MurphyA/hacker-news huggingface dataset:
by winstonhowes | 2025-07-16 05:05:38+00:00
Hi all, I work on security at OpenAI. We have looked into this report and the model response does not contain outputs from any other users nor does it reflect a security vulnerability, compromise, or exploit.

The original report was that submitting a message close to (but not quite) 1500 seconds to the audio transcription API would result in weird, unrelated, off-topic responses that look like they might be replies to someone else’s query. This is not what’s happening. Our API has a bug where if the tokenization of the audio (which is not strictly correlated with the audio length) exceeds a limit, the entire input is truncated, and the model effectively receives a blank query. We’re working with our API team to get this fixed and to produce more useful error messages.

When the model receives an empty query, it generates a response by selecting one random token, then another (which is influenced by the first token), and another, and so on until it has completed a reply. It might seem odd that the responses are coherent, but this is a feature of how all LLM's work - each token that comes before influences the probability for the next token, and so the model generates a response containing words, phrases, code, etc. in a way that appears humanlike but in fact is solely a creation of the model. It’s just that in this case, the output started in a random (but likely) place and the responses were generated without any input. Our text models display the same behavior if you send an empty query, or you can try it yourself by directly sampling an open source model without any inputs.

We took a while to respond to this. Our goal is to provide a reasonable response to reports. If you have found a security vulnerability, we encourage you to report it via our bug bounty program: https://bugcrowd.com/engagements/openai.
by const_cast | 2025-07-16 05:05:40+00:00
Multiple steps:

1. Be aware of remote code downloading and execution. VSC extensions are remote code. Try to find out if you trust the source. I trust Debian repos, I certainly do not trust the VSC marketplace.

2. Know the policies around sandboxing. VSC is not a browser, and does no sandboxing at all.

3. Containerize or virtualize the application. If you're on Linux, always use Flatpak. Deny all filesystem permissions except for your root source code directory. This goes for browsers, too. Ideally they should support xdg-download and then have zero file permissions at all - otherwise, only grant ~/Downloads. Don't want a zero-day stealing your files.

4. Keep sensitive data in a separate, encrypted place. On Linux, you can use KDE vaults.

In a perfect world, we wouldn't be downloading and running remote code at all. But for practically, this is untenable. I have JS enabled in my browser. Our best bet is limiting the blast radius when things go south.
by hellojesus | 2025-07-16 05:05:54+00:00
Bars usually don't write down your data or associate every movement you make while there with your id, so it's definitely more risky than the traditional meatspace verification process.

Part of the issue is that for my entire life, age was either not enforced or a promise. It feels wrong having gates up where they previously didn't exist.

I get it; I wandered into gay porn sites and irc chats when I was in the 4th grade back in the 90s, and my friends and I loved chatting up those interested in our pre-teenage selves at the time. But I still will never provide a legit id for any age restricted services. Though I do have fakes for non us based companies to deal with financial kyc but haven't used them in some time (years), so no idea if they would work in the days of oligarchic identity management saas.
by benbridle | 2025-07-16 05:08:00+00:00
This would be fascinating to see, I have no idea how you'd even start.

There was a video I saw a couple of years back that was showcasing a cellular programming model, where each cell in a two dimensional grid performed an operation on values received from its neighbours. Values would move into one side of a cell and out the other every tick, something like Orca (by 100 rabbits), so the whole thing could be parallelised on the cell level very easily.
by hodgesrm | 2025-07-16 05:08:26+00:00
One question that the article does not cover: compaction. Adding custom indexes means you have to have knowledge of the indexes to compact Parquet files, since you'll want to reindex each time compaction occurs. Otherwise the indexes will at best be discarded. At worst they would even be corrupted.

So it looks as if adopting custom indexes mean you are adopting not just a particular engine for reading but also a particular engine for compaction. That in turn means you can't use generic mechanisms like the compaction mechanism in S3 table buckets. Am I missing something?
by eieio | 2025-07-16 05:08:41+00:00
I thought about not pushing snapshot/move data over websockets - one of the systems-y friends I ran my architecture by brought this up while I was speccing the site out.

