MurphyA/hacker-news huggingface dataset:
by epiccoleman | 2025-07-09 14:32:22+00:00
> You can always tell someone who is well read in English when they mispronounce everything they say.

Totally! I once heard (I think it was in an AvE video) that you shouldn't make fun of someone for wrong pronunciation - it just means they encountered the word in text first - i.e. autodidactically.

I remember a few funny examples of this from my own youth - I didn't know that "dachshund" and what I was hearing as "doxen" were the same thing. I was pronouncing it as "dash-hund" (only realizing after someone pointed this out that it's spelled "dachs - hund" and that the pronunciation makes at least "German sense".)

Also I remember talking about the Led Zeppelin song "D'yer Maker" to someone and pronouncing it like some kind of "fantasy name" - like "Die-er Mah-ker". Only to be told what should have been obvious enough from the music: It's pronounced "Jamaica".
by pkal | 2025-07-09 14:32:38+00:00
I have recently been writing CGI scripts for the web server of our universities computer lab in Go, and it has been a nice experience. In my case, the Guestbook doesn't use SQLite but I just encode the list of entries using Go's native https://pkg.go.dev/encoding/gob format, and it worked out well -- and critically frees me from using CGO to use SQLite!

But in the end efficiency isn't my concern, as I have almost not visitors, what turns out to be more important is that Go has a lot of useful stuff in the standard library, especially the HTML templates, that allow me to write safe code easily. To test the statement, I'll even provide the link and invite anyone to try and break it: https://wwwcip.cs.fau.de/~oj14ozun/guestbook.cgi (the worst I anticipate happening is that someone could use up my storage quota, but even that should take a while).
by Timwi | 2025-07-09 14:34:16+00:00
I know I'm being pedantic, but I just want to point out that even U+200E/U+200F are generally not needed. If you put a Hebrew word in the middle of an English sentence, it displays correctly all by itself. This is due to the Unicode bidirectional algorithm, which defines a super sensible default behavior. You only need the RTL control characters in weird circumstances, perhaps ones involving punctuation marks or unusual uses of special characters.
by MobiusHorizons | 2025-07-09 14:34:45+00:00
Fair enough. I must just not be understanding what the motivation for creating proofs of such software is then. I guess to me assuming the compiler or language runtime have no bugs seem to severely undermine the value of the proof. I feel like if the proof was to have value in an imperative language like C or C++ I would want the assembly proven, as the resulting computation can be drastically altered from the original source text between various compiler flags and optimization levels.
by gsarjeant | 2025-07-09 14:35:22+00:00
Hi, I'm the post writer. I have a habit of writing like a textbook author, but the things that jumped out at me while I was working on this with Oso were:

1. Least privilege can address a lot of these issues. We all know that, but in practice we don't really apply it because it can be a pain.

2. These applications are interesting because they can interpret meaning instead of rigidly following instructions, but that makes them prone to misunderstanding and manipulation. That breaks a lot of our assumptions about how software responds to input.

3. It's helpful to think of these applications in terms of impersonation. The user's rights should be the upper bound of the LLM's permissions when it acts on their behalf.

4. Ideally, we'd also constrain permissions according to the task being performed, but that's trickier.

The article goes into all that in exhaustive (some might say tedious) detail. It was a difficult write because this space moves so quickly and has so much hype, but it's been a good exercise to try to sift through that and think about it seriously.

(edited because I don't know how to make a legible list)
by pydry | 2025-07-09 14:35:27+00:00
I would have loved to have seen somebody predict mass wfh only being possible within the confines of a pandemic and being shut down shortly after.

Or that minus a few exceptions like blockbuster the majority of high street /mall stores would still exist in spite of online shopping being given more favourable tax treatment.

Or that democratic institutions would end up being eroded by the toxic spam that popped up when the barrier for entry for publishing was lowered.
by scubakid | 2025-07-09 14:35:33+00:00
Ah so with this business model there was minimal impact to existing customers? That's fortunate.

