MurphyA/hacker-news huggingface dataset:
by jerf | 2025-07-08 20:05:45+00:00
"I'd heard of sqlmap but I didn't realize it was so good that you can just hand it a URL that hits the database and the tool basically figures out from there how to dump the database contents if there's any SQL injection vulnerability."

If there's one lesson I'd convey to people about security it is do not underestimate your foes. They've been building tools for decades just like any other discipline.

Tech to find a hole in your system that lets you run an arbitrary-but-constrained fragment of shell code that can put a small executable on to the system that puts a larger executable on that lifts itself up to root and also joins a centralized command-and-control server with the ability to push arbitrary code across entire clusters of owned systems is not some sort of bizarre, exotic technology that people only dream of... it's off-the-shelf tech. It's a basic building block. Actually sophisticated attackers build up from there.

If $YOU're operating on the presumption I see so often that the script kiddies blind-firing Wordpress vulnerabilities at servers is the height of attacker's sophistication $YOU are operating at an unrecoverable disadvantage against these people.
by mrsilencedogood | 2025-07-08 20:05:58+00:00
We literally have collectively (to the value that US democracy approximates collectively) decided to abridge those rights within a certain distance of a border. I want people to understand what they are getting themselves into for the sake of their political protest. I would argue it is better to try to approach this reform differently than simply ending up in a border jail with your holiday ruined.
by dlcarrier | 2025-07-08 20:06:02+00:00
It doesn't take much to make a battery pack safe to work with. Every EV I've seen has contactors on both battery terminals, as well as physical shunt that is removed before servicing, in case a contactor fails closed. There's usually also contactors within the battery, making it possible to work on the battery pack itself, without any unsafe voltage present.

It's no more difficult to make safe than household wiring, and DIYers work on it all the time.
by reverendsteveii | 2025-07-08 20:06:27+00:00
He legally obtained the marijuana in Germany, which is a place where the current conflict between US marijuana laws on the state and federal level is less relevant to the discussion. That being said, we're not here debating whether CBP has the right to deny him entry for marijuana, we're here because the reason he was flagged for screening at all was a thoughtcrime meme and the discussion of his (again, perfectly legal) marijuana usage is subsequent to him being flagged for having the wrong political opinion.
by brudgers | 2025-07-08 20:06:32+00:00
from the fine article:

according to the SD Physical Layer Specification, “Card Capacity means the sum of User Area Capacity and Protected Area Capacity”

Which makes sense from a manufacturing perspective...what hardware is required to make the thing?

Also makes sense from a marketing perspective...bigger is better right?

And legally, it's right there in the fine print...that's what "SD" means your honor.
by NoboruWataya | 2025-07-08 20:07:31+00:00
Points 3 and 4 are contradictory, or at least, very difficult to reconcile. The use of "mainly" means you can technically say it's possible to achieve both but I doubt any of Mozilla's critics will ever be happy with their attempts to do so.

Points 1 to 3 also seem very difficult to reconcile. If they need to develop revenue independent of Google, and they need to focus mainly on Firefox, then at some stage they need to monetise other aspects of the browser. How do they do that in a way that is respectful to its users? What is the way for Mozilla to develop a new revenue stream, via Firefox (their main focus), that everyone is happy with?

Points 5 and 6 are too vague, I don't see how they could ever objectively be measured against those principles (other than by looking at the other principles).

All of this is to say that they can't win. They launch new products to try and make money, they are selling out and abandoning their core mission. They try instead to make money from their main product, they are selling out and betraying their users. They try to increase Firefox's mass appeal, they are dumbing it down and letting down their power users. They don't try to increase Firefox's mass appeal, they are failing to stay relevant.

Remember when Mitchell Baker was the problem?
by blibble | 2025-07-08 20:07:41+00:00
like most successful, supposedly focused non-profits, eventually the parasitical professional management class infiltrate it

they do whatever is needed to increase their own compensation, eventually killing the host, at which point they move on

the nominet drama a few years back ([1]) is one of the few cases where they were forcibly removed (due to its unique structure)

[1]: https://openuk.uk/wp-content/uploads/2021/04/The-Stack_Openi...
by TeMPOraL | 2025-07-08 20:08:30+00:00
The amounts are not the only problem; there's no good way to measure which input in the training contributed to what degree to the output. I wouldn't be surprised if it turns out it's fundamentally impossible.

