MurphyA/hacker-news huggingface dataset:
by lubujackson | 2025-07-08 19:55:22+00:00
Having "translated" a book of Urdu ghazals in college, I feel weirdly positioned to comment.

First, there are a ton of opinions about what it means to translate poetry, but it certain is transformative and there isn't any point in avoiding that. It becomes a series of decisions about what to retain, what to discard and even what to elevate or create.

Many people think "adding" anything is counter to the goal of translation, but what is the goal? You can read a transliteration and understand concepts, you can read various translations and triangulate meaning, you can speak the original language and grow up with the author (or be the author!) And none of it will help produce an accurate translation.

So what's the goal? To transmit some germ of the source material, to my thinking. Haikus are equally (or even moreso) impossible. What gets missed in most haiku translation is the turn of phrase, where a single word can hold two meanings in balance. Without it. A fundamental aspect of haiku is simply not there. Yet people still read translated haikus.

For me, I dropped the rhyming scheme completely. Yes, you lose musicality and the rhythm of poem. But you can better maintain the concepts and emotion and not have to fight against the boundaries of the language.
by imilk | 2025-07-08 19:56:01+00:00
> Most people here have commented that they prefer AI responses to raw search results

Strangely enough, I've seen the exact opposite response on here. Especially since the AI overviews are often plain wrong and/or misleading. Many others like myself also prefer to get information directly from 1st parties, rather than whatever sausage has been produced through the black box information meat grinder we call AI.
by ayhanfuat | 2025-07-08 19:56:11+00:00
"Vue is currently the only mainstream framework that remains independent. (i.e. not dominantly owned / backed by a single corporation" Evan You https://x.com/jpschroeder/status/1762764818254016513/photo/1

I know Nuxt is not Vue itself, and I'm not saying Vue is no longer independent — but I do think it's worth remembering that independence is something highly valued in the Vue community.
by spacemadness | 2025-07-08 19:56:33+00:00
People have been asking the executive class this for a long while now: why don’t you care about training? Their response has ever been silence or threats or that’s what school is for. Do it on your own time, after the 50+ hours we demand from you. Some places get it and had a proper pipeline to train. A vast majority do not. And now they give us this. Great bunch of folks.
by nine_k | 2025-07-08 19:56:35+00:00
All frameworks are like that. They make it simple to solve a particular class of problems, by making choices for you, and providing code that supports these choices. If your problems fit the framework's shape, it can be immensely helpful. If not, go look for another. There's nothing wrong about building a framework that matches your particular needs and tastes.

If you need a universal toolbox, no framework will do, you need composable libraries. Most large projects end up facing this, but most projects are not large.
by danielroe | 2025-07-08 19:56:52+00:00
Nuxt maintainer here.

there's lots to say here, but from my point of view, Vercel's backing Nuxt largely _because_ of our open vision.

our open approach isn't an optional extra. it's a core value we all share on the team - and indeed, I think, is as close to a core value of the web as I know.

we've pioneered cross-framework adapters and the provider pattern in all we build and there is no way we are changing direction or vision.

nuxt remains an independent framework, like svelte. the fact that a number of us on the team are employed to work full time on OSS is _great_ news for OSS sustainability.
by TrnsltLife | 2025-07-08 19:57:01+00:00
In France they teach 5 continents. Europe, Asia, Africa, America, and Australia.

I was a language learner there and explained the US 7 continent system. The South Americans in my class said we were racist for splitting North and South America. I told them as far as I knew the split was between Venezuela and Columbia, had something to do with tectonic plates, and that and North America included lots of Spanish speaking countries.

I guess they decided we weren't racist after all. At least not because of that.
by Keyframe | 2025-07-08 19:57:09+00:00
[3] https://supabase.com/.well-known/security.txt

That "What we promise:" section reads like a not so subtle threat framing, rather than a collaborative, even welcoming tone one might expect. Signaling a legal risk which is conditionally withheld rather than focusing on, I don't know, trust and collaboration would deter me personally from reaching out since I have an allergy towards "silent threats".

