MurphyA/hacker-news huggingface dataset:
by Thorrez | 2025-07-20 06:54:55+00:00
>Since the ID Token is coming from the browser, it must be signed to ensure that a malicious actor can't tamper with it. Otherwise an actor could swap out a `sub` or an `email` claim and the RP would be none the wiser.

Are you referring to a login CSRF attack? Where an attacker causes a victim to visit a URL that forces the victim to log in to an account of the attacker's choosing? A signature on the token doesn't solve that AFAICT. The reason a token signature doesn't solve that is that an attacker can take the attacker's own ID Token that has a valid signature, and do the attack with that ID Token, forcing the victim to log in to the attacker's account.

Yes, the token signature does reduce the attacker's ability. Without a token signature, the attacker could force the victim to log in to any account. With a token signature the attacker can only force the victim to log in to the attacker's account. But this isn't a full solution. Some other anti-CSRF mechanism needs to exist. Once that anti-CSRF mechanism exists, the token signature is no longer useful.

Adding a signature to the token doesn't make sense to me as a login CSRF protection mechanism. If the designer's goal was to protect against login CSRF, the signature should be over something else, not just the token, and not part of the token. Then the token itself doesn't need the complexity of a signature (and the authorization code flow doesn't need the complexity of a signature), just the redirect flow needs it. Or even simpler, the designers could have mandated the authorization code flow, and not need any signature at all.

Or maybe you're referring to a completely different attack, where there isn't a victim user, just an attacker wanting to log in as someone else in the attacker's own browser. In that case, the signature doesn't solve that attack, because since everything happens in the attacker's browser, the attacker can modify the js locally to disable signature verification.

>- Signed ID Tokens can be passed around to assert identity to other entities within the system. For example, there are some promising draft specifications that explore exchanging ID Tokens for access tokens in other systems. This is only possible because the ID Token cannot be tampered with.

Yes, but the spec doesn't mention this. Just from reading the spec, a reader can wonder, "why is there all this unexplained complexity for no apparent reason?"
by jajko | 2025-07-20 06:55:05+00:00
There is also the topic of erythritol-induced diarrhea in higher consumption.

Its almost like these days people are desperately grasping for anything that will deliver weight loss, apart from changing their longterm unhealthy fucking eating habits. US is a long term champion but it has slowly crept into most cultures, just not at that scale yet.

Food portion size, its composition and breaking some sweat regularly works wonders but nobody ain't got time or willpower for that.
by Earw0rm | 2025-07-20 06:55:32+00:00
Has anyone tried it on x87 assembly language?

For those that don't know. x87 was the FPU for 32-bit x86 architectures. It's not terribly complicated, but it uses stack-based register addressing with a fixed size (eight entry) stack.

All operations work on the top-of-stack register and one other register operand, and push the result onto the top of the stack (optionally popping the previous top of stack before the push).

It's hard but not horribly so for humans to write.. more a case of annoyingly slow and having to be methodical, because you have to reason about the state of the stack at every step.

I'd be very curious as to whether a token-prediction machine can get anywhere with this kind of task, as it requires a strong mental model of what's actually happening, or at least the ability to consistently simulate one as intermediate tokens/words.
by btilly | 2025-07-20 06:58:00+00:00
It seems that you reversed your point then. You said before:

Even before I read your comment I thought that 5% precision is useful but 1% precision is a silly turn-off, unless that 1% is near the 0% or 100% boundary.

However what I am saying is that there is real data, involving real predictions, by real people, that demonstrates that there is a measurable statistical loss of accuracy in their predictions if you round off those percentages.

