MurphyA/hacker-news huggingface dataset:
Ask HN: How to Argue Against AI Enthusiasts?
by Vektorceraptor | 2025-07-18 09:14:21+00:00
I keep encountering the same attitude whenever I critically discuss AI: there’s a kind of fanatical optimism or hype, a “gold rush” mentality, that feels strange, yet can’t easily be refuted, because its proponents always retreat to the same position: “We don’t know. Time will tell.” But this doesn’t actually tell us what time will reveal, or whether it will be good or bad. So these considerations can't simply be dismissed.

Still, this argument seems irrefutable and at the same time, when taken seriously, it exerts enormous pressure. It represents a kind of evolutionary logic that can override everything else.

That’s why I wanted to ask: are there people or works that realistically and pragmatically outline the limits of AI,something that can serve as a solid counterpoint to blind optimism? Something that can't be overwritten so easily? I don’t mean the “grand limit cases” like quantum randomness, Gödel’s incompleteness theorems, or similar topics, but rather something much closer to the actual technology: inconsistencies or paradoxes that directly affect neural networks and limit them.

Furthermore, a fundamental guiding strategy or maxim seems to be: “What is the next logical step?” This also makes criticism difficult, because it simulates a kind of logical compulsion, one that elevates a person above other doubts and relieves him of them. This quickly turns into: “As long as we are following pure logic, we don’t need to worry about anything else.”

I’m also looking for counterarguments to this maxim, from logic, philosophy, and sociology.

Thank you
by debarshri | 2025-07-18 09:15:16+00:00
Theres a third one, when it comes to compliance and security tools, you don't want to build it even if you can because.

1. It is a liability

2. There is trust deficit during audit and other events. If audits are internal only sure you can build it but when it is 3rd party audited, auditors often know the product and familiar with the features.
by plqbfbv | 2025-07-18 09:15:19+00:00
> Everything is politics, whether you acknowledge it or not. And right now you are taking a political stance.

No, not everything is politics.

Kagi is a well-made tool, and part of the reason why it works so well is exactly because it tries not to be political. Thanks to the founder's reply, we know it ranks its sources based on utility to its users. Part of being a search engine is allowing the users to be exposed to all the information available on a given topic. The user decides how to use the tool.

I am (as many europeans) against the war that Russia started against Ukraine, but that shouldn't prevent me from looking into what Russia is saying about it should I desire to do so, and having the Yandex integration means that I, the user, am in control whether I want to click on the Yandex result or not, but at least I'm aware it exists. If the platform would decide to shut out Yandex, it wouldn't make the problem disappear, it would just remove your awareness and knowledge of it.
by nirui | 2025-07-18 09:15:33+00:00
I'm feeling/guessing the expiration is more of a flow-with-tradition thing. TLS certificates expires, it's part of the security feature, so why not Secure Boot certificates too?

And of course, it gives the root certificate issuer enormous amount of power as well, good riddance from the POV of Microsoft.

However, I think if Microsoft REALLY care about security, they should not let application installed on their system to do anything that is unapproved by the user (such as installing a virus that encrypts all their data), which could actually enhance the user experience and security. But, with secure boot, at least you can be sure that your Windows kernel is not tampered so it can serve the virus correctly :)
by probably_wrong | 2025-07-18 09:16:21+00:00
I think you're painting with too wide a brush.

Someone may say, like in this post, "AI makes my work easier", and that may be a valid point.

Someone else may say "AI has made my work much harder" [1], and that's a valid point too.

It may very well be that we'll find a place in the middle, but in the meantime it seem disingenuous to me to accept one side without acknowledging that the other is making valid points too.

[1] https://news.ycombinator.com/item?id=44558665
by EnPissant | 2025-07-18 09:18:18+00:00
UKI + secure boot works really well, but it is somewhat manual of a set up on Arch (what isnt).

If properly set up the only files you generate are:

- /efi/loader/random-seed

- /efi/EFI/Linux/arch-linux.efi

- /efi/EFI/Linux/arch-linux-fallback.efi

and the .efi are all automatically signed by hooks.