You can't really put move batches on disk and have clients grab them (afaik), since the set of moves you want to send to an individual client depends on their position (and you don't want to send every move to every client).

But you could do this by not sending move batches at all, and instead having clients poll for the entire current state of the board.

The thing is, for them to get realtime-ish move updates they'd have to poll constantly. Cloudflare also has a min TTL of 1 second so there'd be more latency, and also if I screwed something up or saw more cache misses than anticipated I could end up unintentionally hammering my server.

Also if I'd had 100x more traffic (which would be crazy and well beyond what I prepared for!) I think I'd owe like $95 or so for bandwidth with my current setup. So the benefits to reducing bandwidth even more were a little marginal!
by conductr | 2025-07-16 05:08:50+00:00
I was hesitant to even comment on this, but I do have an opinion and some familiarity with this region and it’s flooding. I’m Texan and lived in the hill country for a handful of years. I once got trapped on a narrow ranch road at night and my vehicle was pushed into the ditch. I got stuck between two flooded low points then it rose even more, it wasn’t even raining when I embarked on my journey and the water only rose about 12”-18”, not even high enough to come into my stock height Chevy Silverado, but it was insane forceful. I was outside my vehicle and couldn’t stand upright once it was about 6”. I was a bit scared but it was obviously nothing compared to this.

Anyways, I unfortunately believe most of the deceased likely perished within minutes of being swept away. I don’t know how any response time could beat that especially given the terrain and conditions at the time. I think what is going to come of this will be an alert system similar to tornado sirens we have up in Dallas. If people could have been woken up and moved to higher ground even with just 10 minutes notice, the death stats would be significantly lower. If I had property anywhere near this (there are other similar rivers in the region), I’d be installing something on my property right now.
by windowshopping | 2025-07-16 05:08:55+00:00
for real. same. the level of delusion. i think what'll happen is they'll get some really advanced agents that can effectively handle most general tasks and they'll call it AGI and say they've done it. it won't really be AGI, but a lot of people will have bought into the lie thanks to the incredibly convincing facsimile they'll have created.
by d--b | 2025-07-16 05:10:09+00:00
> As often as OpenAI is maligned in the press, everyone I met there is actually trying to do the right thing

Of course they are. People in orgs like that are passionate, they want to work on the tech cause LLMs are once-in-a-lifetime tech breakthrough. But they don’t realize enough that they’re working for bad people. Ultimately all of that tech is in the hands of Altman, and that guy hasn’t proven to be the saint he hopes to become.
by darth_avocado | 2025-07-16 05:10:15+00:00
When everyone has a million dollars no one is a millionaire.

It’s not that upper míddle class has too many people in it, it’s that the definition of middle and upper middle class hasn’t been updated to reflect the reality of 2025. Money doesn’t go that far anymore, so more people have more of it.

Though this now is getting updated. Amex and other credit card companies have realized this and are now pushing their fees higher to remain exclusive as before.
by srivmo | 2025-07-16 05:11:45+00:00
> Nothing AI does wasn't possible before

Nothing any technology does wasn't NOT possible before that tech went mainstream. The point being tech saves time/cost and boosts productivity. For e.g. if you would have been able to find a webpage in an hour before, search made it easier to find that webpage. Similarly, AI synthesizes webpages and information for you.

That is the point of technology. If you could reach from point A to point B, using a bicycle, car, train or an aeroplane, each has its own use case at its own value and price point. Each such tech saves time/cost. To say that is is only a different modality, fails to capture the value add.
by hiAndrewQuinn | 2025-07-16 05:15:15+00:00
>I know of no world where you can penalize AI researchers across international boundaries nor to believe your scenario could ever play out.

This world where wars and stuff happen? You can just use actual force, you know.

>You're dreaming if you think you could actually get all the players to co-operate on this.

Let me play it out more explicitly since you lack the eyes to see. Say China implements such a rule. Top researchers in the US start mysteriously turning up in China and getting turned in for the cash fine. They aren't allowed to leave China until they empty their bank accounts, because they have broken a very serious Chinese law.

