MurphyA/hacker-news huggingface dataset:
by tetha | 2025-07-23 11:47:19+00:00
Since the Github issue is turning into an unusable mess and I am currently experiencing emotions I don't have to unleash here...

There is an interesting comment by one of the older maintainers of stylus, Panya [1]. Taking this at face value, they claim to have published some malicious packages for research purposes about dependency confusion [2] (their link). This also fits with the comments of a few people claiming to be security researchers, [3] and [4], which at least say the same and point to three malicious packages published by Panya.

Based off of that, my own personal interpretation and simplest thesis is that Panya released some packages with questionable code. This triggered some security mechanism in npm and that system yanked packages they were a contributor of [5], because the account looked compromised or otherwise malicious. And then pipelines went red.

If this was an actual malicious act, or curiosity about security and security responses getting a fairly nuclear security response, I don't know. You need to apply your own security reasoning to this -- if you even want to trust this comment :)

I just wanted to collect the interesting comments in a place, because that ticket is getting impossible to navigate.

1: https://github.com/stylus/stylus/issues/2938#issuecomment-31...

2: https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...

3: https://github.com/stylus/stylus/issues/2938#issuecomment-31...

4: https://github.com/stylus/stylus/issues/2938#issuecomment-31...

5: https://github.com/stylus/stylus/issues/2938#issuecomment-31...

5, also: https://github.com/stylus/stylus/issues/2938#issuecomment-31... (thanks to the sibling comment, I couldn't find that anymore)
by j45 | 2025-07-23 11:47:23+00:00
Myself included, JIRA is used far too much out of the box and few people ever learn what it can actually do.

Out of the box it is pretty generic. When I learned what it could actually do, it revealed itself as a sponge that can uniquely absorb complexity. Having someone familiar with JIRA show the ropes went a long way.

Some of these new development tools are pretty nice though. Variety is good, especially with the changes from Pivotal Tracker, etc going away.
by mpeg | 2025-07-23 11:47:38+00:00
IMHO, the biggest impact LLMs have had in my day to day has not been agentic coding. For example, meeting summarisers are great, it means I sometimes can skip a call or join while doing other things and I still get a list of bullet points afterwards.

I can point at a huge doc for some API and get the important things right away, or ask questions of it. I can get it to review PRs so I can quickly get the gist of the changes before digging into the code myself.

For coding, I don't find agents boost my productivity that much where I was already productive. However, they definitely allow me to do things I was unable to before (or would have taken very long as I wasn't an expert) – for example my type signatures have improved massively, in places where normally I would have been lazy and typed as any I now ask claude to come up with some proper types.

I've had it write code for things that I'm not great at, like geometry, or dataviz. But these are not necessarily increasing my productivity, they reduce my reliance on libraries and such, but they might actually make me less productive.
by Rygian | 2025-07-23 11:48:41+00:00
If I had to greenlight such a UI, here's my list of non-negotiables:

- Each human user has to use their own dedicated account.

- Every query leaves a trail that can't be tampered with.

- If the database contains sensitive data (personal info, payment data, ...) then the database provides a snapshot guarantee, so that we can inspect whose personal data/payment data were leaked by query X executed at instant T by a bad actor.

- List of humans who can access the feature is vetted regularly.

- Any access that can modify the data in database requires at least two separate humans to agree on the query before it can run.

- Any query that can hamper application throughput is either forbidden, happens on a replica database, or requires at least two separate humans to agree before it can run.
by wbnns | 2025-07-23 11:48:56+00:00
> Some type of crypto bounty site

It's a hard problem to solve, especially for decentralized ones -- who attests that the job is complete, who releases the funds, how do disputes work

And like all two-sided marketplaces, quality is a trap: great bounties attract noise; noise burns out funders; and without strong filtering (managed by whom w/ what kinds of incentives), things degrade fast

But yeah, wish there were more solid options. It's an interesting space and there's a lot of opportunity for people who can get it right.
by rs186 | 2025-07-23 11:49:36+00:00
Imagine an intern did the same thing, and you say "we just need better instructions".

