MurphyA/hacker-news huggingface dataset:
by AlecSchueler | 2025-08-29 12:40:58+00:00
Oh I have no doubt those lines are becoming more and more blurred and that certain big companies in key positions are theoretically beyond accountability.

But the question was "why trust a company and not the government?"

So even now it's between:

* A company who, if big enough and in a key position, could theoretically do this

And

* A government who we know for sure have grabbed multiple people off the streets, within the past month, and have trafficked them out of the country without any due process.

So it's still "could maybe do harm" versus "already controls an army of masked men who are undeniably active in doing harm."
by ethersteeds | 2025-08-29 12:41:03+00:00
> That would be nice, but Synology doesn't offer that either, no?

I have a Synology DS920+ 4-bay that averaged 20W total including 2 spinning drives with sleep disabled. I agonized about going with the closed product, and in many ways regret it. But at the time there was nothing I could find that came close, even without the drives. And that's before factoring my time administering the DIY option, or that it would be bigger and less ruggedized.

I went as far as finding the German low power motherboard forum spreadsheet and contemplating trying to source some of the years old SKUs there. You've gotta believe us when we say that before the n100s arrived, it was a wasteland for low power options.

In many ways it still is, although these n100 boards with many SATA are a sea change. Once you set out to define requirements, you pretty quickly get to every ZFS explainer saying that you are a fool to even attempt using less than 32 GB of ECC memory...
by myrmidon | 2025-08-29 12:41:20+00:00
I'm absolutely not a fan of Trump, but this is a highly questionable assumption.

The much more likely hypothesis in my view is that he was helping Trump because of personal conviction (only in small parts motivated by naked self-interest).

You should expect rational billionaires to tend politically right out of pure self-interest and distorted perspective alone; because the universal thing that such parties reliably do when in power is cutting tax burden on the top end.
by terminalshort | 2025-08-29 12:41:21+00:00
I see this brought up a lot, but I don't think it's really an issue. It's misleading in a very technical sense, but it's so misleading that nobody is mislead. Just like nobody thinks the "Magic Eraser" is actually magic. I fundamentally just don't think anybody is out there actually believing this thing is L5 full self driving, especially after all the warnings it shows you and the disclaimers when you buy it.

The problem here isn't that people think they don't need to pay attention because their car can drive itself and then crash. The problem is that people who know full well that they need to focus on driving just don't because fundamentally the human brain isn't any good at paying attention 100% of the time in a situation where you can get away with not paying attention 99.9% of the time, and naming just can't solve this.
by mr_toad | 2025-08-29 12:41:24+00:00
> I've worked in shops that optimized for getting work done, and I've worked for shops that optimized for tracking how much work is getting done, and the former outdelivers the latter every single time.

In the past I’ve attributed this to the people in those organisations. Some people like to get things done. Others just like to be doing things (and they don’t understand the difference).
by julian_t | 2025-08-29 12:41:26+00:00
I got given a small Synology box by a brother-in-law, and have not been impressed by their OS or apps, so I just use rsync. It's OK, but as my needs are simple I'm thinking of using an RPi solution instead.

(What was amusing was that I kept finding it powered off, and spent quite a while trying to find why it could be shutting down. It turned out that, because I kept it on the floor under my desk, the Roomba would occasionally bump into it and hit the power button on the front)
by GiorgioG | 2025-08-29 12:41:31+00:00
On the flip side, some companies have gone to extremes. I now have to MFA and provide a pin-code to authenticate. I have to do this several times a day. It's fucking mind-boggling how I can get anything done in a day when I spend so much time verifying who I am. I'm waiting for the next innovation...require a drop of my blood to log in.
by benterix | 2025-08-29 12:41:45+00:00
What kind of guarantee do we have this is true?

Meta downloaded copyrighted content and trained their models on it, OpenAI did the same.

Uber developed Greyball to cheat the officials and break the law.

Tesla deletes accident data and reports to the authorities they don't have it.

