MurphyA/hacker-news huggingface dataset:
by 90s_dev | 2025-07-08 22:00:06+00:00
I rarely read the Bible anymore. When I first became a Christian, I was reading it all the time, I couldn't put it down. Eventually life got the better of me and I stopped reading it. A few times since then, I decided to start reading it, and every single time, it turned out to be a really great experience that I was surprised I put off for so long. And then once again, life would get in the way and I wouldn't read it for a while, thinking it was too boring or pointless.

So great job making an app to make this easier.

For your core features, the "instant verse lookup" and "reading progress that sticks" look very useful.

But KJV audio? I think you'd be competing with the excellent dramatized audio book Truth and Life (RSVCE), which nobody can top.
by maxbendick | 2025-07-08 22:00:08+00:00
You really ought to never trust the output of LLMs. It's not just an unsolved problem but a fundamental property of LLMs that they are manipulatable. I understand where you're coming from, but prompting is unacceptable as a security layer for anything important. It's as insecure as unsanitized SQL or hiding a button with CSS.

EDIT: I'm reminded of the hubris of web3 companies promising products which were fundamentally impossible to build (like housing deeds on blockchain). Some of us are engineers, you know, and we can tell when you're selling something impossible!
by 90s_dev | 2025-07-08 22:02:19+00:00
> de-staff and de-fund organizations whose existence is enshrined in law

> nobody in the executive branch, of any given party, independent, or otherwise should be granted these powers

Then who should be able to defund and destaff organizations? Nobody? Should they last forever simply because they were legislated at one point?

---

[ EDIT since I can't comment anymore today ]

My mistake, I did not see the word "congress" in the text I was quoting.

My mind has been shut down for about 49 days. It's difficult to think at all.
by abujazar | 2025-07-08 22:02:22+00:00
This "attack" can't be mitigated with prompting or guardrails though – the security needs to be implemented on the user level. The MCP server's db user should only have access to the tables and rows it's supposed to. LLMs simply can't be trusted to adhere to access policies, and any attempts to do that probably just limits the MCP server's capabilities without providing any real security.
by acidburnNSA | 2025-07-08 22:03:14+00:00
Nuclear reactor cores can be very small, like the size of a snow globe (see Clementine), especially if they use highly-concentrated fissile material like plutonium or highly-enriched uranium. But if it's making more than a few hundred watts of power, it will typically be radiation-shielded by about 8 feet of high density concrete on all sides. This shielding will generally weigh around 200 tonnes or more. So if you're seeing reactors on or the size of trucks, keep that in mind.

We ran a truck-mounted in Idaho once before, the ML-1. It required lots of superhigh purity demineralized water (to avoid neutron activation) and earth to be built up around it during operation to avoid significant radiation doses 500 ft. away
by willyt | 2025-07-08 22:05:40+00:00
I’ve been learning french and for the most part once you learn that you just start but don’t finish saying the last letter of any word and you understand which letters you don’t pronounce on the end of the verb that change between je/il/elle/on (usually the last one) and ils/elles (usually the last 3) it’s not that hard. To test my pronunciation I can read a french word I’ve never heard before and have a pretty good chance that the apple speech recognition in notes will get it or conversly I can hear it and have a good chance of spelling it correctly. By contrast I am a native British English speaker, I have two postgraduate degrees, I can read the ‘dearest creature in creation’ poem perfectly and still there are words I would avoid saying in a professional or academic context for fear of saying them wrong and looking ignorant. And good luck pronouncing the name of any UK town or village correctly. What is hard about french is remembering if something is masculine or feminine.
by anonymousiam | 2025-07-08 22:05:47+00:00
It's a catchy name that I haven't seen in very many places. A few years back, I met a salesman named Zorin. I thought for a moment and realized that was the name of a Bond villain (played by Christopher Walken). I mentioned it to him, and he said that his mom had named him after the character.

