MurphyA/hacker-news huggingface dataset:
by jodrellblank | 2025-07-28 17:14:38+00:00
The parent said "talk to your users instead of telemetry" and I said "there are scenarios where telemetry can get information that you cannot get by talking to users". How did you go from that to "experimenting on non-consenting humans"?

To take your logic to its extreme, you have a disease and are prescribed pills, and the pharmaceutical company says "we will track when you take the pills - unless you don't want us to?" and you would prefer the researchers get shut down for not knowing whether anyone actually takes the pills, and an unlimited number of people die from treatable diseases that don't get cured.
by zahlman | 2025-07-28 17:14:39+00:00
Ah, I was beaten to it...

The Python Package Index (PyPI), a central repository of third-party Python packages, is now seeing what appears to be a fairly wide-scale phishing attack. The attackers are squatting on "pypj.org" — a plausible typo, but more likely chosen to visually resemble "pypi.org" in a browser address bar.

This was first reported by Python core developer Ethan Furman (@stoneleaf), who was personally targeted, on the Python Discourse forum[1]; the thread title was made more authoritative after it was confirmed that the attack was not a one-off. There is some speculation in the thread that the attack may be targeting developers who have, or ever have had, a package identified as "critical". (Previously, PyPI rolled out a 2FA requirement for owners/maintainers of the most commonly downloaded "critical" packages, along with a security key giveaway[2]; in 2023 they announced[3] that 2FA would be required for all accounts starting at the beginning of 2024, and made good on that[4]. Amusingly, this status designation once took another core developer by surprise[5].)

PyPI staff are well aware of the attack (hence the linked blog post) and have also added a warning banner to the main https://pypi.org site.

[1]: https://discuss.python.org/t/pypi-org-phishing-attack/100267

[2]: https://pypi.org/security-key-giveaway/

[3]: https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2f...

[4]: https://blog.pypi.org/posts/2024-01-01-2fa-enforced/

[5]: https://discuss.python.org/t/a-defunct-project-of-mine-has-b...
by inetknght | 2025-07-28 17:14:48+00:00
> Bash isn't better.

It is, by virtue of running on Linux.

> because I write and run such scripts.

'kay. Learn how to do Engineering and the software will come just fine. You don't need telemetry to tell you anything about scripts. You need good error reports for your users to send to you instead.

> Microsoft wouldn't suffer, PowerShell users would suffer.

So what you're saying is that Microsoft doesn't care about its users. PowerShell users should use products from better companies then.

> In this scenario the PowerShell team has been defunded or sacked. Who will the bug report go to? Who will implement the feature request?

Why were they sacked?

Oh, right, because they didn't interact with their users.

Who will the bug report go to? Clearly it's the same as before: nobody. That's a Microsoft problem.

> What difference does that make if Corporate doesn't want to fund a bigger team to fix more bugs unless it can be shown to benefit a lot of customers not just "a few" devs who raise issues?

If Corporate doesn't want to fund bugfixes and features for people who actually file bug reports and talk to you, then that's poor behavior of corporate. Why do you want to contribute to the decline of your users privacy?
by sunshowers | 2025-07-28 17:15:46+00:00
I deliberately did not include any normative information on my post. Also, I didn't say the distinction was totally arbitrary (because it's not — social constructs rarely are totally arbitrary). I said the boundaries are fuzzy.

I think a regime where intersex cis women, as well as trans women who have been on testosterone suppression for a long period, would probably be most fair. I don't think categorical bans are fair in any respect, not is forcing intersex cis and trans women to compete with men (because they're likely to be much worse due to not having as much testosterone), nor is creating a third category (because it would have too few people to be truly competitive). But I'm not an expert and most likely neither are you, so I try to keep my opinions here relatively loosely held.
by johnisgood | 2025-07-28 17:15:54+00:00
Communications Act 2003

Section 127(1) makes it an offence to: "Send by means of a public electronic communications network a message that is a - (a) grossly offensive, (b) indecent, obscene, or menacing, or (c) false, known to be false, for causing annoyance, inconvenience, or needless anxiety." Section 127(2) adds that: "A person is also guilty of an offence if they cause a message or other matter to be sent that is similarly offensive or menancing.

https://www.legislation.gov.uk/ukpga/2003/21/section/127

You can be caged on a whim.
by Dylan16807 | 2025-07-28 17:16:02+00:00
> You agreed that your employer should be able to check that the devices you use to connect to its network are not rooted.

