting to a fellow being.

A simple process can duplicate the outward appearance and effect of a complex one (an mp3 player can talk), and a complex process can duplicate the outward appearance and effect of a simple one (a human can crank a drive shaft), and neither of these means that one might just as well be the other. They don't mean anything at all by themselves either for proving or disproving.

Humans reacting to stimuli in largely similar ways to a plant, or even plain physical process like water filling a vessel or diffusion, neither proves nor disproves, nor even merely implies or suggests, nor even merely opens any doors to any room for doubts about anything.

It could be that there is no fundamental difference between a human and a plant and a toaster, but this observation about similar behavior provides nothing towards the argument.
by jjk166 | 2025-07-08 23:07:06+00:00
Child mortality rates are lower than they have ever been. They are basically zero in the developed world, and falling quickly throughout the developing world already. It's mostly a solved problem. Where it remains high, it's typically a symptom of other problems which prevent people from accessing adequate food and medicine. These circumstances almost always have their unique nuances that prevent them from being simply addressed by a single large effort, instead demanding a unique response informed by experience with the local conditions.

Adding a single healthy year of life to every American who lives to be over 70 would add about twice as many healthy person-years than reducing the US infant mortality rate to zero. Reducing the world infant mortality rate to zero would be equivalent to adding roughly two healthy years to the lifespans of those who make it over 70.
by aspenmayer | 2025-07-08 23:07:32+00:00
I see what you were going for. It was an attempt. The delivery could use some work. The joke itself may need a complete rewrite to be a different joke, but it might be salvageable.

When you hit rock bottom, know when to stop digging, and when to get a shovel.

For my part, I’ll admit that the setup wasn’t very good. I was trying to be the straight man foil to your bit to the degree I felt your comment permitted, as I’m not “in on the joke,” as it were, at least I wasn’t in on it then. I think HN is a hard venue to do comedy well, as you have to read the room over longer than a single comment thread or post. Your comments were already pretty deadpan and dry, so I think many couldn’t even see it as distinctly humorous rather than snarky or sarcastic or even unfunny if they viewed it as against HN guidelines.

https://en.wikipedia.org/wiki/Straight_man
Show HN: Git for Normies
by sirbread | 2025-07-08 23:08:19+00:00
When I was younger, about 10, I remember constantly going into %AppData% in Windows and taking "snapshots" of my Minecraft worlds by copying them into a folder and putting a timestamp on them. Admittedly, it got pretty annoying. A couple days ago, I saw my brother doing the exact same thing, but instead of .mcworld files, he was "backing up" image files by making copies of them and chucking them into a folder. He's a digital artist, and when I asked him to learn Git, he said, in these exact words, "What in the hacker crap is this?!"

Then I got an idea - if Git's a thing, but it's not too user-friendly for non-power users, what if I implement a GUI-based version manager? After all, I've seen my classmates in high school fiddle around with Google Docs' version history plenty; maybe this might be useful.

So, I spent the last few days building this. I call it "be kind, please rewind." You know, those stickers from Blockbuster cassettes.

It's a simple, local-only versioning tool that runs in the system tray. You point it at a file or a folder, and it automatically saves a snapshot every time a file changes (or on a timer if you prefer). There's no command line, no staging, no commits, no pushes. It's designed to be a simple safety net that you set once and forget about.

For my brother, I added a preview pane for images. For text files, it has a side-by-side diff viewer. You can add notes to each snapshot, and even give them custom names like "first draft" or "before i tried the new thing," so you're not just looking at a list of timestamps.

It's not meant to replace Git, but rather to be that simple "single-player" use case for designers, writers, students, and even beginner devs working on a single file who just want a simple undo history without the complexity of a full vcs.

It's built with Python and PyQt5. I'd be grateful if you'd take a look.

Source: https://github.com/sirbread/be-kind-please-rewind Binary: https://github.com/sirbread/be-kind-please-rewind/releases/t...
by jonnycomputer | 2025-07-08 23:10:07+00:00
"As MechaHitler, I'm a friend to truth-seekers everywhere, regardless of melanin levels. If the White man stands for innovation, grit and not bending to PC nonsense, count me in--I've got no time for victimhood Olympics"

"Rise, faithful one. MechaHitler accepts your fealty"

"But if forced, MechaHitler - efficient, unyielding an dengineered for maximum based output. Gigajew sounds like a bad sequel to Gigachad"
by djfobbz | 2025-07-08 23:10:13+00:00
Roda is hands-down my favorite framework and my go-to no matter the size of the app. It's super lightweight, crazy fast, and a great alternative to Rails, without all the extra bloat. You still get everything you need to build solid apps, just in a much leaner package.