The OS looks interesting, and may be appealing to non-power users who want more freedom and/or privacy.

https://www.youtube.com/watch?v=lvxumh7ULx4
by taeric | 2025-07-08 22:06:00+00:00
I was on a team once that would add server information to ids. Between that and using the version that has a date on it, it made debugging things MUCH easier. Just plug in the id and tooling could easily determine which logs to look into for when it was generated. Obviously, you may still need to widen your search for many reasons. But it is hard for me to think this is on most people's threat model.
by zenlot | 2025-07-08 22:06:26+00:00
Just read it!

I stopped using as my desktop around 2007, but worked with it till 2009, while using mac as desktop. Then did 5 years of AIX and a bit of Solaris. Afterwards, was just Linux.

These days my desktop is boring, w11+wsl.

Congrats on your job and having FreeBSD at work. Fun fact, while working in a place where we used AIX, we had an incident around 2012, due to some "ancient system running one service", that service was on FreeBSD 2.2.1. Somewhere in my archives, I have a photo of the screen.
by barrkel | 2025-07-08 22:07:21+00:00
The LLM can be predict that it may lie, and when it sees tokens which are contrary to some correspondence with reality as it "understands" it, it may predict that the lie continues. It doesn't necessarily need to predict that it will reveal the lie. You can, after all, stop autoregressively producing tokens at any point, and the LLM may elect to produce an end of sequence token without revealing the lie.

Goals, such as they are, are essentially programs, or simulations, the LLM runs that help it predict (generate) future tokens.

Anyway, the whole original article is a rejection of anthropomorphism. I think the anthropomorphism is useful, but you still need to think of LLMs as deeply defective minds. And I totally reject the idea that they have intrinsic moral weight or consciousness or anything close to that.
by krapp | 2025-07-08 22:09:50+00:00
Yes, I know. I thought I mentioned that in my comment but I guess I wasn't clear.

The modern archetypes of vampires and zombies as they currently appear in media and popular culture are modern in origin. Yes, undead spirits and revenants and the like appear throughout folklore, but all (or very nearly all) modern depictions of vampires originate with Bela Lugosi and Bram Stoker, or pop culture references proceeding from that (such as White Wolf games) and all modern zombies in media originate with Night of the Living Dead.
by kristjank | 2025-07-08 22:10:28+00:00
If a foundation spins off a project's community with certain goals, they take on to some degree the goals and the vision of the people that built it. Those are opinions, and they are important to the cited goals. If then a foreign element enters the system due to the sad state of the technology/corporate enterprises nowadays and changes the mission statement, you have not changed the spirit it was created with, you changed a business strategy in a way that is disconnected and hostile to the initial goal. A lot of the times the goals aren't really stated at all clearly, are protected by different acts like codes of conduct, and open to modification by impassionate people with ephemeral leadership positions who don't care what happens to the organization down the line.

Sure, I can become the chairman of Turtle saving international and change our charter to prioritize feeding hotdogs to hungry Somalis, but I am still doing an ideological disservice to the grassroots initiative that built the foundation and created the position for me to be sitting on, no?

Also, this seems to me extremely fragile when situations are reversed, say that an outright awful organization like an international petrol company gets a new mission statement. Should all they did before and after that be forgiven because their stated goals say otherwise?

I personally see this as little less than a ground truth, but perhaps there is some way that stated goals stand above all regardless.

EDIT: I do see how you make a very good point when you're looking mostly from the present towards the future, though.
by tinymagician | 2025-07-08 22:10:31+00:00
The dates are my fault, thanks to those who pointed it out, its been fixed. I sort of write the way my brain thinks so the in summary is just my way of reminding myself of what's going on.

I used an LLM to gather sources but wrote it myself. The writing having flow errors/grammar is more just a function of poor proofreading on my end - my brain skips words and flow sometimes. I'm not a great writer.

I see your point with the "bullet" namely - Some surgeons doubted the image quality, felt bullet could be left safely in the body, and worried about patient privacy (seeing through clothes). It should read "Some surgeons doubted the image quality. Others felt that the bullet could be left safely in the body and worried about patient privacy (seeing through clothes). The article has been updated.