Out of curiosity, what kind of transactional product has a substantial production database that would be daunting to re-build in a 4-6 mo window given you still had the source code during that time?

And I hope you've taken your wife out for some nice dinners (or whatever she likes). Totally agree that having a supportive and encouraging partner can make all the difference in challenging times.
by maximegarcia | 2025-07-09 14:35:44+00:00
Well it is not quite a mutable vs immutable strings war, nor Ruby being late to the party or something like that.

The move is so we can avoid allocating a string each we declare and use it since it will be frozen by default. It is a big optimization for GC mainly. Before we had to do such optimization by hand if we intend not to modify it:

# before def my_method do_stuff_with("My String") # 1 allocation at each call end # before, optim MY_STRING = "My String".freeze # this does 2 allocations with 1 at init being GC quite early def my_method do_stuff_with(MY_STRING) end # after def my_method do_stuff_with("My String") # 1 allocation first time end

But this move also complicates strings manipulation in the sense of it will lean users toward immutable ops that tend to allocate a lot of strings.

foo.upcase.reverse # VS bar = foo.dup bar.upcase! bar.reverse!

So now we have to be deliberate about it:

my_string = +"My String" # it is not frozen

We have frozen string literals for quite a while now, enabled file by file with the "frozen_string_literal: true" comment and I've seen it as the recommended way by the community and the de-facto standard in most codebase I've seen. It is generally enforced by code quality tools like Rubocop.

So the mutable vs immutable is well known, and as it is part of the language, well, people should know the ins and outs.

I'm just a bit surprised that they devised this long path toward real frozen string literals, because it is already ongoing for years with the "frozen_string_literal: true" comment. Maybe to add proper warnings etc. in a way that does not "touch" code ? I prefer the explicit file by file comment. And for deps, well, the version bump of Ruby adding frozen string literals by default is quite a filter already.

Well, Ruby is well alive and it is what matters)
by macNchz | 2025-07-09 14:36:09+00:00
Perhaps I never put enough effort into it, but I've slowly coalesced on only having IKEA smart home products after years of acquiring piecemeal stuff and trying to wire it together with Home Assistant. I've shut down HA, and with every non-IKEA "smart" thing I have nowadays I just use the manufacturer's app (though I've become pretty sour on most smart devices overall and avoid them when possible).

I didn't really care for the way it became a sysadmin job where the stakes of a bad update or me not reading some release notes were that my light switches didn't work until I sat there and futzed around with it. I'm a programmer, enjoy Linux admin, run a whole bunch of servers....but having to dive into logs and YAML configs because the lights in my kitchen won't turn off is just not ideal. Similar issues with HomeKit, except when things mysteriously stop working there's even less ability to diagnose, given Apple's design principles that everything "just works", so apparently providing detailed error messages or diagnostics is gauche.
by Kon5ole | 2025-07-09 14:36:31+00:00
>Nuclear seems to only work if nation-states build and operate it directly - no private firm can build them profitably and on time.

Nation states are not able to run the plants profitably either, they just don't run out of money.

Look at France, the US, UK, Germany and Japan for example. They all have immense costs related to nuclear power that is not covered by the sale of nuclear electricity.
by sabman | 2025-07-09 14:36:44+00:00
If you have never done a graduate course in Satellite Remote Sensing there are a lot of techniques that you use on satellite imagery that the LLM guides you through without knowing it upfront. Additionally having a way to have the imagery loaded with the LLM in a single interface and apply the LLMs suggestions isn't a trivial engineering problem. We have done that too.
by tiagod | 2025-07-09 14:37:08+00:00
>The same people that say "diez kas" (for 10k) instead of "diez mil" like they're saving words for doing that (hint: no).

I sometimes say (in Portuguese) "dez kapa".

It's just slang. Language changes a lot faster than you realise, and a lot of words that are "normal" to you would illicit the same response before you were born.
by falcor84 | 2025-07-09 14:37:25+00:00
An interesting idea, but I'm surprised that they only mention MemGPT/Letta [0] in passing; from what I've seen of Letta's work and e.g. their recent paper on "sleep-time compute", they are really pushing this space forward.