You can even skip a bootloader and boot the images directly.
by anon22981 | 2025-07-18 09:19:13+00:00
To be perfectly fair saying ”it’s aware of the best practices, context and internal usage” is very misleading. It’s aware none of those (as it is not ”aware” of anything), and that is perfectly clear when it produces nonsensical results. Often the results are fine, but I see nonsensical results often enough in my more LLM dependant coworkers’ PRs.

I’m not saying not to use them, but you putting it like that is very dishonest and doesn’t represent the actual reality of it. It doesn’t serve anyone but the vendors to be a shill about LLMs.
by Mahabharata | 2025-07-18 09:19:44+00:00
If you’re building with Node.js, deploying your app shouldn’t take hours of server prep. Our Node.js VPS gives you a clean and fast environment with everything you need.

Pre-installed:

Node.js (LTS) pm2 with auto-start on reboot Nginx reverse proxy with HTTPS (Let's Encrypt) GitHub deploy script included

Focus on your backend logic, not your server setup.

Use it for APIs, real-time apps, bots, dashboards — anything Node.js.

Root access SSD performance Email & Telegram support Crypto-friendly

Full details: https://3v-host.com/hosting/vps/for-developers/nodejs-vps/
by ACCount36 | 2025-07-18 09:19:49+00:00
Who controls the fucking certs?

"My computer was compromised with an early boot stage hypervisor backdoor" happens basically never. It's an attack vector that exists almost entirely in the minds of infosec fucktards.

"My brand new device ships with vendor-selected boot certificates that can't be changed, can't be overridden, and control what software I can install onto my own device" happens with every other smartphone, gaming console, car, and even some PCs.

"Trusted Computing" is, and always was, about making sure that the user doesn't actually own his device. This is the real, tangible attack vector - and the target of this attack is user freedom and choice.
by Retr0id | 2025-07-18 09:19:52+00:00
> The entire business model built on harvesting user data could become obsolete.

This is far too optimistic. Just because you can build a system that doesn't harvest data, doesn't necessarily mean it's a profitable business model. I'm sure many of us here would be willing to pay for a FHE search engine, for example, but we're a minority.
by cess11 | 2025-07-18 09:20:06+00:00
The local models I've tried can't write software of the kind and quality I require for work. When I'm programming recreationally I'm not really interested in automating it, since I do it for pleasure.

I have yet to meet someone in meatspace who is competent and isn't of the opinion that LLM SaaS are fine for querying out a bit of bash or Python here and there, but not much else. Sometimes people or corporations on the Internet are like 'wow, our entire repo is vibbed, so cool' and when I go look it's as if a bootcamped intern wrote it unsupervised but with a lot more Markdown I'm not going to look at, or a toy or a simple tool gluing some libraries.
by chabad360 | 2025-07-18 09:20:08+00:00
It should be noted, it is 100% possible to use Secure Boot with Linux and not be impacted at all. AFAIK, most (if not all) UEFI firmwares allow enrolling your own keys. Managing secure boot these days is as easy as installing sbctl and adding a hook to sign your kernel when rebuilding the initramfs. For the same price, as noted by the article, the key new key can be updated while the system is online without anyone being the wiser.

The FUD that gets spread around SB helps no one, and other than a small list of exceptions, you are always in control of your system.

SB allows MS to transparently enable Full Disk Encryption by default, which I think is a win for all users. It allows you to do the same on Linux. It lets server operators be sure their systems have not been tampered with. While there are many problems with UEFI, SB is not one of them.
by swores | 2025-07-18 09:21:48+00:00
I'm afraid your maths doesn't add up, so you've missed their point: it can't be done.

To average 30mph over 2 miles, you need to complete those 2 miles in 4 minutes.

But travelling the first mile at 15mph means that took 4 minutes. So from that point the only way to do a second mile and bring your average to 30mph is to teleport it in 0 seconds.

