MurphyA/hacker-news huggingface dataset:
by sim7c00 | 2025-07-24 16:22:37+00:00
depending on what you run one method might have more success than another. protections for malicious scripts vs. modified binaries are often different tools or different components of the same tool that can have varying degrees of success.

you could also use the script to fingerprint and beacon to check if the target is worth it and what you might want to inject into said binary if thats your pick.

still i think i agree, if you gonna trust a binary from that server or a scripts its potato potato...

check what you run before you run it with whatever tools or skills u got and hope for the best.

if you go deepest into this rabbithole, you cant trust your hard disk or network card etc. so its then at some point just impossible to do anyhting. microcode patches, malicious firmwares, whatever.

for pragmatic reasons line needs to be drawn. if your paranoid good luck and dont learn too much about cybersecurity, or you will need to build your own computer :p
by syarb | 2025-07-24 16:23:05+00:00
This project is so cool! Congrats Aaed.

Breaking Taps on YouTube did a really awesome video on a somewhat similar mechanism (I'm no mechanical engineer haha, it was new to me!), rolling contact joints. I love the idea of using string/ropes. Worth checking out as well if this kind of stuff interests you! https://www.youtube.com/watch?v=TQiLLcumqDw
by const_cast | 2025-07-24 16:23:15+00:00
But large cars are not cheap - they're significantly more expensive than the small cars available on the market.

Consumers aren't buying trucks because they're incentivized with money - because the truck is double the cost. Theyre buying trucks because they want them.

Does that make American consumers stupid? Yeah probably.

Id sooner blame marketing and advertising than regulations and tax codes. The reality is that when these gas guzzlers are priced outrageously, Americans still want them.
by gchamonlive | 2025-07-24 16:23:34+00:00
> Why would those be region locked

They don't need to be. In Brazil we don't have Pixel phones whatsoever in the market, so cases and screen protectors are just unavailable as well. Why would stores have wares that people won't buy? I'd have to stock a supply for the lifetime of the device.

> What feature?

Google services

> Samsung can only offer buggy pre installed ad and spyware

The only app I use is the camera and gallery app and they are fine. Do you have any references for the spyware claim?

A software whose focus isn't privacy isn't necessarily spyware. This is a false dichotomy.
by Hilift | 2025-07-24 16:23:36+00:00
> what is Meta doing to get around Apple's iOS privacy protections?

Money always finds a way. Everyone thought the changes made a few years ago would hurt Meta but they make $70 billion net profit. At a minimum, they only need a good relationship with advertisers, and a (sort of measurable) increase from a campaign. Also ads are different now. One address may see the same five seconds of an ad hundreds of times. That is a much easier ecosystem to correlate targets through data enrichment.
by Jtsummers | 2025-07-24 16:23:46+00:00
> Most static type systems that I know of disappear at runtime. You literally cannot "use" them once deployed to production.

That's part of the point of being static. If we can statically determine properties of the system and use that information in the derived machine code (or byte code or whatever), then we may be able to discard that information at runtime (though there are reasons not to discard it).

> Following OP's example, what prevents you from getting a AccountID parsed as a UserID at runtime, in production? In production it's all UUIDs, undistinguishable from one another.

If you're receiving information from the outside and converting it into data in your system you have to parse and validate it. If the UUID does not correspond to a UserID in your database or whatever, then the attempted conversion should fail. You'd have a guard like this:

if user_db.contains(UserID(uuid)) { return UserID(uuid) } // signal an error or return a None, zero value, null, etc.
by rafram | 2025-07-24 16:24:16+00:00
The US already has the highest incarceration rate of any developed country, and it's not even close (we're #5, slotting in right behind Turkmenistan). Your solution to society's ills seems to be more "punishment." Do you think the wrong people are in jail? Or is there something unique to American society makes us have more people deserving of imprisonment than almost any other country in the world?
by ben_w | 2025-07-24 16:24:29+00:00
> You can't really compare the two.

You think one of them is magic?

If not, you're being needlessly pedantic as well as wrong.

> But unlike surgery, code is testable.

Surgeries are tested. Practice sessions are made. Animal tests for the general idea, cadavers to learn about humans, models for specific patients.