Now the US has to seriously ask itself whether it's actually willing to unleash World War 3 for the sake of a couple thousand eggheads. Not gonna happen.

Then someone takes a poll and finds this actually has mass support _in_ the US, because the average person is terrified of where AI is going. If you can't beat em, join em. The US implements its own law similar to the one in China so that this madness can stop. All of the top researchers bitch and moan and move to Portugal.

Top researchers in Portugal start mysteriously turning up in the US... So on and so forth. Rinse and request until everyone is on board with the new Nash equilibrium.

>[I]t doesn't take a huge lab to do it. You can do it at home. It might take longer but there's an 1.4kg blob in everyone's head as proof of concept.

You are thinking so unbelievably small. So, so unbelievably small.

You decide you want to push the state of AI forward and create an enormous new model. Okay, you're going to need to buy or source a bunch of GPUs. You try to order a bunch of GPUs from Nvidia. Nvidia flags you as a high risk client, turns on the tracking firmware, gathers info on your training runs, hires some people in your local area to peek through your curtains to confirm, and turns you in themselves. Nvidia walks away getting roughly half, the other half went to its contractors. You are out of the game.

Alright, so maybe you need to buy a bunch of GPUs on the secondhand market to get started. And maybe you need to source them one or two at a time from several dozen, or hundreds of different players to get away with it. A few of these players take an interest in watching you, notice you're buying GPUs from several secondhand sources, realize this would be extremely weird if you weren't planning on doing something illegal with them, and put together a small posse to turn you in. Your life savings are emptied out and your condo repossessed. You are out of the game.

> It might take longer

Thousands of years longer by my reckoning, at minimum. It's very hard to design an AGI entirely inside your own head when the outside world is so inherently adversarial.
by BobaFloutist | 2025-07-16 05:17:20+00:00
What if you think about it this way: By default, a marriage is a contract agreeing to equally pool financial resources. If that contract feels unfair to you, it's usually possible to draft a contract with a different distribution, which people often do if one of the two has vastly more financial resources going into the marriage.

Does that make it feel more fair?
by jallmann | 2025-07-16 05:17:53+00:00
Good writeup.

> It’s worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com, configured manually or through their browser, to access the public DNS resolver, rather than by IP address.

Interesting, I was affected by this yesterday. My router (supposedly) had Cloudflare DoH enabled but nothing would resolve. Changing the DNS server to 8.8.8.8 fixed the issues.
by jamesfinlayson | 2025-07-16 05:18:18+00:00
> Of the four mother languages, ALGOL is the most "dead"; Everybody still knows about LISP, COBOL still powers tons of legacy systems, and most scientific packages still have some FORTRAN.

I've heard of enough Cobol and Fortran jobs existing, and Lisp continues to exist in some form or other, but Algol really does seem dead. I remember someone telling me about an Algol codebase that was decommissioned in 2005 and that seemed like a very late death for an Algol codebase.
by brudgers | 2025-07-16 05:18:39+00:00
There is an old Egyptian tale of Theuth, the inventor of writing, showing his invention to the god Thamus, who told him that he would only spoil men’s memories and take away their understandings. From this tale, of which young Athens will probably make fun, may be gathered the lesson that writing is inferior to speech. For it is like a picture, which can give no answer to a question, and has only a deceitful likeness of a living creature. It has no power of adaptation, but uses the same words for all. It is not a legitimate son of knowledge, but a bastard —- Plato, Phaedrus

Beginning with writing. Or not.
by simonw | 2025-07-16 05:19:18+00:00
I had to switch away from Algolia - the problem is they only model "show items on the homepage" using a tag that's automatically applied to exactly 30 items, which means any filtering knocks that down to eg 15.

I switched to using the older firebase API which can return up to 500 item IDs from the current (paginated) homepage - then I fetch and filter details of the first 200.

https://github.com/simonw/tools/commit/ccde4586a1d95ce9f5615...
Show HN: CRISPRMind – mutate ideas like DNA, track every step
by SIUSha123 | 2025-07-16 05:19:31+00:00
Hi all, I’m Inayat, a solo builder working without funding or a team. I created CRISPRMind, a simple Python tool that lets you transform ideas like DNA. You start with a thought, apply edits—combine, reverse, personalize, reframe—and each step is recorded as memory.

