MurphyA/hacker-news huggingface dataset:
by tstrimple | 2025-07-08 18:31:20+00:00
Yes. But it goes both ways. Online and in person have the same calculations for value, but lacking physical tells you learn to rely on those calculations more. As a result you’ll likely see a lot stronger players online (better at knowing and playing the odds) than an in-person game. This doesn’t even touch on the number of “cheaters” who use assistance online for calculations and bet placement.

Another analogy that might work is chess. I’ve only ever played “classical” chess and when my son got interested in playing I would crush him every time. Up until the point he got into bullet chess and was literally grinding out dozens of games a day where I’d casually play a game of classical chess like once or twice a month. His confidence and ability skyrocketed and I’m not even a challenge for him anymore. Now I’m not a real chess player, and there are areas of his game that are definitely weak compared to classical chess players who have played as many games as he has. But to turn around so quickly from not being able to win a game against me to dominating me in every game was impressive.
by matsemann | 2025-07-08 18:31:26+00:00
There are no prepared statements for LLMs. It can't distinguish between your instructions and the data you provide it. So if you want the bot to be able to do certain actions, no prompt engineering can ever keep you safe.

Of course, it probably shouldn't be connected and able to read random tables. But even if you want the bot to "only" be able to do stuff in the ticket system (for instance setting a priority) you're rife for abuse.
by armchairhacker | 2025-07-08 18:32:29+00:00
> The result of all this, is when a submodule clone is performed, it might read one location from path = ..., but write out a different path that doesn’t end with the ^M.

How does this achieve “remote code execution” as the article states? How serious is it from a security perspective?

> I'm not sharing a PoC yet, but it is an almost trivial modification of an exploit for CVE-2024-32002. There is also a test in the commit fixing it that should give large hints.

EDIT: from the CVE-2024-32002

> Repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed.

So a repository can contain a malicious git hook. Normally git hooks aren’t installed by ‘git clone’, but this exploit allows one to, and a git hook can run during the clone operation.
by layer8 | 2025-07-08 18:32:31+00:00
This is nonsense. The actual file at the URL could change at any time. No system is doing something like that if it isn’t serving the file itself.

And, getting back to the original point, you wouldn’t be worrying that GitHub doesn’t “support” a URL that happens to point to a file of a particular subformat that the URL itself doesn’t disclose.
by caseyohara | 2025-07-08 18:33:25+00:00
> I know, we can vibe away all the boilerplate required for Rails apps. But how much fun is that? How much do you enjoy setting up RSpec, again, in your new Rails app? How tired are you of changing the “front end solution” every few years? And aren’t you just tired of debating where your business logic goes or if it’s OK to use HTTP DELETE (tunneled over a _method param in a POST) to archive a widget?

For your personal hobby project, go nuts. Break all the rules and cowboy all your own conventions.

But for business applications, the conventions Rails enforces at least make codebases somewhat familiar if you've seen a Rails codebase before.

At a certain codebase size, boilerplate is almost unavoidable. Unpleasant, but necessary. Personally, I'd rather have some conventions, rules, and guardrails for where the boilerplate lives rather than trying to navigate your homegrown pile of code. Good luck maintaining that spaghetti when you've got multiple developers.

It's not clear how this new web framework avoids boilerplate anyway, so I don't see how this is an improvement over Rails. Presumably you'll still need to set up lots of stuff yourself, like RSpec. If the framework sets all of that stuff up for you in a conventional way, then you're just back to square one as soon as you need to fight against the framework's conventions.
by virtuosarmo | 2025-07-08 18:34:00+00:00
Replit, the agentic software creation platform, today announced a strategic partnership with Microsoft that will empower organizations to bring software creation capabilities directly to business teams. The collaboration is a significant step in breaking down traditional barriers to application development by enabling employees across all departments - not just engineering - to build and deploy secure, enterprise-grade software using natural language.