Thanks for everyone's comments, I appreciate them.
by Desafinado | 2025-07-08 22:10:35+00:00
You do need to delineate between the end goals of promotion and job security, though.

If your only goal is to make money and be promoted then yes, politics are necessary. But that developer who is doing all of the work on the bottom rung and who is required for the team to operate, they often have power and job security. They're kept where they are, and are secure, because of their skills.

That might not be true of a Meta who has billions of dollars to throw at devs. But for companies with a hard time recruiting being good means power.

The old adage goes that there are two people with power in the software industry: those signing the cheques and those writing the code.
by _DeadFred_ | 2025-07-08 22:12:09+00:00
Your Al Jazeera link goes to a page that now states at 'least 95 Palestinians killed' but when I click the link next to that stat it takes me to an article that gives no numbers, no sources for numbers. I'm not sure why you would expect the BBC to publish something like that or why you hold that up to be good journalism?
by kragen | 2025-07-08 22:12:25+00:00
I agree. The OVS order in that Spanish clause is unremarkable, though SOV is perhaps more common "un espectáculo de magia barato te impresionó". Up to the 19th century I think SVO or VOS would have been acceptable but now sound archaic: "un espectáculo de magia barato impresionóte", "impresionóte un espectáculo de magia barato", and as far as I know OSV and VSO are completely forbidden: "te un espectáculo de magía barato impresionó", "impresionó un espectáculo de magia barato te".

You can play tricks to come close to OSV and VSO for purposes of emphasis: "A vos un espectáculo de magia barato te impresionó", "Te impresionó un espectáculo de magia barato a vos," but the "te" is still obligatory. And you can do something similar in informal or poetic English: "Just because, you, a cheap magic show impressed you." But the passive offers more flexibility. I posted some other English examples yesterday in https://news.ycombinator.com/item?id=44493065.

But Spanish's inflectional structure is very much reduced from classical Latin, with a corresponding reduction in word-order flexibility. I think any of the six permutations discussed above would be perfectly valid in classical Latin, although my Latin is very weak indeed, so I wouldn't swear to it.
by sdrapkin | 2025-07-08 22:13:09+00:00
The vast majority of Golang developers would benefit from using Guid library instead of UUID library. It’s substantially faster in all cases, more secure (by 2^6) and has more functionality.

For random token-as-string generation Golang developers should be using https://github.com/sdrapkin/randstring instead of crypto/rand.Text (faster and more flexible).
FakeFind
by FakeFind_ai | 2025-07-08 22:13:24+00:00
We built FakeFind to help consumers spot fake or manipulated reviews across Amazon, Walmart, eBay, and more. Paste a product link, and it returns a trust score, a short AI-generated summary, and even suggests better-reviewed alternatives.

It’s free to use, no login required. Would love your feedback! https://fakefind.ai
by burnt-resistor | 2025-07-08 22:14:47+00:00
The narrative of "pro-/anti-" is part of the problem.

Zionist settlers are outright evil, while most Israelis don't care or are unaware of what's going on in Gaza. Unfortunately, the world has been being paying attention and has had enough of the hasbara of ethno-nationalist supremacy BS that is plain to see. A lesson that the Holocaust/Shoah didn't teach properly to much of anyone now that those who survived it and are mostly gone, while those here now lack the oral history continuity of it. It's an intentional Pyrrhic victory in the tradition of the American western frontier and the Trail of Tears. There's now a plan to create a "humanitarian zone" concentration camp in Rafah requiring security screening and involuntary captivity for 600k.

https://www.haaretz.com/israel-news/2025-07-07/ty-article/.p...
by umbra07 | 2025-07-08 22:15:19+00:00
hmm, perhaps I was unclear.

You said that the Wikimedia Foundation's core mission is to basically do good things. Their core goal is not to keep Wikipedia running (as most people believe).

