MurphyA/hacker-news huggingface dataset:
by est | 2025-08-20 02:47:01+00:00
as others have pointed out, it's not a tech issue, it's a support cost.

I have developed several SSO in-house. The various providers don't always align. e.g. sometimes you get the email, sometimes you get others, sometimes you don't get anything. It's a mess. If any of those details goes wrong, your user will be locked outside of your system and vent.

And there's another kind of fake-SSO. After the first time you login with SSO, the system asks for yourr phone or email again! So what's the point of SSO?
by exasperaited | 2025-08-20 02:47:59+00:00
This is predicated on something the polls do not and cannot convey: the selection of electable candidates. This is imaginary.

Reform fielded candidates in essentially every constituency in 2024 and only five of them were elected. One is already sitting as an independent because he’s being investigated for pretty serious fraud and the party will not stand by him.

Again: the polls do not and cannot reflect just how difficult it would be to get from four MPs to 326.
by vlucas | 2025-08-20 02:49:05+00:00
> If y'all view NPR as biased, I'm afraid there's very little hope for you.

What do you mean y'all? What group are you putting me in? I am not a Republican. If you can't see the obvious bias in NPR's reporting, the stories they choose to tell and from what angles, etc. then you might be in an information bubble. It's clear as day to me and a lot of others as well.
by bix6 | 2025-08-20 02:49:08+00:00
This is a rather dismissive response considering the progress they’ve made over the past few years. The other commenter is correct that they use highly detailed maps but you are incorrect as they do not have a remote human operator.

I find them more enjoyable than Uber. They’ve already surpassed Lyft in SF ridership and soon they will take the crown from Uber.
by ubermon | 2025-08-20 02:49:15+00:00
very good articulation on the problem. My bet is that it is probably fine in the sense that the mastery itself is not going to be relevant.

I want to view AI coding as invention of new coding tools, at least in the way you described. I (hope) it will be more like punch-card->assembly-> BASIC/C -> scripting language -> some sort of well-structured natural language.
by haswell | 2025-08-20 02:49:17+00:00
I realize in retrospect my comment was probably confusing as written.

The company didn’t charge extra for SSO despite the support cost, also for ideological reasons. But they were also singularly focused on large enterprise customers so it was table stakes. Plenty of other platform modules to upsell.

My point was mostly to highlight that it can be costly for a bunch of reasons.
by albert_e | 2025-08-20 02:49:29+00:00
If this is indeed how copilot is archtected, then it needs clear documentation -- that it is a non-audited data store.

But how then did MS "fix" this bug? Did they stop pre-ingesting, indexing, and caching the content? I doubt that.

Pushing (defaulting) organizations to feed all their data to Copilot and then not providing an audit trail of data access on that replica data store -- feels like a fundamental gap that should be caught by a security 101 checklist.
by billy99k | 2025-08-20 02:50:51+00:00
"The rest of the world just shakes its head at the US healthcare system."

Perhaps on the cost, but the US has the best doctors in the world. If I need major surgery, I know I can get it in a reasonable amount of time. In many other countries in Europe or even Canada, the government gets to decide if I need to get it or not and the wait time could be in years.

Everyone says the elderly in the US will go broke after a single major surgery. My dad is on Medicare with a low-cost supplemental insurance. He's been in multiple hospitals for the last 6 months and short-term care for the last 6 weeks.

He was treated for sepsis twice and got a pacemaker installed (this doesn't include drugs, meals, everything else that comes with his stay). His cost out of pocket? $0.

My elderly relatives have to wait many months to get surgery in Canada. The UK also has a failing healthcare system. The issue is that in times of economic downturns, socialized medicine gets cut.

I don't think I've seen a single example of socialized medicine that doesn't end up with long wait times for major surgeries or the government making health decisions for you.

A better system would be to have no insurance on procedures that are extremely common (where the free market can reduce the costs, like Lasik eye surgery) and only have insurance on ones that aren't so common and won't benefit from the competition.
by Atlas667 | 2025-08-20 02:54:37+00:00
Can you point me to the critique you mention?