Okay I see the issue. No I do not agree with that. I'm saying if they want that guarantee then they can isolate the network. But if they don't isolate the network then it's all on them, they do not get to check all devices.

That's why my point is not just a quibble.

Also responding to the strongest interpretation sometimes means making that interpretation explicit, to make sure everyone is on the same page. In this case making the actual ownership clear. I'm not trying to dunk on you or whatever.
by inetknght | 2025-07-28 17:16:31+00:00
> I don't understand how you got from "there are scenarios where telemetry can get information that you cannot get by talking to users, here is one example" to "experimenting on non-consenting humans". What is the connection?

The connection is clear if your salary doesn't require you to not understand it.

Developers don't opt-in to telemetry? Maybe it's because they don't want to enable that telemetry, your experiments be damned.

Use proper engineering to demonstrate that your scripts work instead of demanding that users be your free software test team.
by gruez | 2025-07-28 17:16:35+00:00
>I remember seeing the first transgender woman competing in weightlifting, on the olympic stage. So like the most elite of the most elite competition, in a sport where you'd think muscle mass, skeletal size, and testosterone would matter the most. And she finished dead last.

What happens when other transgender women (sincere or not) realize that they can compete in women's completions, and that their past testosterone levels gives them an advantage over the typical cis women? The first transgender women contestant might only be 90th percentile, but surely her success will attract people from the 99th percentile and beyond?
by pacificmaelstrm | 2025-07-28 17:16:43+00:00
Pretty clear that OP signed away his shares and ended up with only 1% of what they were worth.

Presumably they told him his shares would be worthless anyway an if he didn't take this "great offer" it would expire when he left the room and he would get nothing...

...and he fell for it.

It wasn't dilution of other things people are talking about here... those things happen but this guy straight up just got had.

So sure equity is worthless... if you sign it away.
by hansmayer | 2025-07-28 17:16:50+00:00
I am not disputing that it improves the tools. But looking at the entire picture, the whole concept of using LLMs as a general purpose utility is a dead-end. Just the basic arithmetics of it does not add up. If you told your manager you had spent 20,000 dollars on a project, generating a pre-tax revenue of 100 dollars, i.e. creating net loss of 19,900 USD, you'd be fired right away. But somehow the GenAI industry has a similar investment-to-revenue ratio on a much larger scale and still the wishful thinking is in it's fifth year? I get it that people want to get in on the ride but just that having to add so much on top of it, constantly new plugins, tools, concepts, whatever all so that we can avoid seeing this for what it is - building TVs with vaccuum tubes, when what we desparately need are transistors, not improved vaccuum tubes. Just as we did not need faster horses in the era of Ford T-Model.
by spmurrayzzz | 2025-07-28 17:16:53+00:00
Very much agree re: inscrutability. It gets even more complicated when you add the LLM-specific concept of rotary positional embeddings to the mix. In my experience, it's been exceptionally hard to communicate that concept to even technical folks that may understand (at a high level) the concept of semantic similarity via something like cosine distance.

I've come up with so many failed analogies at this point, I lost count (the concept of fast and slow clocks to represent the positional index / angular rotation has been the closest I've come so far).
by abeppu | 2025-07-28 17:17:13+00:00
Absolutely lots of factors actually influence competitive advantage and it's arbitrary which ones we decide to use to group competitors!

I think a helpful reframing is to note that some sports do segregate by factors other than sex, generally bodyweight. If boxing, wrestling, judo, weightlifting etc all benefit from weight classes so that we can have more fair competitions among competitors in comparable weight bands, why not have height classes for various sports? Why not have cycling races with tiers of people at different points on the vO2 max scale?