Paying everyone a flat rate per query is probably the only way you could do it; any other approach is either going to be contested as unfair in some way, or will be too costly to implement. But then, a flat rate is only fair if it covers everyone in proportion to the contribution, which will get diluted by the portion of training data that's not obviously attributable, like Internet comments or Wikipedia or public domain stuff or internally generated data, so I doubt authors would see any meaningful royalties from this anyway. The only thing it would do, is to make LLMs much more expensive for the society to use.
by davetron5000 | 2025-07-08 20:08:35+00:00
Yeah, that makes sense. Where I end up wanting mocks is when this happens:

1 - build first version of feature, all core logic in a class I can test conventionally 2 - logic gets complex, test gets complex 3 - Eventually, I need to create some layering, where the class from step 1 now delegates to other classes. The initial test is more like an integration test and gets harder to keep up

At this point, there is a camp that says I should be using dependency injection and inject null objects for the dependencies. I get that idea. I am in the other camp that does not want to make custom objects just to satisfy a test. A mocking system can do that for me. So that's what I would do - mock the dependencies. The "real" versions would be tested conventionally.

I definitely do NOT just start with mocking imaginary internals though - I guess that's a whole other camp :)
by alok-g | 2025-07-08 20:08:44+00:00
My understanding (may be wrong):

WhatsApp data is encrypted, however, the keys are on the device itself and accessible on Android. There are many third-party apps that support transferring WhatsApp data from one phone to another, and some even claim so between Android and iOS devices. As I understand, the chats are in some usual database format. So anyone having access to the device can read the data even without WhatsApp being there itself (as far as the data is there).
by kragen | 2025-07-08 20:10:08+00:00
It seemed like a good idea in 01981; the purported expansion of MIPS was "Microprocessor without Interlocked Pipeline Stages", although of course it's a pun on "millions of instructions per second". By just omitting the interlock logic necessary to detect branch hazards and putting the responsibility on the compiler, you get a chip that can run faster with less transistors. IBM's 45000-transistor 32-bit RISC "ROMP" was fabbed for use in IBM products that year, which gives you an idea of how precious silicon area was at the time.

Stanford MIPS was extremely influential, which was undoubtedly a major factor in many RISC architectures copying the delay-slot feature, including SPARC, the PA-RISC, and the i860. But the delay slot really only simplifies a particular narrow range of microarchitectures, those with almost exactly the same pipeline structure as the original. If you want to lengthen the pipeline, either you have to add the interlocks back in, or you have to add extra delay slots, breaking binary compatibility. So delay slots fell out of favor fairly quickly in the 80s. Maybe they were never a good tradeoff.

One of the main things pushing people to RISC in the 80s was virtual memory, specifically, the necessity of being able to restart a faulted instruction after a page fault. (See Mashey's masterful explanation of why this doomed the VAX in https://yarchive.net/comp/vax.html.) RISC architectures generally didn't have multiple memory accesses or multiple writes per instruction (ARM being a notable exception), so all the information you needed to restart the failed instruction successfully was in the saved program counter.

But delay slots pose a problem here! Suppose the faulting instruction is the delay-slot instruction following a branch. The next instruction to execute after resuming that one could either be the instruction that was branched to, or the instruction at the address after the delay-slot instruction, depending on whether the branch was taken or not. That means you need to either take the fault before the branch, or the fault handler needs to save at least the branch-taken bit. I've never programmed a page-fault handler for MIPS, the SPARC, PA-RISC, or the i860, so I don't know how they handle this, but it seems like it implies extra implementation complexity of precisely the kind Hennessy was trying to weasel out of.

