MurphyA/hacker-news huggingface dataset:
by thijson | 2025-08-27 12:52:40+00:00
I remember my computer science professor talking about this, how critical safety can be in software. Another example he gave was the refueling machine at a nuclear power plant, it had fell off the tracks and broke the pipe that goes through the reactor due to a software bug. Also he mentioned the software in his pacemaker.

Engineers in other fields need to sign off on designs, and can be held liable if something goes wrong. Software hasn't caught up to that yet.
by 1718627440 | 2025-08-27 12:53:17+00:00
> Having to pass the object explicitly every time feels clunky, especially compared to C++ where this is implicit.

I personally don't like implicit this. You are very much passing a this instance around, as opposed to a class method. Also explicit this eliminates the problem, that you don't know if the variable is an instance variable or a global/from somewhere else.
by AndrewDucker | 2025-08-27 12:53:50+00:00
The government, by saying that there was a single zone, despite the electricity not actually working that way (because interconnectors don't have infinite capacity), were defying economics.

By breaking the country in to zones, where the electricity that's bought can actually reach the users they then apply the actual economics of the system properly, and encourage suppliers to build where the demand can be satisfied by them.
by zOneLetter | 2025-08-27 12:54:06+00:00
lol that prompt is actually pretty decent!

Technical debt increase over the past few years is mind boggling to me.

First the microservices, then the fuckton of CI/CD dependencies, and now add the AI slop on top with MCPs running in the back. Every day is a field day for security researchers.

And where are all the new incredible products we were promised? Just goes to show that tools are just tools. No matter how much you throw at your product, if it sucks, it'll suck afterwards as well. Focus on the products, not the tools.
by 0xDEAFBEAD | 2025-08-27 12:54:38+00:00
>it's "just" for stealing government and EU money, which a lot of people don't actually mind

I think your double standard is pretty clear at this point. I won't be offering further replies to you in this subthread after this one.

>Comparing to a delusional and senile old man who is literally convicted of rape, and there is plenty of credible evidence, out in the open, is also a pedophile. With a shit program with little concrete other than fucking up groups of people. After seeing his "work" his first term.

IMO, the fundamental reason people in the US vote for Trump is because they don't trust the establishment/media. So yeah, if you uncritically believe everything that's reported about Trump in left-leaning ("mainstream") US media, of course you won't understand why people vote for him.

I'm no Trump voter, but I think conservatives have good reasons to distrust the establishment/media: https://slatestarcodex.com/2017/05/01/neutral-vs-conservativ...
by stinkbeetle | 2025-08-27 12:54:52+00:00
> I've always wondered though how it works with KVM

Other people have given some more comprehensive explanations, but I'll try to put it as simply as possible.

Plain QEMU has a CPU emulation layer called TCG. The machine basically consists of memory (RAM and MMIO devices) and CPUs (CPU registers and state). When QEMU has set up the machine and is ready to run, it calls TCG to say "given this memory and this initial CPU register state, start running instructions". When you use QEMU with KVM, the TCG emulation layer is swapped out with KVM and it asks KVM to start running instructions. That's it. KVM exposes APIs that caller can specify guest memory and initial CPU register state, and a call to run that CPU with that memory.

Going a bit further, the hardware virtualization functions that KVM uses have the ability to map that memory with a second level of translation which lets KVM present it to the guest at the locations it expects, and to prevent the guest from accessing any memory that it should not. The hardware also has the ability to run the CPU in a mode where it has the normal set of registers (which is what QEMU wants), but it maintains some additional hypervisor control registers not available to the guest, and those can ensure the guest can't take complete control of the CPU (for example, the guest OS can "disable interrupts" with the usual MSR or similar bit and that does prevent the guest from getting interrupts, but that it does not disable hypervisor directed interrupts, so the hypervisor can always take back control of the CPU with a hypervisor-IPI or hypervisor timer interrupt).

