MurphyA/hacker-news huggingface dataset:
by achernik | 2025-08-25 01:16:32+00:00
> How should you store the key? I’ve seen people store it in some durable, resource-specific way (e.g. as a column on the comments table), but I don’t think that’s strictly necessary. The easiest way is to put them in Redis or some similar key/value store (with the idempotency key as the key).

I'm not sure how would storing a key in Redis achieve idempotency in all failure cases. What's the algorithm? Imagine a server handling the request is doing a conditional write (like SET key 1 NX), and sees that the key is already stored. What then, skip creating a comment? Can't assume that the comment had been created before, since the process could have been killed in-between storing the key in Redis and actually creating the comment in the database.

An attempt to store idempotency key needs to be atomically committed (and rolled back in case it's unsuccessful) together with the operation payload, i.e. it always has to be a resource-specific id. For all intents and purposes, the idempotency key is the ID of the operation (request) being executed, be it "comment creation" or "comment update".
by riversflow | 2025-08-25 01:16:56+00:00
> it sure does seem sad (and wrong) to claim our modern life is “out of balance”.

I think the global CO2 levels would disagree. Our oceans, and therefore most of the biosphere are quite literally out of (pH) balance due to rapid CO2 release.

> We are destined for the stars.

I doubt it. Don’t get me wrong I love the idea of it, but the reality is our physical form is so fragile and fleeting relative to the harsh vastness of the Universe.

We should protect this cradle of our genesis with everything we have. That we have not met other life should be taken as a warning of how difficult the road ahead.
by roughly | 2025-08-25 01:17:15+00:00
I am generally well read across a wide variety of fields, but now and again I come across a sentence or paragraph where the sheer density of information packed into a small number of well-chosen field-specific terms just stops me in my tracks. The abstract for this paper is a testament to the ability of jargon to increase the information carrying capacity of the limited bitrate of human language - it hit my head like a zip bomb.
by secabeen | 2025-08-25 01:17:25+00:00
The wild increases in tuition are for the nameplate price, not the actual price paid by median students net of grants. See pg. 12 here:

https://research.collegeboard.org/media/pdf/Trends-College-P...

Published tuition has gone up, but grant aid has matched it, making the net cost at 4-year public institutions to be flat, or even down slightly over the 10 year period. The same applies at private 4-year institutions, large increase in nameplate price, matched by large increase in grant aid, actual net tuition flat.

Expenditure data also show that they are not spending significantly more. See the chart at the end of this page, which gives expenditures in real, per-student dollars. They are up, a little less than 20% over 10 years, but half of that is increases in hospital costs of their associated health care systems, which have nothing to do with tuition. The rest is a mix of various activities of universities, much of which are not tuition-funded.

https://nces.ed.gov/programs/digest/d23/tables/dt23_334.10.a...
by saurik | 2025-08-25 01:18:54+00:00
I'm cited on the first page of this paper (reference 20) for my work on the Android Master Key vulnerability (which I didn't find, to be clear, but I did most of the exploitation people saw), and, while this paper looks AWESOME (and I'm very excited to read it in detail), if you are interested in this concept but feel you need something a bit more concrete--maybe with diagrams and some hand-holding--to understand what is going on, I will recommend my series of articles on Master Key as an introduction.

https://www.saurik.com/masterkey1.html

https://www.saurik.com/masterkey2.html

https://www.saurik.com/masterkey3.html
by dkdcio | 2025-08-25 01:19:08+00:00
some sources:

- https://voltrondata.com/codex/a-new-frontier (links out to others) - https://wesmckinney.com/blog/looking-back-15-years/

in short you can think of a DB as at least 3 decoupled subsystems: UI, compute (query engine), storage. DuckDB has a query engine and storage format, and several UIs (SQL, Python, etc.). Trino is only a query engine (and UIs, everything has UIs). Polars has a query engine. DataFusion is a query engine (and other things). Spark is a query engine. pandas has a query engine

typically query engines are tightly coupled with the overall “product”, but increasingly compute, data (and even more recently via DuckLake metadata), and UI are decoupled allowing you to mix and match parts for a “decomposed database” architecture

quick disclaimer: I worked at Voltron Data but it’s a dead company walking, not trying to advertise for them by any means but the doc I linked is very well written with good information IMO
by ggreer | 2025-08-25 01:20:13+00:00
There were 135 space shuttle missions over 30 years, with 2 failures resulting in 14 lives lost, giving a success rate of 98.5%. The second failure happened when the program was mature, which means that either NASA didn't analyze certain failure modes or they didn't take steps to address them. The Space Shuttle's design is inherently less safe than a normal capsule on top. With the orbiter on the side of the stack, any debris from other components is more likely to damage it. The orbiter also had no launch escape system or ability for crew to eject. Also, the solid boosters could not be throttled or shut down early if they malfunctioned. In contrast, capsules like Dragon and Soyuz are above the booster stages, reducing the chance of damage from any malfunctions in the stages, and allowing a launch escape system to get the crew away in the event of an emergency.

Falcon 9 has had 531 launches over 15 years (394 of them have happened since January of 2022), with 3 failures (one on the pad before launch, two during launch), for a success rate of 99.4%. Had these failures occurred during manned missions, the Dragon capsule's launch escape system would have likely saved the crew.

The mature version of Falcon 9 (block 5) has had 466 successful landings out of 472 attempts, giving it a success rate of 98.7%. This likely means that riding on a Falcon 9 first stage with no additional safety devices (such as a parachute or a launch escape system) is safer than riding in the Shuttle.
by echelon | 2025-08-25 01:24:11+00:00
> adapted to intercontinental sailing either but we overcame that.

We carried the seeds of our civilization to new continents which carry our gas mixture, food resources, temperature, gravity, and a million other parameters that the human body plan needs. The destinations were completely hospitable.

Good luck in space. It is beyond hostile and offers nothing for our survival. Also, there's really no economic reason to go there.

Space belongs to the robots.
by chupchap | 2025-08-25 01:24:33+00:00
I don't understand why transaction fee is a percentage as it takes the cost of transferring money is the same irrespective of the amount. There should be a reasonable cap. For example 2% for any transaction less than $2, and $0.2 for any larger transactions. Why do we still have this charade of collecting money and then giving some pittance back to the customer in the form of credit card points?
by eru | 2025-08-25 01:24:43+00:00
> How is AI supposed to simulate a player, and why should it be able to determine what real people would find engaging?

Games have goals, and players are prone to 'optimising the fun out of games', by doing some save strategy over and over again to reach that goal, even if it's not fun. Think eg grinding in an RPG, instead of facing tough battles with strategy and wits and the risk of failure.

Even if AIs are terrible at determining what's engaging, you can probably at least use them to relatively quickly find ways that you accidentally opened that let players get in the way of their own fun.
by spicyusername | 2025-08-25 01:26:12+00:00
I cloned the backend for Truco and gave Claude a long prompt explaining the rules of Escoba and asking it to refactor the code to implement it.

Definitely still incredible by 2019 standards. Absolutely no doubt.

But by LLM standards, feeding it the entire working codebase of a simple, similar, game you wrote by hand as context is basically doing all the work yourself still.
by rootusrootus | 2025-08-25 01:27:40+00:00
I may be missing some big downside, but my current thought on this is that I'd like to see the return of true walled gardens. Modern versions of Prodigy or Compuserve, something like that.

I would seriously consider paying to be part of a nice walled garden, somewhere that had tight controls over advertising, spam, anonymous trolls, etc. I obviously can't have anything like the Internet I grew up with (in the late 80s, early 90s), that ship has sailed, but I would pay actual money if someone could offer me an online experience that absolutely did not have scams, spam, incessant advertising, etc.

The biggest headache is probably the difficulty in maintaining communication with people who choose other gardens to join. Though perhaps that's more a problem if you want to communicate with people who want to stay outside the gardens and use only the 'free' Internet.
by mrangle | 2025-08-25 01:27:45+00:00
What you're missing is that elite prep school admissions to Ivies (for example) virtually all smoke the SAT and are well rounded.

