MurphyA/hacker-news huggingface dataset:
by what-the-grump | 2025-08-07 07:50:17+00:00
I think only time will tell? Let me flip this on it's head.

LLMs allow me to tackle stuff I have no business tackling because the support from the LLM for the task far exceeds google / stack overflow / [insert data source for industry or task].

Does the concept sink in? Yes and no, I am moving too fast most of the time to retain the solution.

When the task is complex enough and LLM gets it wrong, oh boy is it educational, not only do I have to figure out why the LLM is wrong, I have to now correct my understanding and learn to reason against it.

I was a very bad student, most of the classes didn't make sense to me, bored me out of my mind, I failed a lot. Do I ever feel that way when talking to Chatgpt about a task I have no idea how to solve? No, and guess what we figure it out together.

Another data point, my english writing has improved by using chatgpt to refactor / reformat, more examples, mostly correct english structure. Over time stuff sinks in even if you are not writing it, you are still reading it, and editing.

Lets take code for a minute, is it easier to edit someone else's code or your own? So everyone that has to dive deep into troubleshooting chatgpt's code is somehow dumb/lazy? I don't think so, they are at least as smart as the code.

What would happen if we made a curriculum around using chatgpt, how far would I get in chem 1 if I spent 90 minutes with chatgpt prompts prepared by a professor and a machine that never gets tired of explaining / rephrasing until I get it?
by kazinator | 2025-08-07 07:50:22+00:00
Debouncing refers to cleaning up the signal from an opening and closing switch contact so that the cleaned signal matches the intended semantics of the switch action (e.g. one simple press of a button, not fifty pulses).

The analogy here is poor; reducing thrashing in those obnoxious search completion interfaces isn't like debouncing.

Sure, if we ignore everything about it that is not like debouncing, and we still have something left after that, then whatever is left is like debouncing.

One important difference is that if you have unlimited amounts of low latency and processing power, you can do a full search for each keystroke, filter it down to half a dozen results and display the completions. In other words, the more power you have, the less important it is to do any "debouncing".

Switch debouncing is not like this. The faster is your processor at sampling the switch, the more bounces it sees and consequently the more crap it has to clean up. Debouncing certainly does not go away with a faster microcontroller.
by ajuc | 2025-08-07 07:51:57+00:00
Having 0-1000 fit inside a byte would be great. 1 byte for tonnes, 1 for kg, 1 for g, 1 for mg. Same with meters, liters, etc. Would work great with metric.

Or addressing 1 TB of memory with 4 bytes, and each byte is the next unit: 1st byte is GB, 2nd byte is MB, 3rd byte is KB, 4th byte is just bytes.
by AlecSchueler | 2025-08-07 07:53:04+00:00
> You believe that the monarch has any vestigial power??

I believe they are the head of state and that they carry out the functions of the head of state in a way that is consistent with comparable states such as Ireland or The Netherlands.

> And the House of Lords has given its authority to the House of Commons.

No they have not. The 1911 Act is alive and well. It is occasionally called into question but the Lords have retained their authority. And all of this is to say nothing of the courts etc.

> A British Prime Minister has more power than an American President.

This is neither here nor there in regards to the claim made above. They are not "basically" the legislature...
by imtringued | 2025-08-07 07:54:45+00:00
You're forgetting that some sequences are more predictable than others, hence the name "speculative" decoding. Let's say your token encoding has 128k tokens. That means the model has to pick the right token out of 128k. Some of those tokens are incredibly rare, while others are super common. The big model has seen the rare tokens many more times than the small model. This means that the small model will be able to do things like produce grammatically correct English, but not know anything about a specific JS framework.