Further still: when running in plain QEMU mode, devices are emulated by registering MMIO ranges in the memory address space and emulated loads and stores have code to detect these regions and instead of performing a simple load or store, they call into device model code which handles it accordingly. When you plug KVM in, you can still use these emulated devices. These are modeled by using that second level page table to put "not-valid" mappings in those MMIO ranges. These cause the CPU to trigger a page fault when it tries to access them, and KVM sees this, looks up the table of memory registered by QEMU, and sees that it is an address which QEMU wants to handle, so it returns from the KVM_RUN system call with result code that indicates there was an MMIO read/write that needs to be handled. QEMU then directs this into its emulated device model. Then when QEMU has performed that device emulation, it calls back into KVM to continue running the CPU.

It's all pretty clever. The really astounding thing is that most of the basic concepts for all this stuff were developed/discovered/invented like 50+ years ago.
by f311a | 2025-08-27 12:55:03+00:00
People really need to start thinking twice when adding a new dependency. So many supply chain attacks this year.

This week, I needed to add a progress bar with 8 stats counters to my Go project. I looked at the libraries, and they all had 3000+ lines of code. I asked LLM to write me a simple progress report tracking UI, and it was less than 150 lines. It works as expected, no dependencies needed. It's extremely simple, and everyone can understand the code. It just clears the terminal output and redraws it every second. It is also thread-safe. Took me 25 minutes to integrate it and review the code.

If you don't need a complex stats counter, a simple progress bar is like 30 lines of code as well.

This is a way to go for me now when considering another dependency. We don't have the resources to audit every package update.
by JdeBP | 2025-08-27 12:55:07+00:00
> Are you using a compromised version of nx?

> Run semgrep --config [...]

> Alternatively, you can run nx –version [...]

Have we not learned, yet? The number of points this submission has already earned says we have not.

People, do not trust security advisors who tell you to do such things, especially ones who also remove the original instructions entirely and replace them with instructions to run their tools instead.

The original security advisory is at https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7... and at no point does it tell you to run the compromised programs in order to determine whether they are compromised versions. Or to run semgrep for that matter.
by inopinatus | 2025-08-27 12:55:27+00:00
That is kinda my point though. None of those are kernels, device drivers, hypervisors, virtual machines, interrupt handlers, bootloaders, dynamic linkers; and writing such things in Go would be an uphill battle against the language's own design, much like the Go runtime itself. Being a GC'd language almost completely fences Go off from even being in the running for these, except for hobby projects trying to prove a point.

Universal applicability may not be necessary to write a Ruby installer, but it certainly is to have any hope of taking C's crown.
by aquariusDue | 2025-08-27 12:55:35+00:00
As another Emacs user it'll remain immensely funny to me how Emacs can be shoe-horned into almost any conversation. Probably due to the fact that even when it's not the best tool for the job, by any stretch, it can be kludged into something useful enough.

And yeah, regarding writing (fiction and non-fiction) there's Emacs Writing Studio which people praise and I haven't personally used: https://github.com/pprevos/emacs-writing-studio

There's also some packages like Olivetti or Writeroom-mode for just a "Zen mode" writing experience.
by coxley | 2025-08-27 12:55:40+00:00
Are there any enhancements that you've wanted to do, but haven't had the time?

I'm a huge fan, and am surprised how stable Monodraw has been for me. I've kept a single, growing document open as a scratch pad for the last three years. The only downtime was converting it to the new-ish file format haha.
by scotty79 | 2025-08-27 12:55:44+00:00
> We need these things to be legislated. Punished.

That's harsh. Way more people in history killed themselves because they read a moody book than because interaction with AI pushed them in this direction. Werther effect.

How many suicides is music "responsible" for? Movies? Theatre? Clubbing? Friends?

You can't legislate people out of being danger to themselves by punishing all the possible triggers.
by api | 2025-08-27 12:55:57+00:00
It seems like the mobile ecosystem is the most user-exploitative of all software ecosystems.

Outside apps for accessing useful services or doing work, everything seems designed to addict, manipulate, or drain bank accounts: most games, social media doom-scrollers, payday loan in your pocket apps, crypto and stock trading apps that are built like casino games on purpose, and now sports betting.