But, that's just like my opinion man on your remark about "XYZ did not follow our responsible disclosure processes [3] or respond to our messages to help work together on this.", so you might take another look at your guidelines there.
by PaulHoule | 2025-07-08 19:57:32+00:00
I've come around. And I used to be a serious djb cultist who used

https://cr.yp.to/daemontools.html

for any service I ran that I cared about or was responsible for (not shovelware that came with the Linux distro.) Of course I liked qmail too and used it to build something that's nearly indescribable but was kinda like a webcrawler but for email and could send and receive emails to do information gathering and dissemination tasks asynchronously over a long time.
by leakycap | 2025-07-08 19:57:39+00:00
Make personal connections by reaching out to people you want to connect with. Many emails and messages will go unanswered or even unread/unnoticed - but others will get a response.

If you spend time thinking about the topic you want to connect on with the person and add value to their life in some way while communicating clearly, you'll have something much better than 100 LinkedIn connections.
by mrsilencedogood | 2025-07-08 19:57:53+00:00
People who try to enforce this stuff via license fundamentally misunderstand the nature of copyright law.

Do you plan to sue people to enforce your license? Do you think people who are committing war crimes / crimes against humanity are going to not violate your license alongside all their other crimes?

The only thing this license accomplishes is ensuring no even semi-serious business will touch this with a 10' pole because it's a completely bespoke license with no prior understanding by their legal counsel. But you can already basically do that via the AGPL, except that some companies who are well-meaning may actually still use it.
by tptacek | 2025-07-08 19:58:04+00:00
Hold on. I feel like the premise running through all this discussion is that there is one single LLM context at play when "using an LLM to interrogate a database of user-generated tickets". But that's not true at all; sophisticated agents use many cooperating contexts. A context is literally just an array of strings! The code that connects those contexts, which is not at all stochastic (it's just normal code), enforces invariants.

This isn't any different from how this would work in a web app. You could get a lot done quickly just by shoving user data into an eval(). Most of the time, that's fine! But since about 2003, nobody would ever do that.

To me, this attack is pretty close to self-XSS in the hierarchy of insidiousness.
by achierius | 2025-07-08 19:58:07+00:00
The hard part here is that normally we separate 'code' and 'text' through semantic markers, and those semantic markers are computably simple enough that you can do something like sanitizing your inputs by throwing the right number of ["'\] characters into the mix.

English is unspecified and uncomputable. There is no such thing as 'code' vs. 'configuration' vs. 'descriptions' vs. ..., and moreover no way to "escape" text to ensure it's not 'code'.
by 12_throw_away | 2025-07-08 19:58:17+00:00
> And I'm so confused at why anyone seems to phrase prompt engineering as any kind of mitigation at all.

Honestly, I kind of hope that this "mitigation" was suggested by someone's copilot or cursor or whatever, rather than an actual paid software engineer.

Edited to add: on reflection, I've worked with many human well-paid engineers who would consider this a solution.
by ollien | 2025-07-08 19:58:27+00:00
> It is also crazy to point that command at a production database and do random stuff with it

In a REPL, the output is printed. In a LLM interface w/ MCP, the output is, for all intents and purposes, evaluated. These are pretty fundamentally different; you're not doing "random" stuff with a REPL, you're evaluating a command and _only_ printing the output. This would be like someone copying the output from their SQL query back into the prompt, which is of course a bad idea.
by vkazanov | 2025-07-08 19:58:37+00:00
Why do you think ml is on the worse side of the principle when compared to java?

Sml is a superpolished language, very well-defined formally, being a culmination of years of design effort and uniting a family of academia-born languages. It took 40 years of research to release the final version in 1997.

Java is on the industry side of thing: semi-formalized, numerous omissions when created, a bunch of ad hoc ideas, released in 1995. Not sure it took more than 3-4 years to get the first official version out.
by dlcarrier | 2025-07-08 20:00:08+00:00
Electrically, regenerative breaking just runs the motor driver in reverse (or really, out of phase) and it doesn't take any extra components, only requiring a few instructions in the motor drivers firmware. It's not anything a DIYer has to even know exists, let alone mess with.

