MurphyA/hacker-news huggingface dataset:
by robomc | 2025-08-20 01:23:21+00:00
> because researchers from Kudelski Security most likely tried different static analysis tools and they didn't work the way Rubocop did.

Yes but that's kind of the point - they say this issue that takes you directly from code execution to owning these high value credentials was only present on rubocop runnners but isn't it a bit coincidental that the package with (perhaps, since they chose it) the easiest route to code injection also happens to be the one where they "oops forgot" to improve the credentials management?

It just seems very convenient.
by blinkymach12 | 2025-08-20 01:23:32+00:00
I like this insight. We kind of always knew that we wanted good docs, but they're demotivating to maintain if people aren't reading them. LLMs by their nature won't be onboarded to the codebase with meetings and conversations, so if we want them to have a proper onboarding then we're forced to be less lazy with our docs, and we get the validation of knowing they're being used.
by colkassad | 2025-08-20 01:23:47+00:00
In the FPS space, there used to be only three games worth modding for: Quake, Unreal Tournament, Half Life. You could make a mod back then and get tons of press and players if you could follow through. I was interviewed in popular gaming websites! The games themselves were quite simple graphically so anyone with a drip of talent, time, and motivation could contribute. That specific environment doesn't exist anymore. There are so many games now, it's an ocean, developers have exerted more control over their games, and the talent required to create content for FPS games is too high a bar now.
by Atlas667 | 2025-08-20 01:25:34+00:00
If Pol Pot was a Marxist why did Vietnam (Marxist) fight against Pol Pot?

I'll tell you.

Pol Pot was never a communist. He was an anti-intellectual who himself said he had never read Marx and said he admired Hitler. Western Nations claim he was a Marxist in order to spook the average citizen. There are also serious allegations that the CIA and the MI6 were involved in trafficking weapons to them.

The Vietnamese were seen as a threat by the Cambodian capitalists and the Chinese didn't like the Vietnamese due to the sino-soviet split. The US, China, and the UK backed Pol Pot to get at Vietnam.

Pol Pot was a populist. Asian fascism was created to counter Marxism.

Read about the CIA backed killings in Indonesia. They aided in the killing of LITERALLY 125,000 people a month in order to squash communist sentiment in Asia.

> and yet it always ends up the same, with one person in charge (chairman, commissar, supreme leader, etc.), and everyone at the point of a gun.

Where did you read that?

Did you know that the Americans have placed more dictators in power than any other state in existence?

> I’ve known many people who lived through the USSR, and a few that lived through Mao’s China. I’ve lived in Eastern Europe and seen the long term damage. This isn’t academics. This is what happens when people are given high minded academics and use it to justify atrocities - which are easy to do in this case. Almost custom made to do.

Did you know that capitalism started world war 1 AND 2? What has caused more destruction in Eastern Europe than both world wars? Did you know that most of the destruction and social chaos in Africa was caused by capitalism? Did you know that capitalism has decimated South America? Why do you not say that the poorest countries on earth are all capitalists?

I'm not here to defend or espouse the doings of past states. I'm here because I want to put power in peoples hands. The billions of us, not just the middle class. I don't want anyone above me, like there is now. I want people to have democratic power in order to end this artificial poverty that generates power for the few. All poverty world wide is sustained for profits and that is evident.
by Spooky23 | 2025-08-20 01:26:32+00:00
It’s a bug. He reported it, they fixed it.

It is not a five alarm fire for HIPAA. HIPAA doesn’t require that all file access be logged at all. HIPAA also doesn’t require that a CVE be created for each defect in a product.

End of the day, it’s a hand-wavy, “look at me” security blog. Don’t get too crazy.
by sanchitmonga | 2025-08-20 01:26:59+00:00
Demo: https://www.youtube.com/watch?v=GG100ijJHl4 Testflight for demo app: https://testflight.apple.com/join/xc4HVVJE Website: https://www.runanywhere.ai/ Follow us for more updates:https://x.com/RunAnywhereAI/

Bring SOTA language models to your device and your apps, with a few lines of integration.
by jjkaczor | 2025-08-20 01:27:55+00:00
So... basically like when Delve was first introduced and was improperly security trimming things it was suggesting and search results.