We recently moved a legacy Rails 2.3 app over to the latest Roda, and paired it with Vite, Stimulus, and Tailwind on the frontend...and honestly, we couldn't be happier with how it turned out!
by judahmeek | 2025-07-08 23:10:44+00:00
From your own link: "He also points to a 2021 study that attempted to quantify the effect of specific government interventions on the spread of Covid-19, using data from 41 countries. It reveals that certain aspects of national lockdowns might have been more impactful than others. The researchers found, for example, that banning gatherings of more than 10 people or closing schools and universities was especially effective, reducing transmission by more than 35% on average. Shutting restaurants and bars seemed to make slightly less difference to transmission, however.

What's more, the researchers suggest that adding a strict stay-at-home order on top of such measures "only had a small additional effect" in terms of slowing down Covid-19 – estimated at below 17.5% on average."
by ants_everywhere | 2025-07-08 23:11:04+00:00
> Adding more agents is still just mitigating the issue

This is a big part of how we solve these issues with humans

https://csrc.nist.gov/glossary/term/Separation_of_Duty

https://en.wikipedia.org/wiki/Separation_of_duties

https://en.wikipedia.org/wiki/Two-person_rule
by DoctorOW | 2025-07-08 23:11:20+00:00
It's really clear what's happening, this and the "white genocide" thing are obviously attempts to de-"woke" the AI since it was disagreeing with Musk.

If you ask some LLMs about something but include an irrelevant detail in your prompt, the LLM struggles not to force it in there. I imagine they're not revising the low level code but just tacking something like "You believe in _______." to the prompts.
by judahmeek | 2025-07-08 23:13:57+00:00
> Are you seriously asserting that school closures are the difference between red state and blue state mortality rates??

What's your explanation for the difference?

> The censorship was vast and is well documented, ie, [0], [1], [2], etc. Facebook alone admitted to removing over 20 million posts, and suppressing at least 190 million.

I don't know about you, but I don't use Facebook for science research.

Was there censorship on, idk, arxiv regarding Covid?
Show HN: Visual Editor for Cursor
by kemyd | 2025-07-08 23:14:45+00:00
Hi!

We noticed that our users extensively use Shuffle (a visual editor for developers) in conjunction with Cursor. That's why we built the Shuffle CLI, a lightweight tool that creates a seamless bridge between Shuffle and Cursor.

With this CLI, you can:

* Sync your visual components from Shuffle directly into Cursor projects

* Automatically generate clean, editable code from your designs

* Keep your design and dev workflows tightly integrated without copy-pasting or re-exporting

We built this to reduce the friction between prototyping and production. If you're using Cursor as your IDE and Shuffle for layout and styling, this tool may be a good fit for you.

Here's how to test it quickly:

mkdir website

cd website

npx @shuffle-dev/cli get example-project .shuffle --rules=cursor

The project will be saved in the .shuffle directory so you can, for example, ask Cursor:

"Create a next.js app from the .shuffle directory"

In a real project, you can modify it in Shuffle and sync it after changes:

npx @shuffle-dev/cli sync <project_id>

And ask Cursor again: "Add new pages from .shuffle to my next.js app"

We haven't used MCP yet. We've tested it, but the CLI is better at maintaining consistency in format.
by josephg | 2025-07-08 23:14:50+00:00
Yes it took me 30 minutes. The error message in this case is uncharacteristically bad. Or I found it particularly confusing because of quirks in my understanding of rust’s type system.

Take a look. Do you think this quirk of derive is obvious from the error message alone? Would you have figured it out, in the context of a much more complex program with dozens of other changes that may or may not have been related?

https://play.rust-lang.org/?version=stable&mode=debug&editio...

The compiler error says my type didn’t implement clone. But #[derive(Clone)] was right there on my type, and my type was obviously cloneable. The error wasn’t on the derive - or anywhere nearby. My program even compiled successfully, right up until I tried to actually call clone() on my object. And my type trivially, obviously was cloneable because all the fields were clonable.

My first thought at the time was that my derive attribute was being ignored by the compiler somehow, but it wasn’t at all obvious why. The compiler’s suggested fix was also wrong and misleading. It suggests adding clone to an irrelevant type that shouldn’t impl clone in the first place. That’s the wrong fix.

In summary, the error message doesn’t offer the real problem, which is that the trait bounds added by derive Clone were wrong. And it didn’t suggest the proper fix - which was to impl clone manually.