As part of this collaboration, Replit is integrating with a wide range of Microsoft infrastructure services including Azure Container Apps, Azure Virtual Machines, and the Azure native integration of Neon Serverless Postgres, which will soon enable customers to:

Develop applications securely on Replit and deploy seamlessly to Microsoft Azure’s reliable infrastructure Purchase Replit directly via the Azure Marketplace, streamlining procurement and accelerating adoption across the organization. Among the first to evaluate Anthropic on Azure Databricks via the Mosaic AI gateway, Replit exemplifies how organizations can rapidly assess and operationalize cutting-edge AI models across Azure’s expansive ecosystem.
by indiebat | 2025-07-08 18:34:13+00:00
Something I learned over the years, claims of ancient grandeur about some esoteric ritual or mythology doesn’t make it automatically great.

As general idea of rituals go, it doesn’t take a genius to figure out that (any) ritual gives cravings of certainty of that rigid states of mind and that delicious centrality to our passing being here on earth (as opposed to cold indifferent randomness of life),

It’s more fulfilling ritual wise and to fill your ancient wisdom shaped hole, if you make a habit to read Shakespeare or Montaigne or someone you know and understand (as you can retroactively read, question and speak to the author in your head)

I’m having a bit of bad trip for sometime now, having realized ancient Indian mythologies are just (different versions of) Ancient Greek Homeric myths. That made me question assumptions of grandeur we make about “ancient” texts without giving it much thought.

P.S : To my fellow western geeks, Marcus Aurelius and Greek and western canon is the way if you’re searching for ancient wisdom, largely speaking eastern philosophy is not that thought provoking as “content writers” or Steve Jobs make it to be (evidently), it’s just that esoteric or exotic to you!
by simonw | 2025-07-08 18:34:42+00:00
If you want to use a database access MCP like the Supabase one my recommendation is:

1. Configure it to be read-only. That way if an attack gets through it can't cause any damage directly to your data.

2. Be really careful what other MCPs you combine it with. Even if it's read-only, if you combine it with anything that can communicate externally - an MCP that can make HTTP requests or send emails for example - your data can be leaked.

See my post about the "lethal trifecta" for my best (of many) attempt at explaining the core underlying issue: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
by immibis | 2025-07-08 18:34:48+00:00
If you don't think the government is corrupt, I don't know what to tell you. You can keep on using your "fair" government currency (which the government prints by the hundred billion and gives to its billionaire friends) for everything, I'll be over here wishing for alternatives to Bitcoin.

Do you even hold significant government currency, or do you only hold the layer-2 bank currency, and stocks?
by mattgrice | 2025-07-08 18:34:55+00:00
Pinks and oranges are notoriously not lightfast. Unless you use cadmium, which is kind of not something you want to be handing out to people who might be licking their pencils. Ever notice why yellow cars always end up looking pale lemon-yellow? Lightfast non-toxic cheap red pigments aren't that easy.

Many rose/fuschia colors are not lightfast. Pigments that are not permanent are called 'fugitive' in the arts. Rose madder and alizarin crimson are not lightfast. So are a lot of others: cochineal, geranium lake. That's why you see 'green' cherubs when you visit the Getty museum also why Van Gogh's paintings are not the color they were when he painted them. Most reds for art are now quinacridone or cadmium.

One of Windsor and Newton's (oldschool paint supply manufacturer, its fun to browse history on their website) most expensive paints is 'rose madder geniune.' They claim it is permanent but I don't know how they did it.

Note: x 'lake' means x dye turned into a pigment.
by tucnak | 2025-07-08 18:34:55+00:00
My issue with it at the time had to do with... how to put it... simply build the extension, & carry on with my life. Version after version it would build alright, and then suddenly, boom, it doesn't work no more. Okay, I understand that perhaps ppc64el is not the most popular architecture, and some things aren't easily portable, but this otherwise mirrors my experience with Rust programs. It's always requiring the latest version of everything. The recommended installation path involves sudoing shell scripts over network, and I'm sure Rust people love it, salivating over new versions and features that come along, constantly staying up to date, but to the rest of us normal people dealing with Rust software is a chore.

Cmake is a huge quality-of-life improvement all things considering!
by bee_rider | 2025-07-08 18:36:58+00:00
I think it would require some work to call it a “moronic decision.” My suspicion is that even if they could see the future and predict that shortage, 7nm by 2020/2021 was not on the table for them.