... Or ... a very long-time ago, when SharePoint search would display results and synopsis's for search terms where a user couldn't open the document, but could see that it existed and could get a matching paragraph or two... Best example I would tell people of the problem was users searching for things like: "Fall 2025 layoffs"... if the document existed, then things were being planned...

Ah Microsoft, security-last is still the thing, eh?
by legostormtroopr | 2025-08-20 01:27:59+00:00
So the solution to using AI so you don't have to code, is to try to write some kind of pseudocode in AGENT.md and hope the AI does a bit better?

Why does it seem that the solution to no-code (which AI-coding agents are) always comes back to "no-code, but actually there is some code behind the scenes, but if you squint enough it looks like no-code".
by nomel | 2025-08-20 01:28:03+00:00
I don't think that's fair. It's R&D for a potential infinite money/effort hack. Unless you're in the camp that thinks only meat can be intelligent, depending on your perspective, it can be considered somewhere between useful research and critical research, including for the pursuit of things like "housing".

Maybe all the learnings of the specific architectures/implementations will be thrown out in the end, but that's not some rare occurrence with R&D/progression.

If you think their goal is to make chatbots, then maybe this won't make sense to you.
by lmm | 2025-08-20 01:28:22+00:00
> You mean, like those silly science fiction stories where FTL travel is possible? Or time travel?

FTL or time travel are not necessarily unscientific - we know that relativity permits CTCs to exist, they're something that can be explored rigorously and scientifically. Even for stories that adopt decidedly unscientific handwave versions, one dropped stitch won't necessarily unravel the whole garment, especially when it's not the focus - if you're telling a story about life on Omicron Persei 3, how one gets to Omicron Persei 3 may well be beside the point. But yes if a story is full of things like that, even for things that are the focus of the story, then it's not science fiction.
by saurik | 2025-08-20 01:28:43+00:00
So, when Apple released the iPhone, they went out of their way to make sure that YouTube and Google Maps were on the device, to the point of making special deals with Google and developing all of the software for them (as they didn't want to give up any control)... I maintain that, given how they already have a partnership with OpenAI, it is a strange lack of vision that I can't go down to the beach and spend my day talking to ChatGPT to get things done.
by pontifier | 2025-08-20 01:30:32+00:00
Consistency is key. I need it too. With 1000 things pulling me this way and that, I get the most done when I just open my IDE and do it. It's so hard though. I feel like an agoraphobic trying to leave the house. What's the big deal? Just open the IDE and start doing stuff... but it's almost physically painful to even think about... I gotta get help.
by catmanjan | 2025-08-20 01:31:47+00:00
As someone else mentioned the file isnt actually accessed by copilot, rather copilot is reading the pre-indexed contents of the file in a search engine...

Really Microsoft should be auditing the search that copilot executes, its actually a bit misleading to be auditing the file as accessed when copilot has only read the indexed content of the file, I don't say I've visited a website when I've found a result of it in Google
by ameliaquining | 2025-08-20 01:31:58+00:00
Jules uses AGENTS.md, which indicates that Google is on board with it as the standard. If Gemini Code Assist continues to be a thing (I'm not sure whether Jules is intended to succeed it) then presumably it will support AGENTS.md as well. In the meantime you can configure Gemini Code Assist to use an arbitrary filename.

I don't see a reference to a specific filename in Aider's documentation, can you link to it?

Anthropic appears to be the major holdout here.
Ask HN: How to prepare for potential layoffs in this AI era?
by ALostEngineer | 2025-08-20 01:32:21+00:00
I'm four years into my SWE career here in the US and struggling with how to prepare for potential layoffs. Outside of emergency fund, etc.., how do I prepare to find a job again with all the horror stories of nobody hiring?

Beyond grinding LeetCode, what should I focus on to stay competitive?

I have a BS in Software Engineering from a state school but nothing higher. Any suggestions on areas to focus on?
by nmfisher | 2025-08-20 01:32:43+00:00
Filament is a great lightweight cross-platform PBR rendering library. There's a few things missing (real GPU instancing is one), but in terms of shadows/antialiasing/color grading, it's very powerful. The material (shader) language is also very accessible.

