MurphyA/hacker-news huggingface dataset:
by formerly_proven | 2025-08-28 14:54:43+00:00
The article claims this is based on Token Binding, but skimming the W3 spec it seems to be something entirely different and not at all to be based on or related to TLS Token Binding (with an integration already envisaged by the WebAuthN spec). TB doesn't need or rely on a TPM at all, it conceptually just ties bearer tokens to a key which is (re-)used across TLS sessions; for upper layers this is transparent, but for attackers it makes it much harder to use exfiltrated tokens.
by gjsman-1000 | 2025-08-28 14:54:50+00:00
> You all don't understand how any of this tech works but you think you do.

We do; and it is specifically called out in the spec that the certificate chain is not submitted, due to the potential for overpowered fingerprinting. As such, this battle, should they make a move to change that, needs to be fought a different day. Fighting against hypotheticals is pointless.

Edit: For the pedantic, fighting against hypothetical things that they could do if they invented something that doesn't exist right now, is pointless.

Edit 2: You can't boil a frog without ecosystem cooperation. The internet isn't going to bow to inconsistent adoption. They already made it clear with WEI they have no interest.
by akagusu | 2025-08-28 14:55:13+00:00
The Linux Desktop is not failing because there is no such thing as Linux Desktop.

Windows is an operating system made by Microsoft for PCs, macOS is an operating system made by Apple for Macs but a product call Linux Desktop does not exist.

There is Ubuntu, REHL, Debian, Fedora, Arch and many other operating systems based on the Linux kernel - which is a just a kernel - that are built for different purposes, none of them targeting mainstream desktop usage.

In the history of operating systems based on Linux there were a few products targeting mainstream desktop users like Lindows and Ubuntu, but the only really successful, at least for some time, was Ubuntu.
by mananaysiempre | 2025-08-28 14:55:14+00:00
I believe Guix also borrowed[1,2] the bootstrap chain[3,4,5] written by Jeremiah Orians, same as you did.

[1] https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-...

[2] https://www.gnu.org/software/mes/

[3] https://bootstrapping.miraheze.org/wiki/Stage0

[4] https://savannah.nongnu.org/projects/stage0/

[5] https://github.com/oriansj/bootstrap-seeds
by 4fips | 2025-08-28 14:55:16+00:00
The only browser bookmark I use is:

javascript:window.prompt("Title + URL:",document.title+"\n"+document.URL);

Which when clicked, opens an alert with 2 lines like this:

Bookmarks.txt is a concept of keeping URLs in plain text files | Hacker News https://news.ycombinator.com/item?id=45047572

I then paste this into my bookmarks.txt and have a simple text editor script to perform fuzzy searching on it and open a web browser tab with the found URL.
by smt88 | 2025-08-28 14:55:25+00:00
> What I bet is happening under the covers is reprioritization of work, offshoring or both.

AI has been frequently used as an explanation for layoffs.

Before AI, layoffs would be a positive signal to investors, but they'd be demoralizing to staff and/or harm the brand.

Now, you can say, "Wow, we're so good at technology, we're eliminated ___ jobs!" and try to get the best of both worlds.
by kstrauser | 2025-08-28 14:55:28+00:00
Oh, sure. They’re not going to fly someone out to fix a retail customer’s monitor. I get that and would never expect that level of service.

And yet, they doubled down hard on refusing to replace my defective 6 month old, still under warranty, screen. Amazon was the hero in this story. They listened to my story and gave me a refund, which I spent with a different brand.

It felt wonderful explaining to their enterprise rep why we were rejecting their bid and going with a different vendor.
by socalgal2 | 2025-08-28 14:55:32+00:00
That is not a repo of the code in the article. The article's code is effectively

set_href('/foo'); let future = doSomethingElse() block_on(future) if (some_condition) { set_href('/bar'); }

This code makes the bug clearer. doSomethingElse is effectively allowing the page to exit. this would be no different in many apps, even in rust.