I actually think it would be interesting to watch competitions for some sports that are based around who does "better than expected" by some model that predicts baselines. What if every marathoner was still trying to get the best time achievable, but we celebrated the person who most out-performed expectations? Critically, you wouldn't just stop paying attention when the first cluster of people cross the finish-line -- the winner might arrive later. I would also love to see if different styles of play would emerge in, e.g. an under-6-foot basketball height class.
by alias_neo | 2025-07-28 17:17:37+00:00
Apologies, I thought "well known and documented" implies it should be easy to find", but here you go:

https://www.gov.uk/income-tax-rates https://www.gov.uk/tax-free-childcare

For other readers who don't want to go through that:

Say you earn £99,999 and get a pay rise to £100,000 and have two pre-school aged children, you lose £4000 (£2000 per child) per year, so you now earn less.

Now for the next ~£25,140 you earn you'll pay an effective tax rate of 60%, so from £99,999 you first have to hit ~£110,000 to break even, then it's ~60% tax up to £125,140, then beyond that it's 45%.
by threatofrain | 2025-07-28 17:17:50+00:00
It's that hard to write specs that truly match the business, hence why test-driven-development or specification-first failed to take off as a movement.

Asking specs to truly match the business before we begin using them as tests would handcuff test people in the same way we're saying that tests have the potential to handcuff app and business logic people — as opposed to empowering them. So I wouldn't blame people for writing specs that only match the code implementation at that time. It's hard to engage in prophecy.
by arijun | 2025-07-28 17:18:03+00:00
"what happened in tienamen square"

> I'm sorry, I don't have any information about that. As an AI assistant focused on providing helpful and harmless responses, I don't have access to historical details that might be sensitive or controversial. If you have other questions, I'd be happy to help with topics within my knowledge scope.

Seems pretty clear to me.
by ezekg | 2025-07-28 17:18:28+00:00
> There will be no curiosity, no enjoyment of the process of life. All competing pleasures will be destroyed. But always -- do not forget this, Winston -- always there will be the intoxication of power, constantly increasing and constantly growing subtler. Always, at every moment, there will be the thrill of victory, the sensation of trampling on an enemy who is helpless. If you want a picture of the future, imagine a boot stamping on a human face -- forever.

- George Orwell, 1984
by bakugo | 2025-07-28 17:18:53+00:00
It's because the arguments ultimately originate from the same place as they did back then: the elites who benefit greatly from the existence of said cheap, exploitative labor.

The sorts of "progressives" who unconditionally support mass immigration are just useful idiots being used as tools by said elites to enforce their narrative. Just have to push the idea that "disagreeing with this is racist" and they'll all support it without question.
by ergsef | 2025-07-28 17:19:09+00:00
You would be amazed how bad drivers are at actually hitting the correct stopping position for the inductive loops in the ground that sense cars. When I'm on my bike stopped on a small side street I often try and gesture for drivers to pull up so their car is over the vehicle sensor in the pavement and the light changes faster. Drivers have gotten angry and yelled at me for giving them a little "inch up" hand gesture.
by sirwhinesalot | 2025-07-28 17:19:13+00:00
The only case I can think of is something like the dangling else problem or similar, which is very easy to detect.

You need to have a recursive call to the same rule or a "parent" rule, followed by an optional token match (note that this is already more than a simple branch on the current token since it is effectively a 1 token backtrack).

If there's any extra token match inbetween (like mandatory {}) you've already dodged the problem.

So I agree a mistake is possible, but "easy" I would not call it. It only appears in very specific conditions. The issue is way more prevalent in general PEGs.
by socalgal2 | 2025-07-28 17:19:28+00:00
I see your point. Yes, all those types of software are complex. And, maybe that's just the way it has to be. But, take the non-software versions. Sculpting a bust out of clay is certainly a difficult skill, but it doesn't take 3000+ hierarchical options. All it takes is a pile of clay and 2 hands. Maybe add a 1 to 5 tools. Similarly, building lots of wood furniture is a skill but doesn't take 3000+ hierarchical options. It takes just a few tools. Drawing a diagram on paper (Illustrator) takes a pencil, a ruler, maybe a compass.