(Doing the second mile at 41mph would give you an average speed of just under 22mph for the two miles.)
by vouaobrasil | 2025-07-18 09:23:07+00:00
As a staunch AI critic, my opinion is that if you're on the fence about it, and just want to bring some realism into the discussion, you can't if you're talking about the future. Because eventually AI might indeed gain quite a lot of the hyped features that some are talking about. You can look in the academic papers on Google Scholar to find some cautionary tales, but in general with academia, most researchers want to get on the hype train to inflate their CVs.

The only way to truly be critical of AI is to be against it for other reasons, such as its damaging effects on society and its ability to aggregate wealth to the top without much serious life improvement for the average person. I think AI is really one of those things that you're either for or against and there's no middle ground.
by 000ooo000 | 2025-07-18 09:23:24+00:00
Everybody loves NIH until what gets invented is dogshit. Seriously, it's easy to romanticise the idea but wait until you have to work on something that evolved over a decade without any refactoring or documentation, and worse, the author is a lifer who couldn't ever imagine that their code could use improvement. I'll migrate to whatever silly API react router has cooked up this year over living that again, thanks.
by Yizahi | 2025-07-18 09:23:50+00:00
Geoblock is kids game. Try birthblock. Western megacorps are asking Ukrainians for the passport data, to prove they are from Ukraine and then block them anyway, if they were born in the currently russian occupied regions. And they don't accept any proof of living outside of those regions. This is the level of sewing a yellow star on your work robe, but no one if talking about it or shaming the corporations.
by Tainnor | 2025-07-18 09:24:17+00:00
> > assume that a woman won't push back as hard or because they just feel uncomfortable with a woman earning that much (or more than her colleagues).

> Exactly. They are seen as less valuable in the marketplace

I'm really confused as to how you think what you wrote follows from I wrote.

They're not seen as "less valuable", they're seen as more exploitable for chauvinistic reasons.

At no point did I say that the gender gap doesn't exist, how do you even come to that conclusion? My point is that "women should just demand less money" is a really bad takeaway from the gender pay gap. Maybe women should demand more money and/or unionise, and maybe men should help expose biases whenever they see them and demand transparent reviews. Just as an example, that's something works councils usually do where I live.
by jeroenhd | 2025-07-18 09:24:48+00:00
The mistake was not to put an expiry date on the certificates, but to trust hardware vendors to do even basic firmware maintenance after motherboards and laptops leave the warehouse.

In theory a KEK update will fix the expiry issue just like a CA package update on any normal operating system will do.

In practice, most UEFI firmware is written like trash, unmaintained, and mostly untested.
by khalic | 2025-07-18 09:24:58+00:00
Oh I wouldn’t try anything other than English with Claude. For the quality, it depends on many things, the context given, the quality of the code given as context, style, etc.

I easily double my output with very little effect on quality. It does require constant supervision though, I don’t see AI producing professional quality code by any other mean than human supervision, for a looooong time.
by wiether | 2025-07-18 09:27:37+00:00
> simply because they’re afraid of looking dumb

I'm on the opposite side of this.

Being the expert at works means that I can't fail. I'm the one everybody is relying on. The pressure is huge.

Being able to try new stuff that I know nothing about is a great way to release that pressure! I sometimes take the opportunity of being with knowledgeable/experienced people to completely turn off my brain and just do what they say.
by TacticalCoder | 2025-07-18 09:27:57+00:00
> Any installed distribution should have a bootloader signed with its own key that will continue to boot

I'm kinda concerned here: as long as there's no mandatory security upgrade requiring a reboot, I'm the kind of person to reach six months of uptime with my desktop (yup, Linux is that stable, a far cry from Windows).

So I'm concerned about not being about to boot in x months and forgetting why (ah, yes, Microsoft having a key expiring).

Am I correct in my understanding that this only affects my installation media and not my already installed systems?

Lastest Debian stable FWIW.

Oh well, I take it it's going to be mokutil and whatnots when I get back home.
by bmacho | 2025-07-18 09:28:04+00:00
Verdagon has this linear types/higher-RAII article: https://verdagon.dev/blog/higher-raii-7drl

It is about types that can't be copied and can't go out of scope, and the only way to destroy them is to call one of their destructors. This is compile time checkable.