Driver assist has nothing to do with what type of fuel and powerplant a vehicle has, and those features can be broken by DIYers on any vehicle type. Sometimes being able to disable them is a built-in necessity for safety, for example when driving on gravel roads where they tend to do more harm than good.
by rurp | 2025-07-08 20:00:16+00:00
If true, that's pathetic on Apple's part. The unreliability of LLMs was maybe the biggest topic in the entire tech industry around that time. To be ignorant of that basic fact would be an incredibly bad look.

I have no insider knowledge but to me on the outside it looks like the same old panicky hype-chasing we've all seen in other contexts. Some executives kept reading and hearing about AI AI AI!, and were terrified of being left behind. The many voices of reason within the company pointing out the correct risks and tradeoffs to consider were ignored while the over-confident voices blustered their way onto the roadmap.
by DamnInteresting | 2025-07-08 20:00:25+00:00
It's far from a fortune, and its future is uncertain, but I've been earning a bit via donations with my writing/podcasting for almost 20 years now: https://www.damninteresting.com

I'm also working on diversifying, starting with a free daily word game that I hope gets a little traction on Patreon: https://omiword.com

I have a few other projects-in-progress, if I'm lucky, one will earn a dollar or two.
by TeMPOraL | 2025-07-08 20:00:28+00:00
This is why I believe that anthropomorphizing LLMs, at least with respect to cognition, is actually a good way of thinking about them.

There's a lot of surprise expressed in comments here, as is in the discussion on-line in general. Also a lot of "if only they just did/didn't...". But neither the problem nor the inadequacy of proposed solutions should be surprising; they're fundamental consequences of LLMs being general systems, and the easiest way to get a good intuition for them starts with realizing that... humans exhibit those exact same problems, for the same reasons.
by GuB-42 | 2025-07-08 20:00:33+00:00
I am not talking about website compatibility, in fact, for as far as I can tell, I had no problem with Google services using Firefox. Some degradation maybe, but not enough for me to notice.

To give your an example, here is the bug that made me switch to Chrome: https://bugzilla.mozilla.org/show_bug.cgi?id=791429

May seem trivial, but that's with bugs like these that you lose users. I wanted my mouse to zoom, my mouse didn't zoom on Firefox (and only on Firefox), I tried Chrome, it worked, found no (technical) downside, it was faster, so I stayed with Chrome. I continued using Firefox on another PC, and I saw a lot more crashes, slowdowns, etc... on Firefox, also, a single tab could crash the entire browser (it was before Electrolysis and Quantum). Website incompatibility wasn't actually that much of a problem, it mostly affected corporate intranets, which were equal part Chrome-only and IE-only during that time.

Things have improved on the Firefox side (Quantum!), and I don't use that mouse anymore, so I am back on Firefox for most part, the ad-blocking thing pushed me back, hoping that they don't to anything crazy to push me away like they did before.
by refulgentis | 2025-07-08 20:00:49+00:00
> but it's not obvious to me the way to solve it

It reduces down to untrusted input with a confused deputy.

Thus, I'd play with the argument it is obvious.

Those are both well-trodden and well-understood scenarios, before LLMs were a speck of a gleam in a researcher's eye.

I believe that leaves us with exactly 3 concrete solutions:

#1) Users don't provide both private read and public write tools in the same call - IIRC that's simonw's prescription & also why he points out these scenarios.

#2) We have a non-confusable deputy, i.e. omniscient. (I don't think this achievable, ever, either with humans or silicon)

#3) We use two deputies, one of which only has tools that are private read, another that are public write (this is the approach behind e.g. Google's CAMEL, but I'm oversimplifying. IIRC Camel is more the general observation that N-deputies is the only way out of this that doesn't involve just saying PEBKAC, i.e. #1)
by rpaddock | 2025-07-08 20:01:04+00:00
I don't know about my feet. They did take away my shoes to be scanned, which took ~15 minutes. Just normal shoes from a shoe store.