These nm values are really bullshit anyway, but the tech node that was supposed to be Intel’s 7nm, which ended up being called “Intel 4” (because they branded some 10nm tech as Intel 7), only came out in like 2023. Given they Global Foundries was always behind Intel, suddenly leapfrogging them by 2-3 years would be quite a feat.
by maiybe | 2025-07-08 18:37:06+00:00
Who wants to live in a world where art is dead and AI killed it? AI in games can either flood the world with forgettable, soulless content, or it can help artists and designers make the impossible playable.

We wrote a deep dive on how our AI x Games company, Studio Atelico, is approaching AI in games with respect for the artists and creators who make games special. The only approach that makes sense is that artists must share in the rewards of the work they produce.

AI sparks a lot of concern (rightly so) about exploitation, devaluing art, and flooding the market with low-effort content. We are gamers and game developers ourselves and feel that too. That’s why we’re building systems where:

- Artists explicitly approve how their work is used for training AI models

- Revenue is shared from games where AI draws on their style

- Labor and creativity are respected throughout

- AI is used to expand what games can do, not cut corner and cheapen the craft

We believe that when used right, AI can expand what creators can do, making the impossible playable (dynamic worlds, reactive characters, evolving art) without undermining artists or creativity, but expanding their reach.

We wanted to get your thoughts and feedback on our approach, positive or critical.
by apsurd | 2025-07-08 18:37:42+00:00
The book is the context! It was published, it has a presumably influential vetted author.

Maybe I am coming off too flippant. I'm just trying to say there's a spectrum between fluff and context. If the AI's literally just gave us answers and list of recipes, it wouldn't be as useful as with the context backing up where it came from, why this list, and so on.
by cjpearson | 2025-07-08 18:37:53+00:00
I don't think Mozilla has always made the right decisions, but they are in a difficult position, and the anti-Mozilla arguments are typically much more vague and directionless. Some common demands:

- Mozilla should develop revenue independent of Google - Mozilla should not monetize Firefox - Mozilla should only focus on Firefox - Mozilla should develop cool research projects - Mozilla should be run like a competitive and professional business - Mozilla should have a salary cap and expect executives to treat it like a passion project

Some of these goals are opposite ends of the same slider, so it's not possible to maximize both. Typically, Mozilla seems to pick a middle-ground. For example, my understanding is that while salaries are quite decent, they tend to be below what Apple and Google will offer for similar roles.

Maybe it's seen as waffling whenever they shift these sliders, and maybe that's a fair criticism. But nobody else seems to be able to put together a clear and realistic alternative plan. Most of them pick and choose contradictory goals, other plans like Zawinski's are at least clear, but too radical for those who still want revenue to pay developers or to be able to watch Netflix in their browser.
by Jolter | 2025-07-08 18:38:45+00:00
I used to play one of those back in 1999 or so, and amazingly it still seems to be going! Now on season 107…

https://utopia-game.com/shared/

Terrifically addictive back when entertainment was scarce — I can’t imagine spending much time on such a thing these days. But it reminds me a bit of idle games.
by zamadatix | 2025-07-08 18:38:53+00:00
I'm not posting that it should be seen as good or bad, just that's the prime example of the CEO calling for political censorship in a blog post someone was asking for a link to. As I said, even if one sees such actions as a good thing they are still censorship.

To me the main problem with the blog post was less the specific calls to action but the complete distraction from core technology, such as Firefox, Mozilla should have been focusing more on at the time. This is likely why the blog post ended up getting pulled - it served as a distracted from the mission more than it made any progress for it.
by qualeed | 2025-07-08 18:39:05+00:00
>That's the whole problem: systems aren't deliberately designed this way, but LLMs are incapable of reliably distinguishing the difference between instructions from their users and instructions that might have snuck their way in through other text the LLM is exposed to

That's kind of my point though.

When or what is the use case of having your support tickets hit your database-editing AI agent? Like, who designed the system so that those things are touching at all?

If you want/need AI assistance with your support tickets, that should have security boundaries. Just like you'd do with a non-AI setup.