I maintain an open-source Dart/Flutter package[0] which is mostly a wrapper around Filament. This makes it considerably easier to have a single UI+codebase that runs across macOS, iOS, Android, Windows, and Web.

[0] https://github.com/nmfisher/thermion
by atleastoptimal | 2025-08-20 01:32:57+00:00
It's a new hammer

but one that is improving at an exponential pace and is developing capabilities to use itself with increasing reliability

It's easy to look at AI and draw a simple analogy to existing tools, because in most cases it is used as a tool, but the properties of intelligence and its ability to make things in the world is very unique and not comparable to any other tool.

All tools are useful because they require intelligence to use, and the tool magnifies the aim of intelligence. When the tools become intelligent themselves, certain recursive feedback loops will start to appear. Simply look at the quality of AI code outputs from 2 years ago compared to today.
by aspenmayer | 2025-08-20 01:34:59+00:00
In the past, this has been the case. I looked and didn’t see anything on the forum about this news, but it may be too soon to hit the forum? I don’t visit it very often.

https://forum.openwrt.org/t/security-advisory-2021-01-19-1-d...

https://openwrt.org/advisory/2021-01-19-1
by balamatom | 2025-08-20 01:35:32+00:00
Nice, just the other day I coded up some quick 2d shooter demo and realized I have no idea how to draw interesting sprites for it. What you're doing here with drawing the generated vector onto different sizes of grid is brilliant. A sort of structured pulsation. Same simple technique can be used for both "breathing" animation of a critter and for animating it into bigger, badder forms. Bravo.

At this point (actually before even writing the comment) If your blog had a RSS feed I'd have subscribed to it... but (at least according to my RSS plugin) it doesn't, so I fear I will miss out on your next inspiring writeups. Consider adding one, if you feel like it :-)

https://muffinman.io/invaders/#/size:15/main-seed:began-ever... is a favorite so far
by AlanClifford | 2025-08-20 01:36:28+00:00
AI will reshape software engineering, but it won’t eliminate it. The boring stuff, such as coding, routine QA, and documentation, is bounded and pattern-heavy, so AI will eat that first.

The real bottleneck has never been typing. It’s figuring out who the stakeholders are, what they need, and why. That’s messy, political, and brutally hard to automate. For most products, the critical work is defining the problem, not writing the solution.

That kind of work requires soft skills, requirements engineering, deep domain knowledge, and prompt engineering. It’s also much harder to outsource, because deep language and cultural awareness are critical.

If you want to future-proof your career, focus on being really good at understanding and defining the problem to be solved.
by joegibbs | 2025-08-20 01:36:38+00:00
I think they'll always need special guidance for things like business logic. They'll never know exactly what it is that you're building and why, what the end goal of the project is without you telling them. Architectural stuff is also a matter of human preference: if you have it mapped out in your head where things should go and how they should be done, it will be better for you when reading the changes, which will be the real bottleneck.
by goosejuice | 2025-08-20 01:36:53+00:00
I suspect machine readable practices will become standard as AI is incorporated more into society.

A good example is autonomous driving and local laws / context. "No turn on red. School days 7am-9am".

So you need: where am I, when are school days for this specific school, and what datetime it is. You could attempt to gather that through search. Though more realistically I think the municipality will make the laws require less context, or some machine readable (e.g. qrcode) transfer of information will be on the sign. If they don't there's going to be a lot of rule breaking.
by ecb_penguin | 2025-08-20 01:37:25+00:00
> CVEs are for vulnerabilities that are common across multiple products from multiple sources.

This is absolutely not true. I have no idea where you came up with this.

> Honestly, the worst thing about this story is that apparently the Copilot LLM is given the instructions to create audit log entries.

That's not at all what the article says.

> That’s the worst design I could imagine!

Ok, well, that's not how they designed it.

> This is just engineering 101.

Where is the class for reading 101?
by thaumasiotes | 2025-08-20 01:39:47+00:00
> it's wild to see a whole underground city made by human hands thousands of years go.

Fun fact: those cities buried in hills on the plain are called "tells".