In theory they can solve a lot of problems easily, mainly resource management. Also it generalizes C++'s RAII, and similar to Rust's ownership.

In practice they haven't got support in any mainstream programming language yet.
by closewith | 2025-07-18 09:28:13+00:00
You are agreeing with me.

> The fallacy here is that we're somehow, magically, required to move on to more extreme forms of the same logic.

Yes. It's inherently subjective whether animal husbandry is worth the input resources and each person can decide for themselves is it's worth it or wasteful, as with every other example (travel, medicine, etc).

> By that logic, shouldn't we also ban all mean words? I mean, they might incite distress, and they can cause emotional harm, and even physical harm if someone gets too offended.

Yes, again you're agreeing with me. We collectively choose the boundaries of acceptable behaviour and practices. We have speed limits but don't ban cars, we regulate e-waste disposal but don't prohibit computers, and we can and should forbid cruel and environmentally damaging practises in husbandry, but not ban meat production.

The person I'm replying to is making the opposite argument, that husbandry is inherently wasteful and therefore should be subject to regulation. That is the is–ought fallacy, which I pointed out using reducto ad absurdum.

So again, re-read the thread.
by noobermin | 2025-07-18 09:28:26+00:00
May be things have changed over the last 10 years but HN comments literally convinced me to switch to a macbook a decade ago and it was literally one of the worst experiences with a product of my life. Everyone who says mac is unix and is just as good as linux is a fool and should never be trusted.

If you want, you can search my username with "macbook" and see my rants since 2015. The worst experience I had with it was it glitching out a hour before a national conference presentation that forced me to remake the slides on another person's laptop. I was sitting in the audience sweating bullets remaking those slides over the course of a grueling hour or so. I have never had the desire to buy another apple product since then and I don't miss it.

Linux just works, especially if you have a machine it works well on. Don't believe the naysayers, learn from my exprience.
by palata | 2025-07-18 09:28:44+00:00
[Warning: I'm not interested in sarcasm or uninformed rants against secure boot, there are plenty already]

I'm hoping to get insights from people who understand secure boot well here. My understanding on Android (for the minority of Android manufacturers that do it correctly) is that there is a "manufacturer key" burnt somewhere on the ROM that cannot ever be changed, and once a first system is installed properly:

1. It is impossible to overwrite the system partitions unless the bootloader is unlocked from the already-installed OS (I assume that something makes sure that only the signed OS can unlock the bootloader?).

2. Once the bootloader is unlocked, it is impossible to overwrite only parts of the system: it's all or nothing, such that one cannot inject stuff into an existing system (evil maid style).

Still on Android, it's possible to add custom keys. That's what GrapheneOS and the likes use.

How is it on UEFI? It sounds like the "manufacturer keys" are always from Microsoft, but is there not a way to use custom keys?
by fauigerzigerk | 2025-07-18 09:28:47+00:00
>Imagining that AI is somehow more neutral or resistant to influence is incredibly naive

The point is well taken. I just feel that at this point in time the reliance on Wikipedia as a source of objective truth is disproportionate and increasingly undeserved.

As I said, I don't think AI is a panacea at all. But the way in which LLMs can be influenced is different. It's more like bias in Google search. But I'm not naive enough to believe that this couldn't turn into a huge problem eventually.
by okanat | 2025-07-18 09:29:26+00:00
> Why do you think Linux can't do auto-updates?

Because they literally cannot. Linux package managers like to ask deeply technical questions. Even on Ubuntu dpkg will occasionally ask about configuration file changes and expect you to make decisions like keeping the existing one, replacing the config file with the new one or editing it. Windows never asks such questions. Its configs are relatively stable and usually Windows uses more formally defined forms like registry or XML files. They are much easier to write migration scripts for than human readable text files on Linux.