The browser does not start a process when you set `window.location.href`. It starts a process after your code exits and lets the event loop run other tasks. The `await` in the example code is what allow other tasks to run, including the task to load a new page, (or quit an app, etc..) That task that was added when you set `window.location.href`

If that's not clear

// task 1 window.location.href = '/foo' // task2 (queues task2 to load the page) let content = await response.json(); // adds task3 to load json // which will add task4 // to continue when finished // task4 if (content.onboardingDone) { window.location.href = "/dashboard"; } else { window.location.href = "/onboarding"; }

task2 runs after task1. task1 exits at the `await`. task2, clears out all the tasks. task3 and task4 never run.
by Mallowram | 2025-08-28 14:55:37+00:00
btw what this means neurobiologically/neurodynamically is that arbitrary language's only function is to refute itself. That is its only form of reasoning or logic in grammar. It's only a temporary palliative that eventually gets revealed (AI does a great job of this, better that media or the web) that embeds simian bias seamlessly. It demands a direct, concatenated, irreducible form of signaling.
by Topfi | 2025-08-28 14:55:44+00:00
They've already shared it under a none-commercial use license: https://github.com/tldraw/draw-fast

The TLDraw team, from what I have seen, is really open in sharing their experiments under their own license. Not FOSS strictly, but I feel their licensing approach and decision is fair considering how they fund development, know that it's a contentious topic though for some.
by freehorse | 2025-08-28 14:56:15+00:00
You can do it after, remove all commas and newlines. Make it all a huge continuous blob of text that is hard to read. Definitely not LLM written.

A lot of this here imo is just llm paranoia. I do not think the style of the author is different than their pre-llm posts. One em dash is not proof of anything imo as long as the text in general does not smell as much like llm-generated. I could be wrong because I do not interact much with llms lately, but it does not seem that to me.
by layer8 | 2025-08-28 14:56:15+00:00
Here “on Tuesday” is ambiguous, in my opinion. I first thought it meant “on a Tuesday” and that it was just a diversion. But it is likely intended to mean “last Tuesday” or “this Tuesday” (which excludes the boy-then-girl case). Wording it more clearly would likely reduce the ratio of wrong answers.

Furthermore, “of different ages” is likely intended to exclude the case of twins. However, even with twins, one is generally nominally older than the other. (Not to mention that it’s possible for two non-twin siblings to be the same age in years, at certain points in time.) Why not just say “that aren’t twins”?

I loathe when logic puzzles are obscured by ambiguous language, turning them more into “gotcha” text interpretation riddles than logic puzzles.
by lifeisstillgood | 2025-08-28 14:56:30+00:00
Stat of the day:

US deaths from over-heating / heat exposure per year - approx 1300

European deaths from over-heating / heat expoaure per year - approx 175,000

It’s a huge gap and HVAC is the prime answer, and willingness to hold back HVAC to cope with climate chnage is a major driver

It’s a dilemma to be sure - interesting what options exist
by WalterBright | 2025-08-28 14:57:08+00:00
> Much of the terrain doesn't allow for heavy equipment use

Do the areas that are reachable. After all, somehow roads manage to get constructed.

> or the budget

Well, the budget for the devastation from the fires will be orders of magnitude more.

Fences can also be constructed that will stop flaming debris from being pushed across the ground.
by utyop22 | 2025-08-28 14:57:21+00:00
I agree. What's worse is, the upper layer and middle layers of management are filled with bozo's looking out for their own interests and have no desire to find those with potential and hone them.

Business school is a terrible proxy for future business leaders.

It boggles the mind how these firms have bloated to the size they have - it's the cost of ill-disciplined management from the top.
by jszymborski | 2025-08-28 14:57:46+00:00
Tell that to dock workers, who have successfully delayed the automation of ports to the extent we see them automated in e.g. the PRC [0].

Hell, they're even (successfully) pushing back against automated gates! [1]

[0] https://www.cnn.com/2024/10/02/business/dock-workers-strike-...

[1] https://www.npr.org/2024/10/03/nx-s1-5135597/striking-dockwo...
by username332211 | 2025-08-28 14:57:48+00:00
Well, depending on the sort of other laws you've supported, that shouldn't be very surprising.

The special interest of a particular group always result in far more intense support than any law that benefits the public at large. And privacy is usually a general concern.