So forgive me I have zero trust in whatever these companies say.
by whizzter | 2025-08-29 12:42:04+00:00
This is an example of clickjacking protection, CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply but whose login cookie would authorize the request at the target.

Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct cookie.

https://owasp.org/www-community/attacks/csrf

https://developer.mozilla.org/en-US/docs/Web/Security/Attack...
by Wowfunhappy | 2025-08-29 12:42:40+00:00
I saw the popup yesterday. Maybe I've just gotten really good at navigating dark patterns (or I have stock-home syndrome), but I remember the opt out choice being really clear and easy to select.

I'm not arguing on the facts of the modal design, I don't remember either way, I just don't remember it being confusing.

Unless I was in some A B test?
by wsc981 | 2025-08-29 12:42:45+00:00
Yeah, my experience with LÖVR [0] and LLM (ChatGPT) has been quite horrible. Since it's very niche and quite recently quite a big API change has happened, which I guess the model wasn't trained on. So it's kind of useless for that purpose.

---

[0]: https://lovr.org
by dcre | 2025-08-29 12:43:01+00:00
My approach in "LLM-only RAG for small corpora" [0] was to mechanically make an outline version of all the documents _without_ an LLM, feed that to an LLM with the prompt to tell which docs are likely relevant, and then feed the entirety of those relevant docs to a second LLM call to answer the prompt. It only works with markdown and asciidoc files, but it's surprisingly solid for, for example, searching a local copy of the jj or helix docs. And if the corpus is small enough and your model is on the cheap side (like Gemini 2.5 Flash), you can of course skip the retrieval step and just send the entire thing every time.

[0]: https://crespo.business/posts/llm-only-rag/
by lillecarl | 2025-08-29 12:43:05+00:00
It's more likely someone using higher-level constructs for something that'll spend most of it's time doing NOTHING will write code that does less. Asyncio helps you write code that does nothing most of the time.

You think the Python interpreter just randomly executes stuff for shits and giggles? No but it does use more memory than something compiled to native.

Meanwhile: TLP is implemented in Bash.

Stop spreading FUD please it contributes negatively to the world.
by animesh | 2025-08-29 12:44:14+00:00
I learned about extrepo when trying out LibreWolf. Then I realized theres plenty of stuff on extrepo I could install. No more curl installs or third-party package sources for me mostly.

This repo has a list of extrepo stuff - https://salsa.debian.org/extrepo-team/extrepo-data/-/tree/ma...
by whizzter | 2025-08-29 12:44:18+00:00
You're talking about injection attacks when escaping isn't present.

CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply, but whose login cookie would authorize the request at the target.

Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct CSRF-cookie.

https://owasp.org/www-community/attacks/csrf

https://developer.mozilla.org/en-US/docs/Web/Security/Attack...
by nembal | 2025-08-29 12:44:49+00:00
Web Bot Auth solves a real problem with a real standard. Per-request signatures make automated traffic accountable, and that is the right long-term primitive. In Cloudflare’s hands, the current implementation is built first for bots, not agents. “Signed agents” read like a label added to a bot-centric system, not a first-class agent identity fabric. The design also centers Cloudflare as the arbiter and on-ramp, which is great for reliability inside their network and great for their business moat, but not great for an open, decentralized agentic web.

While it builds on standards as the top poster notes, cloudflare's version is a business moat driven central registry service and nothing what the decentralized internet would/should look.

i wrote a but more about this on my blog if someone care to read https://blog.agentcommunity.org/2025-08-23-web_auth_box_not_...
by xattt | 2025-08-29 12:44:56+00:00
I extended the lifecycle of my 2013 vintage x64 QNAP (which lost support status around 2018 or 2019) by installing Ubuntu directly. The QNAP “firmware” was just an internal USB flash drive (DOM) that lived on a header that contained QNAP’s custom distro. There was a fully-featured standard UEFI that allows booting from the SATA devices.

I learned a lot in the process, but most important is that the special sauce NAS makers purport is usually years behind current versions.