This doesn't mean that any individual prediction is accurate to that percent. But it happens often enough that the last percent really does contain real value.
by nerdsniper | 2025-07-20 06:58:29+00:00
Claude Code / 4o struggle with this for me, but I had Claude Opus 4 rewrite a 2,500 line powershell script for embedded automation into Python and it did a pretty solid job. A few bugs, but cheaper models were able to clean those up. I still haven't found a great solution for general refactoring -- like I'd love to split it out into multiple Python modules but I rarely like how it decides to do that without me telling it specifically how to structure the modules.
by threatripper | 2025-07-20 06:58:34+00:00
Current models have no memory, they don't learn. You have to learn for them for now. You have to put the learnings in the instructions and in code comments. If you don't describe WHAT your code SHOULD do and WHY you write it in THAT particular way it will have no idea and the code may just look like bad non-standard code waiting to be "improved".

It works best if you keep close to mainstream styles and if you keep it easy and straight-forward.
by submeta | 2025-07-20 06:58:40+00:00
The hidden message of the title: Plant based alternatives may not succeed. I don’t believe that. I rather see more and more friends and people avoid eating meat or reduce their consumption drastically. Many buy plant based alternatives to milk as well. Twenty years ago only a few people would ask for oat/soy milk when ordering a coffee. But these days many do.

I have been eating plant based meat alternatives for four years now, and I am never going to go back to eating meat. Yes, these products may be ultra processed food, but I cannot justify the ecological consequences and the suffering brought upon the animals just so I can eat a piece of their muscle tissue.

Our lifestyle is not sustainable, we have to look for alternatives. And young folks already grow up with a very critical attitude towards meat consumption.
by db48x | 2025-07-20 06:58:58+00:00
True, he doesn't come right out and say the words. But don’t lose sight of the context. This is the big Keynote speech at a conference called OOPSLA, or “Object-Oriented Programming, Systems, Languages & Applications”, in 1998. It is safe to say that the audience has heard of Java by now. They already know that the core language design choice made during the creation of Java was to make it object—oriented. Objets are everything and everywhere in Java. Even the simplest “Hello World” program in Java has to be written as a class with a a Main method.

This talk tells us why he and the others at Sun made that choice. He says right there that he wants Java to enable people to write large programs. He specifically contrasts it with the small languages and small programs of the past, the kind that were invariably written by individuals or small teams.

This is what he believes OOP is good for, and why researchers have been studying it for so long. He is reinforcing the belief of the attendees that OOP in general, and languages like Java specifically, are a panacea created for the explicit purpose of letting engineers work more efficiently together on large, complex systems.

We know from the historical record that early researchers did not have this belief. We know that many practitioners of the 90s and 2000s did. This talk may not be the genesis of that belief, but it is proximate to it.
by Animats | 2025-07-20 06:59:04+00:00
From 1962 to 1964, the Times Square - Grand Central shuttle was fully automated. There was still a "motorman", for union reasons, who did not ride in the cab.[1] Worked fine, but an unrelated station fire damaged the equipment, and the automatic system was not rebuilt.

That's the simplest possible case - a train on a dedicated track, going back and forth between two stations. It's a 90 second trip.

That trip is still being driven manually today. It takes two motormen, one at each end of the train, because one person going from one end of the train to the other through the crowd would slow the 90-second operation way down. It's amazing that it's not automated today.

[1] https://www.nycsubway.org/wiki/IRT_Times_Square-Grand_Centra...
by nine_k | 2025-07-20 06:59:41+00:00
All these stories about vibe coding going well or wrong remind me of an old joke.

A man visits his friend's house. There is a dog in the house. The friend says that the dog can play poker. The man is incredulous, but they sit at a table and have a game of poker; the dog actually can play!

The man says: "Wow! Your dog is incredibly, fantastically smart!"

The friend answers: "Oh, well, no, he's a naïve fool. Every time he gets a good hand, he starts wagging his tail."

Whether you see LLMs impressively smart or annoyingly foolish depends on your expectations. Currently they are very smart talking dogs.
by lelanthran | 2025-07-20 07:02:44+00:00
Serious question: have you considered that dealing with all that minutiae and working through all that pain has made you capable to have the LLM write code?

Those young engineers, in 10 years, won't be able to fix what the LLM gave them,because they have not learned anything about programming.