Also, am I the only one who finds the idea that you need to demonstrate the existence of political capital to elected politicians concerning? (As opposed to persuading them that it's the right thing to do.) I don't want to sidetrack the whole discussion, but this makes me doubt the future of western democracy in a hundred different ways.
by schiffern | 2025-08-28 14:57:48+00:00
>You were careful to say "on land," but I wanted to highlight it for anyone who isn't familiar enough with the argument to spot the hedging.

I didn't know saying what I meant is such a heinous crime. :) But to make things fun here's a nice strong claim:

E-Gas won't work for airplanes either.

That's because A) E-Gas converters are not free and not 100% efficient, so it's more like 5x the cost in best-case-scenario (vs 10x today), and B) the aviation industry is well aware that corruption is simply cheaper.

E-Gas will not happen. What will actually happen is more of the same:

1) aviation will continue to use E-Gas (and some costly demo flights) as a greenwashing tactic while behind-the-scenes working to soften climate goals,

2) eventually the intermediate technical-economic-policy compromise will be to only use fossil fuels for aviation, and

3) in the long-long term aviation will go electric too, only with slightly different routing and network design to accommodate the reduced range (this has a cost, but by then fossil fuels will be costlier).

E-Gas is good for nothing except greenwashing fossil fuel assets, hence the big push on HN. Gotta fool your talent pool that they're not 'really' part of the problem. This both lowers labor cost and delays effective regulation, since engineers tend to be thought-leaders in crafting future policy.
by blitzar | 2025-08-28 14:57:56+00:00
A bit oldskool but go retro and try a tv "broadcast" ... anyone who is actively listening at 8:30:000 gets it served to them.

I am getting strong "tech bros invent the bus in 2025" vibes. Putting Founder, CEO, Cereal Entrepreneur on your linkedin bio doesnt make you instantly a genius.
by FirmwareBurner | 2025-08-28 14:58:00+00:00
Indeed, just look at the CGI VFX industry of Hollywood. US invented it and was the leader for a long time, but now it has been commodified, standardized and run into the ground, because union or not, you can't stop US studios form offshoring the digital asset work to another country where labor is 80% cheaper than California and quality is 80% there. So the US is left with making the SW tools that VFX artist use, as the cutting edge graphics & GPU knowhow is all clustered there.

Similarly, a lot of non-cutting edge SW jobs will also leave the US as tooling becomes more standardized, and other nations upskill themselves to deliver similar value at less cost in exchange for USD.
by larodi | 2025-08-28 14:58:25+00:00
Curious indeed, no offense in my previous comments, Sir. Perhaps you are the same Milen who worked on Socialite? Not sure I find it in your resumee but the Джумеров name matches this article .) https://www.novinite.bg/index.php/articles/6180/Prilojenieto...

Congrats on your work and achievements.
by aleksejs | 2025-08-28 14:58:35+00:00
I'm not sure I follow your point: how would a web service provider use a user's TPM in a pre-DBSC world? "Use hardware based attestation to tie the session token/cookie to the device" is pretty much exactly what DBSC does.

DBSC is intended to be deployed opportunistically alongside regular cookies, so users on devices without TPMs just won't benefit from the additional protections that DBSC provides.
by JohnBooty | 2025-08-28 14:59:01+00:00
If you write concise but with some panache, people *will* think you LLMed it. I've had the accusation leveled at me with rising frequency since ~2023

Nobody's ever accused me, but I am definitely conscious (paranoid) about the possibility. I have found myself editing my words to look "less LLM-like"

What a world!
by gtirloni | 2025-08-28 14:59:17+00:00
Can you imagine that question being asked thousands of times per second around the globe vs a well built app?

Also, how many years do you think it will take for AI to reach that level of creating a bugless app that won't need a real developer to look at not even a single time?

Will users stay around for hours for the app to be built and deployed after they ask their question?
by Procrastes | 2025-08-28 14:59:19+00:00
I have --- set to autocorrect to —. I've been using it in formal writing for 30 years. When we were in high school, we had a "Dash Party" in English class, where we ate Twinkies and learned about the different dashes.

I would argue that LLMs overuse the emdash more because they overuse specific rhetorical devices, e.g. antithesis, than because they are being too correct about punctuation.
by OskarS | 2025-08-28 14:59:31+00:00
You're correct in principle, but I'm saying that "in practice", boolean arguments are usually feature flag that changes the behavior of the function in some way instead of being some pure value. And that can be really problematic, not least for testing where you now aren't testing a single function, you're testing a combinatorial explosions worth of functions with different feature flags.