And code is, sadly, often pushed live without testing. Kills people, even.
by 9rx | 2025-07-24 16:25:28+00:00
> Word-of-mouth.

If that worked, why would anyone give up their business to VCs ever? Having VCs is not a fun place to be. It is a horrible situation to find yourself in (unless you are the VC, I suppose).

There was a time where you could rely on word-of-mouth, but those days are behind us. Everyone and their brother is vying for word-of-mouth attention nowadays. The noise is too great. It takes vast resources to emit a usable signal.
by hiq | 2025-07-24 16:25:53+00:00
Good advice!

I'm on stable like 3/4 of the time, until there's some newer package version I want and that happens to be in testing, at which point I switch (using the codename as you suggest instead of Testing). If I don't have a specific need, I tend to switch during the soft or hard freeze, out of curiosity, because I never had problems doing that.
by weinzierl | 2025-07-24 16:26:15+00:00
"What's happening here, as happens so often in other situations, is that a term of art was created to describe something complicated; [..] Later, people uninvolved with the popularization of the term took the term and tried to define it from first principles, arriving at a place different than the term of art."

Happens all the time in math and physics but having centuries of experience with this issue we usually just slap the name of a person on the name of the concept. That is why we have Gaussian Curvature and Riemann Integrals. Maybe we should speak of Jung Memory Safety too.

Thinking about it, the opposite also happens. In the early 19th century "group" had a specific meaning, today it has a much broader meaning with the original meaning preserved under the term "Galois Group".

Or even simpler: For the longest time seconds were defined as fraction of a day and varied in length. Now we have a precise and constant definition and still call them seconds and not ISO seconds.
by card_zero | 2025-07-24 16:26:24+00:00
Drawing too. ...take pains and pleasure in constantly copying the best things which you can find done by the hand of great masters. [...] take care to select the best one [...] If you follow the course of one man through constant practice, your intelligence would have to be crude indeed for you not to get some nourishment from it. Then you will find, if nature has granted you any imagination at all, that you will eventually acquire a style individual to yourself, and it cannot help being good; because your hand and your mind, being always accustomed to gather flowers, would ill know how to pluck thorns. --Cennino Cennini, about 1400.
by thewebguyd | 2025-07-24 16:26:32+00:00
This is why its so upsetting over in Linux land how so many people are just itching to move away from distro package managers and package maintainers. Curl | bash is everywhere now because "packaging is hard" and devs can't be arsed to actually package their software for the OS they developed it for.

Like, yeah I get it - it's frustrating when xyz software you want isn't in the repos, but (assuming it's open source) you're also welcome to package it up for your distro yourself. We already learned lessons from Windows where installers and "uninstallers" don't respect you or your filesystem. Package managers solved this problem many, many years ago.
by sorcerer-mar | 2025-07-24 16:26:55+00:00
Not true, there’s been a huge jump in deportation of people with no criminal record. You’re right though there has been only a marginal increase in deportations specifically of criminals.

https://www.cato.org/blog/65-people-taken-ice-had-no-convict...

The effective tariff rate on American consumers is above 20%…

https://budgetlab.yale.edu/research/state-us-tariffs-july-23...

Just because there can be MORE deportations and MORE tariffs doesn’t mean he’s not doing them lol. You’ve done a fine job of revealing your motivated reasoning anyhow. Clearly one shouldn’t take your predictions on NWS seriously.
by marssaxman | 2025-07-24 16:27:16+00:00
What do you mean by "decline in public safety"? The violent crime rate has dropped to around half what it was in the '90s:

https://www.brennancenter.org/our-work/research-reports/us-c...

Property crime is down similarly.

I understand that some people feel so afraid of homeless people or street addicts that they assume they must be in danger whenever they witness such poverty, but crime statistics do not support this opinion.
by WorldMaker | 2025-07-24 16:27:36+00:00
> It's shocking to me that Microsoft aren't heavily involved with the project considering it's one of the fundamental frameworks for releasing software on Windows.

The history of WiX is that it started internally at Microsoft. IIRC it was a project under the Office organization originally. It's generally considered the first big open source success of Microsoft in spinning a project out to open source community ownership and paved the way for almost every later open source project at Microsoft.