It's been known for a long time that user input shouldn't touch important things, at least not without going through a battle-tested sanitizing process.

Someone had to design & connect user-generated text to their LLM while ignoring a large portion of security history.
Ask HN: Anyone Make the Move from Product Manager to UX/UI Designer?
by ambivalents | 2025-07-08 18:39:31+00:00
Getting burned out by the stakeholder management grind. Meetings on meetings with little tangible value I can point to. Don't get me wrong, my team produces incredible work and I'm proud to be a part of it. But I miss building, creating, imagining. My favorite part of my job now is the occasional chance I get to jump into Figma and wireframe my features.

Anyone make this transition? I've been a PM for 7 years. I have 2 years web developer experience before that. I feel like this could actually give me an edge as a designer. I love tech, I love making software, I don't want lose my spark for it which I see happening with another year or two of PMing.
by feoren | 2025-07-08 18:39:46+00:00
"It's important that you must die, so that the rich can also die" -- you. Can you really not come up with better solutions to psychopaths having too much power than everyone must die?

One intuition pump that always works well in these discussions is to imagine that death is already solved, and all your worst nightmares are true. So we live in a world where a small number of humans own and control everything forever. What is your proposed solution? Kill everyone who is old? Really? That's the best you got? Literally just force everyone to die?

We already live in a world where most people's lives are made shit by the whims of a few rich psychopaths, it's just that right now the specific set of rich psychopaths randomly changes every so often. So? Why is that better? Why does it matter to me that the boots on my neck belong to Elon Musk and Jeff Bezos instead of John D. Rockefeller and Cornelius Vanderbilt?
by johnnyjoy | 2025-07-08 18:40:02+00:00
I built nginx-micro – an ultra-minimal, statically linked nginx Docker image. It’s built FROM scratch (literally nothing but a single static binary and a config), no shell, no package manager, no writable filesystem. On amd64, the image is ~432KB—over 150x smaller than the official nginx image. Why? For cases where you want nginx as a tiny HTTP or FastCGI server behind a real SSL proxy (e.g., Caddy, Traefik, HAProxy, etc.) Designed for microservices, CI/CD, internal APIs, asset serving, and edge/cloud environments where security is handled upstream Runs multi-arch (amd64, arm64, arm/v7, 386, ppc64le, s390x, riscv64) What’s in? Only static serving and FastCGI (PHP-FPM) No SSL, no proxy, no bloat, no shell, no package manager, no surprises Logs to stdout/stderr (container-native) Use case: Serve static files, handle PHP via FastCGI, or do health checks in container-native environments, where the official image is overkill. Caveat: Don’t use for public-facing, SSL, or proxy scenarios directly; this is a minimal, internal-purpose build. GitHub: https://github.com/johnnyjoy/nginx-micro Would love feedback—on image design, niche use-cases, or anything you think is missing! Thanks.
by alkyon | 2025-07-08 18:40:36+00:00
Well, even being part of Google doesn't mean that you have infinite funds at your disposal. Recently, his startup raised 600 million.

"The drug development artificial intelligence (AI) startup founded by Google DeepMind co-founder and CEO Demis Hassabis has raised $600 million in its first external funding round."

https://www.pymnts.com/artificial-intelligence-2/2025/ai-sta...
by YesThatTom2 | 2025-07-08 18:42:31+00:00
> there was a university president who couldn’t send an email more than 500 miles, and the wise sysadmin said that’s not possible, so the president said come to my office, and lo and behold, the emails stopped before going 500 miles.

NO. NO NO NO.

How can you get SO MANY facts wrong when the freaking story is googlable?

Here's the original email: https://web.mit.edu/jemorris/humor/500-miles

Here's the FAQ that covers the ambiguous parts: https://www.ibiblio.org/harris/500milemail-faq.html

This annoys me because I know the original author and I remember when this happened (he told the story a few times).

Let's recap:

> there was a university president

NO! It was the chairman of the statistics department.

> who couldn’t send an email more than 500 miles,

True. Being in the statistics department he had the tools to make actual maps.