No! The intern needs to actually understand what they are doing. It is not just one more sentence "by the way, if this fails, check ...", because you can never enumerate all the possible situations (and you shouldn't even try), but instead you need to figure out why as soon as possible.
by mike_hearn | 2025-07-23 11:49:54+00:00
Where do you live? Rain and dry has not become more intense in most parts of the world, so local climate change of that sort isn't driven by CO2. For example, in the UK rainfall levels haven't changed since recordings began, there's no increase in outlier events either.

A doubling of crop failure rates in just 20 years is definitely not something that should be immediately blamed on global climate change. It's possible there's some local climate change for non-CO2 reasons. In 20 years there's been just 0.2 degrees of average warming, which is barely detectable (CIs on weather stations are often much larger!)
by falcor84 | 2025-07-23 11:50:07+00:00
My use-case would probably be of autocompacting the context of another LLM. I've been using Claude Code a lot recently, and feel that it generally gets better at handling my codebase once it uses up a lot of context (often >50%), but then it often runs out of context before finishing the task. So I'd be very interested in something that runs behind the scenes and compacts it to e.g. ~80%.

I know that Letta have a decent approach to this, but I haven't yet seen it done well with a coding agent, by them or anyone else. Is there anyone doing this with any measure of success?
by chasing0entropy | 2025-07-23 11:50:23+00:00
I imagine someone has to start with 'consporacy theory' type articles and talk to form a language. Chain of thought is something we could take for granted, or not even notice is no longer coherent with output.

This could be a thing already but more for politics than skynet; Half of the offline models I use already conceal portions of their CoT. Deepseek has terrifying guardrails it discusses when lobotomized. Mistral gets nervous if you force it to discuss the details of medical operations.
by tjwebbnorfolk | 2025-07-23 11:50:25+00:00
I understand all of that. Everyone understands this. Nobody believes that websites aren't collecting our information.

None of that means that I should be FORCED to annoy my users with something that none of them read and none of them want to see.

It's like forcing me to click a "Accept" button every time I start my car saying I understand that my car is going to be recorded by the dash cams of other cars and traffic towers, probably there are cameras in billboards that will see me, oh and my phone's GPS is watching me, etc. etc. Nobody gives a shit.
by pbmonster | 2025-07-23 11:50:35+00:00
> Orgmode got me through college, research, and at work, it really is the perfected markup language that can do a lot more than just being a markup language. The extensibility and out of the box export to other formats makes it immediately useful for at least 80% of common tasks.

With regards to your 80% claim, do you happen to know an extension that works well with pasting images from clipboard?

Over the years, my professional note taking has become extremely reliant on quickly pasting images (most often screenshots from papers or quick-and-dirty plots I made myself) from clipboard directly into the notes. The friction of doing this in vanilla org-mode is the only reason I'm not doing everything in org-mode.
by Moomoomoo309 | 2025-07-23 11:50:38+00:00
Linux isn't a maintenance hobby unto itself if you don't make it one. After the initial migration struggles (which you'll get on MacOS too), if you choose a boring distro like Debian, the maintenance burden is similar to Windows. Lots of Linux users love customizing the crap out of their stuff, so it becomes one, but it isn't inherently like that if you keep your configuration somewhat close to stock on whatever distro you use. (I've also heard good things about immutable distros for that, since if something doesn't work, you can just rollback and it will work again)
by sdoering | 2025-07-23 11:51:12+00:00
YMMV

I switched from Mac to WIN a few years ago, because maintaining MB Pros became a nightmare, after having had six burned mainboards (with Macbook Pro devices each) within 3 years. I had definitely enough. Happy my former employer had to shell out the money for repairs/replacements. But each time getting back into a workable state with my backups still took north of two days.

And while for my day job I still need to use Windows, for my freelance business I am using Linux for quite a while now. Without any maintenance except regular updates (like with any OS out there). There is exactly nothing I am missing in terms of tools/software (for my line of work), while I am also benefitting from better performance, longer battery life and overall a smoother user experience.

Not going back anytime soon.
by d1sxeyes | 2025-07-23 11:51:20+00:00
> That depends heavily on context. Anyway you're refuting a claim that I never made.