I regularly set off the scanner for no apparent reason and get pulled aside to have a Wand run over me, which finds nothing.

On international travel I get frisked every time I have to show my passport.
by strcat | 2025-07-08 20:01:17+00:00
Fairphone no secure element, no hardware memory tagging and lack the expected security patches. It's missing some of the other features too. Our list is about hardware requirements and firmware/driver requirements, not the AOSP portion of the OS.

> The "Complete monthly Android Security Bulletin patches without any regular delays longer than a week for device support code (firmware, drivers and HALs)" part isn't even true for Pixels.

That's not correct. Pixels also ship the monthly, quarterly and yearly OS updates rather than the Android Security Bulletin backports to older releases. Android Security Bulletins are backports of High and Critical severity patches to the initial yearly releases from the past several years. Stock Pixel OS and AOSP have a new release each month and often ship those patches before they're backporting.

Android Security Bulletins also include a small subset of SoC vendor patches, but the remaining SoC vendor patches and other hardware component patches also need to be provided as part of meeting our requirements.
by mxfh | 2025-07-08 20:01:25+00:00
What do you mean? Lossless animations with a soundtrack or some embeded video?

This is 570k and runs in a webassembly runtime:

https://archive.org/details/flash_badger

SVG could do that too. Minimal javascript plus audio tags.

http://xn--dahlstrm-t4a.net/svg/audio/html5-audio-in-svg.svg
by rhavaeis | 2025-07-08 20:01:26+00:00
CEO of General Analysis here (The company mentioned in this blogpost)

First, I want to mention that this is a general issue with any MCPs. I think the fixes Supabase has suggested are not going to work. Their proposed fixes miss the point because effective security must live above the MCP layer, not inside it.

The core issue that needs addressing here is distinguishing between data and instructions. A system needs to be able to know the origins of an instruction. Every tool call should carry metadata identifying its source. For example, an EXECUTE SQL request originating from your database engine should be flagged (and blocked) since an instruction should come from the user not the data.

We can borrow permission models from traditional cybersecurity—where every action is scoped by its permission context. I think this is the most promising solution.
by lunw | 2025-07-08 20:01:27+00:00
Co-founder of General Analysis here. Technically this is not a responsibility of Supabase MCP - this vulnerability is a combination of:

1. Unsanitized data included in agent context

2. Foundation models being unable to distinguish instructions and data

3. Bad access scoping (cursor having too much access)

This vulnerability can be found almost everywhere in common MCP use patterns.

We are working on guardrails for MCP tool users and tool builders to properly defend against these attacks.
by strickjb9 | 2025-07-08 20:01:39+00:00
I'm baffled by the doom-and-gloom reactions here. Nuxt remains what it's always been: the best convention-over-configuration framework in existence. It's built on Vue which is opinionated as hell, and you get all the benefits of that. The "vendor lock-in" concerns are frankly overblown. At the end of the day Nuxt produces artifacts you can deploy anywhere - AWS, Cloudflare, your own infrastructure, or yes, Vercel. The alternatives (underfunded OSS maintainers burning out) are way worse than having a well-funded team with aligned incentives. If anything this validates that Nuxt is valuable enough for a major platform company to invest in. I'll take that over watching great tools die from lack of resources.
by MrDresden | 2025-07-08 20:01:42+00:00
I thoroughly disagree. The EU and it's many organizations, does not know how to operate a long running software development project.

What the union should do instead is to create a funding structure that had as it's mission to identify and financially support groups that develop open source software which is critical to both the people and companies that are based in the EU. Make it a requirement that the software be accessible, free and open source.
by stouset | 2025-07-08 20:02:12+00:00
The mocking thing actually touches on another point of frustration for me. I think the design of Rails ends up causing people to reach for mocking way too often in order to test things. At a glance I think Brut should avoid a lot of this by having things just be plain old Ruby objects.