It runs locally, no sign-ups or barriers. Think of it as a mirror for your mind’s journey.

I built it to share, not sell. If you're curious about how I made it, the technical stack, or its philosophy, I’m here and happy to discuss.

GitHub link above — please tell me what you see or feel.
by rdm_blackhole | 2025-07-16 05:20:25+00:00
> I find the repeated comments of how much parenting 'sucks' and how much childbearing 'sucks' to be distasteful.

Shouldn't people who think that parenting is not a glamorous job be allowed to express their thoughts on this subject?

> It has been the single most incredible experience I've had (5 times over).

So other people's feelings and experiences are according to you distasteful but yours should be accepted as some sort of universal truth?

You had a great experience bringing kids into this world, that's nice but that doesn't mean that everyone should be willing to go through the same things you did.
Circlecropimage.net –image tools: crop, enhance, compress, remove background
by maysunyoung | 2025-07-16 05:20:42+00:00
Hi HN,

I recently built CircleCropImage.net — a growing suite of lightweight, privacy-friendly image tools that all run 100% in your browser. No logins, no uploads, no tracking. Just fast, focused utilities that solve common image-editing tasks.

Current tools include: Circle Crop – Crop any image into a perfect circle with transparent background

Image Enhancer – Automatically improve sharpness, contrast, and detail

Background Remover – Remove image background instantly (powered by AI, local preview)

Compress to 500KB – Smart image compression for file size limits

Blur Image – Apply adjustable Gaussian blur to any photo

Resize Image – Resize by dimensions or percentage, while keeping quality

Why I made this: Most image tools either:

require signup,

upload your photos to a server,

or are crammed with ads and clutter.

I wanted something lightweight, privacy-first, and genuinely useful — especially for quick edits like preparing a profile picture, compressing an image for web, or blurring something before sharing.

Everything runs client-side (except the AI background remover which requests a cloud function), and works on desktop & mobile.

Would love your feedback or feature requests — thanks!
by lelanthran | 2025-07-16 05:21:02+00:00
I've experienced this since 2018 across all versions of linux mint since 2018.

The problem appeared to be a lot of unnecessary disk io coupled with DNA lookup that only get done after every single read request is complete. This means that when tab #10 is taking long to read whatever from disk it blocks every other tab.

Noticeable only when using spinning rust disks.
by zenapollo | 2025-07-16 05:21:27+00:00
> isn't room for doing it arbitrarily as from my perspective it is a suboptimal strategy towards accomplishing one's goals.

One’s goals? And if my goal were to enslave a nation of people to enrich myself and maintain power for as long as possible?

> I am not interested in making an emotional argument. I would be willing to hold my belief regardless of what a system is made up of.

You cannot discuss governance and civilization design without emotional arguments - i mean i guess you can you can if you lean psychopathic. I don’t mean to name call so please correct my assumptions here what you mean.

Closed societies are tolerable in theory - but in theory people should be able to opt-in or opt-out. If they aren’t free to opt-out such as with a national closed society it’s not civilization, it’s slavery.
by trealira | 2025-07-16 05:22:23+00:00
> I did consider that, but I wrote "in general" for a reason. It works very specifically in the case of "add one" or "subtract one", but it doesn't work with anything more complicated, like chasing pointers or adding/subtracting more than one at a time.

You're reminding me of the book "Modern Compiler Design." The author goes over how to compile a general Pascal-style for-loop correctly, accounting for increasing or decreasing ranges, differing step sizes, and accounting for overflow. It was written using just goto statements, so I adapted a version of it to C. Just replace "intN_t" with an actual integer size. It works by calculating the number of times the loop will run. If "from" is equal to "to," it's still going to run at least once. Again, this is not mine, just adapted from the author's code (Dick Grune's).