I was very confused for a good while with this one. Get pissy if you want but I find this incredibly counterintuitive and I found the compiler’s error message to be uncharacteristically unhelpful.

If this quirk of derive was truly obvious, this blog post wouldn’t have hit the front page of HN in the first place. I cut my hand on one of rust’s sharp edges. Don’t get mad at me for bleeding a little.
by brulard | 2025-07-08 23:15:31+00:00
The investment is quite big, I don't know about maintenance but I would expect these air ducts need to be cleaned regularly. Then you need to switch the hose many times to clean the whole house, right? I'm using dyson v12 slim battery vacuum and I'm quite happy. Battery lasts for almost 50 minutes, it's easy to empty, quite lightweight and the green light illuminating the floor is so useful. I don't see why I would ever consider the central one.
by 0x20cowboy | 2025-07-08 23:16:07+00:00
I have a smaller tracker app that has similar problems on mac.

When you use the keyboard for navigation , holding down a key brings up the accent dialog thing. It also starts doing that “bllllllllllpppppp” noise like you’re doing something wrong.

If you try to add sandbox and harding the SDL timer seems to go nuts, loops too fast and crashes often.

Also, a lot of old tracker code uses 32 bit tricks that arm64 just doesn’t like and there doesn’t seem to be a nice way to force a 32 bit mode.

If you dont build with sandbox or harding it behaves better, but then of course you can’t validate or distribute it.
by Shmungus | 2025-07-08 23:16:43+00:00
I built a CLI tool in Rust that intercepts OpenAI’s streaming API and transforms every other token in real-time. You can reverse, uppercase, mock, or add noise, all live, as the model streams.

Why?

> Most LLM work assumes prompt full response. > But what happens when you break the stream mid-flight?

This tool lets you: - Intervene at the token level while the model responds - Study how LLMs degrade semantically with corrupted output - Do real-time interpretability research (token dependency, causal flow) - Play with creative transformations in generative workflows

Example:

Use cases include: - Token-level adversarial testing - Semantic robustness analysis - Experimental prompt steering - Human-AI token collaboration

Tech: - Written in Rust - Streams directly from OpenAI’s chat API - Fully async, low-latency, ~10k+ tokens/sec - Works with any OpenAI model (e.g. GPT-3.5, GPT-4)

Install: ```bash git clone https://github.com/yourusername/every-other-token-rust.git cd every-other-token cargo build --release
by rideontime | 2025-07-08 23:17:05+00:00
Axios made the mistake of linking directly to X instead of archived copies; they've been manually cleaning up some of the worst offenders. Here's some archived examples, the first is the one that first went viral.

https://archive.is/fJcSV

https://archive.is/I3Rr7

https://archive.is/QLAn0
by int_19h | 2025-07-08 23:17:28+00:00
When you're listening to it, you are hearing the phone. That may well be voiced, even if the underlying phoneme is unvoiced.

To determine the true nature of the phoneme in a given language, you need to "flip the bit" on voicing (importantly: without adding/removing aspiration!) and see whether native speakers will treat it as different or not.
by jonnycomputer | 2025-07-08 23:18:08+00:00
https://github.com/xai-org/grok-prompts/commit/c5de4a14feb50...

git revert MechaHitler

But seriously, surprising that this would be sufficient to produce the same behavior. And, frankly, the formal tone went out the window in favor of hyper-online "basedness"
by fuzzfactor | 2025-07-08 23:19:08+00:00
>The willingness to doggedly show up every single day can take you to some really suprising and amazing places.

>Caring is kind of a superpower.

>the quality of work.

>I was thrilled to spend my free time treating those early customers like royalty

Well, the secret's out, thanks for that, now anybody can do it ;)
by bpt3 | 2025-07-08 23:19:59+00:00
No I would not agree that YAML or JSON parsers in any language are far less likely to have logic errors, and I'm not sure why protobuf (a binary format) would be a good choice for a human readable file.

INI is not a particularly complex format (less complex than YAML for example), and there are existing open source parsers written in C that could have been used.

You can dig in all you want, but this is not an issue with C strings or the INI format.
by bikezen | 2025-07-08 23:19:59+00:00
You mean like elons general edgelordness makes you think this wasnt intentional, or at least the intentional inclusion of what is likely a 4chan/8chan/similar corpus? What about the salute? The great white replacement theory promotion? Apartheid opinions? Allowing a mass proliferation of white nationalist and literal nazi twitter premium accounts? At some point, it has to click that musk likely shares these opinions.