I have dealt with countless Rails projects where testing things conventionally was difficult or impossible so mocks/stubs had to be used everywhere (controllers are the worst offenders here). When you start digging in to what's actually being tested, you find that the tests express little more than "this method is written the way it's currently written" rather than actually testing behavior.

Good tests should do three important things: catch bugs early in development, prevent regressions, and allow refactoring. Overly-mocked tests not only end up doing none of these but often actively work against these goals. They can't catch bugs because they reaffirm the current implementation rather than testing behavior. They can't catch regressions because any change to the code necessitates a change to the test. And they actively inhibit refactoring for both of those reasons.

All that is to say that maybe having a less-convenient mocking system is maybe a good thing :)

Also, since you're here, I want to say it also looks like your design encourages avoiding one of my other huge issues with Rails. I hate that ActiveRecord conflates the ORM layer with domain logic. This causes an antipattern where consumers of records (usually controller methods) pierce all the way down into the database layer by using AR methods and attributes directly. While convenient, this makes doing database-layer changes excruciating since your table layout is implicitly depended upon by pieces everywhere throughout the stack.

Better is to do what it looks like you suggest here: there should be an ORM layer that just exposes the database structure, and then you should layer domain objects on top of that which expose higher-level methods for interacting with persisted objects. If you change the database, you only need to change the mid-level layer. None of its consumers need to care that the underlying table layout changed.

From what I can tell so far I am very excited about Brut.
by Macha | 2025-07-08 20:04:03+00:00
Honestly having occasionally glimpsed the logged out YouTube page which appears to do this... I'm glad that I don't have to deal with that either.

As for what they should do, I think populating the homepage from the subscriptions list (either literally as an ordered list or by some algorithmic "watch time vs average watch time for this creator", I don't care) would be preferable.
by losvedir | 2025-07-08 20:04:09+00:00
I've been uneasy with the framing of the "lethal trifecta":

* Access to your private data

* Exposure to untrusted input

* Ability to exfiltrate the data

In particular, why is it scoped to "exfiltration"? I feel like the third point should be stronger. An attacker causing an agent to make a malicious write would be just as bad. They could cause data loss, corruption, or even things like giving admin permissions to the attacker.
by ryao | 2025-07-08 20:04:11+00:00
That was a huge gift to AMD since it let them use TSMC as for fabrication instead, and they gained a process node advantage over Intel for the first time in history.

My guess is that the guys in Abu Dhabi did not want to do the investments needed to bring 7nm into production. They lost a huge opportunity because of that. At the time, it probably looked like the right financial decision to them, even though practically everyone affected downstream thought it was myopic.
by const_cast | 2025-07-08 20:04:54+00:00
It's not that learning JS is hard, it's that JS is a very unsafe and unergonomic language. Which is why we have TS... but TS has other problems. People want to use C# or what have you because these are languages that are simply better to develop large applications in. JS, like most dynamically typed scripting languages, becomes more and more of a liability as application size grows.
by tptacek | 2025-07-08 20:04:59+00:00
Yes. "Writing tools to parse the output" is the work, like in any application connecting untrusted data to trusted code.

I think people maybe are getting hung up on the idea that you can neutralize HTML content with output filtering and then safely handle it, and you can't do that with LLM inputs. But I'm not talking about simply rendering a string; I'm talking about passing a string to eval().

The equivalent, then, in an LLM application, isn't output-filtering to neutralize the data; it's passing the untrusted data to a different LLM context that doesn't have tool call access, and then postprocessing that with code that enforces simple invariants.
by davetron5000 | 2025-07-08 20:05:17+00:00
I didn't come up with the license. You can read about it here: https://firstdonoharm.dev/

I didn't want the code to be All Rights Reserved, so I chose the best license I could find that communicates my desires - I assume that's what most people do when choosing a license?

I'm OK if a "semi serious business" don't want to use my software.