The WP page also mentions that MIPS had load delay slots, where the datum you loaded wasn't available in the very next instruction. I'm reminded that the Tera MTA actually had a variable number of load delay slots, specified in a field in the load instruction, to allow the compiler to allow as many instructions as it could for the memory reference to come back from RAM over the packet-switching network. (The CPU would then stall your thread if the load took longer than the allotted number of instructions, but the idea was that a compiler that prefetched enough stuff into your thread's huge register set could make such stalls very rare.)
by Terr_ | 2025-07-08 20:10:44+00:00
To twist the Upton Sinclair quote: It's difficult to convince a man to believe in something when his company's valuation depends on him not believing it.

Sure, the average engineer probably isn't thinking in those explicit terms, but I can easily imagine a cultural miasma that leads people to avoid thinking of certain implications. (It happens everywhere, no reason for software development to be immune.)

> If you expose your data to an LLM

I like to say that LLMs should be imagined as javascript in the browser: You can't reliably keep any data secret, and a determined user can get it to emit anything they want.

On reflection, that understates the problem, since that threat-model doesn't raise sufficient alarm about how data from one user can poison things for another.
by coffeecoders | 2025-07-08 20:10:46+00:00
After each Firefox install, I do:

- Right click context menu cleanup - I don't need Inspect Accessibility Properties, Email image, Set image as desktop background etc. - Disable telemetry - Minimal theme - Clean up search engines - Disable pocket, top sites, ads, what's new, search suggest - Disable tab groups, container, hover preview - Disable recommended extensions

These can all be done through config or userChrome.css.

After that, I install three extensions - uBlock, skip redirect, I don't care about cookies.

I have never cared about signing into browser or syncing bookmarks. All I want is a minimal browser that doesn't bother me on each run.
by jerf | 2025-07-08 20:10:48+00:00
One of my standard answers here is a chat server. You've got thousands upon thousands of connections to it, which are all live, and they're cross-talking with each other in arbitrary ways. The easiest way to write that is to assign a fiber per connection. You shouldn't do that in PHP today.

"Just that they wouldn’t be directly useful to the average PHP dev,"

But you're restating my point, whether you realize it or not. They're not useful to the "average PHP dev" because if the "average PHP dev" needed them, they would cease to be a PHP dev, just as I ceased to be a Perl dev when I needed something it couldn't do for similar reasons. All the use cases that PHP could have with fibers have evaporatively-cooled out of the community because PHP couldn't do them, leaving behind precisely that set of people who don't have problems that could be solved with fibers.
by strcat | 2025-07-08 20:10:56+00:00
> Doesn't the ASB get published at the same time as pixel updates? So by definition it's up to date.

Android Security Bulletin are standalone backports of High and Critical severity security patches to older initial yearly releases. Those older releases are currently Android 13, 14, 15 and 16. They're not the full security patches. Many backports included in the ASB were often included in the stable OS updates a month or two earlier.

There are 2 officially supported paths for updates:

1) The path taken by Pixels of shipping each monthly, quarterly and yearly OS release in the month they come out, which they always do unless something goes very wrong and an update is pulled without them having a replacement ready. It's extremely rare for them not end up rolling out the latest OS release to users. 2) The path taken by most non-Pixel OEMs where they stick with an initial yearly release and apply Android Security Bulletin backports, eventually moving to a new initial yearly release. Pixels have never really used this, with the exception of the Pixel 8a and Pixel 9a launching on a branch of the previous quarterly release and then moving to the regular OS releases with the next quarterly/yearly release. That's a special case at launch from them saving resources.

GrapheneOS follows the Pixel path and would need to make that work on hardware not doing it if we supported it. That would mean dealing with issues created by relying on the forward compatibility system (Treble) and not having improvements to the device support code tied to newer Android releases. Our hardware requirements require that this would work and that they would be providing the OS updates for the lower level code without a huge delay.

Using older code below the OS layer would also mean not building it with the OS but rather separately, and would imply that it's probably a lot more closed source than Pixels were.
by VirusNewbie | 2025-07-08 20:11:21+00:00
I'll chime in and say just south of Los Angeles is Orange County that in a lot of ways a better place to live if you're in teech and also not going to be in the Bay or Seattle.