Basically, if you have a function takes a boolean in your API, just have two functions instead with descriptive names.
by thatguysaguy | 2025-08-28 14:59:37+00:00
37 billion bytes per token?

Edit: Oh assuming this is an estimate based on the model weights moving fromm HBM to SRAM, that's not how transformers are applied to input tokens. You only have to do move the weights for every token during generation, not during "prefill". (And actually during generation you can use speculative decoding to do better than this roofline anyways).
by sirwhinesalot | 2025-08-28 14:59:45+00:00
I had a somewhat related idea to this which was simply to track reference stability (i.e., is there any operation beyond freeing the data outright that will invalidate them).

A reference into a vector is unstable so you can only have 1 mut xor N read. A reference into an arena is stable so you can have all the muts you want, but they cannot be sent across threads.

Reference to object vs reference to contents is also related, you can safely have multiple mut references to the same object that cannot invalidate each other, even if they invalidate references to the contents.

This can be tracked with path analysis as employed by Hylo (Hylo only has second class references, but I mean the algorithm they use to track paths is applicable).
by arp242 | 2025-08-28 14:59:55+00:00
> A perfect example: the Python documentary releases tomorrow, featuring interviews with Python community leaders and contributors. Despite creating one of the most foundational Python libraries in history, I wasn't even contacted about participating. No email, no mention, complete invisibility. The omission speaks volumes about how mental health disclosure transforms you from community asset to community liability

It features 22 people, which already seems quite a lot for a 90 minute documentary. And I can think of several other prominent Python people who are not listed. And lets be real here: "I made a Python library people like" really doesn't compete against "I was a core Python dev for 20 years". requests being "one of the most foundational Python libraries in history" seems quite exaggerated.

This kind "I need to be front and centre of attention and when I'm not I am being oppressed" type stuff is a big part of the reason why so many people found it hard to work with Kenneth. His constant self-aggrandizing and need for endless validation gets very tiring very fast.

I appreciate that Kenneth's mental health struggles are very real and I do not mean to devalue that in any way, but his constant use of his mental health to dismiss and and all criticism of his behaviour is another thing that gets very tiring very fast.

Of course I have no insight in many aspects of Kenneth's life and can't comment on any of it. I am perfectly willing to believe that sometimes in some places he has been discriminated due to his mental health diagnosis.

I can however comment on the state of things in Python because much of it is public, and the problems there have been mostly or entirely unrelated to his mental health diagnosis.
by sfn42 | 2025-08-28 15:00:22+00:00
It certainly isn't all about money, though I think the money is worth talking about. Anyway you're welcome to make up your own mind, I thought the blog seemed credible and reasonable and it certainly cast some light on why this person is having social problems beyond just a diagnosis.

I wasn't really looking for information to discredit Reitz, it was just the first thing I stumbled upon.
by nemomarx | 2025-08-28 15:00:25+00:00
It's more like 4 or 5 uses of it, and some of the phrasing choices also have that vibe. Everyone's threshold for the smell will be different, of course.

It seems to me like it's more effort to write something and then have an llm clean it up instead of just posting it so I mostly don't understand the behavior to start with. Why are we going through this new effort?
by WillPostForFood | 2025-08-28 15:00:25+00:00
When the Stanford paper looked at augment vs automate, they used the data from Anthropic's AI Economic Index. That paper defined the terms like this:

We also analyze how AI is being used for tasks, finding 57% of usage suggests augmentation of human capabilities (e.g., learning or iterating on an output) while 43% suggests automation (e.g., fulfilling a request with minimal human involvement).

From the data, software engineers are automating their own work, not augmenting. Anthropic's full paper is here:

https://arxiv.org/html/2503.04761v1
by MontyCarloHall | 2025-08-28 15:00:28+00:00
This is the crux of the "paradox," which is really just an interpretation problem. Most people assume that the question asks exactly your scenario, i.e. if a specific child is selected and it's a girl, what's the probability that the sibling is also a girl? In that case, the event space is just GB or GG, and p(GG)/(p(GB) + p(GG)) = 0.5. (BG is not in the event space because we are conditioning on a specific child being a girl.)