They have all learned how to.micromanage an LLM instead.
by eurleif | 2025-07-20 07:03:03+00:00
If you want to have a tangential discussion about how you interpret Ring's terms to permit them to do wild things behind the user's back, that's fine; but it would have been better to be more clear about the tangential nature of your comments. If the terms allow them to do wild things behind the user's back, then they can do those things with or without introducing this feature. And they can also introduce this feature with or without the wild things; and with or without terms of service allowing those things. They're orthogonal issues.

In any case, you're mistaken about what the terms allow. When you paraphrased the terms as saying they can "hand over your footage to anyone so long as Ring believes it's 'reasonably necessary' to protect the rights or property of anyone", you neglected to account for the clause: "as required or permitted by law". Under the Stored Communications Act, 18 U.S. Code § 2702 (b), there is only a short and narrow list of circumstances under which it is permissible for a provider to disclose communications content without a warrant. The most pertinent is an emergency involving danger of death or serious physical injury (exigent circumstances), which is what the link in the OP regarding warrantless and consentless disclosures is about. But exigent circumstances are also a longstanding exception to fourth amendment search protections in general: law enforcement can break into your house without a warrant if there are exigent circumstances requiring them to do so.
by eviks | 2025-07-20 07:04:41+00:00
> You can do all of this yourself from the primary materials, the product pages, etc.

Unless you can't. What exact Ethernet card is embedded in your extensive brand port extension hub? No way to know unless someone knowledgeable disassembles it. Valuable information doesn't just float around one google search array. Product pages are too often the same kind of garbage like the reviews you've described, containing very little useful info
by konstantinua00 | 2025-07-20 07:04:41+00:00
I prefer to never use it

C and C++ are about types before names - and modifying that is simply a change for the sake of a change, needless and useless. There's a lot of education enertia behind it - and effort should be spent on fighting what matters (like smart pointers), not hip/non-hip declaration style

decltype(a*b) is the only good "escape hatch"-type excuse for it, but idk why everyone make such a big deal out of it - when was the last time return type was both unpredictable AND needed to be specified? by that point you're already too deep
by t0mas88 | 2025-07-20 07:05:54+00:00
Anecdata, but looking at the higher end of the "normal people" market Intel has already lost. It's macbooks everywhere. The only non-apple notebooks I see are either for cost reasons or tech experts that want more contol (a small group)

And Apple is silently reducing prices by making the cheap Macbook Air close in specs to the Pro. So they're likely to start taking more and more of the midrange market as well.
by dhx | 2025-07-20 07:06:27+00:00
Thanks. It seems such glazing was common in American 1970's era construction as a way to evenly distribute across the pane and into the frame the heat from a fire on one side of the window. This extends the time before the glass shatters, which once shattered allows flames/smoke through. It has commonly been misunderstood to be "stronger" glass, an overloaded term that might have some applicability to fire resistance, but has given people the wrong idea about impact resistance. Glazing with embedded wires is much less impact resistant whilst also posing additional safety risk to humans impacting the glass. When humans attempt to pull themselves out of glass they've impacted, the wires hold sharp glass shards in place causing even more severe injuries.[1]

It looks like all adjoining offices on the exterior of the building are single fire zones, with stairwells at either end of each zone. Internal offices seem to be divided into fire zones too (e.g. 6x2 rooms as a single zone) with use of the odd internal slab-to-slab wall that would possibly be fire resistant.

[1] https://www.youtube.com/watch?v=x6Lmwl7y-9M
by RamRodification | 2025-07-20 07:07:07+00:00
Sorry for bugging you about this. I'm not the person you are responding to but this is important to me before buying so if you don't mind, could you verify that this is your setup?

1. The doorbell cam is connected only to the LAN.

2. The doorbell cam is definitely blocked from accessing the internet.

3. Having access to the LAN from your phone through VPN allows you to watch the feed and talk to people at the door through the app.
by throwawaylaptop | 2025-07-20 07:07:42+00:00
Exactly this. I'm a self taught PHP/jQuery guy that learned it well enough to make an entire saas that enough companies pay for that it's a decent little lifestyle business.