The SAT is weighted. If you are going to complain until it completely overwhelms anything else, then you're going to be in for a disappointment.

And if the goal is to get it to overwhelm everything else until mostly lesser advantaged kids are admitted, you're going to be more disappointed still because elite kids can be elite and hard to beat even just in terms of SAT scores.

Which is where the well rounded aspects of their profile come in.

When that's the case for public school admissions, they also get in. But admissions usually well knows what the competitiveness of their classes was in whatever public school they attended. All are not equal, as it goes. Complaining after having taken non-competitive academics isn't honest in the national discussion.

Less competitive but still competent wealthy students generally end up at a private liberal arts college.

> The big corruption of the process is when these qualified students are displaced by decisions that aren’t meritocratic.

You have no way of knowing that this happens often, and the PR and DEI incentives seem to be against it.

Last, a factor in all of this is college-by-college capacity for tuition assistance. At a certain point in admitting any class, tuition must be paid by a proportion of students. Endowment capacity differs from college to college, but it isn't helpful to act as if these colleges exist solely to educate every promising lower SES student who can't pay. "Promising" being a relative measurement.
by ghxst | 2025-08-25 01:28:03+00:00
In my experience a good aimbot is impossible to tell from a normal player when you play ranked at a high competitive level, at least not with any degree of certainty that I think is worth banning people for. The cheaters you lose to at that level are the ones calling out your positions to their team because they can see you on the minimap while they aren't supposed to, things like that.
by andrekandre | 2025-08-25 01:29:49+00:00
> You have to absorb those bumps. But if you have no shocks you just rattle apart.

yes, and the real issue is, there are no smooth roads (ime anyways)

> Super smooth road with only left turns and is built to allow you to go as fast as possible?

whats interesting is, from a high-level perspective, riding with shocks (slack) can feel more like nascar than rally even if the day-to-day has bumps.

and of course, aside from slack, there are other things that help get to "nascar" such as good specs, good/easy architecture, low-interruption/async communication, and good management, but even then its just reducing the likelihood of bumps...
by jasonwatkinspdx | 2025-08-25 01:31:00+00:00
Well way back in the day there was the old Direct3D vs OpenGL debate, where Carmack heavily favored an open standard and ecosystem. And what ended up happening is NVIDIA just has defacto control of things now.

But more technically, when he was experimenting with what became the Doom 3 engine, he favored a model of extending the basic OpenGL state machine to be able to do lots of passes with a wider variety of blending modes.

Basically, you get "dumb" triangles, but can render so many billions of them per frame you build up visual complexity, shadows, lighting, etc that way.

The other model has its roots in Renderman and similar offline rendering frameworks. Here a small shader kernel is invoked per vertex and per fragment. Your shader can run whatever code it wants subject to some limitations. So you get "smart" triangles, and build up complexity, shadows, lighting, etc through having complex shaders.

The shadow algorithm used in Doom 3 is a great example of the difference. Doom 3 figures out the shadow volume, and renders it as triangles with the OpenGL modes set such that how many shadow volumes a given pixel intersects is recorded in the stencil buffer. Then you can render the scene geometry with a blending mode where the stencil selects if you're inside shadow or not.

This is in contrast to shadow map style algorithms, where you render from the PoV of the light into a depth buffer, then inside your fragment shader you sample that shadow map to figure out if the fragment is occluded from the light or not.

Anyhow, Doom 3 is the only major game to use stencil volume shadows afaik.

And not to hang Carmack's dissatisfaction on just that alone, I think it is clear he didn't want a graphics world where NVIDIA was running everything.

I also think not being able to keep up with Unreal Engine's momentum was maybe part of it too.
by jmull | 2025-08-25 01:31:25+00:00
I think Apple should mostly be allowed to run as crappy an App Store as they want.

But people should also be able to get apps from whatever store they want.