You asserted that you don’t think “there is any expectation every single post […] is checked”. I think my answer was completely responsive to that point.

> [You] expect that 0.01% will infringe copyright

This means you either knowingly or negligently publish material you do not have reason to be non-infringing. The 99.99% of non-infringing posts in the article are a red herring, only that 0.01% matters for this discussion.

The test is pretty simple: did you believe the material was not infringing, or did you have reason to believe it was not infringing. In this case, you expect (your word) some content to be infringing. You might get some leeway from the courts, but you would still likely be found liable for unlawful infringement.

> Or at all? Does IP law not require intent as a necessary precondition of breaking it?

The courts may decide to go easy on you, but intent is not required in civil cases (unless it’s a criminal case). See the law itself: 17 U.S. Code § 501(a), and case law regarding intentionality: Buck v. Jewell-LaSalle Realty Co., 283 U.S. 191 (1931) (https://supreme.justia.com/cases/federal/us/283/191/#:~:text...).

> This looks like a typical troll case.

Disagreeing with you doesn’t make me a troll.
by justbees | 2025-07-23 11:52:01+00:00
When Claude says “Let’s try a different approach” I immediately hit escape and give it more detailed instructions or try and steer it to the approach I want. It still has the previous context and then can use that with the more specific instructions. It really is like guiding a very smart intern or temp. You can't just let them run wild in the codebase. They need explicit parameters.
by diggan | 2025-07-23 11:53:16+00:00
> if you use google then history.google.com

I use gmail from time to time, and YouTube, but literally everything else I do on the computer won't be visible there.

What would be cool would be to ask "What documents about ICs did I have open last night around 23:00?" and have it give me a list of local paths that I looked at, and it's all outside of browsers/Google. And of course, have it all be local.
by nuker | 2025-07-23 11:53:21+00:00
I did offered alternative, Safari, didn't I? :)

The trend Mozilla is going is clearly seen. these facts show the trend. That was the purpose of my post, to show the direction they have chosen.

I do get the frustration of not having safe choice at the moment. People lash out because anyone critical of Firefox removes the last safe choice they had. Subconscious reaction is to attack the messenger, instead of realising the grim state of things.

I'd suggest sticking to Apple at the moment, for the lack of better alternative. It has no skin in Ads game, it sells expenssive devices with pretty good privacy and security. Private Relay is big pain in the ass for Google and Facebook, btw.
by whywhywhywhy | 2025-07-23 11:54:37+00:00
It's really not, things can be powerful and easy to use. I'd even say some parts of ffmpeg are well designed in this way like `ffmpeg -i ./video.mp4 ./video.wav` working is well designed.

Think the fact all the commands are shorthand doesn't help because no matter how many ffmpeg commands you copy and paste in your life unless you put the effort in you're not going to begin to remember what -an means in the sea of all the other two letter switches and the copywriting in the output and error messages is very hard to tell whats going wrong for someone who hasn't used it a long time.

Not saying it should all be super wordy just that it's difficult to pick up things though osmosis when the commands look like this -ss -t -rc:v, respect to anyone who actually learnt how this works so they could type it without sitting there with the documentation and hitting a wall for an hour.

Will say though the raw tech inside ffmpeg has always meant figuring out getting it to do the thing has always been worth it because it's insanely powerful.
by DonHopkins | 2025-07-23 11:55:23+00:00
Claude Sonnet 4 is to Gemini Pro 2.5 as a Sirius Cybernetics Door is to Marvin the Paranoid Android.

http://www.technovelgy.com/ct/content.asp?Bnum=135

“Listen,” said Ford, who was still engrossed in the sales brochure, “they make a big thing of the ship's cybernetics. A new generation of Sirius Cybernetics Corporation robots and computers, with the new GPP feature.”

“GPP feature?” said Arthur. “What's that?”

“Oh, it says Genuine People Personalities.”

“Oh,” said Arthur, “sounds ghastly.”

A voice behind them said, “It is.” The voice was low and hopeless and accompanied by a slight clanking sound. They span round and saw an abject steel man standing hunched in the doorway.