I've got a feeling Microsoft doesn't want to support it anymore because they see it as completely legacy today. WiX is one of the better/cheaper/harder ways to build an old school MSI file. MSI installers are an ancient archive format (the old CAB format) wrapping an ancient and dying DB format (the old JET database engine) and a lot of the complexity of the WiX toolkit is just a reflection of the complex legacy of the old terrible MSI output format. Today Microsoft suggests using MSIX which looks a lot more directly like the better/simpler input to a (well crafted greenfield) WiX project, it's a plain ZIP file with XML metadata.
by programmertote | 2025-07-24 16:27:45+00:00
Spouse of an oncology trainee here. This is an accurate statement. But whenever you mention similar thing on public forums like HN or Reddit, you get downvoted. I have a feeling that a lot of pre-meds, current medical residents and doctors (and their families) hang out in those forums and downvote everything that is stating the truth.

My wife is going to make $400K+ minimum (if she does more than one day per week on-call, she will make easily $500K/year; on-call for oncology aren't difficult btw) when she's done with the fellowship. We both came from Burma (Myanmar), and she told me how unnecessarily expensive everything with medicine in the US is (including the number of years required to train to become a generic/internal medicine doctor in the US).

She is also unhappy with the fact that doctors are acting as unnecessary gatekeeper for a lot of medicines that are fairly safe to use (and are available for over-the-counter purchase in other countries like India and Burma). We have a lot of doctor friends in the US, so we know the "industry" very well. Doctors (along with pharma and insurance companies) are at least somewhat complicit in the ever-increasing prices in the US. AMA (American Medical Association) spent $24M+ in 2024 for lobbying [ https://www.opensecrets.org/federal-lobbying/clients/summary... ] while pharma spent 30-40x more in lobbying [ https://www.opensecrets.org/news/reports/layers-of-lobbying ].

Side note: yesterday, my wife's department (a fairly large hospital in LA metro area) was treated with steaks by pharma reps from cancer medicine company. A lot of doctors, residents and fellows were delighted with that meal to say the least. I have been to expensive (Wagyu-beef expensive) hot pot dinner hosted by another pharmacy company when my wife was just an intern at a private clinic.
by Fraterkes | 2025-07-24 16:27:48+00:00
There's people working in Dubai who make very little money, have crowded, cramped, hot living quarters, will be jailed if they try to start a union, and have to do dangerous construction work in one of the hottest places on earth. When they die, their employers don't care. If one of these people described Dubai as "hell on earth", would you tell them they were being hyperbolic?
by tialaramex | 2025-07-24 16:28:13+00:00
> disallowing anything that might be a potential thread safety issue will give you a pretty limited language.

Safe Rust doesn't seem that limited to me.

I don't think any of the C# work I do wouldn't be possible in Rust, if we disregard the fact that the rest of the team don't know Rust.

Most of the programs you eliminate when you have these "onerous" requirements like memory safety are nonsense, they either sometimes didn't work or had weird bugs that would be difficult to understand and fix - sometimes they also had scary security implications like remote code execution. We're better off without them IMNSHO.
by jmyeet | 2025-07-24 16:29:09+00:00
I really don't understand HN's love affair with nuclear.

Uranium mining produces significant toxic waste (tailings and raffinates). Fuel processing produces toxic waste, typically UF6. There is some processing of UF6 to UF4 but that doesn't solve the problem and it's not economic anyway. Fuel usage produces even more waste that typically needs to be actively cooled for years or decades before it can be forgotten about in a cave (as nuclear advocates argue).

And then who is going to operate the plant? This administration in particular is pushing for further nuclear deregulation, which is terrifying. You want to see what happens without regulation? Elon Musk's gas turbines in South Memphis with no Clean Air permits that are spewing pollution [1].

That's terrifying because the failure modes for a single nuclear incident are orders of magnitude worse than any other form of power plant. The cleanup from Fukushima requires technologies that don't exist yet, will take decades or centuries and will likely cost ~$1 trillion once its over, if it ever is [2].

