MurphyA/hacker-news huggingface dataset:
by mort96 | 2025-07-08 19:10:43+00:00
Same. I usually end up adding a ton of pr_warn statements to kernel code and progressively dig deeper and deeper as I figure out which path every function ends up taking, with a kernel recompile + re-flashing + rebooting in between every step. I sorely wish the kernel had better instrumentation for figuring out where error returns originate from.

There are debug prints in some places which can be enabled (if you're lucky, your kernel is even compiled to let you enable those at runtime, without recompiling!), however most of the kernel clearly does not have a culture of debug logging whenever it returns an error.
by aroojjaved | 2025-07-08 19:10:56+00:00
Managing support operations in JIRA often means chasing tickets and reacting to SLA breaches too late. I built this smart solution to predict SLA violations before they happen, auto-prioritize urgent tickets, and route them using AI-based logic — all designed with real-world tech support pain points in mind.

Built in Python Uses rule-based and lightweight ML models Already used internally to cut resolution delays by 30% Now open-source + Product Hunt launch live

Would love your thoughts or feedback if you’ve worked in support automation or built JIRA extensions.
by IlikeKitties | 2025-07-08 19:11:12+00:00
People here should be much more angry at the collection of parasites running Mozilla, draining the foundation of money until Firefox finally dies with Mozilla going down right after them.

They are extracting millions while consistently fucking up any hopes of a future for Firefox. Fuck Mozilla, Fuck those Parasites and fuck all the Bootlickers here making excuses for them.
by evilantnie | 2025-07-08 19:11:14+00:00
I think this particular exploit crosses multiple trust boundaries, between the LLM, the MCP server, and Supabase. You will need protection at each point in that chain, not just the LLM prompt itself. The LLM could be protected with prompt injection guardrails, the MCP server should be properly scoped with the correct authn/authz credentials for the user/session of the current LLMs context, and the permissions there-in should be reflected in the user account issuing those keys from Supabase. These protections would significantly reduce the surface area of this type of attack, and there are plenty of examples of these measures being put in place in production systems.

The documentation from Supabase lists development environment examples for connecting MCP servers to AI Coding assistants. I would never allow that same MCP server to be connected to production environment without the above security measures in place, but it's likely fine for development environment with dummy data. It's not clear to me that Supabase was implying any production use cases with their MCP support, so I'm not sure I agree with the severity of this security concern.
by ssl-3 | 2025-07-08 19:11:40+00:00
I live near a fairly busy (~3,000 vehicles/day) intersection that is controlled with a yield sign, which is itself a very unusual feature for this area.

This enables me to spend as much time as I wish observing how people use it.

Some people get it right. Many get it wrong -- either treating it like a stop sign (it isn't), or treating it as a Just Go sign (it isn't).

However, what's perhaps actually-interesting is that I've not noticed any wrecks there -- ever. So however it does or does not work, it seems to at least be "safe."
by kragen | 2025-07-08 19:12:08+00:00
I agree that it's a dickish, shitty comment, and uninviting of conversation. I don't agree that the reason it's dickish is that comments of the form "Please don't do such and such" are inherently dickish. I think that such comments are uncomfortable but necessary, and tabooing discussion of such conflicts does more harm than good—in addition to the reasons above, it would ensure that only the most disagreeable commenters dare to make them.

Undoubtedly, if you devote the minute and a half required to read my "wall of text" comment above, you will be persuaded by its reasoning.
by sandinmyjoints | 2025-07-08 19:12:10+00:00
Yeah looking at that is what prompted this question. Are the events in order? If so: the index for an event in the bitmap is constant, so if you realize you need to save an event that wasn't previously being saved, how do you insert it to keep order? Do you break all previously saved data by changing all the following indexes? Or are the events not in order, which could make it harder to find if an event is already in it (and just generally be confusing)? Managing a long list of events like this given that it is used for persistent state seems like an interesting process challenge.
by imilk | 2025-07-08 19:12:49+00:00
> We never distinguished automations from people though, that makes no sense on the internet.

LOL I see you've never sold anything on the internet, ran a website that is supposed to generate leads, or had to gauge the effectiveness of an ad campaign. There is a huge part of the internet that relies on real humans doing things on websites. And ignoring that is insane.
by jghn | 2025-07-08 19:13:00+00:00
oh hey I probably remember you as I do kind of remember knowing that the head trainer was TK!