Also

I mean "what it looks like" to you is kind of irrelevant because we really do not live in a democracy but it probably looks like one to you.

Are you OK that your country aids in the literal enslavement and exploitation of people abroad for cheap goods?

Are you OK that capitalist countries perpetrate more war and caused more death than any other before it? You must be if you believe in democracy.

Wake up, there is no democracy.

ALL poverty is fabricated and sustained for profits.

So in the same sense: How does capitalism work? Is it democratic or is it a profit extraction system that knows no bounds?

I know communist states commited some mistakes in the 20th century, most are inflated for capitalist propaganda but there are legit ones.

But Im not here for apologia. I do what makes sense. And it makes sense to me that profit creates authoritarianism. And that to create true democracy we must democratize production. That shit makes more sense to me than "getting rich makes everyone better through competition".

Read communist literature and decide for yourself, be intellectually honest, and move on if its not right. I dont care. I dont want someone to rule over me. And I'll never EVER vote for someone who isnt enacting mass democracy. Which is why I havent voted. I'm a real person with real aspirations and I wont be taken advantage by the rich who provably run this shit.
by southernplaces7 | 2025-08-20 02:55:19+00:00
>It is meaningful to call that reasoning.

This take on the nature of sentience and consciounsess, things we humans have, know we have, and which are quite distinct from unaware pattern-matching, is becoming foolish and tedious.

No, it's not meaningful to call that reasoning. Indeed it's wrong, because it's not reasoning. That would require sentience, and absolutely zero evidence indicates its presence in any LLM. Are some people so glittered by their algorithmic tricks with communication that they simply fall to near religious beliefs in a conversational LLM being an example of awareness?

computers have been solving mathematical problems for decades. Would you thus argue that those machines were also reasoning?
by kaycebasques | 2025-08-20 02:55:59+00:00
I've also been debating this: https://technicalwriting.dev/ai/agents/#gotta-keep-em-separa...

(Quoting from that post)

Arguments in favor of keeping them separated:

* Writing style. In agent docs, using all caps might be an effective way to emphasize a particular instruction. In internal eng docs, this might come off rude or distracting.

* Conciseness vs. completeness. In agent docs, you likely need to keep the content highly curated. If you put in too much content, you’ll blast through your API quotas quickly and will probably reduce LLM output quality. In internal eng docs, we ideally aim for 100% completeness. I.e. every important design decision, API reference, workflow, etc. is documented somewhere.

* Differing knowledge needs. The information that LLMs need help with is not the same as the information that human engineers need help with. For example, Gemini 2.5 Pro has pretty good built-in awareness of Pigweed’s C++ Style Guide. I tested that assertion by invoking the Gemini API and instructing it Recite the Pigweed C++ Guide in its entirety. It did not recite in full, but it gave a detailed summary of all the points. So the Gemini 2.5 Pro API was either trained on the style guide, or it’s able to retrieve the style guide when needed. Therefore, it’s not necessary to include the full style guide as AGENTS.md context. (Credit to Keir Mierle for this idea.)

Arguments against:

* Duplication. Conceptually, agent docs are a subset of internal eng docs. The underlying goal is the same. You’re documenting workflows and knowledge that’s important to the team. But now you need to maintain that same information in two different doc sets.
by idontwantthis | 2025-08-20 02:56:19+00:00
> Everyone says the elderly in the US will go broke after a single major surgery. My dad is on Medicare with a low-cost supplemental insurance. He's been in multiple hospitals for the last 6 months and short-term care for the last 6 weeks.

> I don't think I've seen a single example of socialized medicine that doesn't end up with long wait times for major surgeries or the government making health decisions for you.

Do you love socialized medicine or not? I can't tell.
by Nextgrid | 2025-08-20 02:57:24+00:00
I pay for several services via SEPA direct debit and the only things I had to provide to sign up was an IBAN and a pinky-promise I was the account holder. As far as I know they have to way to correlate the identity information on the provider account to the bank account holder’s, so it should work in case of fraud too. This lines up with how UK direct debits work as well, where a “sort code” (bank identifier) and account number are enough.