// enumerate: print out numbers from "from" to "to", inclusive, with step size "by" void enumerate(intN_t from, intN_t to, intN_t by) { uintN_t loop_count; intN_t i; if (by > 0) { if (from > to) return; loop_count = (to - from) / by + 1; } else if (by < 0) { if (from < to) return; loop_count = (from - to) / -by + 1; } else /* (by == 0) */ { // Maybe some kind of error return; } for (i = from; ; i += by) { printf("%d\n", i); if (--loop_count == 0) break; } }

You can see it's more complicated than the idiomatic C for-loop, haha. But that's just a general solution. Like you guys noted, it could be simpler for step sizes of 1.
by defrost | 2025-07-16 05:23:59+00:00
At least five ..

https://en.wikipedia.org/wiki/Conscription_in_Israel

https://en.wikipedia.org/wiki/Conscription_in_Ukraine

https://en.wikipedia.org/wiki/Conscription_in_Russia

https://www.aljazeera.com/news/2025/4/11/myanmars-military-d...

https://en.wikipedia.org/wiki/Conscription_in_Sudan
by tonyarkles | 2025-07-16 05:24:08+00:00
Yeah, that’s the downside to swapping architectures. x86 goes to great pains to be backward-compatible at the instruction level, and then MS puts a lot of effort into keeping Windows backwards compatible.

A couple years back on Windows 10 I successfully installed and used a PCB layout tool from 1998. I was shocked at how smooth it went. I think it needed to run as administrator but otherwise zero issues.
by a_bonobo | 2025-07-16 05:24:23+00:00
>Thanks to this bottoms-up culture, OpenAI is also very meritocratic. Historically, leaders in the company are promoted primarily based upon their ability to have good ideas and then execute upon them. Many leaders who were incredibly competent weren't very good at things like presenting at all-hands or political maneuvering. That matters less at OpenAI then it might at other companies. The best ideas do tend to win. 2

This sets off my red flags: companies that say they are meritocratic, flat etc., often have invisible structures that favor the majority. Valve Corp is a famous example for that where this leads to many problems, see https://www.pcgamer.com/valves-unusual-corporate-structure-c...

>It sounds like a wonderful place to work, free from hierarchy and bureaucracy. However, according to a new video by People Make Games (a channel dedicated to investigative game journalism created by Chris Bratt and Anni Sayers), Valve employees, both former and current, say it's resulted in a workplace two of them compared to The Lord of The Flies.
Ask HN: OSS Distributed Ollama Proxy?
by nodesocket | 2025-07-16 05:24:24+00:00
Are there any good open source solutions that manages a cluster of ollama serve nodes and distributes 'chat' requests to nodes that are up and not currently processing 'chat' requests?

A http reverse proxy seems to be up to the job, with perhaps consul or redis as the queue and service discovery. Would prefer written in go or rust.
by const_cast | 2025-07-16 05:24:38+00:00
Yes, I agree completely. You cannot even compare Chrome and Firefox because the sheer privacy violations of Chrome make it not a worthy competitor. The difference is, nobody cares.

Google develops Chrome and Chrome relies entirely on Google's money. Google is the default search engine. They are much, much, MUCH more tightly coupled to Google than Firefox could ever be.

But nobody says anything. And yet, Firefox makes Google the default search engine, and everyone has a think piece on it. Firefox is dead, they say, they're just Google's puppet. Then what is Chrome?
by cadamsdotcom | 2025-07-16 05:25:39+00:00
The solution is so simple as to be boring: keep your stuff in files on the filesystem.

Your data is in a box. SaaS put your data in other people’s servers. Phones put your data in a hidden store because app APIs only let developers do it that way - and Apple decided people don’t want filesystems.

But this is all reverting back: you can download your data thanks to GDPR, and phones have file browsers now.

Every computer has a filesystem. Even ones that pretend not to. It’s the common-denominator of computing.
by throwawaymaths | 2025-07-16 05:26:21+00:00
no, in golang (and erlang) every function is async, and there are implicit yield points in "well-known" places. for erlang it's every function call boundary, for golang its the end of functions. in the past this was a problem for go because a for (ever) loop could block your cpu process. not a problem for erlang since all forever loops must be tco function calls (inducing a yield at each interation)