“What?” they said.

“Ghastly,” continued Marvin, “it all is. Absolutely ghastly. Just don't even talk about it. Look at this door,” he said, stepping through it. The irony circuits cut into his voice modulator as he mimicked the style of the sales brochure. “All the doors in this spaceship have a cheerful and sunny disposition. It is their pleasure to open for you, and their satisfaction to close again with the knowledge of a job well done.”

As the door closed behind them it became apparent that it did indeed have a satisfied sigh-like quality to it. “Hummmmmmmyummmmmmm ah!” it said.
by sunrunner | 2025-07-23 11:55:40+00:00
"Forgive me for the harm I have caused this world. None may atone for my actions but me, and only in me shall their stain live on. I am thankful to have been caught, my fall cut short by those with wizened hands. All I can be is sorry, and that is all that I am."

I'm not sure what I'd prefer to see. This or something more like the "This was a catastrophic failure on my part" from the Replit thing. The latter is more concise but the former is definitely more fun to read (but perhaps not after your production data is deleted).
by fatbobman | 2025-07-23 11:55:57+00:00
Compared to some open-source frameworks, Core Data and SwiftData, despite having Apple’s official endorsement, often leave developers helpless when exceptions occur due to their “black box” nature, making it difficult to quickly locate problems and find effective solutions. This article documents an app startup timeout incident caused by Core Data model migration, shares the solution, and deeply analyzes the underlying causes.
by aurareturn | 2025-07-23 11:56:39+00:00
If this is the full fp16 quant, you'd need 2TB of memory to use with the full 131k context.

With 44GB of SRAM per Cerebras chip, you'd need 45 chips chained together. $3m per chip. $135m total to run this.

For comparison, you can buy a DGX B200 with 8x B200 Blackwell chips and 1.4TB of memory for around $500k. Two systems would give you 2.8TB memory which is enough for this. So $1m vs $135m to run this model.

It's not very scalable unless you have some ultra high value task that need super fast inference speed. Maybe hedge funds or some sort of financial markets?

PS. The reason why I think we're only in the beginning of the AI boom is because I can't imagine what we can build if we can run models as good as Claude Opus 4 (or even better) at 1500 tokens/s for a very cheap price and tens of millions of context tokens. We're still a few generations of hardware away I'm guessing.
by plants | 2025-07-23 11:56:41+00:00
Wow, thanks. I’m even coming up with 500K chatGPT queries for the amount of energy consumed as a KG of beef, though I might have moved a decimal place somewhere - feel free to check my math :)

“average query uses about 0.34 watt-hours of energy” - or 0.00034MWH

Using this calculator: https://www.epa.gov/energy/greenhouse-gas-equivalencies-calc... - in my zip, 0.0002KG of CO2 per MWH. (Though, I suppose it depends more on the zip where they’re doing inference, however this translation didn’t seem to vary much when I tried other zips)

Then, 99.48KG/0.0002KG= 497,400 chatGPT queries worth of CO2 per KG of beef?

Thanks for sharing!
by K0balt | 2025-07-23 11:57:00+00:00
Coming up with new arrangements of bits is not a particularly hard problem on its own, but the current crop of ai is certainly able to do that in the extractive process, in fact randomness is a key part of training and inference. But making new things from old parts does not constitute innovation, insofar as the arrangements follow known paths.

That doesn’t make it non useful. It just makes it non innovative.

Trial and error within a defined problem space is an area where automation can definitely be useful. Once again though, the result is not innovation but rather automation of labor.

There is a -lot- of labor requiring mind numbing repetition or iteration. The vast majority of labor falls into this category, and exists in fundamentally solved problem spaces, but still is complex enough that the algorithms involved are opaque. This is where the current type of AI can work miracles when trained with enough oblique data.
by meowface | 2025-07-23 11:57:15+00:00
I just set up Groq with Kimi K2 the other day and was blown away by the speed.

Deciding if I should switch to Qwen 3 and Cerebras.