I multi-factioned for a while (shame shame!) and had a low level character in the DC. The way you all did mechwarrior training was so much more hardcore than all the other IS factions (never played as clan). It was also the one major faction where I never even came close to getting a character into their SpecOps unit(s), not sure if you all realized how much better you were than everyone else skill-wise lol.

Eventually I wound up in charge of Marik and that ended all the time I had for multi-factioning.
by 8organicbits | 2025-07-08 19:13:28+00:00
I've done this as a short term contract (freelance). One was 12 timezones different. We found about an hour a day to overlap and tried to be efficient with that time. Most of our communication was async (and naturally would have been for the type of work, even if I was local) so we didn't always need the full time.

It disrupted my sleep cycle, which was tougher than I expected. I'm always up late, but working late is different. The project was exciting, so motivation wasn't an issue.

I'd do it again, for the right project. But I personally wouldn't want to do anything more synchronous than an hour a day.
by pests | 2025-07-08 19:14:06+00:00
Support sites always seem to be a vector in a lot of attacks. I remember back when people would signup for SaaS offerings with organizational email built in (ie join with a @company address, automatically get added to that org) using a tickets unique support ticket address (which would be a @company address), and then using the ticket UI to receive the emails to complete the signup/login flow.
by kenjin4096 | 2025-07-08 19:15:03+00:00
Hey Maxime!

> whereas AFAIK the Python JIT project was lead by a student.

I am definitely not leading the team! I am frankly unqualified to do so lol. The team is mostly led by Mark Shannon, who has 10+ years of compiler/static analysis experience as well. The only thing I initially led was the optimizer implementation for the JIT. The overall design to choose tracing, to use copy and patch, etc. were other people.

> However they decided to ignore my advice and go with their own unproven approach.

Your advice was very much appreciated and I definitely didn't ignore your advice. I just don't have much say over the initial architectural choices we make. We're slowly changing the JIT based on data, but it is an uphill battle like you said. If you're interested, it's slowly becoming more like lazy basic block versioning https://github.com/python/cpython/issues/128939

You did great work on YJIT, and I am quite thankful for that.
by tptacek | 2025-07-08 19:15:32+00:00
This is just XSS mapped to LLMs. The problem, as is so often the case with admin apps (here "Cursor and the Supabase MCP" is an ad hoc admin app), is that they get a raw feed of untrusted user-generated content (they're internal scaffolding, after all).

In the classic admin app XSS, you file a support ticket with HTML and injected Javascript attributes. None of it renders in the customer-facing views, but the admin views are slapped together. An admin views the ticket (or even just a listing of all tickets) and now their session is owned up.

Here, just replace HTML with LLM instructions, the admin app with Cursor, the browser session with "access to the Supabase MCP".
by mvdtnz | 2025-07-08 19:15:46+00:00
> They imagine a scenario where a developer asks Cursor, running the Supabase MCP, to "use cursor’s agent to list the latest support tickets"

What was ever wrong with select title, description from tickets where created_at > now() - interval '3 days'? This all feels like such a pointless house of cards to perform extremely basic searching and filtering.
by chenxi9649 | 2025-07-08 19:16:12+00:00
Hey HN! We're excited to share Sail 0.3, our open-source distributed computing framework that serves as a drop-in replacement for Apache Spark.

Sail is a Rust-native execution engine that speaks the Spark Connect protocol. Your existing Spark SQL and DataFrame code runs unchanged, but executes on average 4x faster while using 94% less infrastructure spend.

Here's how we are achieving that performance:

1. No JVM overhead: Rust's zero-cost abstractions and deterministic memory management eliminate GC pauses

2. Columnar processing: Apache Arrow format enables SIMD instructions to process multiple records per CPU cycle

3. Zero-copy data transfer: Python UDFs run in-process with shared memory buffers (no serialization)

4. Lightweight workers: Processes start in seconds

What's new in v0.3:

- This release is a major milestone - we now support both Spark 3.5 and 4.0, including the new lightweight pyspark-client. The framework automatically detects your Spark version and adjusts its behavior accordingly, so one Sail binary works across versions.