And who's going to pay for that? It's not going to be the private operator. In fact, in the US there's laws that limit liability for nuclear accidents. The industry's self-insurance fund would be exhausted many times over by a single Fukushima incident.

And then we get to the hand waving about Chernobyl, Fukushima and Three Mise Island. "Those are old designs", "the new designs are immune to catastrophic failure" or, my favorite, "Chernobyl was because of mismanagement in the USSR" like there wouldn't be corner-cutting by any private operator in the US.

And let's just gloss over the fact that we've built fewer than 700 nuclear power plants, yet had 3 major incidents, 2 of them (Chernobyl and Fukushima) have had massive negative impacts. The Chernobyl absolute exclusion zone is still 1000 square miles. But anything negative is an outlier that should be ignored, apparently.

And then we get to the impact of carbon emissions in climate change but now we're comparing the entire fossil fuel power industry vs one nuclear plant. It's also a false dichotomy. The future is hydro and solar.

and then we get to the massive boondoggle of nuclear fusion, which I'm not convinced will ever be commercially viable. Energy loss and container destruction from fast neutrons is a fundamental problem that stars don't have because they have gravity and are incredibly large.

I have no idea where this blind faith in nuclear comes from.

[1]: https://www.politico.com/news/2025/05/06/elon-musk-xai-memph...

[2]: https://cleantechnica.com/2019/04/16/fukushimas-final-costs-...
by Leftium | 2025-07-24 16:29:35+00:00
My app also shows yesterday's weather: https://weather-sense.leftium.com

- It uses open-meteo's API. Before open-meteo, I tried with OpenWeatherMap's API.

- However, besides requiring an additional call for each previous day's data, OpenWeatherMap's One Call API only supported local time zones for current and forecast data. So depending on the timezone and time, there could be a big gap in the data that needed to be filled with timezone math (and extra API calls. The original DarkSky One Call API did not have this issue.)
by softwaredoug | 2025-07-24 16:29:45+00:00
There are different groups with vested interests that color a lot of AI discourse

You have Tech CEOs that want work done cheaper and AI companies willing to sell it to them. They will give you crazy alarming narratives around AI replacing all developers, etc.

Then you have tech employees who want to believe they’re irreplaceable. It’s easy to want to keep working how we’ve always worked with hope of getting back to pre 2022 levels of software hiring and income. AI stands in the way of that.

I don’t think people are doing this intentionally all the time. But there is so much money and social stature from all these groups on the line, there are very few able to give a neutral, disinterested perspective on a topic like AI coding.

And to add to that, reasoned, boring, thoughtful middle of the road takes are just naturally going to get fewer eyeballs than extreme points of view.
by petesergeant | 2025-07-24 16:30:00+00:00
> I know what a UUID (or a String) is. I don't know what an AccountID, UserID, etc. is. Now I need to know what those are (and how to make them, etc. as well) to use your software.

Yes, that’s exactly the point. If you don’t know how to acquire an AccountID you shouldn’t just be passing a random string or UUID into a function that accepts an AccountID hoping it’ll work, you should have acquired it from a source that gives out AccountIDs!
by aggie | 2025-07-24 16:30:46+00:00
The value of AI is easy to see personally, concretely. But there is always a gap between concrete value in your hands and how that plays out in larger systems. The ability to work remotely could intuitively project to outsourcing of almost all knowledge work to cheaper labor markets, and yet that has only happened at the margins. The world is complex and complicated, reserve a measure of doubt.
by throwaway20174 | 2025-07-24 16:30:50+00:00
AI more of a force muliplier than a replacement. If you rated programmers from 0 to 100. AI can take you from 0 to 80, but can't take you from 98 to 99.

I'd love to record these AI CEOs statements about what's going to happen in the next 24 months and look back at that time -- see how "transformed" the world is then.
by palmfacehn | 2025-07-24 16:31:06+00:00
You seem to have projected a fear or intent into the comment which wasn't intended or explicitly described. I mostly agree in that taste is subjective, "There's no accounting for taste". Personally, I find those things unappetizing. As I said above, this is my bias. You asked for an example of something which I would regard as a highly processed food. I provided one. I cannot satisfy your other inquiries.