Wikimedia runs very prominent banner ads all the time on Wikipedia, saying that they need money to keep Wikipedia running, and that they're a small team that depends on community funding to keep Wikipedia running, and they can't do it without you, and please please please donate by this date. I think it is very reasonable for your average Wikipedia user to believe the following, thanks to how Wikimedia advertises:

* Wikimedia is the non-profit organization that runs Wikipedia. They're basically the same thing, since Wikimedia's goal is running Wikipedia.

* Wikipedia is run by a small team

* Wikipedia is heavily reliant on donations from normal people

* Wikipedia needs money all the time. I know this because they're constantly running big highlighted banner ads urgently asking for money before $DATE

If what you said is true, and Wikimedia's core mission is not in fact, to preserve Wikipedia, then they're engaging in deceptive advertising. They're giving the impression that they need money right now to keep Wikipedia's funding source secure, but in reality, their goal is much broader than just Wikipedia. I think it's reasonable to assume that Wikipedia's funding could be much more secure if the Wikimedia Foundation solely focused on running Wikipedia. In other words, if they stopped spending on $NOT_WIKIPEDIA_REL_COST they would be fine.

What does this have to do with capitalism or $ENTITY using pictures of starving African children?

> In any decent world, governments would use tax money to both fund projects like Wikimedia and help get poor countries off on a self-sustaining economy, but that ship has sailed I am afraid.

I want to make sure I'm not misinterpreting your words. Are you saying that it's okay for Wikimedia to engage in knowingly deceptive advertising because otherwise poor countries won't be able to get their economy running?

Are we agreeing that they're knowingly being deceptive, and that they wouldn't need to be deceptive if they just focused on Wikipedia? And we're disagreeing on whether that deception is moral or immoral?
by TeMPOraL | 2025-07-08 22:15:43+00:00
That "problem" remains unsolved because it's actually a fundamental aspect of reality. There is no natural separation between code and data. They are the same thing.

What we call code, and what we call data, is just a question of convenience. For example, when editing or copying WMF files, it's convenient to think of them as data (mix of raster and vector graphics) - however, at least in the original implementation, what those files were was a list of API calls to Windows GDI module.

Or, more straightforwardly, a file with code for an interpreted language is data when you're writing it, but is code when you feed it to eval(). SQL injections and buffer overruns are a classic examples of what we thought was data being suddenly executed as code. And so on[0].

Most of the time, we roughly agree on the separation of what we treat as "data" and what we treat as "code"; we then end up building systems constrained in a way as to enforce the separation[1]. But it's always the case that this separation is artificial; it's an arbitrary set of constraints that make a system less general-purpose, and it only exists within domain of that system. Go one level of abstraction up, the distinction disappears.

There is no separation of code and data on the wire - everything is a stream of bytes. There isn't one in electronics either - everything is signals going down the wires.

Humans don't have this separation either. And systems designed to mimic human generality - such as LLMs - by their very nature also cannot have it. You can introduce such distinction (or "separate channels", which is the same thing), but that is a constraint that reduces generality.

Even worse, what people really want with LLMs isn't "separation of code vs. data" - what they want is for LLM to be able to divine which part of the input the user would have wanted - retroactively - to be treated as trusted. It's unsolvable in general, and in terms of humans, a solution would require superhuman intelligence.

--

[0] - One of these days I'll compile a list of go-to examples, so I don't have to think of them each time I write a comment like this. One example I still need to pick will be one that shows how "data" gradually becomes "code" with no obvious switch-over point. I'm sure everyone here can think of some.

[1] - The field of "langsec" can be described as a systematized approach of designing in a code/data separation, in a way that prevents accidental or malicious misinterpretation of one as the other.
by ameliaquining | 2025-07-08 22:16:31+00:00
I think the above comment refers to the proposal for SVG 1.2 (which never shipped) to include an API for opening raw network sockets: https://www.w3.org/TR/2004/WD-SVG12-20040510/#rawsocket

(It observes that this feature raises certain security risks, but promises to figure out by the next draft how to fix them. This of course never happened.)

I recall Hixie had a funny rant about this, but I can't find it.
by surgical_fire | 2025-07-08 22:16:51+00:00
Not to defend Apple - A lot of attempts of integrating AI are shot in the dark that lilely make no sense.