As far as I know even packages like `unattended-upgrades` from Ubuntu doesn't perform things like kernel upgrades which requires `apt dist-upgrade`. They are required for keeping good security. And forget about upgrading an actual version like from 24.04 to 24.10. On Windows upgrades from 24H1 to 24H2 are relatively painless and can easily rolled back. My Ubuntu running colleagues had to rescue their distros at least twice since a version upgrade went wrong.
by jeroenhd | 2025-07-18 09:30:11+00:00
Evil maid and rootkits, mostly. It's also part of the trust chain that unlocks an encrypted disk without having to enter a password.

On Windows, secure boot has worked pretty well when it comes to rootkits. MBR rootkits were trivial to write, but UEFI rootkits require UEFI firmware changes or exploiting the bootloader process itself, both of which are much more complex. If malware uses the Linux shim, the TPM will notice and refuse to provide the Bitlocker key, so your computer won't boot without going to the IT office and asking for the recovery key (which should prompt more investigation).
by johnisgood | 2025-07-18 09:31:33+00:00
> There is this fallacy, the 'Sunk Cost' fallacy, where people accept a substandard result because they feel they have already invested in the result and don't want to 'throw away' that investment.

I was going to say the same thing. The car on the picture may not have a broken headlight, and the one in reality may, but if it takes for the person >2 hours just to visit that car, they may still end up buying it anyway as they have already invested too much time (and possibly money) into it.
by delusional | 2025-07-18 09:31:42+00:00
I think that nuance is fairly unwarranted when you observe the American system through the lens the laws ask you to view it through.

The American H1B system isn't about importing foreign workers that do a good job, it's about importing foreign workers that do a job no American could do. The system demands you look for some American do do the job first, and only if you fail to find one can you import one from overseas.

In that view, all the talk about GPA fall flat, because it doesn't matter if the foreign worker is better than an American worker, you are supposed to pick the American worker anyway.
by Daviey | 2025-07-18 09:31:42+00:00
I can only talk about the law in England & Wales, but:

For code generated by an LLM the human user would likely be considered the author if you provided sufficient creative input, direction, or modification.

The level of human involvement matters, simply prompting "write me a function" might not be enough, but providing detailed specifications, reviewing, and modifying the output would strengthen the claim.

the Copyright, Designs and Patents Act 1988 (CDPA), Section 9(3) staes, "In the case of a literary, dramatic, musical or artistic work which is computer-generated, the author shall be taken to be the person by whom the arrangements necessary for the creation of the work are undertaken". This was written before LLM's existed, but recent academic literature has supported this position, https://academic.oup.com/jiplp/article/19/1/43/7485196?login...

However, a comparable situation was tested with Thaler v Comptroller-General, where courts emphasised that legal rights require meaningful human involvement, not just ownership of the AI system. - https://www.culawreview.org/journal/unlocking-the-canvas-a-l... and https://www.whitecase.com/insight-our-thinking/uk-supreme-co...

I do acknowledge there is uncertainty, and this is highlighted here in "The Curious Case of Computer-Generated Works under the Copyright, Designs and Patents Act 1988.", with "section 9(3): the section is either unnecessary or unjustifiably extends legal protection to a class of works which belong in the public domain" - https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4072004

Today, I think it's doubtful that a functional application can be entirely vibe coded without decent direction and modification, but I don't think that will always be the case.
by IceDane | 2025-07-18 09:32:42+00:00
It boils down to that there are not many good reasons not to. The vast majority of backends people write are really just relatively thin proxies to your database or something like that. They mostly wait on IO, which is perfect for node.

It's just a no-brainer when it's a good fit and you already have competent devs. Then there are advantages like being able to share types across your entire system without having to resort to code generation.

On top of all that, we have Effect which is easily the best and most robust way to write production grade typescript. It's nearly a language into its own and sort of should be, but we are fortunate that we can instead have and use such a useful tool in the most popular ecosystem in the world.
by johnisgood | 2025-07-18 09:33:43+00:00
I am not attractive. Thankfully once I am being given the chance to have a conversation with people, after that, they find me attractive regardless of my appearance, in fact, I am more attractive now in their eyes due to the way "I am". Oftentimes all it takes is a deeper conversation.

It happened to me, too. I did not find someone particularly attractive, but their experiences, their views of relationships, the world, and so forth somehow ended up making them look more attractive.