I started another project recently basically vibe coding in PHP. Instead of a single page app like I made before, it's just page by page single loading. Which means the AI also only needs to keep a few functions and the database in its head, not constantly work on some crazy ui management framework (what that's called).

It's made in a few days what would have taken me weeks as an amateur. Yet I know enough to catch a few 'mistakes' and remind it to do it better.

I'm happy enough.
by FreakLegion | 2025-07-20 07:07:42+00:00
Silicon Valley as people think of it today (tech, talent, and capital) is generally considered to have come together in the early 1970s. That doesn't mean the ingredients weren't there before -- tech had been around for decades already, and the laws allowing free movement of talent go back to the late 1800s -- but by most accounts the early 1970s are when it all clicked. Note that there's no fact of the matter to be right or wrong about here, though.

If I had to pick a point in time as the beginning, I'd probably put it at the founding of either Kleiner Perkins or Intel (a couple years after or before the Silicon Valley moniker was coined, respectively). Before then funding mostly came from other companies. With Intel you have successful founders funding their own new company, and with Kleiner Perkins you have successful founders funding other founders. To me it isn't Silicon Valley until this dynamic emerges.
by ChristianJacobs | 2025-07-20 07:08:07+00:00
I switched to AeroSpace from Yabai because I had to disable parts of SIP for certain functions (such as switching workspaces with keybindings from SKHD), and that didn't feel right. Updates are also smoother since I don't need to update the sudoers file allowing the Yabai CLI to run without requiring password. Been happy as a clam ever since.
by 0xDEAFBEAD | 2025-07-20 07:08:10+00:00
The "properties of the value it returns" are, by design, implementation-dependent. You're only supposed to use the id function if you need to know something about what's going on under the hood. The id function is working exactly as intended: it's exposing aspects of the implementation, if for some reason you need to know that stuff.

It would not be a positive change to sacrifice Python performance in order to make the output of id() more intuitive. I've spent many hundreds of hours coding Python and I don't believe I ever used that function or saw someone else use it.
by fpoling | 2025-07-20 07:08:40+00:00
For me the problem with TypeScript or Flow when the latter was a thing was that the syntax/semantics of the sub language of types was extremely ad-hoc with so many idiosyncrasies. Maybe if I programmed it all the time I would learned it. But I had to change the relevant code only occasionally and typing helpers to access DOM required constant look at the spec and StackOverflow.

With Rust the rules at least are simple. While following them can be a struggle the compiler errors at least are much more helpful and points to the problem with the design or the checker limitations.
by SecuredMarvin | 2025-07-20 07:09:38+00:00
I also made this experience. As long as the public level of knowledge is high, LLMs are massively helpful. Otherwise not so much and still hallucinating. It does not matter if you think highly of this public knowledge. QFT, QED and Gravity are fine, AD emulation on SAMBA, or Atari Basic not so much.

If I would program Atari Basic, after finishing my Atari Emulator on my C64, I would learn the environment and test my assumptions. Single shot LLMs questions won't do it. A strong agent loop could probably.

I believe that LLMs are yanking the needle to 80%. This level is easy achievable for professionals of the trade and this level is beyond the ability of beginners. LLMs are really powerful tools here. But if you are trying for 90% LLMs are always trying to keep you down.

And if you are trying for 100%, new, fringe or exotic LLMs are a disaster because they do not learn and do not understand, even while being inside the token window.

We learn that knowledge, (power) and language proficiency are an indicator for crystalline but not fluid intelligence
by redmug | 2025-07-20 07:09:53+00:00
Microsoft is aware of active attacks targeting on-premises SharePoint Server customers, exploiting a variant of CVE-2025-49706. This vulnerability has been assigned CVE-2025-53770.

We have outlined mitigations and detections in our blog. Our team is working urgently to release a security update and will share more details as they become available.
by Terr_ | 2025-07-20 07:11:18+00:00
> It's my understanding that LLMs change the code to meet a goal

I assume in this case you mean a broader conventional application, of which an LLM algorithm is a smaller-but-notable piece?