There are fewer tech jobs than LA, but most of the FAANGs have offices here. There are a lot more options for housing than LA, and a lot less traffic.

For instance, my ~5 bedroom house is worth around 2 million in a nice neighborhood and i'm a 10 minute drive from a huge Amazon office, a 10 minute drive from Blizzard HQ, and a 25 minute drive from a decent size Google office.

A similarly priced and sized house in Los Angeles would be a 80 minute commute to either Amazon, Google or Meta in Santa Monica.
by rexpository | 2025-07-08 20:12:19+00:00
I broadly agree that "MCP-level" patches alone won't eliminate prompt-injection risk. Latest research also shows we can make real progress by enforcing security above the MCP layer, exactly as you suggest [1]. DeepMind's CaMeL architecture is a good reference model: it surrounds the LLM with a capability-based "sandbox" that (1) tracks the provenance of every value, and (2) blocks any tool call whose arguments originate from untrusted data, unless an explicit policy grants permission.

[1] https://arxiv.org/pdf/2503.18813
by strcat | 2025-07-08 20:12:36+00:00
GrapheneOS has no specific requirement for the Titan M2. It requires a secure element providing the standard AOSP secure element features which are provided by other devices such as recent Samsung Galaxy devices. Fairphone doesn't provide a secure element. Snapdragon provides a basic secure element in the flagship SoC but not every SoC, and it doesn't necessarily provide all the required features without the OEM doing work. There are more requirements than a secure element. It's best to look at the official list of requirements at https://grapheneos.org/faq#future-devices.
by kragen | 2025-07-08 20:12:43+00:00
Well, because there are open-source designs they'd be using. The GD32V microcontroller, for example, uses Nucleisys's BumbleBee, and high-performance chips from several vendors use Brother Honey Badger's Apache-licensed XuanTie C910: https://github.com/XUANTIE-RV/openc910

But see https://news.ycombinator.com/item?id=44503847
by HappMacDonald | 2025-07-08 20:13:00+00:00
Well the question then becomes "how do you identify the quoting that needs to happen on the line" and tactics common in Rust enabled by features available in Rust will still lead a person away from this pattern of error.

One tool I'd have probably reached for (long before having heard of this particular corner case to avoid) would have been whitespace trimming, and CR counts as whitespace. Plus folk outside of C are also more likely to aim a regex at a line they want to parse, and anyone who's been writing regex for more than 5 minutes gets into the habit of adding `\s*` adjacent to beginning of line and end of line markers (and outside of capture groups) which in this case achieves the same end.
by glenstein | 2025-07-08 20:13:07+00:00
>You’re twisting what people ask for.

I've seen the comments they are talking about, so I don't agree they are twisting anything. Your aspirationally consistent restatement of the case is vague, and the contradictions are specific. Does the existence of the investment fund count as failing to focus on Firefox or succeeding at developing revenue independent of Google? How about the VPN, another potential revenue source?

Is advocating for open web standards (as mentioned in the article as an example of a good thing) a distraction from Firefox (as I've seen commenters here suggest), or respecting users by giving a voice to their users in standards deliberation where their voice would otherwise be excluded?

And how confident are you that your answers are the unique and consistent representation of what users really want, and that I won't be able to quote half a dozen commenters coming to completely different diagnoses of the same questions?
by ajb | 2025-07-08 20:13:09+00:00
It's an interesting comparison because MIPS used to occupy the niche that RV does now - an ISA that anyone could implement.

Lots of companies had their own mips implementation, but still might use an implementation from mips-the-company because even if you have your own team, you probably don't want to implement every core size that you might need. But then for some reason lots of them switched to using ARM, within a few years (in some cases getting an architecture licence and keeping their CPU team).