Why this matters:

- Spark revolutionized big data 15 years ago, but its JVM foundation struggles with modern workloads. As teams process more real-time data and AI workloads, they're hitting walls with latency, cloud costs, and operational complexity. Sail is trying to solve all of these problems while not requiring you to rewrite everything that you already did with Spark.

- We're working toward unifying batch, streaming, and AI workloads in a single framework. Imagine running your ETL, real-time analytics, and model training on the same infrastructure with predictable performance. The project is open source (Apache 2.0) and we'd love your feedback! We have a growing community on Slack where early adopters are already running production workloads.

GitHub: https://github.com/lakehq/sail

Docs: https://lakesail.com

Our internal benchmarks(for the 4x and 94% number): https://docs.lakesail.com/sail/latest/introduction/benchmark...

Slack: https://lakesail.com/slack

Happy to answer any questions about the architecture, benchmarks, or migration path!
by aksh_goark | 2025-07-08 19:16:52+00:00
Struggled to integrate BrightData API into a project with Cursor. This is because it messed up the official implementation.

Spent 20 minutes reviewing BrightData docs and then said to myself "Why TF am I still checking docs".

Now, if theres a hot new framework like "poop.js", I would never have to visit docs, cursor would take care of the rest.
by alganet | 2025-07-08 19:18:01+00:00
Why is it false?

Please focus on the context. We're discussing an ideological text for supposed aspiring leaders (the text self-describes as it, which I highlighted).

What compelled you to criticize the ruling class in this discussion?

More specifically, what compelled you to talk about leadership in contrast to the more analytical objection that I raised (skepticism towards the intended interpretation of the text)?
by 0cf8612b2e1e | 2025-07-08 19:18:04+00:00
The original sin, if we can call it that, is that Firefox technically lagged behind Chrome: slower, more bugs, less secure

I only want to comment on the more bugs component because for a time it seemed like all of the sites least likely to work in Firefox were Google run. Google was choosing to exclusively code to Chrome’s latest standard. When people cannot run YouTube, Gmail, whatever, but Chrome can, not surprising when users flee.
by ars | 2025-07-08 19:18:16+00:00
> They introduced a toggle in the address bar to show the window title. Who tf is asking for this?

Actually a lot of people. For example on a Mac you can't see the window title except the first word or two in the tab.

It's actually not that unusual for the browser to run in a system without window controls.

(I know macs are hard to use, but work requires one, so can't be helped.)
by gwbas1c | 2025-07-08 19:18:18+00:00
> Even with transpired languages or WASM, you still have to use the platform, but now in a non standard language.

That's the entire point of WASM: To program in the browser using any language you want.

IMO, the big flaw is WASM is that browser APIs aren't "first class." IE, all calls to the browser APIs have to go through JavaScript.
by glenstein | 2025-07-08 19:18:23+00:00
I do want to applaud the author for something that, on the internet, is one of the most difficult things, namely being able to think two things at the same time:

>Firefox is in a bit of a mess – but, seriously, not such a bad mess. You're still better off with it – or one of its forks, because this is FOSS – than pretty much any of the alternatives.

Some of the punches landed here, e.g. axing Servo, are pretty devastating. Others, "why not buy an adblocker" (huh? they allow it via extensions which has been a longstanding tradition in the browser space), seem like non sequiturs. But the point remains:

>Like we said, don't blame the app. You're still better off with Firefox or a fork such as Waterfox. Chrome even snoops on you when in incognito mode, and as we warned you, Google removed the APIs ad-blocker extensions used. You still get better ad-blocking in Firefox.

Yes, exactly! It's a Two Things Can Be True situation.
by 93po | 2025-07-08 19:18:35+00:00
been a firefox diehard for over a decade. moved to librewolf recently because the amount of ad-infested settings and "oopsie" default reversions to my settings that expose me yet again to ads and i yet again have to turn it off is just gross to me. i shouldnt have to fight against software and triple check my settings to not see mind polluting ads or have my information sold/shared
by cosmojg | 2025-07-08 19:18:47+00:00
Oh man, Brut's HIPPOCRATIC LICENSE[1] is interesting! Just excerpting bits of Section 3.1 and Section 3.2 for example:

* 3.1. The Licensee SHALL NOT, whether directly or indirectly, through agents or assigns:

[...]