(Ground rules all app stored would have to follow based on technical, security, and legal concerns would be fine too, IMO.)

Of course Apple would never go for that, so we'll end up with whatever mess legal processes can wring out of them.
by estimator7292 | 2025-08-25 01:32:17+00:00
That doesn't track because the real cost to replacing underground infrastructure is not the digging, materials, or labor. We avoid such maintenance as long as possible because shutting down a road is usually very expensive in terms of second-order effects.

Digging up a pipe and replacing it is actually pretty cheap and easy. Disrupting a main thoroughfare is incredibly expensive in terms of lost productivity, transport, shipping.
by nis0s | 2025-08-25 01:32:24+00:00
An important concept for encouraging altruistic behavior is the idea of passing it on, that is if you do something for someone, it’s expected that they should do something similar for someone else, and preferably whatever it is, should be worth the same monetary amount. I think doing so would encourage more willingness to behave altruistically, and also discourage parasitic or narcissistic behaviors. Of course, I think the expectation for such behavior should be conveyed in a graceful and thoughtful way to not alienate or accuse anyone. The goal should be to create a habit for passing it on.
by spicyusername | 2025-08-25 01:32:36+00:00
If learning is the goal, and we just learned that we need to do more work to provide an experience conducive to learning, then the cost for learning just increased.

First, its interesting to see a situation where a new technology INCREASED the cost of something.

Grading a stack of blue books is a "just kill me now" brutal experience. When I had 200 linear algebra exams to grade at once

Second, this is alluding to one of the dimensions along which that cost is going to be born, staffing. If its too many papers to grade, then more staff are needed to grade them.

We're probably not going to get that, though, and instead the cost increases, the funding stays the same, so the quality will decline to compensate.

So it goes...
by wat10000 | 2025-08-25 01:32:38+00:00
This AI browser agent is outright dangerous as it is now. Nobody has been attacked this way... that we know of... yet.

It's one thing to build something dangerous because you just don't know about it yet. It's quite another to build something dangerous knowing that it's dangerous and just shrugging it off.

Imagine if Bitcoin was directly tied to your bank account and the protocol inherently allowed other people to perform transactions on your wallet. That's what this is, not "ordering pizza."
by makeitdouble | 2025-08-25 01:33:30+00:00
It is generally true regarding the intent of the platform owner (the app is supposed to be better, they'll put efforts into it).

The funny part being, you might still want the web version to apply extensions on it. Youtube for instance is a lot better with the auto-dub features and title translations off, but it won't be possible in the native app as Google is actively forcing those on us. I don't use Spotify, but would advise looking it it.
by jchw | 2025-08-25 01:34:17+00:00
> If that was viable, they would have started with Arduino before trying DMA attacks.

I'm not describing something theoretical. I didn't use it for cheating, but I have in fact used an RP2040 to emulate an HID mouse and tried to make it look "invisible" from the other end. I don't have code posted to GitHub, but other people do have similar examples. If you wanted to get obsessive about it, it probably wouldn't even be hard to emulate vendor-specific proprietary behaviors, like whatever custom HID reports are used for things like mouse profiles and firmware updates. It requires a bit of reverse engineering, but nothing that crazy.

You can also just do it with a normal Raspberry Pi too, if it's one that has USB OTG support. This is how a lot of those Raspberry Pi KVM solutions send inputs without needing much external hardware.

Let's say you are still not convinced, and assume that this method is doomed to be detected somehow. One last thing: you could always hack up a real USB gaming mouse and rig the sensor up to a microcontroller or FPGA. That is substantially harder and more expensive, but I'm just trying to illustrate that if people are really driven to cheat and cheating is really a big expensive industry, this can be done.

> One possibility: The Arduino added input latency cancelling out the cheating benefit.

I don't believe so, no. You don't have to stick to a specific hardware platform, but if there's one advantage that microcontrollers have over typical computers like Raspberry Pis it's latency. Even if their USB controllers are too limited or broken somehow, you can probably get away with bitbanging USB, especially on something with a nice and beefy microcontroller like the RP2350.