They're called "tells" because, thousands and thousands of years ago when Mesopotamia spoke Old Akkadian, they were called "tells". The concept was old then.

https://en.wiktionary.org/wiki/t%C4%ABlum#Akkadian
by AnimalMuppet | 2025-08-20 01:40:26+00:00
> Marx's Capital is actually a very well written piece of research

Marx's Capital is actually a very well written piece of bad research. He cherry-picked the data, ignoring evidence that was available to him that disagreed with the conclusions he was reaching. Let me say that again: There was evidence against his theories present in the data he was perusing.

> Nah. The central point of Socialism/Communism is the DEMOCRATIZATION of production.

How does that work out? You can call what happened "democratization", but it sure looks like central control to me - central control by an authoritarian. That's what has happened every time.

You know how they say "the purpose of a system is what it does"? Well, at least by that standard, no, the purpose of communism is not the democratization of production, because that's not what it does.
by socalgal2 | 2025-08-20 01:40:39+00:00
the post is gaslighting his own mom

> It’s that some of the folks who used to use it that way don’t remember that they did. When I asked my mom to define the word this week, she used the modern meaning, with no apparent recollection of her former firm conviction that a jerk was a dope, dodo, or dimwit. Did someone Neuralyze my mom,

No, they didn't. It's well documented the meaning was already changing in the 70s. "The Jerk" the movie might make it seem ambiguous but usage meaning "obnoxious/asshole" was common in the 70s and 80s. Dictionary defintions just mean they were out of date to common usage.

It doesn't help that you can warp the "idiot" meaning into the "obnoxious" meaning in the form of "If you'd stop being stupid you'd realize your being obnoxious".

> In fact, “the 1970s is when you start to see the obnoxious meaning really take off,” says Michael Adams, an English professor and specialist in lexicography at Indiana University Bloomington and the author of Slang: The People’s Poetry and other books about language. Not only was there “a rising use of ‘jerk,’” but there was also “the absolutely predictable development” of “compound forms like jerk ass, jerk face, jerk wad, jerk weed. … That is another reflection of the obnoxious meaning, and basically a generation of heavy slang users looking for a way not to sound like they come from the 1930s by using jerk in the traditional way of their parents and grandparents.” Martin, Adams notes, was in his mid-30s when The Jerk came out, old enough that in contrast to the kids on the cutting edge of jerk usage, he would have been “referring to an older use of the word.”
by CommenterPerson | 2025-08-20 01:40:48+00:00
I have employer provided health insurance. I'm an immigrant from India and routinely postpone non urgent care to my annual trips there. One does need pointers to good clinics. I get great care at low cost. With none of the bureaucracy and arrogance I see in my adopted country unfortunately. When I get my additional blood tests, I never have the blue bruise that I usually get here at Quest or LabCorp. This year I'm going to get a wisdom tooth extracted. My amazing family doctor answers questions on Whatsapp for a very nominal fee.

Healthcare in the United States is broken. Avaricious profit mentality from all the players broke it. We need to vote for leaders who are not on the payroll of these players, to fix this very serious problem. I don't have much hope. Even educated people as on HN keep quoting the same tired capitalist propaganda.
by privong | 2025-08-20 01:40:48+00:00
> Radio astronomy was an accidental offshoot of this project: they noticed the reflected microwave signals from space came back with some extra noise...

Perhaps you're conflating Project Echo with Karl Janksy's Bell Labs research in the 1930s? Radio astronomy's "birth" is probably best set to when Jansky detected radio emission from the Milky Way in 1932-1933 while trying to identify the source of noise in wireless telephone transmissions.

Grote Reber picked up radio astronomy in the pre-war (WWII) years and then the advancement of RF technology for radar during WWII led to some further discoveries (e.g., radio emission from the Sun). After WWII, radio astronomy initially had good participation from radar folks.

Many national radio observatories were already in existence before Project Echo. Jodrell Bank Observatory (UK) was established in 1945. ASTRON (Netherlands Institute for Radio Astronomy) was founded in 1949. The US's Green Bank Observatory was created in 1956 and this led to the creation of the National Radio Astronomy Observatory in 1959. Parkes, in Australia, was completed by 1961.