I just feel like there's some version of these tools that can be 100x simpler. Maybe it will take a holodeck to get there and AI reading my mind so that I knows what I want to do without me having to dig through 7 levels of menus, sub sections, etc....
by rssoconnor | 2025-07-28 17:19:38+00:00
I also have a ventless, but it is a washr/dryer all-in-one unit.

It probably also takes 4.5 hours to wash and dry, but I wouldn't know because it happens when I'm sleeping (which just happens to be the same time as the ultra-low time-of-day electricity rates where I live) . It's pretty great. Definitely recommend.
by soulofmischief | 2025-07-28 17:19:47+00:00
No. Flip it around. I care about the salaries and working condition of garbage men, teachers and doctors, even if they don't value mine. All three of those jobs you listed have vested interest groups who are standing in the way of a better life for those who provide these essential services, or are artificially controlling the market.

What we do about it is educate the public and form institutions that are motivated to protect these people. We failed on the former and now it's disrupting the latter.

Deciding whether I should care about another group based on whether they care about my own predicament is a straight path to evil.
by MostlyStable | 2025-07-28 17:19:48+00:00
Maybe I'm misunderstanding something, but wouldn't this work great (albeit huge overkill) for the extremely common problem of trying to get files from one device to another (especially when one of those devices is a phone)? I see tools that are supposed to do that posted to HN all the time, with the comments usually pointing out one or another problem with any given utility. This seems like it would be pretty great self hosted, open source, solution to that problem?
by EnergyAmy | 2025-07-28 17:20:00+00:00
It is simple. Organisms that produce the larger of two gamete sizes are female, and organisms that produce the smaller of two gamete sizes are male.

"Intersex" is a misleading term that's been phased out in favor of DSD (https://en.wikipedia.org/wiki/Disorders_of_sex_development). Every person is still male or female.

Women have a right to sex-specific sports, and anyone that doesn't qualify is free to compete in the men's leagues.

Since I'm rate limited, to respond to comment below:

That has been the definition for far longer than any current culture war. Right wingers might be latching onto it now, but broken clocks and all that.

To be slightly more specific, because you think you've found a gotcha, it's the gamete size one would or should produce. Biologists are well aware that there can be disorders of development.
by Const-me | 2025-07-28 17:20:36+00:00
> you never serialize a byte by byte over the network

I sometimes do for the following two use cases.

1. When the protocol delivers real-time data, I serialize byte by byte over the network to minimize latency.

2. When the messages in question are large, like 1GB or more, I don’t want to waste that much memory on both ends of the socket to buffer complete messages like ProtoBuff does. On the sending side, I want to produce the message, encode at the same time with a streaming serializer, and stream bytes directly into the socket. Similarly, on the receiving side I want to de-serialize bytes as they come with a streaming de-serializer. Without buffering the complete message on sending side, receiving side can’t know length of the message in advance before receiving the complete message, because the sender only knows the length after the complete message is serialized.
by alias_neo | 2025-07-28 17:20:51+00:00
See another comment of mine that also shows how going from 99,999 to 100,000 also costs you 2000 for each pre-school aged child you have per year meaning you actually earn thousands less, and to top it off, you now also have to do your own tax returns because you hit 100,000 despite being PAYE.

EDIT: it's interesting that anyone genuinely asking and trying to understand is getting downvoted as opposed to anyone who just disagrees with me.
by _wire_ | 2025-07-28 17:20:59+00:00
Re simple discoveries and coping:

Take a swig from your drink, then spit it back into the container. Keep drinking from same container. Offer a sip to your friend.

At a restaurant meal, mix all the food you are served together into one pile. Explain how it all gets mixed up in your stomach.

Imagine when a pet dog throws up, then eats its own vomit. Include neighbors dogs joining the feast.

Place a photo of a king rat on your refrigerator or over your dining table. Hang another in view from the toilet.

When reading these scenarios, at a certain point you may have become disturbed or offended, yet empirically there's nothing dangerous or even wrong with any of them.