The NAS finally bit the dust last year because of a design defect associated with Bay Trail systems that’s not limited to QNAP.
by kpcyrd | 2025-08-29 12:45:22+00:00
How about: commit your dependency lockfiles, make sure they use content-addressing cryptographic checksums like Cargo.lock does.

This is also needed for both reproducible builds and SBOMs.

If you commit the actual source code you're making things worse, because it makes coordinated source code review efforts a lot harder. Also patch management with actual vendored source code is terrible.
by clipclopflop | 2025-08-29 12:45:35+00:00
Years back I bought a model3 infotainment unit on eBay to hack on - it’s absolutely insane at the amount of data contained on them. After gaining access to the system I was able to get the VIN of the car and find the salvage auction from the car it came out of - it had been wrecked. I then was able to get all the location data that gets logged, showing a glimpse of the previous owners life (house, work, stores they went to, etc) as well as the final resting place of the car. The last gps locations logged were at the end of a “T” intersection in North Carolina - google street view gave a nice look at the trees the car most likely hit :>
by bob1029 | 2025-08-29 12:45:54+00:00
> That said, we already have value types like System.Int32 which inherit from System.ValueType (an abstract type) which inherits from System.Object (a non-abstract reference type), so things are already a bit weird.

But it all works, right? The runtime can do anything it wants to with the IL. The handling of Vector<T> is a good example of this - Locating arbitrary types/namespaces and emitting special instructions based upon the current machine's capabilities. Normalizing value vs reference semantics would be a tiny drop in this bucket.
by bjornsing | 2025-08-29 12:45:58+00:00
> Moreover, GraphRag preprocessing is insanely expensive and precisely does not scale linearly with your dataset.

Sounds interesting. What exactly is the expensive computation?

On a separate note: I have a feeling RAG could benefit from a kind of ”simultaneous vector search” across several different embedding spaces, sort of like AND in an SQL database. Do you agree?
by phtrivier | 2025-08-29 12:46:03+00:00
Is there a summary of the stance on training with user data for the main llms ?

I have a really hard time thinking that Google, Microsoft, Meta, etc... would _not_ train on whatever people enter (willingly or not in the system.)

The silver lining is that what most people enter in a chat box is _utter crap_.

So, training on that would make the "Artificial Intelligence" system less and less intelligent - unless the devs find a way to automagically sort clever things from stupid things, in which case I want to buy _that_ product.

In the long run, LLMs dev are going to have to either:

* refrain from getting high on their own supply, and find a way to tag AI generated content

* or sort the bs from the truth, probably reinventing "trust in gatekeepers and favoring sources of truth with a track record" and copying social pressure, etc... until we have a "pulitzer price" and "academy awards" for most relevant AI sources with a higher sticker price, to separate from cheap slop.

That, or "2+2=7 because DeepChatGrokmini said so, and if you don't agree you're a terrorist, and if our AI math breaks your rocket it's your fault."
by JohnFen | 2025-08-29 12:46:55+00:00
> It is probably because you haven't learned the basics.

That's not the case with me, honestly. It's just a poor mesh with my brain is all.

> So I am not sure what you are trying to say here.

I'm trying to say that I dislike the use of JS, at least for common websites, and I'm in favor of anything that could reduce its use.
by illuminator83 | 2025-08-29 12:47:16+00:00
Well, they've been using the whole internet and anything else they can get their hands on to train their models. If you are using LLMs and want to continue seeing them get better and more useful, you really have to accept that they train on data collected from their users. Unless there is another technology breakthrough somehow, this is going to be the best they can do to increase user satisfaction and make their product more useful.

TBH, I'd love to have a model which was specifically trained on conversation which I had with an earlier iteration. That would make it adapt to me and be less frustrating. Right now I'm relying only on instruction files to somewhat tune a model to my needs.
by lurk2 | 2025-08-29 12:47:27+00:00
> Most people that work in offices fit under this definition.