It seems like RV has a more stable structure, as the foundation doesn't licence cores, so even if one or two of the implementors die it won't necessarily reflect on the viability of the ecosystem
by Anon84 | 2025-07-08 20:14:45+00:00
There is an argument to be made that the current loss of a sense of community and the meaninglessness epidemic can (at least in part) be attributed to a lack of shared rituals. S. Junger (https://amzn.to/4nSaxfY) and M. P. Some (https://amzn.to/4eB5sUW) do a great job of making this point from somewhat different (and non-eastern) perspectives.
by kasabali | 2025-07-08 20:15:16+00:00
No I don't, but then, how bad it could be? As bad as Samsung's 8nm? Or Intel's 10nm? Even they delivered something in the end. What did GF deliver? A whole fucking nothing. Samsung had Nvidia and Qualcomm as their customers even with its, ehm, not so good 8nm process. It was a sure bet GF was going to have some customers as long as they delivered something (and I don't even count AMD's wafer supply agreement).
by mc32 | 2025-07-08 20:15:33+00:00
How about smart traffic signals that detect traffic and manage traffic accordingly. For example, there are traffic lights that manage the traffic between a high throughput road and a low throughput road. In this instance, it could wait to cycle when multiple -thresholds are met like amount of time plus presence of automobiles waiting. More sophisticated systems might optimize for flow/throughput without overly frustrating any driver.
by NotAnOtter | 2025-07-08 20:16:39+00:00
I do not need to know if AI therapy is as good as Real Life therapy. It almost certainly is not.

I need to know if using it as AI therapy is actively harmful for some significant percentage of the population, and should be avoided. This arxiv does not discuss that as far as I can tell. LLM therapy is closer to an interactive journal. Journaling, getting your thoughts out, being forced to articulate grief in succinct words and pick out patterns - is all healing.

And most people cannot afford professional therapy.
by 999900000999 | 2025-07-08 20:16:43+00:00
My only issue with VC is a few of them will act like they're open to submissions when they really aren't.

Outside of a few small projects with friends I've never gotten meaningful feedback.

I did teach myself programming and I do love my career, but I'm not going to lie.

I'm a bit bitter I never at least got to a meeting with a VC. I was playing with machine learning back in 2018. I imagine had I stuck with it, and had the right encouragement I could be rich by now.

I haven't completely given up. Once I come across an idea worth while I'll get to work.
by jrflowers | 2025-07-08 20:17:16+00:00
It’s not really that contentious of a statement. Language models encouraging delusions is pretty well-documented.

https://www.rollingstone.com/culture/culture-features/ai-spi...

https://www.psychologytoday.com/us/blog/psych-unseen/202507/...

And we’re in a comment thread about a study that concluded:

>LLMs 1) express stigma toward those with mental health conditions and 2) respond inappropriately to certain common (and critical) conditions in naturalistic therapy settings

And it’s been shown to be addictive

https://www.tomshardware.com/tech-industry/artificial-intell...

So if you overheard somebody say “I don’t do that stuff because it’s addictive and people go crazy on it” you would probably assume that they were talking about a substance. Or at the very least you would not assume that they were talking about seeing a therapist.
by zamadatix | 2025-07-08 20:17:22+00:00
From my current mac these show up: Slack, Beeper, 1Password, KeeWeb Teams, Chrome, Firefox, Signal, Zoom, Sublime, iTerm2. I have very little in the way of other apps except the defaults + a few only available on the official App Store. Most all of my 3rd party CLI stuff is in Linux, via iTerm2+built in SSH.
by kelthuzad | 2025-07-08 20:17:23+00:00
From a cursory reading of Astro's docs their model/philosophy seems to be more like "fast by default."

So their philosophy is to start with zero client-side javascript, even when one is using components from javascript-heavy frameworks like React or Vue. Interactivity is apparently something one has to explicitly opt-in to by adding a client:* directive, rather than it being the default.

The migration guide states, "Astro projects can also be SSG or SSR with page level prerendering," which puts it on par with Nuxt in that regard.

A difference I've noticed regarding server-side features is that Astro allows one to "define and call backend functions with type-safety."[0] which even Nuxt doesnt offer in such a convenient and type-safe manner. I'm pretty happy with what i'm seeing in Astro's docs so far.

[0] https://docs.astro.build/en/guides/actions/