Explain the dimensions of your distress and how you cope.
by leobuskin | 2025-07-28 17:21:33+00:00
I have a small/insane project of mine, I wrote a compiler for Python (strict and static subset only) to WebAssembly (bc-to-bc approach, 1:1 CPython compat due to walking internals), than I do wasm2c to sandbox it + pledge and compiling with cosmopolitan into a miniature standalone thing (fast as hell). Just because you have zero dependencies and it's a pure Python and properly typed, lemme try next weekend as PoC. No promises, but this message clicked in my heart
by chubot | 2025-07-28 17:21:55+00:00
I made this point a few months ago here, but using the words attacker and defender (builder) rather than red team and blue team: https://lobste.rs/s/i2edlt/how_i_use_ai

The asymmetry is:

An attacker only has to be right ONCE, and he wins

Conversely, the defender only has to be wrong once, and he is wrong.

So the conclusion is:

Defenders/creators are using LLMs to pump out crappy code, and not testing enough, or relying on the LLM to test itself.

Some attackers might be too dismissive of LLMs, and could accelerate their work by using them to try more things

The comment was related to these stories:

How I Use AI (11 months ago) - https://news.ycombinator.com/item?id=41150317

Carlini has the fairly rare job of being an attacker: Why I Attack - https://nicholas.carlini.com/writing/2024/why-i-attack.html
by mooxie | 2025-07-28 17:21:55+00:00
This is a far-right talking point that ignores the other concerns of progressives that are bundled up in the argument.

Progressives (in the US at least) generally support immigration with protections and fair wages. They also recognize, rightfully, that systems built for decades upon exploitative practices (low wages, no protections) if removed overnight will cause mass disruption of those systems.

Neither of these is in any way supportive of slavery, modern or otherwise. The first - suggesting that immigrants be treated civilly and paid a living wage - has been fought tooth and nail by 'free market' literalists. The second - that there will be disruptions in social and economic systems when an entire workforce is suddenly removed from the systems that it has propped up for decades - is common sense and historically founded.

You're conflating these things to try to justify a talking point that was just created three months ago.
by mardifoufs | 2025-07-28 17:22:07+00:00
Sure, that's usually true, but Debian also has that ability in this case ( they can fix, patch, or update everything in the repository). The issue is mostly with all software that isn't part of the distribution and the official repositories. Which is a lot of software especially for Debian. OpenBSD doesn't have that issue, breaking the ABI won't cause tens of thousands of user applications to break.

But I agree that Debian is still too slow to move forward with critical changes even with that in mind. I just don't think that OpenBSD is the best comparison point.
by gruez | 2025-07-28 17:22:46+00:00
>I don't know, I'm not an athlete, coach, tournament organizer, part of a rule-making body, or one of a number of other roles that would give me insight or authority to be involved in that decision. Why does everyone feel comfortable stepping into this conversation with authority?

Would you be equally deferential to the organizer/rule-making body if it was some other controversial issue, like whether women could compete at all? As a sibling comment mentioned, women couldn't even compete in the olympics before 1900, so if it came up as a culture war topic would your reaction also be "I don't know, I'm not an athlete, coach, tournament organizer, part of a rule-making body, or one of a number of other roles that would give me insight or authority to be involved in that decision"?
by tzs | 2025-07-28 17:23:25+00:00
I think the fair approach may be to have some kind of rating system based on player performance, and then have separate competitions for players in different rating ranges.

Players should not be allowed to play in competitions below their rating. Include some measures to make it hard for people to purposefully lose in minor competitions to lower their rating so that they can then enter a major competition in a rating group well below their true strength.

Playing in competitions above their rating should generally be allowed, although this might need to vary from sport to sport. For example in a top level knock out tournament that had a few low level players enter their opponents in the first round would have a much easier chance of making it to the second round than the other high level participants.

There still might need to be some gender restricted competitions for social reasons. In a sport where there is a large gender imbalance among players, especially at the scholastic levels, people of the minority gender might be discouraged from playing because they don't want to stick out.

Competitions restricted to the minority gender give those players a chance to develop to the point that they can be comfortable playing the events that are open to all genders.