Not at all. The majority of office jobs can't be automated by current generation LLMs, because the jobs themselves serve either creative or supervisory functions. Generative AI might be able to fill in creative functions one day, but the whole point of a supervisory role is to verify the status of inputs and outputs. A lot of these roles already have legal moats around them (e.g. you can't have an LLM sign financial statements), but even if we assume that regulations would change, the technical problem of creating supervisory "AI" hasn't been solved; even if it was, implementation won't be trivial.
Show HN: A guide on how to level up your prompt game: RCS-CO PROMPT MAGIC
by rektlessness | 2025-08-29 12:48:05+00:00
Most people use AI like they're throwing darts in the dark. They get frustrated with generic responses, inconsistent results, and feel like they're fighting with the technology instead of collaborating with it. This guide changes everything.

RCS-CO Prompt Magic provides the systematic approach that AI professionals use but have never shared in simple terms. Whether you're writing emails, analyzing data, creating content, or solving complex problems, you'll learn to direct AI with precision and confidence. It's what i wish i had a year ago.

Sample chapter: https://aggy.cloud/RCS-CO/RCS-CO_Prompt_Magic_sample_chapter...

Pitch deck: https://aggy.cloud/RCS-CO/

In a nutshell, RCS-CO PROMPT MAGIC is about a technique employed to refine LLM interactions, achieving tailored and contextually appropriate responses that elevate the consumer experience.
by lmm | 2025-08-29 12:48:10+00:00
> only units which are accessible from the internet

Sort of. Accessible via Asustor's own software which they'd been promoting to users, which I'm pretty sure had some kind of hole punching / bridge node setup so that you could use it even if you were blocking all inbound connections to your NAS. Obviously if you completely disconnect it from the internet in both directions then you're safe (but also can't get updates etc.)
by geokon | 2025-08-29 12:48:13+00:00
what's the difference with PPAs?

the main reason i always fall back to Ubuntu is bc everyone has a PPA for it. Sometimes the PPA also works for Debian, but its 50/50 (from what i understand its not an official thing under Debian?)

AppImages have aleviated this.. but appimagelauncher is broken under Ubuntu and theyre annoying to integrate manually
by zdragnar | 2025-08-29 12:48:22+00:00
> “more more more”

If you're a salaried or hourly employee, you aren't paid for your output, you are paid for your time, with minimum expectations of productivity.

If you complete all your work in an hour... you still owe seven hours based on the expectations of your employment agreement, in order to earn your salary and benefits.

If you'd rather work in an output based capacity, you'll want to move to running your own contacting business in a fixed-bid type capacity.
by etbebl | 2025-08-29 12:49:03+00:00
Isn't the conventional wisdom "at least 2 backups, one offsite"? My lab gets by with 2 copies for most of our data: one on our Synology NAS and one mirrored to Box.

With the size of data we're dealing with, loading everything from cloud all the time would slow analyses down to a crawl. The Synology is networked with 10G Ethernet to most of our workstations.
by kevindamm | 2025-08-29 12:49:04+00:00
I've seen morse code written around the border of images (e.g. Spy vs Spy did this) which easily goes ignored by the uninitiated, and even when noticed can often escape further detection.

Another note: since in the US there are only four letters allowed as the first letter (A, K, N, or W) and will be 4-6 characters with further restrictions on which can be letters and which can be numbers (2-by-3 being the most common, 1-by-2 and 2-by-1 only being available to higher license classes, where those are the numbers of letters before and after the region identifying number). You could use this in your detective story, along with other details like inferring where they got their license from or getting more details from the FCC. Following this up with an inspection of the radio and which frequency was recently used, could make for some interesting detective work. Ham Radio doesn't make very many appearances as a plot device.
by komali2 | 2025-08-29 12:49:41+00:00
> What kind of guarantee do we have this is true?

None. And even if it's the nicest goody two shoes company in the history of capitalism, the NSA will have your data and then there'll be a breach and then Russian cyber criminals will have it too.

At this point I'm with you on the zero trust: we should be shouting loud and clear to everyone, if you put data into a web browser or app, that data will at some point be sold for profit without any say so from you.
by diggan | 2025-08-29 12:49:51+00:00
Personally, I'm able to write code I wasn't able to before, like functions heavy with math. For game development, this has been super helpful, when I know basically what inputs I have, and what output I need, but I'm not able to figure out how the actual function implementation should be. Add a bunch of unit tests, let the LLM figure out the math, and I can move on to more important features.