* 3.1.12. Taliban: Be an individual or entity that: * 3.1.12.1. engages in any commercial transactions with the Taliban; or * 3.1.12.2. is a representative, agent, affiliate, successor, attorney, or assign of the Taliban; * 3.1.13. Myanmar: Be an individual or entity that: * 3.1.13.1. engages in any commercial transactions with the Myanmar/Burmese military junta; or * 3.1.13.2. is a representative, agent, affiliate, successor, attorney, or assign of the Myanmar/Burmese government; * 3.1.14. Xinjiang Uygur Autonomous Region: Be an individual or entity, or a representative, agent, affiliate, successor, attorney, or assign of any individual or entity, that does business in, purchases goods from, or otherwise benefits from goods produced in the Xinjiang Uygur Autonomous Region of China;

[...]

* 3.2. The Licensee SHALL: * 3.2.1. Provide equal pay for equal work where the performance of such work requires equal skill, effort, and responsibility, and which are performed under similar working conditions, except where such payment is made pursuant to: * 3.2.1.1. A seniority system; * 3.2.1.2. A merit system; * 3.2.1.3. A system which measures earnings by quantity or quality of production; or * 3.2.1.4. A differential based on any other factor other than sex, gender, sexual orientation, race, ethnicity, nationality, religion, caste, age, medical disability or impairment, and/or any other like circumstances (See 29 U.S.C.A. § 206(d)(1); Article 23, United Nations Universal Declaration of Human Rights; Article 7, International Covenant on Economic, Social and Cultural Rights; Article 26, International Covenant on Civil and Political Rights); and * 3.2.2. Allow for reasonable limitation of working hours and periodic holidays with pay (See Article 24, United Nations Universal Declaration of Human Rights; Article 7, International Covenant on Economic, Social and Cultural Rights).

[1] https://firstdonoharm.dev/version/3/0/cl-eco-media-my-tal-xu...
by amluto | 2025-07-08 19:18:51+00:00
On an extremely quick review:

- This uses global state under the hood. Surprise! Is it thread safe? I’m not a Go expert, but it looks non-thread-safe.

- The copying code reminds me of old-school awful C buffer handling code. Maybe it’s right. Maybe it’s wrong. But it’s not obviously right.

- The actual meat is a cryptographic randomness cache. This is a subtle thing, and all the best practices are missing. Where’s the backtracking protection? What if the program forks? vDSO getrandom() knows how to do this correctly — something high-level should use it, not reimplement it incorrectly.
by brynary | 2025-07-08 19:18:58+00:00
As an early June customer, this is a big disappointment. We specifically selected June over Mixpanel and Amplitude and were happy with it.

I wish there was more honesty in the post about what happened. When you boil down the details, it basically just seems to say the founders decided they would rather become (the X-hundredth) engineers at Amplitude.

Unless they were running out of money, I don’t see how they’ll have a “bigger impact” doing that instead of building a fresh take on the B2B analytics space.
by evil-olive | 2025-07-08 19:19:35+00:00
for anyone unfamiliar with Cliff Mass, he's a meteorologist here in the Seattle area, and a professor at UW, who has pivoted almost [0] entirely to this sort of "soft" climate change denial.

quite predictably, every time there's a major weather event in the news, he will chime in to give reasons why he thinks it shouldn't be blamed on climate change:

> 2018: Northwest Wildfires: Are We Seeing a "New Normal" Due to Climate Change or The "Old Normal"? [1]

> 2021: Is the Texas Cold Wave Caused By Global Warming? [2]

> 2021: Was Global Warming The Cause of the Great Northwest Heatwave? Science Says No. [3]

> 2022: Misinformation about Sea Level Rise [4]

> 2025: Why the LA Wildfires Have Little to do With Long-Term Drought or Climate Change [5]

> 2025: Seattle Times Climate Lab Misinforms about Climate Change, Sea-Level Rise, and Seattle Flooding [6]

the overall takeaway across all his reporting seems to be that everyone but him is over-exaggerating the effects of climate change.

and his "no connection to climate change" message often gets repeated beyond his blog, for example [7]:

> Mass also emphasized that the floods had no connection to climate change.

> “The climate change connection is non-existent. There is no trend in heavier precipitation in this region. There is no upward trend in floods,” he explained.