LLMs themselves have no goals beyond predicting new words for a document that "fit" the older words. It may turn 2+2 into 2+2=4, but it's not actually doing math with the goal of making both sides equal.
by anilgulecha | 2025-07-20 07:11:53+00:00
Thanks. marimo is cool, but spinning up N backends for scale would not be tenable cost wise.

Currently looks like there's this very cool full-frontend notebook tool: https://github.com/gzuidhof/starboard-notebook , which can be tied to a small backend to save/load python scripts from. This is working well for edu usecases potentially with support for both js and python.
by devjab | 2025-07-20 07:12:41+00:00
I worked with C# for a decade and it's become a really great general purpose language. I'd still prefer never to work with it ever again after having worked with Go. This isn't for technical reasons at all, but because Golang is so easy to work with for "people reasons". There are brilliant parts of Go, but the only thing I find myself missing in other languages is the simplistic module isolation, where every folder is a module, every file within the folder is part of it and then you expose functions with capital letters at the beginning of their name. Holy hell did I wish Python had that. Anyway, the thing that makes Go nice to work with over time is the explicity of everything and a lot of the very opinionated decisions. With a piece of Go code I can jump in and immediately know what is going on regardless of who wrote it. With C# I'll often have to go down long "go to definition" paths. Often you will end up trying to figure out just how someone was trying to "fight" the implicit magic of the non-STL Microsoft dependencies they used. Usually because they didn't really understand what they were doing. All of these are human issues and no fault of C# or .Net as such.

Of the few technical advantages Go had for us is that we don't need a single dependency outside of the standard library, which can't live in isolation. We use SQLC and Goose, both are run in containers that only have rights and access on the development side of things.

I'm not sure I would say that Golang has a lot of weird, pointless quirks, but it has opinions and if you happen to dislike them, well... that sucks. I hate the fact that they didn't want runtime assertions as an example, so it's not like I don't understand why people dislike Go for various reasons. I've just accepted that those strong opinions is the reason Go is so productive.

The challenge for us is that it's not exactly as productive as Python. So while you'll need to do a lot of toolchain work to get Python anywhere near Go's opinionated stucture, that is often a better choice if you're not a hardcore software engineering team. At least for us, it's been much easier to get our business intelligence people to adopt UV, pyrefly, ruff and specific VSC configs for their work than to have them learn Go.

I suspect that is why Rust is also doing so well. Go is a better Java/C# for a lot of places, but are you really going to replace your Java/C# with Go if you have dacades worth? If you're not coming from Java/C# will you really pick Go over Rust? I'm not sure, but I do know, Go failed to become a Python replacement for us. It did replace our C#, but we didn't have a lot of C#. Eventually we'll likely replace our Go with C/Zig and Python to keep the language count lower.
by sandspar | 2025-07-20 07:13:16+00:00
There's crappy meat. Have you ever had cheap salmon sashimi? It's completely flavorless, with a rubbery, watery mouthfeel. Conversely have you had expensive salmon sashimi? A delicate umami flavor with a mouthfeel of liquified butter. It's not preparation. They're not the same fish.

Different subspecies of plant and animal taste different. Farmers have learned to charge more for the ones that taste better.

You wouldn't say "there's no crappy tomatoes, only crappy preparation." Nah, some tomatoes are simply junk.

Some of the best food cultures in the world - Italy, France, Japanese - lean much more heavily on ingredient quality than on preparation. Fine dining as a whole revolves around ingredients.
by fjfaase | 2025-07-20 07:13:31+00:00
In some sense VB was ahead of time with its 'automatic' event mechanism and it total transparent interproces communication based on the fact that all objects are COM objects. No need to use JSON or protobuffers when sharing an object among processes, because of the automatic marshalling that was done when calling a method on an object from another process.

Most of this got lost when VB.NET was introduced.