Everything is also loaded with as much spyware as possible, and given that it's a phone and users say 'yes' to permissions it can often do very invasive things like track the user's location in real time.
by simne | 2025-08-27 12:56:15+00:00
> I'm confused ... > The original Rolls-Royce company ...due to financial issues with its aerospace business.

Well, it is because you do not understand economy of business. Unfortunately, main goal of any business is to be viable, not mean profitable, just be good enough to pay expenses need to run things defined as goals.

By definition, ALL old automotive companies started as hybrids - car division to make profits and motors division to make use of outstanding knowledge gathered when making consumer cars (as highest technology of that time). There are nearly no exceptions - Daimler began as Daimler plus Maybach; BMW began as motorized vehicles garages production plus motors business; Renault began as aviation motors business, made automobiles to make additional cash.

When Rolls-Royce divided to aerospace motors and cars, it was already semi-dead business, because their aerospace behavior was non-viable without donations from car division.

To be exact, I don't mean, aerospace impossible to be viable, just RR was.

And returning to our ontopic, Intel was caught in same hole - they lost their superiority and cannot survive without external help, absolutely as RR business.
by jajko | 2025-08-27 12:56:39+00:00
> and Merkel did what she does best.

You mean f_ck up safety and security of whole Old continent for decades to come, for some ego polishing, personal weaknesses or similar noble reasons?

She still admits no failures nor missteps during her reign in many topics where she clearly failed badly, despite journalists asking very direct questions about this. I wonder when will German population realize how much long term damage she has done, if ever.
by tsukikage | 2025-08-27 12:56:41+00:00
OneDrive has to manage synchronising the cloud with multiple, potentially independently updated, local copies. This is a much harder problem than anything Google have tried to tackle, with more ways for things to go wrong compared to "no internet connectivity? No documents for you!"

This has the effect that (to a first approximation) everyone knows someone with a horrific OneDrive data loss story, no-one particularly trusts OneDrive with anything actually important, and so no-one wants to be forced to use it for everything.
by slibhb | 2025-08-27 12:56:47+00:00
It's notable that the NYT is suing OpenAI while publishing this article (and at least one other) about ChatGPT's involvement in suicides. Well, I imagine more people kill themselves after reading Nietzsche.

In my view, OpenAI has enough safeguards in place. If the metric we aim for is "zero people get harmful advice from ChatGPT" then that's the same as making LLMs illegal.
by aniviacat | 2025-08-27 12:56:50+00:00
There is a setting for Google Safe Browsing, but you can't turn it off. Tapping the toggle does nothing.

Some settings are not self-explaining, for example "improve built-in query stripping".

I suppose that's to be expected for an alpha.

Not being able to add a custom search engine URL (at least as far as I can tell) is unfortunately what will make me not use this browser.
by IshKebab | 2025-08-27 12:57:30+00:00
Yeah but so what? A process on your computer could do whatever it wants anyway. The article claims:

> What's novel about using LLMs for this work is the ability to offload much of the fingerprintable code to a prompt. This is impactful because it will be harder for tools that rely almost exclusively on Claude Code and other agentic AI / LLM CLI tools to detect malware.

But I don't buy it. First of all the prompt itself is still fingerprintable, and second it's not very difficult to evade fingerprinting anyway. Especially on Linux.
by mdrzn | 2025-08-27 12:58:26+00:00
the truly chilling part is using a local llm to find secrets. it's a new form of living off the land, where the malicious logic is in the prompt, not the code. this sidesteps most static analysis.

the entry point is the same old post-install problem we've never fixed, but the payload is next-gen. how do you even defend against malicious prompts?
by echelon | 2025-08-27 12:58:32+00:00
Google and Anthropic: this is a SEV0.

Assemble your teams and immediately do the following:

1. Issue a public statement that you are aware of this issue and are tracking it

2. Begin monitoring your analytics to see which customers are impacted and shut down their access

3. Reach out to impacted customers and let them know you'll be preparing a list of next steps for them.

4. Monitor for a wider blast radius or larger attack surface area

5. Notify internal teams of broader security efforts as a result of this

6. After this cools down, hold internal and public postmortems.

Do this now.