Radio astronomy was well under way before Project Echo.
by tony-yamin | 2025-08-20 01:41:00+00:00
This is a good question. Parachute is not a certification body so we do not help you pass audits. Instead we help with internal decision-making surrounding the implementation of AI tools. We also help hospitals keep track of why decisions we made and who made them to produce to regulators and litigators in the future. Parachute does not assume any liability during production deployment.
by GlitchRider47 | 2025-08-20 01:43:26+00:00
I wouldn't say it is unusable lol. Many people don't need to sync. My work notes for example stay on my work computer.

For those that want to sync without paying, many use syncthing, though I don't think this is a feasible workaround for iOS users.

There are some other syncing methods that I haven't really looked into.
by naniwaduni | 2025-08-20 01:43:49+00:00
> It isn't a hobby, because Vim and Emacs allow me to perform in a way that I consider far more enjoyable, productive and satisfactory than I ever had before them. That is of course on a personal empirical basis - I cannot promise them having the same effect on anyone else.

> I honestly don't know why more people don't gravitate towards these ideas. Perhaps, because these ideas are kind of like 'meditation' - people say one can only experience the mind shift after practicing it for some time.

idk this reads a lot like tl;dr: it's a hobby.
by aspenmayer | 2025-08-20 01:44:05+00:00
I think there were two sets of 7 total vulnerabilities at the same time so they might be perceived as one event? I don’t know for sure, the wording was kind of ambiguous.

https://openwrt.org/advisory/2021-01-19-1

> Dnsmasq has two sets of vulnerabilities, one set of memory corruption issues handling DNSSEC and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on the target device and perform cache poisoning attacks against the target environment.

> These vulnerabilities are also tracked as ICS-VU-668462 and referred to as DNSpooq.

https://web.archive.org/web/20250121143405/https://www.jsof-...

> DNSpooq - Kaminsky attack is back!

> 7 new vulnerabilities are being disclosed in common DNS software dnsmasq, reminiscent of 2008 weaknesses in Internet DNS Architecture

Some less breathless sourcing, though I can’t blame OP for being excited in the above post:

https://www.kb.cert.org/vuls/id/434904

https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-...
by computerdork | 2025-08-20 01:44:08+00:00
Yeah, streaming does continue to keep music prices low, but for us who followed the music industry, the major damage to pricing happened 25 years ago. This was when p2p file sharing was at its height, and the music industry was in a tail spin and revenue was nose diving. Then the iTunes store came out and allowed customers to be single songs for a dollar (instead of the whole album). This was a necessary compromise the music industry had to do because young people weren't buying music any more. This sealed the deal and the end of it, the music industry was about half the size it was only a few years ago.

Yeah, Spotify does screw musicians really horribly. Don't know what the solution is, but was talking with someone else here, and maybe piracy is not a big factor with the music industry anymore. With the rise of DAW's so that making music is really easy, and youtube as a primary source to market music, piracy really isn't as big a deal. This sounds reasonable to me (not great state of things, but not bad).
by JdeBP | 2025-08-20 01:46:06+00:00
Psst! NSD isn't a "resolver" at all. Traditional DNS terminology is tricky to use (given that what is covered by "resolver" in the RFCs does not match how most people see the system as divided up) but something that does not do the resolving part at all is definitely not a resolver.

* https://jdebp.uk/FGA/dns-server-roles.html
by socalgal2 | 2025-08-20 01:46:25+00:00
It wasn't funny when it came out, for me, and I was a big fan at the time :P

Steve Martin's comedy in general isn't funny anymore for me. I listened to his 70s albums which I found hilarious when I was a kid. Nothing about them is funny anymore. The jokes themselves aren't funny. It's only the delivery that made them funny and that style of delivery doesn't work anymore. He's been in some great movies, some of which are comedies and still funny but his own stand up comedy isn't anymore, at least for me.
by jauntywundrkind | 2025-08-20 01:46:41+00:00
The whole post here is nicely replete with good information, on how things are going to work what the situation is.

I really really dig the "Decision Process" section in particular, because it goes over so many what-if scenarios. https://oxc.rs/blog/2025-08-17-oxlint-type-aware.html#decisi...

More than just trying to stake your claim, talking up your thing: to situate your audience and help them to see the broader view, to get many what-if's flowing: that is divine.