However, if the question is interpreted as "what's the probability of having two girls if we know there aren't two boys," then the event space is GB, BG, GG, and p(GG)/(p(GB) + p(BG) + p(GG)) = 1/3. Both GB and BG are in the event space because we are not conditioning on the sex of one specific child.
by mdaniel | 2025-08-28 15:00:41+00:00
Please offer an implementation of the docker-credential helper, just like chainguard does with docker-credential-cgr[1], and don't put throwaway text that says "docker supports credential stores, so good luck to you" on your website https://docs.minimus.io/foundations/authentication#using-a-c...

1: https://edu.chainguard.dev/chainguard/chainguard-images/chai...
by AnotherGoodName | 2025-08-28 15:00:43+00:00
Because it's entirely dependent on sampling assumptions. Go to a random house where there's two children, one of which randomly opens the door. Each bb, gg, bg, gb is equal probability and a random child opens the door.

Now if you see a boy disregard that since you can't make the statement that one is a girl.

If you see a girl go ahead and make the statement "a family has two children. You're told that at least one of them is a girl.

What is the probability now?

You have twice the chance of making that statement if you encounter a gg family over a bg/gb family right since there's one of two girls possibly answering the door amongst those families.

So 50% chance of that statement being enabled from a gg family, 25% chance coming from a bg family, 25% chance of coming from a gb family. Which means 50% chance the other child's a girl and 50% chance the other childs a boy.

The probabilities here are entirely dependent on details of the sampling which is not made explicit here.
by dghlsakjg | 2025-08-28 15:01:02+00:00
Why?

The DOD is one of the world's largest organizations. There are people there who do things like publish newsletters and put up webpages for people like boy scouts to arrange tour bases. It is totally fine to use Node for things like that.

Those systems are not connected to the systems that fire missiles. If the sign up page for the 4th of July fireworks announcement gets vandalized, it isn't really an issue.
by Cilvic | 2025-08-28 15:01:13+00:00
I'm waiting for this! But I'm to consumer / usage is rare for me to build from repo

how often did I pickup my phone and just want to say "Hey my parents are over for my 5yo's birthday can we have something upbeat while we eat cake" and then be able to follow up "less vocals and a bit slower" to adjust the mood.
by VagabundoP | 2025-08-28 15:01:14+00:00
hmmm seems interesting.

I've always been a really good sleeper. The cold feet trick worked for me because I grew up in a house without central heating in Ireland. So if I woke I'd toddle to the toilet and back, by the time I did that I was properly cold. And I run quite hot so I heat up under the covers quickly. boom back to sleep.
by bsenftner | 2025-08-28 15:01:41+00:00
> In either case you are left with sticking to the prescribed reality or you say fuck it and go down any of the spiritual and or occultist rabbit holes.

Too limiting. Make one's assessment to the best of their ability and satisfaction, which is all one can do, and then act out that reality for better or worse. Learn academically or via hard knocks self deception, or never learn and experience a life an anguish. Which is all anyone and everyone does anyway.
by Topfi | 2025-08-28 15:02:12+00:00
That doesn't seem compatible with what he stated more recently:

> We're profitable on inference. If we didn't pay for training, we'd be a very profitable company.

Source: https://www.axios.com/2025/08/15/sam-altman-gpt5-launch-chat...

His possible incentives and the fact OpenAI isn't a public company simply make it hard for us to gauge which of these statements is closer to the truth.
by 542354234235 | 2025-08-28 15:02:25+00:00
My brain defines my whole life. Risking damaging the thing that defines everything I love, hate, have interest in, or remember is a pretty high bar. Blind people live pretty rich, full, independent lives, even if they have to forgo many things the sighted enjoy. I don't know if I would say the same for the severely brain damaged.
by zerocharge | 2025-08-28 15:02:54+00:00
It's meant in a tongue in cheek way. Day to day I develop in C# and Typescript/React using all the latest bells and whistles. Long for the simpler times though. The time before product managers, Scrum and ticket driven development. All the tickets drive the complexity that maybe shouldn't exist. Hard to push back against feature requests when it's a one-way street.