Although I will say that I have suspicions around the industrial processes for food additives and dyes. Yellow 6 for example is petroleum or coal tar derived. I'm sure the relevant regulatory bodies have approved these things, but I am not convinced that it is something I would like to consume personally.

Perhaps the burden should be on the manufacturer? I'm not sure where the discussion would lead if I had to rationalize every industrial by-product I preferred not to eat?

Again, there's no accounting for taste.
by alphazard | 2025-07-24 16:31:13+00:00
This is a little misleading. Go will automatically convert a numeric literal (which is a compile time idea not represented at runtime) into the type of the variable it is being assigned to.

Go will not automatically cast a variable of one type to another. That still has to be done explicitly.

func main() { var x int64 = 1 Func(SpecialInt64(x)) // this will work Func(x) // this will not work } type SpecialInt64 int64 func Func(x SpecialInt64) { }

https://go.dev/play/p/4eNQOJSmGqD
by scop | 2025-07-24 16:31:36+00:00
His in ring performance will always give me goosebumps, every time. I’ve seen him start puffing his cheeks, shaking his head, no-selling punches, and finger pointing a million and every…single…time it gets me excited and pumped. And all for a silly leg drop at the end. Goes to show that the story can communicate so much more than the moves.

What a an amazing talent and performer.
by steveBK123 | 2025-07-24 16:31:50+00:00
Very interesting. I had considered the Genesis sub-brand if only for the separate dealers, though there are much fewer of them.

On the plus side a lot of the Genesis vehicles seem like they slap every option the Germans make you pay $1000s each for into the base model, so decent value from that perspective.

I've sat in their EV hatch thing the GV60 in showroom and was impressed by the base features set. I also had a decent length uber ride sitting in the back of their ICE sedan, either the G80 or G90 and it was a nice executive sedan. My backseat reclined, it had motorized shades, the air vents in the back were actually powerful, etc.
by pyman | 2025-07-24 16:32:00+00:00
Sorry, I commented on the wrong article. I meant to post this under:

https://alignment.anthropic.com/2025/subliminal-learning/

Regarding your comment, yes, it's well known in the ML world that machines are way better than humans at picking up on correlations. In other words, the output of a model can carry traces of its internal state, so if another model is trained on those outputs, it can end up learning the patterns behind them.

What's contradictory is hearing companies say: "We wrote the software, but we don't fully understand what it's doing once it's trained on trillions of tokens. The complexity is so high that weird behaviours emerge."

And yet, at the same time, they're offering an API to developers, startups, and enterprise customers as if it's totally safe and reliable while openly admitting they don't fully know what's going on under the hood.

Question:

Why did Anthropic made its API publicly available? to share responsibility and distribute the ethical risk with developers, startups, and enterprise customers, hoping that widespread use would eventually normalise training models on copyrighted materials and influence legal systems over time?

Why are they saying "we don't know what's going on, but here's our API"? It's like Boeing saying: "Our autopilot's been acting up in unpredictable ways lately, but don't worry, your flight's on time. Please proceed to the gate.”

So many red flags.
by harmmonica | 2025-07-24 16:32:09+00:00
Sorry to focus on the greedy developers comment, but one thing I'd ask you to consider is that sometimes you need some greedy developers to balance things out a bit. The US has gotten so bad at building housing supply to meet the demand that prices have obviously gotten out of whack. The past several years in Austin, TX, though, as an example, have shown that unshackling some greedy developers to come in and build is actually good for the masses because it leads to reduced rents/prices. That's not the entire story in Austin, but it is a major reason prices have come down.

I feel like we've been out of balance for so long (decades and decades and decades) that it might be a good idea to swing the pendulum back to the greedy developers so that rents/prices become more affordable. Disclosure: I guess I'm sort of a greedy developer albeit at a tiny scale.
by const_cast | 2025-07-24 16:32:10+00:00
It's more complicated than this, because muscle raises your basal metabolic rate.

If you look at bodybuilders, they're buring 400 calories a day, regardless of exercise. Having an extra 100 pounds of muscle means your body just burns A LOT of calories doing absolutely nothing.

This is part of the reason why men burn more calories than woman just right out of the gate.