[0] https://www.letta.com/

[1] https://arxiv.org/abs/2504.13171
by sigwinch | 2025-07-09 14:37:40+00:00
This doesn’t cut both ways. Scrambling after Patel failed to deliver a satisfying report, Bondi reassigned one thousand FBI officials to comb through the case. That’s the same scale as the FBI response to Jan 6. So far as I can tell, it’s the most personnel for a case that’s now guaranteed to never see a charge. Taxpayers should get their money back.
by hadao | 2025-07-09 14:37:41+00:00
@SAI_Peregrinus Your comment perfectly illustrates the problem.

You're saying we should accept: - 30% accuracy for $200/month - Zero customer support as "not an advertised feature" - Being treated like we're dealing with a "gullible teenage intern on unlimited magic mushrooms"

This is exactly the predatory mindset I'm calling out. You want customers to voluntarily surrender their rights and lower their expectations to the floor.

When I pay $200/month, I'm not paying for a "magic mushroom teenager." I'm paying for a service that claims to be building "Constitutional AI" and "human values alignment."

If Anthropic wants to charge premium prices while delivering: - Hallucinations that cost real money - AI that calls customers "증명충" - 25 days of complete silence

Then they should advertise honestly: "We're selling an unreliable teenage intern for $200/month. No support included. You'll be mocked if you complain."

The fact that you think this is acceptable shows how normalized this exploitation has become.

We deserve better. And we should demand better.
by myrmidon | 2025-07-09 14:37:51+00:00
I highly doubt that we will have global negative emissions (CO2 capturing) within the next decades-- maybe by the end of the century.

Even very rich nations have a handful of prototype plants for CO2 capture right now at best, and the budget for things like this is the first thing that gets slashed by Doge et al.

If we were on track for lots of CO2 capture by 2050, we would see the beginnings already (massive investments, quickly scaling numbers of capture sites, rapid tech iteration).

Fully agree with the rest of your point though. I consider CO2 emissions as basically "raising the difficulty level" for current and future humans (in a very unethical way, disproportionately affecting poor/arid/coastal nations).

I'm also highly confident that human extinction from climate change is completely off the table (and I think a lot of people delude themselves into believing that scenario for no reason).
by tslocum | 2025-07-09 14:38:27+00:00
Based on the examples given in the blog post, this appears to be a massive step backwards for PHP. The language has been making an effort to clean itself up for years. The author claims that the temporary variable solution "feels icky". If we ultimately care about readability and performance, temporary variables seem ideal even with this change in the language. Modern compilers look for things like temporary variables when performing optimizations. PHP's compiler probably already does this, and if it doesn't, adding support for that would make more sense than adding some new syntax.
by root_axis | 2025-07-09 14:38:29+00:00
> Saying twitter is the most censored is completely delusional

It's simply the facts. Elon allows people like Nick Fuentes and Alex Jones on the site because they share a political agenda. Twitter is the only social media site where e.g. links to competitor platforms are suppressed while the owner of the site artificially boosts his own posts above those that are more popular.

Twitter is the most cutting edge censorship platform.
by Rastonbury | 2025-07-09 14:38:35+00:00
I'd say 2/3 of the time I find what I'm looking for on first page of search using Confluence, 2nd page is totally irrelevant. So I'd say it's not that it's broken, it's just that it isn't there and that tribal knowledge isn't written. So imo forcing tribal knowledge to be written documented is the issue. LLMs won't help here because a contractor or first line employee has conflicted incentives whether to document their tribal knowledge which loses them value
by 0xbadcafebee | 2025-07-09 14:38:37+00:00
> No one should ever run a Bash script under CGI. It’s almost impossible to do so securely, and performance is terrible.