I presume the only security there is arises from the fact that those transactions can be reversed by the account holder within a generous grace period, and that this method of payment is only ever used to pay for long-standing services where there’s a strong paper trail to the beneficiary of said service (so not much point in doing the fraud to begin with).
by DiabloD3 | 2025-08-20 02:58:05+00:00
You say container, but if you're at AWS, for example, and you're using any API of theirs, either the original deprecated EC2 API, or the Docker API, or the Kubernetes API... its all a real honest to god VM underneath, provided by Firecracker.

In other words, the technology I have used non-stop since it was mainlined in 2008 is the technology all of you use today. I can deploy a VM, you can deploy a VM, the difference is the API we use to do it, but they're all VMs.

And yes, my VMs are not required to be Debian Stable, and I can deploy any version as needed. That is why we have VMs, so we do not need to dedicate entire machines to a single application with unusual dependencies. Something big companies like Amazon and Google and Microsoft realized is the true wisdom that sysadmins like me have always known: even the damned kernel is a dep that should be tracked, and sometimes this does matter, and the only way you can deploy kernels on a per-application basis is with VMs.

Something container jockeys will never understand: containers that are offered through the OCI facility in the kernel has multiple discrete userlands, but one kernel. You do not have a hypervisor with its own kernel.

Docker, real namebrand Docker, is an OCI consumer. Using something that implements a compatible API is not Docker, but merely a compatibility shim.
by gibbitz | 2025-08-20 02:58:10+00:00
Since when is Harvard a public school? Frankly, no college in the US can be called a public school only getting between 20-30% of their funding. If our bully in chief and the political right want to tell colleges who to educate they could try ponying up the cost. Otherwise if a Chinese or North Korean wants to go to Harvard, has the academic chops and can pay for it, they can go there. That's a free market.
by glenstein | 2025-08-20 02:58:14+00:00
My goal is to invite you to think critically about the specific caveats in the comment you are replying to instead of ignoring those caveats. They said that generally speaking using thinking mode on non niche topics they can get reliable answers, and invited anyone who disagreed with it to offer examples where it fails to perform as expected, a constructive structure for counter examples in case anyone disagreed.

You basically ignored all of those specifics, and spuriously accused them of cherry picking when they weren't, and now you don't want to take responsibility for your own words and are using this conversation as a workshopping session for character attacks in hopes that you can make the conversation about something else.
by neandrake | 2025-08-20 02:59:16+00:00
They first disabled rubocop to prevent further exploit, then rotated keys. If they awaited deploying the fix that would mean letting compromised keys remain valid for 9 more hours. According to their response all other tools were already sandboxed.

However their response doesn't remediate putting secrets into environment variables in the first place - that is apparently acceptable to them and sets off a red flag for me.
by beart | 2025-08-20 03:00:16+00:00
I've always felt that Microsoft's biggest problem is the way it manages all of the different teams, departments, features, etc. They are completely disconnected and have competing KPIs. I imagine the edge advertising team has a goal to make so much revenue, and the security team has a goal to reduce CVEs, but never the twain shall meet.

Also you probably have to go up 10 levels of management before you reach a common person.
by overgard | 2025-08-20 03:01:07+00:00
I don’t know much about audit logs, but the more concerning thing to me is it sounds like it’s up to the program reading the file to register an access? Shouldn’t that be something at the file system level? I’m a bit baffled why this is a copilot bug instead of a file system bug unless copilot has special privileges? (Also to that: ick!)
by DiabloD3 | 2025-08-20 03:02:54+00:00
We already have this though. SD Express, which allows SD cards to actually protocol switch to one lane PCI-E NVME. It's been part of the spec officially since 2018, and an enhancement slightly later to add more pins to allow a second lane.