I believe the actual real reason why this wasn't a thing was because in the beginning for CV-based cheating, the CV part itself wasn't good enough. Now with computers having advanced a few more steps and with ML having advanced many many steps, being able to do very good classifiers in real time seems to be viable.

So really, the clock is ticking. There is no practical reason why the I/O part can't be done, so as long as the actual aimbot part works well enough. I'm willing to put my name on that.
by roughly | 2025-08-25 01:35:14+00:00
This is a fantastic recap of everything Juno discovered and the value of this kind of mission - there’s multiple discoveries in here that are at odds with our theoretical understanding of planetary formation, physics, and chemistry that can inform new science moving forward. One that stuck out to me in particular was that Jupiter’s massive magnetic field isn’t generated by a metallic core like we expected, but rather Hydrogen under pressures sufficient to tear free electrons.

Combine that with the fact that the Juno probe has now more than doubled its expected life, and this whole mission serves as as good of an argument for continuing to fund NASA as you’re going to see.
by NotOscarWilde | 2025-08-25 01:36:25+00:00
Hello, TCS assistant professor here: he is legitimately respected among his peers.

Of course, because I am a selfish person, I'd say I appreciate most his work on convex body chasing (see "Competitively chasing convex bodies" on the Wikipedia link), because it follows up on some of my work.

Objectively, you should check his conference submission record, it will be a huge number of A*/A CORE rank conferences, which means the best possible in TCS. Or the prizes section on Wikipedia.
by ImPostingOnHN | 2025-08-25 01:36:29+00:00
so you went from what you thought was a more biased source (npr) to what you thought was a less biased source (reuters) and it turned out to be the same report? 'we claim it's a matter of national security on the totally-solid basis of we say so' etc?

> The omitted specifics around "national security" suggested that perhaps there was more to the story

there were and still are no specifics provided by the administration on how this is a matter of national security to the point of halting the project, only implausible pretexts which are insufficient by default until convincingly proven otherwise.

given the 'national security because we said so but with more words' pretext, we see there was and is indeed no more to the story than that.
by striking | 2025-08-25 01:36:38+00:00
The real bummer is not that you have to manually refresh them, it's that refreshing them involves refreshing the entire view. If you could pick and choose what gets refreshed, you might just sometimes have a stale cache here and there while parts of it get updated. But refreshing a materialized view that is basically just not small or potentially slightly interesting runs the risk of blowing your write instance up.

For this reason I would strongly advise, in the spirit of https://wiki.postgresql.org/wiki/Don't_Do_This, that you Don't Do Materialized Views.

Sure, Differential/Timely Dataflow exist and they're very interesting; I have not gotten to build a database system with them and the systems that provide them in a usable format to end users (e.g. Materialize) are too non-boring for me to want to deploy in a production app.
by gus_massa | 2025-08-25 01:37:06+00:00
Similar post has been appearing for years https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

It doesn't make sense. It's super expensive to make, perhaps impossible with the current technology. Normal bacterias will out compete them. (Just imagine a mirror Earth, where mirror evil scientist create mirror^2 life. Who wins?) Also the inmune system is very generic to detect any crap, normal or mirrored.
by wat10000 | 2025-08-25 01:38:51+00:00
1. Access to untrusted data.

2. Access to private data.

3. Ability to communicate externally.

An LLM must not be given all three of these, or it is inherently insecure. Any two is fine (mostly, private data and external communication is still a bit iffy), but if you give them all three then you're screwed. This is inherent to how LLMs work, you can't fix it as the technology stands today.

This isn't a secret. It's well known, and it's also something you can easily derive from first principles if you know the basics of how LLMs work.

You can build browser agents, but you can't give them all three of these things. Since a browser agent inherently accesses untrusted data and communicates externally, that means that it must not be given access to private data. Run it in a separate session with no cookies or other local data from your main session and you're fine. But running it in the user's session with all of their state is just plain irresponsible.