Edit: -4 and flagged. I give up.
by vid | 2025-08-27 12:58:36+00:00
Here's my variation; I can't stand the ergonomics of Apple computers. The screen doesn't tilt back far enough, they're heavy and slippery, and the only thing I could switch to from a Trackpoint is mind control.

I'm a Linux guy too, when I have to use a Mac I turn all the gloss off and it's ok, but without going to Nix I miss a system wide package manager and I like an open-as-possible community OS that runs everywhere. It's a shame Apple doesn't license their chips.

About a year ago I got a maxed out Macbook Pro, but the above combined with the fact I wasn't comfortable travelling with something that cost as much as a good used car made me return it.

Now I'm using a Thinkpad that was ¼ the price and it's great, AMD chip, 64GB of RAM, replaceable storage, fantastic screen, keyboard (and Trackpoint) means it can do just about anything. Yes, battery life is limited, around four hours with the 16" OLED (I haven't put any work into optimizing it, and this isn't a battery-first model), but I can handle it. I'll maybe get a Strix Halo laptop since I like running LLMs, but otherwise x86 has improved enough that it's pretty good. That said, I won't complain if it matches/surpasses Apple chips, and I'd consider running a headless Apple 'server' at home.
by kayodelycaon | 2025-08-27 12:58:46+00:00
Mental health is a lot more complicated than that. A visible external cause isn’t necessary. Things are completely normal people wouldn’t have any problem with can be extremely traumatizing to someone else

Teenagers may not have the life experience to handle what adults find simple.

Neural divergence can be a major factor as well.

Telling a child with ADHD they just need to try harder is a recipe for life-long self-hatred.
by fuzzy_biscuit | 2025-08-27 12:58:53+00:00
I played this game briefly and jumped before I got hooked. It's a game of progressively longer timers, resource crunches and anything to make you feel stuck so you will spend. What's more, it's not fun, imho.

It still shocks me how we all look for time sinks when we have so much we could be doing. I'm no better.
by jmclnx | 2025-08-27 12:59:18+00:00
Well when the highest court in the US does the exact opposite of what the Constitution says, breaking every law, then other judges will follow. This no rule of law.

One possible example, Texas is now redistricting in the middle of the decade to remove some congress people to give the GOP more seats. California started doing the same to offset Texas. You can bet if this redistricting gets to the Supreme Court, Texas will be allowed to continue, Calif. will be banned.

Everyone in the US knows that will happen. So this is on Roberts, allowing this court to do what it wants, not what is legal.
by sippeangelo | 2025-08-27 12:59:40+00:00
This Semgrep post describes a very different prompt from what Nx reported themselves, which suggests the attacker was "live-editing" their payload over multiple releases and intended to go further.

Still, why does the payload only upload the paths to files without their actual contents?

Why would they not have the full attack ready before publishing it? Was it really just meant as a data gathering operation, a proof of concept, or are they just a bit stupid?

https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7...
by carlnewton | 2025-08-27 12:59:42+00:00
I'm working on Habitat. It's a free and open source, self-hosted platform for communities to discover and discuss their local area. The plan is for it to be federated.

- The idea: https://carlnewton.github.io/posts/location-based-social-net...

- A build update and plan: https://carlnewton.github.io/posts/building-habitat/

- The repository: https://github.com/carlnewton/habitat

- The project board: https://github.com/users/carlnewton/projects/2
by wjr | 2025-08-27 12:59:53+00:00
(https://casacompose.com) - Real Estate Listing Description Generator

I built it after a conversation with a friend thats a RE agent.

As an agent, he was literally spending 45+ minutes per listing just staring at a blank screen trying to make "3BR/2BA ranch" sound compelling.

The AI actually analyzes the photos to pull out key features he might miss and adds neighborhood context, like walkability score and gets professional descriptions in 30 seconds.

Just launched it as a standalone SaaS - would love feedback from anyone in the RE industry.
by Towaway69 | 2025-08-27 13:00:04+00:00
All these GPUs have to be used for something, if it's not AI then its bitcoin, if its not bitcon it's NFTs, if its not NFTs then its Porn.

This is a hardware driven bubble that will mutate into the next big computing hype. Server farms have to be doing something because they cost money. So whatever the next big hype is, big-tech will jump on the bandwagon.