And since, underneath, it becomes a standard PCI-E NVME with standard lanes, there is no inherent speed limit from the bus itself, only from the fact that SD cards are tiny and any real controller is going to cook.
by tptacek | 2025-08-20 03:03:12+00:00
I'm just giving you shit. Thanks for posting it. You're not wrong: I have longstanding strong feelings (much further back than that post) about DNSSEC, both because I had to implement it, and because I remember it being used as an excuse not to randomize DNS requests. Also: I tilt at a lot of windmills, and this particular evil giant is on the verge of collapsing!
by Jimmc414 | 2025-08-20 03:03:28+00:00
I appreciate you taking the time to respond. I was immediately logged out right after posting which I had never experienced before. I would consider myself a daily user. I assumed I had just received a ban or suspension and was surprised when I was able to log in on another device. If HN doesn't do that, I take you at your word and chalk it up as an anomaly with unfortunate timing.
by moomoo11 | 2025-08-20 03:04:13+00:00
Right but I'm telling you that you're worrying about the wrong thing, if that makes sense.

The truth is that engineering is very opinionated, and you've picked an opinionated framework.

I don't know php/laravel, but I've worked on Rails/Elixir/etc frameworks. Having interviewed juniors in technical rounds, I'm telling you that the more important thing for you (I take it you're a fresh junior?) is to understand the framework's conventions and be able to navigate that well enough. Can you code in php? Once you're on the job, you'll find that those conventions tend to go out the door when there's actual money on the line, so the best you can do is be aware and on top of it.

Also, to be honest, without knowing php/laravel, the best I can do while I'm on my phone (take it or leave it, or use Claude/AI - I am self taught and nobody code reviewed me when I started)

- Return custom errors instead of strings. Like NotFoundError, ForbiddenError, etc. This way you have some consistency, and you can include like code, message or whatever fields for better API user experience

- If there are no Products, just return an empty list instead of a string like "No products found"

- When you delete you can just return the ID or even nothing (just a 200 OK)

- Use proper http codes. I'm not sure if laravel handles that automatically, or you need to do like 201 for create, for example.

Anyway good luck man, if you're new you're in for a world of wonder :-)

Also try any Php/Laravel Slack/Discord communities too. They will be more helpful!
by lmeyerov | 2025-08-20 03:04:39+00:00
We find it useful:

* Agents still kinda suck so need the help around context management and avoiding foot guns. Eg, we make a < 500loc ai/readme.md with must haves, links to others, and meta how-to-use

* Similar to IaaC, useful to separate out as not really ready the same way we read it, and many markdowns are really scripts written in natural language, eg, plan.md.template
by ashdev | 2025-08-20 03:05:12+00:00
This is pretty impressive. A lot of people underestimate the amount of work required to make something available offline. Planning the syncing architecture alone is a monumental task, especially at the scale Notion operates. I built a custom sync solution for my own app, Brisqi (https://brisqi.com), and it took me weeks to get it right, albeit with some trade-offs.

Kudos to the Notion engineering team for achieving this milestone.
by p1necone | 2025-08-20 03:09:50+00:00
I've been trying to keep my baked in llm instructions to a terse ~100 line file, mostly headered sections with 5 or so bullet points each. Covering basic expectations for architecture, test mocking, approach to large changes etc. I can see why for some projects that wouldn't be enough but I feel like it covers everything for most of mine.
by queenkjuul | 2025-08-20 03:10:48+00:00
I do agree reality was a lot more messy, but i also think it still paints a compelling case that Google in particular acted how it did (mostly) to shape the web to its own best interests.

That it wasn't literally "Google railroaded WHATWG/W3C/everyone else to get what it wanted" doesn't mean Google didn't take advantage of the situation to kill open web standards to its own benefit. I imagine Mozilla, for instance, went along with as much as they did because Google accounted for most of their revenue.
by Dylan16807 | 2025-08-20 03:11:17+00:00
A step up form factor is great. The thing in the article is not a step up though, it's smaller than an SD card, and there's no great reason for it. Since it's brand new it can guarantee a better minimum speed than SD express, but that advantage falls away fast and it's not worth the hassle of an extra format.