Actually shell scripting is the perfect language for CGI on embedded devices. Bash is ~500k and other shells are 10x smaller. It can output headers and html just fine, you can call other programs to do complex stuff. Obviously the source compresses down to a tiny size too, and since it's a script you can edit it or upload new versions on the fly. Performance is good enough for basic work. Just don't let the internet or unauthenticated requests at it (use an embedded web server with basic http auth).
by empath75 | 2025-07-09 14:39:25+00:00
Helm is not intended to be able to write files outside of the directory you are rendering the templates to, and the directory that you have downloaded the chart to, so if there is a way to do that, it is a bug in the program and a security bug at that, particularly when the destination is controlled by someone who has written a malicious chart. That it also happens to be able to run arbitrary code makes it worse, but the primary problem is that it can write files outside of the chart directory or the directory you are rendering to at all.

This has nothing to do with whether you are running it in sudo or whatever. (and in fact on MacOs, I don't believe this requires running it with sudo permissions to overwrite ~/.zshrc for example)
by ptsneves | 2025-07-09 14:39:43+00:00
I found that ChatGPT revived vanilla javascript and jquery for me.

Most of the chore part is done by chatgpt and the mental model of understanding what it wrote is very light and often single file. It is also easily embedded in static file generators.

On the contrary Vue/React have a lot of context required to understand and mentally parse. On react the useCallback/useEffect/useMemo make me need to manually manage dependencies. This really reminds me of manual memory management in C, with perhaps even more pitfalls. On vue the difference between computed, props and vanilla variables. I am amazed that the supposed more approachable part of tech is actually more complex than regular library/script programming.
by phtrivier | 2025-07-09 14:39:50+00:00
I really don't know how to assess China's economic or financial state.

I vividly remember hearing about how the housing bubble was going to break any time soon... a decade ago ?

And then how they would never survive Covid-19. Or the Trump tarrifs, etc...

To be clear, I'm not saying they're invincible or anything - maybe the economy _did_ collapse, but not uniformly, and maybe the central government is able to bail out the economy more efficiently than western economies, and maybe they're just lying their way off, etc...

But so far I have the same feelings about rumors on china's economical death as on Russian ones - metaphorically, I'll believe it when I see the corpse, and when its head has been chopped off for safety ;)
by derdi | 2025-07-09 14:40:04+00:00
> So you aren't shipping your product to some place that doesn't exist.

But businesses can't usually verify whether a place exists. The best they can usually do is to verify whether a place has an entry in their database of supposedly all places that supposedly existed at a point in time that is necessarily in the past.

That's not the same thing. Trust me, I would know: I live in a new-ish building, and for at least two years after it was completed and people were living here, some businesses still refused to take my money because they claimed that my address didn't exist. That was neither in their interest nor in mine.

> Also, some KYC requires that you verify the address of the person.

Define "verify". Verify that they provided some address that exists somewhere, possibly unconnected to the person? Worthless. Verify that they can receive mail at said address? OK, but doesn't require you to parse the address, just to print it onto a label and let the post office worry about it.
by tiagod | 2025-07-09 14:40:12+00:00
Yep it's a mess. Most newspapers and official channels just avoid the word billion altogether, just writing "mil milhões" (a thousand million).

AFAIK the exception is the finance world, where I believe B stands for the short scale for a long time, and $1B has been used in newspapers for a long time too due to globalisation of the economy.
by ebiederm | 2025-07-09 14:40:52+00:00
Since when has following the advice of a customer service agent been using technology incorrectly?

It might not be the sole responsibility of the customer service agent, but it is certainly their fault for giving bad advice.

It is completely reasonable to rely on the public statements of a company.

That said unless a someone at the company steps up, this seems like an issue for something like small claims court.
by mzmzmzm | 2025-07-09 14:40:52+00:00
Not sure about the law, but if you memorize and quote bits of a book and fail to attribute them, you could be accused of plagiarism. If for example you were a journalist or researcher, this could have professional consequences. Anthropic is building tools to do the same at immense scale with no concept of what plagiarism or attribution even is, let alone any method to track sourcing--and they're still willing to sell these tools. So even if your meat model and the trained model do something similar, you have a notably different understanding of what you're doing. Responsibility might ultimately fall to the end user, but it seems like something is getting laundered here.
by 542354234235 | 2025-07-09 14:41:24+00:00
Rules that give leeway to act when consumer costs are estimated to be above a certain threshold, instead of when company costs are below a certain threshold would be a much better, if still imperfect, rule that would satisfy the “correct direction in a useful way”.