Hype it 'til you make it.
by eqvinox | 2025-08-27 13:00:23+00:00
> gPTP full-duplex ethernet peer synchronisation uses timestamps from free-running local clocks at each end of the link.

Do you mean free-running as opposed to VCXO? Most implementations I know indeed use free-running clocks, but there's an increment/rate register in hardware that specifies what value to add to the time counter per crystal tick, which gets updated by the PTP layer — and timestamps use that. So even though the crystal is physically free running, the feedback loop is still there, it just doesn't include the crystal itself.
by KaiserPro | 2025-08-27 13:00:53+00:00
I would kindly ask you to re-read my post again.

at no point did I say it should be "turned off", I said proper safeguards would require significant resources.

The kid exhibited long term behaviours, rather than idle curiosity. Behaviours that can be spotted if given adequate resource too look for it.

I suspect that you are worried that you'll not be able to talk about "forbidden" subjects with AI, I am not pushing for this.

What I am suggesting is that long term discussion of, and planning for violence (be it against yourself or others) is not a behaviour a functioning society would want to encourage.

"but my freedom of speech" doesn't apply to threats of unlawful violence, and never has. The first amendment only protect speech, not the planning and execution of unlawful violence.

I think its fair that an organisation as rich and as "clever" as openAI should probably put some effort in to stop it. After all, if someone had done the same thing but with the intent of killing someone in power, this argument would be less at the forefront
by nathan_compton | 2025-08-27 13:01:02+00:00
I guess what I am sort of getting at is that no amount of trusting labels to delineate intellectuals will protect you from having to actually look at something and decide whether the person has something useful or interesting to say or not.

In this particular discussion I don't particularly care whether some Joe Schmoe on the street trusts or doesn't trust Terrance Deacon on the basis of what his degree says. It doesn't matter.

And I actually think your example of Michael Behe works towards my point of view. Credentials are a very weak signal of expertise on any subject, as he demonstrates. I think at the basic level of philosophy of science or physics or whatever, the idea that we can break up disciplines into clear chunks is just silly. At some point a serious intellectual just has to do the work for themselves to digest the ideas. I'd be worse off if I had skipped Deacon's book (which, incidentally and again, I don't think really lands) if I had skipped it because he didn't have a PhD that matched mine.
by jajko | 2025-08-27 13:01:02+00:00
> Outside apps for accessing useful services or doing work, everything seems designed to addict, manipulate, or drain bank accounts: most games, social media doom-scrollers, payday loan in your pocket apps, crypto and stock trading apps that are built like casino games on purpose, and now sports betting.

You just described the work of a better half of this forum, don't expect much sympathies. Of course most will say they don't / didn't work on the evil part like it somehow actually matters.
by TheCraiggers | 2025-08-27 13:01:10+00:00
> Hopefully the LLM vendors issue security statements shortly. If they don't, that'll be pretty damning.

Why would it be damning? Their products are no more culpable than Git or the filesystem. It's a piece of software installed on the computer whose job is to do what it's told to do. I wouldn't expect it to know that this particular prompt is malicious.
by matheusd | 2025-08-27 13:01:25+00:00
> in Brazil it is 20% (sugar cane based)

30% in 2025 for cars (from 27%), 15% biodiesel in diesel for trucks (from 14%).

Source: https://www.em.com.br/politica/2025/06/7183470-governo-aumen...

> The whole bio-fuel industry is a very complex mix of economics (often requires subsidies to make sense), geopolitical (less imported oil), environmental concerns (mass scale farming soil degradation and CO2 emissions derived from it) and logistical (completely different transportation and refining process).

Don't forget lobyying by the relevant sectors!
by drclegg | 2025-08-27 13:01:33+00:00
I truly hate the F2P mobile gaming industry. Clone a quality (and reasonably priced) PC game, add dark patterns and microtransactions, then make money hand over fist by taking advantage of people like this.

FOMO marketing, gambling mechanics, and unrepresentative ads really need to get self-regulated by the app stores, otherwise it's going to become necessary to legislate this.