For me this been a pretty fundamental shift, where before I either had to figure out another way so I can move on, or had to spend weeks writing one function after learning the needed math, and now it can take me 10-30 minutes to nail perfectly.
by extraisland | 2025-08-29 12:50:15+00:00
I think you are being a bit silly. I just plugged the numbers into an online cost calculator.

That is extra 10 watts, is less than £2 a month in the UK. Drives are about 5 watts idle and I have 6 of them.

The NAS costs me about £20/month. Which isn't too crazy IMO. The UK has some of the most expensive energy prices in Europe.

I will probably be upgrading the board to something better in a few years and see if I can put in a GPU for some AI bits and pieces.
by jech | 2025-08-29 12:50:34+00:00
Yes, I mean explaining to your bank advisor that you cannot run their app, and asking whether they can recommend any solutions other than switching banks. They must have a number of elderly customers, and they most certainly have something to propose to them.

It worked for me, in a European country with very high smartphone usage (you can pay on the bus by scanning a QR code). Twice.
by skylurk | 2025-08-29 12:50:46+00:00
Tested it, and yes, when I increase the access from "Add Photos Only" to "Limited Access" I can add photos again.

But now Whatsapp retains access to all the photos I added unless I go into settings and revoke access to those photos. Creepy.

And yeah the contacts thing also pisses me off. They know what they are doing.
by Someone | 2025-08-29 12:51:20+00:00
FTA: Apple also added Enter to the numeric keypad, although an Enter that almost exclusively did the same thing as Return.

If applications followed the UI guidelines, Enter behaved like Return if enter didn’t make sense in the context and vice versa. Yes, that was mostly (when do you have UI to enter a multi-line text to be processed as a separate unit?) but when it mattered, return started a new line, and enter sent entered text to be processed by the application.

MPW shell was a (?the?) prime example. In its editor, Return started a new line, Enter executed the current selection or, if there was none, line.
by JohnFen | 2025-08-29 12:51:54+00:00
I bring in a USB stick (now -- it used to be a CD, and before that a floppy disk) containing programs I've written (both executables and the source) as well as example documentation, white papers, etc., when appropriate to the situation. I choose what goes into the portfolio specifically to demonstrate not only how I think as a dev, but also techniques and skills that I think are likely to be relevant.
by lukev | 2025-08-29 12:52:14+00:00
It is entirely uncontroversial that mental states affect the physical body. You've probably observed this yourself, directly, if you've ever had headaches or muscle tightness related to mental or emotional stress.

We can use MRIs to directly observe brain differences due to habitual mental activities (e.g. professional chess players, polyglots, musicians.)

It would be extremely odd if our bodies did not change as a result of mental activity. Your muscles grow differently if you exercise them, why would the nervous or hormonal systems be any different?
by izacus | 2025-08-29 12:52:41+00:00
There's really nothing that comes close to the hardware + software package Synology offers .

I was looking for alternatives, but anything else didn't come close to Syno Photos+Drive+Surveillance+Active Backup package you get with the NAS.

There's alternatives to each, sure, but they mostly need massively more powerful hardware to run pile of docker containers and end up being alpha quality.
by dejanmilosevic0 | 2025-08-29 12:53:20+00:00
We just launched a small side project on Product Hunt!

Alex Tew launched the Million Dollar Homepage, counting pixels. Exactly 20 years later, we launch a new dimension – time. Life moves faster now!

Upvote if you like it and post some cool videos!

https://www.producthunt.com/products/million-dollar-day
by diggan | 2025-08-29 12:53:21+00:00
It's actually pretty clever (albeit shitty/borderline evil), start off by saying you're different by the competitors because you care a lot about privacy and safety, and that's why you're charging higher prices than the rest. Then, once you have a solid user-base, slowly turn on the heat, step-by-step, so you end up with higher prices yet same benefits as the competitors.