Just off the top of my head, you could have a rule that if some business activity is estimated to cost consumers $100 million or more, then FTC can implement it instead of looking at the cost to companies. The “average US household” spends $200 a year on forgotten or unused subscriptions [1], if even 10% of those are due to a lack of click to cancel, that is $2.6 billion per year.

[1] https://thedesk.net/2025/05/cnet-subscription-survey-2025/
by vishakh82 | 2025-07-09 14:41:53+00:00
Not at all. "S3" is only in the loop because that's what labs generally use. In production, when we have ongoing scale, we will not use S3 or anything like it to transfer data between labs and our infra, even if it means using sneakernet!

The whole point of our project is to keep people's data always under encryption so that nobody can sell the data even if they wanted to. Using MPC (and FHE) we ensure that nobody can decrypt your data without your permission.

You can also delete your data any time without needing any third party's permission using the latest versions of the libraries we use.

We are building all this go get away from the closed, exploitative model that 23andMe built. The way we are building our infra, our company could go out of business tomorrow and you'll still be able to use the protocol and have access to your data and insights.

Also, fun fact, genetic data from newborns is retained by the state in many industrialized countries. We need to get that data away from "trust me, bro" infrastructure to securing it using MPC and FHE.
by shadowgovt | 2025-07-09 14:41:56+00:00
> Generic clients just need to understand hypermedia

Yikes. Nobody wants to implement a browser to create a UI for ordering meals from a restaurant. I'm pretty sure the reason we ended up settling on just tossing JSON blobs around and baking the semantics of them into the client is that we don't want the behavior of the application to get tripped up on whether someone failed to close a <b> tag.

(Besides: practically, for a web-served interface, the client may as well carry semantic understanding because the client came from the server).
by sophacles | 2025-07-09 14:42:18+00:00
Who the fuck cares? Seriously - a corporation is a piece of paper that separates ownership from responsibility. It's already a fucking stupid idea - You're deeply liable if you can't keep you trees maintained, or your car under control, but if you can't control you company, it's no problem?

We hand out these get-out-of-trouble cards to the type of useless trash that destroy lives (see pollution, workplace safety, dangerous products knowingly misadvertised as healthy, etc), let those disgusting shareholders profit, and then use tax dollars to cover the bill (if anyone does). Now you wan them to have rights on top of the special treatment? How about instead we do something that is sane, something that doesn't make a handful of people extremely powerful, and doesn't make millions of sad, pathetic tools who just want to pretend they matter complicit? How about we say, "Look if you want special protection, you have to follow these rules that limit the damage you do. If you want to do those damaging actions, you can be responsible", and put in a bunch of rules that stop these specially protected investors from profiting off other's suffering.

tl;dr - it's an incredibly stupid and ultimately harmful position that a paper granting special privileges has rights. Corporations are no more entitled to profit than anyone else, privileges should come with responsiblities equal to them.
by fwip | 2025-07-09 14:42:35+00:00
With complicated formulas, it often makes more sense and can give more guidance by first talking about the last operations to be applied. This seems to match the LLM structure, by starting by describing what we want, and then filling in the more specialized holes as we get to them. "Top-down" design vs "bottom-up".

Your insight about APL being reverse-concatenative is very cool.
by ordinaryradical | 2025-07-09 14:42:35+00:00
Because there will always be someone with an advantage over the others.

Equilibriums in geopolitics are inherently unstable, states naturally compete for their own self-interest. No state will be willingly co-equal with another unless some actor with greater power forces it into that position.

To your last point, given the state of the US, it would probably be better for the world if the EU were on top at the moment. But they will not be.