However, Apple did have a use case that would be an obvious improvement. The very thing LLMs excel at is at processing and generating natural language. Improving Siri with LLM capabilities was the obvious move, especially at a time where LLM providers are willing to burn cash to reach a wider use base. It speaks volumes of a company that is just rent seeking their position in the smartphone market at this point.
by jchw | 2025-07-08 22:19:04+00:00
I'm not going to argue there's any bar too low for Google to not clear, but also, it really is possible that it's just for the stupid AI feature they say it is. Just because it's something Google could feasibly do doesn't mean they will. I'm very confident they have never used Google Public DNS for advertising or tracking.

It's one thing to treat funneling data "to the cloud" with suspicion out of principle, but personally I think it's counterproductive to go a step further and just assume everything is always being maximally abused. The fact that it could be is an issue, but that doesn't mean it is.
by otterley | 2025-07-08 22:19:53+00:00
> This to me is like going "Jesus H. Christ" at the prompt you get when you run the "sqlite3" command.

Sqlite is a replacement for fopen(). Its security model is inherited from the filesystem itself; it doesn't have any authentication or authorization model to speak of. What we're talking about here though is Postgres, which does have those things.

Similarly, I wouldn't be going "Jesus H. Christ" if their MCP server ran `cat /path/to/foo.csv` (symlink attacks aside), but I would be if it run `cat /etc/shadow`.
by burnt-resistor | 2025-07-08 22:19:55+00:00
There isn't "polarization". There's no zero sum team sports going on. There's a cult and then there's everyone else wondering why they have such crazy, hateful beliefs. It's because the Paul Harvey's, Rush Limbaugh's, and Alex Jones' weren't countered or restrained effectively. And so the Overton Window of America was dragged right past Reagan voodoo economics and into Nixon agro "get off my lawn" religious-ethnonationalism with people who wore the hoods.
by acheong08 | 2025-07-08 22:20:32+00:00
Reproduced the issue after a bit: https://github.com/acheong08/CVE-2025-48384 Then immediately went to update my git version. Still not up on Arch yet. Will refrain from pulling anything but I bet it'll take quite a while for most people to upgrade. Putting it in any reasonable popular repo where there are perhaps automated pulls will be interesting.
by barrkel | 2025-07-08 22:20:33+00:00
Yes, the context (along with the model weights) is the source data from which the hidden state is calculated , in an analogous way that input and CPU ticks (along with program code) is the way variables in a deterministic program get their value.

There's loads of state in the LLM that doesn't come out in the tokens it selects. The tokens are just the very top layer, and even then, you get to see just one selection from the possible tokens.

If you wish to anthropomorphize, that state - the set of activations, all the calculations that add up to the logits that determine the probability of the token to select, the whole lot of it - is what the model is "thinking". But all you get to see is one selected token.

Then, during autoregression, we run the program again, but one more tick of the CPU clock. Variables get updated a bit more. The chosen token from the previous pass conditions the next token prediction - the hidden state evolves its thinking one more step.

If you just look at the tokens being selected, you're missing this machinery. And the machinery is there. It's a program being ticked by generating tokens autoregressively. It has state which doesn't directly show up in tokens, it just informs which tokens to select. And the tokens it selects don't necessarily reflect the correspondences with perceived reality that the model is maintaining in that state. That's what I meant by talking about a lie.

We need a vocabulary to talk about this machinery. The machinery is learned, and it runs programs, effectively, that help the LLM reduce loss when predicting tokens. Since the tokens it's predicting come from human minds, the programs it's running are (broken, lossy, not very good) simulations of processes that seem to run inside human minds.

The simulations are pretty decent for producing gramatically correct text, for emulating tone and style, and so on. They're okay-ish for representing concepts. They're poor for representing very specific facts. But the overall point is they are simulations, and they have some analogous correspondence with human behavior, such that words we use to describe human behaviour are useful and practical.

They're not true, I'm not claiming that. But they're useful for talking about these weird defective minds we call LLMs.