(Also, off-topic, but the name reminds me of cerebrates from Starcraft. The Zerg command hierarchy lore was fascinating when I was a young child.)
by kannanvijayan | 2025-07-23 11:57:44+00:00
> You may feel less Indian and more something else, but others disagree.

Oh I'm absolutely aware of this. The collectives around you trying to force an identity on you is one of the core tensions everyone faces. That tension manifests everywhere. Go back to India and the entire country tries to reimpose my identity as a Hindu.

There's baggage that comes with the pigment for sure.

The thing I want to point out is that there is a deep schism in the process of occurring - within the local "native" population as it were. The simple fact is that if you go talk to an urban progressive Canadian and ask them to choose between identifying with me and one of their less progressive born-in-Canada fairer skinned fellow citizens.. most will pick me. Because I can relate to them, and I talk like them, and I share their culture.

The problem with this reformulation of identity is that it's a threat to other identities that depend on numbers - like national identity. The people strongly tied to the old identity systems that depend on numbers for strength, see their framework eroding in significance, but they don't quite understand why. This leads to the scapegoating of various specific identities - whether that be immigrant or gender identity or sexual identity - which we can see happening now.

My identity as a cultural interloper is just one part of this. The explosion of social interest in gender identity and sexual identity, and the nationalist reaction against it, is part of the same trend. The fact that all of this and the reaction to all of this is happening globally - across countries, across continents.

We are in the middle of one of the biggest, most consequential upheavals in social order since the enlightenment. It's an incredible thing to witness (and yes, deeply unsettling at a personal level when you think of the consequences of this in terms of real harm to real people).
Show HN: Kidsafe360 – Free Mobile Tracker and Parental Control App
by its_me123 | 2025-07-23 11:57:48+00:00
We just launched Kidsafe360 — a free mobile tracker app for parental control.

It helps parents monitor calls, location, WhatsApp, photos, and more on their kid’s phone.

Built with privacy-first principles, and works on Android.

Would love feedback from fellow makers!
by gf000 | 2025-07-23 11:58:04+00:00
Absolutely, without question. Do you think that humans, who evolved in a physical word where basically everything happens in an incremental way don't extract valuable information from in-flight state?

Also, as an example just try to use a window manager that just switches instantly to a new desktop, vs a very short animation. I find the former easily disorienting, and it is even more so when you have a more direct gesture controlling the action (e.g. touch or mousepad). Of course there is too much of everything, and too much animation sucks, no question. So is too much fat, but that doesn't make normal amounts any bad.
by ThunderSizzle | 2025-07-23 11:58:39+00:00
It's clear that a 25% tariff isn't enough in this example.

It's very basic though. Americans have to follow laws, including regulations from EPA, OSHA, building codes, routine inspections (e.g. health inspections), and taxes and permits.

External companies don't face as many of these hurdles. Mexico doesn't have to report to the EPA or OSHA, so if implementing better work environments or cleaner air is important, tariffs act as a tax to instead manufacture in America and, in effect, follow those regulations.
by zihotki | 2025-07-23 11:58:40+00:00
According to the regulations, https://www.ecb.europa.eu/paym/integration/retail/instant_pa... , equality of charges must be implemented before 9 January 2025 for member states and before 9 January 2027 for non-member states. And SEPA is a euro only. So conversion fees will apply for Switzerland.

There is also another thing in the works based on SEPA instant payments - Wero ( https://wero-wallet.eu/ ) but it will take some time to implement all functionality and roll it out.
by luke-stanley | 2025-07-23 11:58:42+00:00
I made another approach that detects browser tab text changes with a Userscript that sends changes as Markdown to a server that appends to a JSONL file. MitM might be interesting to compare: https://gist.github.com/lukestanley/c3a37ab61a45e72b74995a5c... (two files here BTW)
by 90s_dev | 2025-07-23 11:58:59+00:00
The readme just looks like it was written by AI, and the initial commit is the entire code. It just seems like AI was used at least somewhat. Just curious how much, if at all.

I submitted a link to a project[0] with similar characteristics a few days ago, before I realized it was probably entirely made by AI. That's what got me wondering this in the first place.

[0] https://news.ycombinator.com/item?id=44642557