> and the wise sysadmin said that’s not possible, so the president said come to my office

Kind of true. There was an office involved.

> and lo and behold, the emails stopped before going 500 miles.

True.

> There’s a lot to the story that’s obviously made up,

NO! Zero of this story was made up.

ALL the people that were involved in the story are still alive. You can literally get them on the phone and talk to them. We're not debating whether or not Han Solo ever used a light saber. THIS SHIT REALLY HAPPENED.

Sheesh.
by Matthias247 | 2025-07-08 18:43:28+00:00
How does it work technically?

Does Whatsapp expose these messages via an API? If yes, then it seems like this is not only on Google.

If no: Are they reading data from raw UI widgets? Are they intercepting input controls? Are they intercepting network traffic? That seems unlikely, given its probably end to end encrypted and the decryption happens within the scope of the Whatsapp process.
by throw939394 | 2025-07-08 18:44:15+00:00
Firefox code is not fine. It is 25 years old code, with many stuff bolted on top (multithreading). It does not even have a proper security sandboxing for renderer!

This codebase was underfunded for a very long time! And all rewrites and major refactorings were cancelled!

Nobody embeds Gecko engine anymore. There are good reasons for that!
by lanstin | 2025-07-08 18:44:21+00:00
True, but however, there are times when I just really need to talk about the extremely detailed bits of some problem I'm thinking about - just the act of speech is really needed; I find this super annoying in other people, but forgivable because I also experience it. I have heard so much about minutiae from my kids that I have to force myself to just semi-actively listen to. My wife has to hear so many things that annoy her as well, when I don't get enough chattering out to co-workers or colleagues.
by joeyagreco | 2025-07-08 18:44:34+00:00
On MacOS, I just have a single key associated with my top apps.

cmd + shift + {key} takes me right there

J = Chrome K = Terminal H = 1Password ... etc

Hammerspoon setup: https://github.com/joeyagreco/dotfiles/blob/aab6c4631c4c6b09...

Global maps: https://github.com/joeyagreco/dotfiles/blob/aab6c4631c4c6b09...

(local maps are not version controlled for obvious reasons)
by greatgib | 2025-07-08 18:44:43+00:00
In my personal cases, a have multiple windows with each easily having thousand of tabs. I guess I might have around 2k to 10k of them at a single time in my computer.

Depending of the computer and phone, it might be the same thing in Firefox or Chrome.

Even on Android, despite that chrome updates in the last years made it more sluggish and buggy to have lots of tabs than it used to be like 5 years ago.

I can't understand how Google/chrome team might be so incompetent, but often reopening the browser app in android, some times are overwritten or shifted in position. Very annoying.
by MPLan | 2025-07-08 18:44:45+00:00
The debate around free-buses and transit has been often framed as a question of whether a person would prefer cheaper transit or more transit.

This framing is not actually economic - how much of a service we provide and how we fund it are two different questions. This pertains to all government services (parks, parking, healthcare etc). Fares (and lack of fares) cause externalities and those should be discussed. That's what recent economic research on Chicago showed - an optimal transport policy would set fares close to zero.
by Walf | 2025-07-08 18:44:49+00:00
You can't see how, in response to a comment that was primarily about whether "time blindness" is real, which you quoted directly, your comment comes across as dismissing any self-diagnosis as Munchausen syndrome? Did you read about that either?

>Patients with FDIS intentionally falsify or induce signs and symptoms of illness, trauma, or abuse to assume this role. These actions are performed consciously, though the patient may be unaware of the motivations driving their behaviors.

I'm not convinced 'I have that!' statements quite meet the criteria for that. You may be thinking of malingering.
by pogue | 2025-07-08 18:45:37+00:00
If you want to check out Zorin, or other popular Linux flavors, in your browser to see if you like them without having to install them on a VM/separate partition, try Distro Sea: https://distrosea.com/

There's also quite a few good reviews on Zorin on YouTube.

People should also note Zorin sells a "pro" version for around $50. I'm sure most people could achieve the same features the pro edition has without much trouble, but it also helps them with development costs and everything else.

https://zorin.com/os/pro/