I'm reminded of XFMEXPRESS, a tech that had some justification to exist as a low profile replaceable and coolable main storage for small devices. But it doesn't look like it went anywhere.
by ThatPlayer | 2025-08-20 03:11:35+00:00
I've considered installing CachyOS on my Deck to be able to use bcachefs for a tiered storage setup with the SD card. For automatic movement of unused files to the SD card over time, because I don't want to deal with managing it myself.

Though I also did the SSD upgrade and haven't really been bothered by space, so haven't bothered. I have that setup on a spare parts PC with HDDs instead of microSD, since that's an older 1/2 TB SSD.
by aspenmayer | 2025-08-20 03:14:26+00:00
I used the handy audio pronunciation feature on my dictionary, and I am not a German speaker, but I can definitely see how that eggcorn might have occurred.

https://en.wikipedia.org/wiki/Eggcorn

> An eggcorn is the alteration of a word or phrase through the mishearing or reinterpretation of one or more of its elements, creating a new phrase which is plausible when used in the same context. Thus, an eggcorn is an unexpectedly fitting or creative malapropism. Eggcorns often arise as people attempt to make sense of a stock phrase that uses a term unfamiliar to them, as for example replacing "Alzheimer's disease" with "old-timers' disease", or William Shakespeare's "to the manner born" with "to the manor born". The autological word "eggcorn" is itself an eggcorn, derived from acorn.
by bigwheels | 2025-08-20 03:15:09+00:00
> The real bottleneck has never been typing. It’s figuring out who the stakeholders are, what they need, and why. That’s messy, political, and brutally hard to automate. For most products, the critical work is defining the problem, not writing the solution.

The fewer employees you have, the less politics will get in the way. Then the quicker the business can execute.. especially as the cost of producing product continues to approach 0.

Most roles can be automated, I've been thinking of a real B2B platform enabler which optimizes for AI to negotiate the best deals with other AIs. But over time, I think even this will become trivial for GPT-6, 7, etc.
by marcus_holmes | 2025-08-20 03:15:41+00:00
I don't understand this. The software is free. But calling it "free software" is a mistake?

And I don't understand the advocacy angle. Is any reference to "free" or "open" in any tech-related conversation automatically advocacy (even if the author did not intend to be an advocate for it)?

Genuinely curious. Apologies if it doesn't read like genuine curiosity, I am genuinely curious.
by mindslight | 2025-08-20 03:16:44+00:00
> If I need major surgery, I know I can get it in a reasonable amount of time

Do you have much experience with this major surgery in a reasonable amount of time, or are you just taking it on faith? Because my experience is the US system has the exact same "government gets to decide if I need to get it or not and the wait time could be in years" and "government making health decisions for you" - only that government is made up of private corpos and isn't even nominally democratically accountable. My experience with the US system is that each step of a process gets booked 2-6 months out, and any kind of major surgery will require many steps of referrals - testing/imaging, follow ups, first line treatments that need to be tried, etc. So time can most certainly add up to years from first could-have-been-diagnosed until actual treatment.

And excuse me for getting personal, but have you been in the hospital with your dad advocating for him? Or at least through the phone? Because my experience doing that for multiple family members has made me see the system's failings in galling detail, to the point that I would never write a comment saying our healthcare system is effective. And FWIW, "sepsis twice" seems like a possible red flag that his care isn't as good as you might think it is
by yownie | 2025-08-20 03:16:48+00:00
> sinking ships can only be done when near the surface.

Isn't this itself a huge assumption?

Sinking ships via upward facing torpedoes would be a huge tactical advantage at first glance. Less time to detection and deploy countermeasures or evasive maneuvers.

Perhaps, I am wrong in assuming they cannot be fired below a certain depth?
by AdieuToLogic | 2025-08-20 03:18:46+00:00
> In my opinion, using AI tools for programming at the moment, unless in a sandboxed environment and on a toy project, is just ludicrous.

Well put.

The fundamental flaw is in trying to employ nondeterministic content generation based on statistical relevance defined by an unknown training data set, which is what commercial LLM offerings are, in an effort to repeatably produce content satisfying a strict mathematical model (program source code).