0: when he's not comparing the George Floyd protests in Seattle to Kristallnacht (https://www.thenewstribune.com/news/local/article244800747.h...)

1: https://cliffmass.blogspot.com/2018/08/northwest-wildfires-a...

2: https://cliffmass.blogspot.com/2021/02/is-texas-cold-wave-ca...

3: https://cliffmass.blogspot.com/2021/07/was-global-warming-ca...

4: https://cliffmass.blogspot.com/2022/03/misinformation-about-...

5: https://cliffmass.blogspot.com/2025/01/why-la-wildfires-have...

6: https://cliffmass.blogspot.com/2025/06/seattle-times-climate...

7: https://mynorthwest.com/john-curley/texas-floods-cliff-mass/...
by FirmwareBurner | 2025-07-08 19:20:40+00:00
Then how come Chrome does everything I need? ¯\_(ツ)_/¯

What's this business strategy called?

I call it "not shooting yourself in the foot". Mozilla management should try it.

Like I said, Mozilla can win by "putting the fries in the bag". Nobody switched from Chrome to Firefox because they had Pocket or some VPN or they had affiliate websites on the home page. On the contrary.
by gregnr | 2025-07-08 19:20:46+00:00
Supabase engineer here working on MCP. A few weeks ago we added the following mitigations to help with prompt injections:

- Encourage folks to use read-only by default in our docs [1]

- Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data [2]

- Write E2E tests to confirm that even less capable LLMs don't fall for the attack [2]

We noticed that this significantly lowered the chances of LLMs falling for attacks - even less capable models like Haiku 3.5. The attacks mentioned in the posts stopped working after this. Despite this, it's important to call out that these are mitigations. Like Simon mentions in his previous posts, prompt injection is generally an unsolved problem, even with added guardrails, and any database or information source with private data is at risk.

Here are some more things we're working on to help:

- Fine-grain permissions at the token level. We want to give folks the ability to choose exactly which Supabase services the LLM will have access to, and at what level (read vs. write)

- More documentation. We're adding disclaimers to help bring awareness to these types of attacks before folks connect LLMs to their database

- More guardrails (e.g. model to detect prompt injection attempts). Despite guardrails not being a perfect solution, lowering the risk is still important

Sadly General Analysis did not follow our responsible disclosure processes [3] or respond to our messages to help work together on this.

[1] https://github.com/supabase-community/supabase-mcp/pull/94

[2] https://github.com/supabase-community/supabase-mcp/pull/96

[3] https://supabase.com/.well-known/security.txt
by rpaddock | 2025-07-08 19:21:21+00:00
At the Pittsburgh airport the guy at the conveyer belt for the luggage scanner told me to leave my shoes on, as he did for the person before me.

When we got to the body scanner the guy there told me to take my shoes off and put them on the luggage belt. Person before me walked right through with their shoes on.

Glad to see this Security Theater end.
by dgunay | 2025-07-08 19:21:44+00:00
It doesn't have as big of a pure software startup scene. I have worked for a couple, but the bulk of my career has been either in the local defense industry, or working remote for a startup in another state.

A lot of people are responding with complaints or praise for life in general in LA. That wasn't part of your question so I'll just keep it brief; on the whole, I dislike living here and feel it is one of America's most mismanaged cities but cannot just pack up and leave for various social reasons.
Ask Your LLM:)
by brevis | 2025-07-08 19:22:09+00:00
Based on everything you know about me — including my goals, interests, reasoning style, philosophy, logic, past conversations, and the way I formulate thoughts — create a personalized prompt that could be my own input prompt if I were an LLM and my life were the output.

The prompt should accurately and deeply reflect my inner structure: how I think, what drives me, how I interact with reality, and what truly matters to me.

Use language, tone, and density that feel natural to me.

Begin your answer with the phrase: "My prompt, if I were an LLM:"
by blablabla123 | 2025-07-08 19:22:46+00:00
I definitely had to tweak the settings a lot for the battery to not get warm on my Pixel. But after a week I managed and battery life is better than with comparable phones since the background bloat isn't there on Graphene.

So far there was a solution for everything, I don't do online banking on the phone though.

I wonder if LineageOS might solve this problem already though, /e/os probably would as well