The post training fine tuning costs (low thousand dollars) are the main reason why speculative decoding is relatively unpopular. The most effective speculative decoding strategy requires you to train multiple prediction heads ala medusa (or whatever succeeded it). If you don't do any fine tuning, then the probability of the small model being useful is slim. Using a random model as your draft model will probably give you very disappointing results.
by neom | 2025-08-07 07:55:36+00:00
The post covers 9 CVEs May-June 2025 (Full chain from default user > admin > root > RCE):

CVE-2025-6010 - [REDACTED]

CVE-2025-6004 - Lockout Bypass https://feedly.com/cve/CVE-2025-6004

Via case permutation in userpass auth Via input normalization mismatch in LDAP auth

CVE-2025-6011 - Timing-Based Username Enumeration https://feedly.com/cve/CVE-2025-6011

Identify valid usernames

CVE-2025-6003 - MFA Enforcement Bypass https://feedly.com/cve/CVE-2025-6003

Via username_as_alias configuration in LDAP

CVE-2025-6013 - Multiple EntityID Generation https://feedly.com/cve/CVE-2025-6013

Allows LDAP users to generate multiple EntityIDs for the same identity

CVE-2025-6016 - TOTP MFA Weaknesses https://feedly.com/cve/CVE-2025-6016

Aggregated logic flaws in TOTP implementation

CVE-2025-6037 - Certificate Entity Impersonation https://feedly.com/cve/CVE-2025-6037

Existed for 8+ years in Vault

CVE-2025-5999 - Root Privilege Escalation https://feedly.com/cve/CVE-2025-5999

Admin to root escalation via policy normalization

CVE-2025-6000 - Remote Code Execution https://feedly.com/cve/CVE-2025-6000

First public RCE in Vault (existed for 9 years) Via plugin catalog abuse > https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vau...
by zejn | 2025-08-07 07:56:11+00:00
Your first paragraph implies 8-bit bytes are a coincidence, which is not true. It was a design decision.

A byte in computer is the smallest addressable memory location and this location at that time contained a character. The way characters are encoded is called code. Early computers used 5-bits, which was not enough for alphabetics and numerals, 6 bits was not enough to encode numbers and lower and upper case characters, which eventually lead to ASCII.

ASCII was also designed(!) to make some operations simple, eg. turning text to upper or lower case only meant setting or clearing one bit if the code point was in a given range. This made some text operations much simpler and more performant, that is why pretty much everybody adopted ASCII.

Doing 7-bit ASCII operations with a 6-bit bytes is almost impossible and doing them with 18-bit words is wasteful.

When IBM was deciding on byte size a number of other options were considered, but the most advantageous was the 8-bit byte. Note that already with 8-bit bytes, this was over-provisioning space for character code, as ASCII was 7-bit. The extra bit offered quite some space for extra characters, which gave rise to character encodings. This isn't something I would expect a person living in the USA to know about, but users of other languages used upper 128 bytes for local and language specific characters.

When going with 8-bit byte, they also made the bytes individually addressable, making 32-bit integers actually 4 8-bit bytes. 8-bit byte also allowed to pack two BCD in one byte and you were able to get them out with a relatively simple operation.

Even though 8-bits was more than needed, they were deemed cost effective and "reasonably economical of storage space". And being a power of two allowed addressing a bit in a cost effective way, if a programmer needed to do so.

I think your post discounts and underestimates the amount of performance gain and cost optimisations 8-bit byte gave us at the time it mattered most, at the time computing power was low, and the fact that 8-bit bytes were just "good enough" and we didn't get anything usable from 9, 10, 12, 14 or 16 bit bytes.

On the other hand you overestimate the gains with imaginary problems, such as IPv4, which didn't even exist in 1960s (yes, we ran out of public space quite some time ago, no, not really a problem, even on pure IPv6 one has 6to4 NAT), or negative unix time - how on Earth did you get the idea that someone would use negative unix time stamps to represent historic datings, when most of the time we can't even be sure what year it was?

I think the most scary thing is having and odd-bit bytes; there would be a lot more people raging against the machine, if byte was 9 bits.

If you want to know why 8 bits, this is a good recap - https://jvns.ca/blog/2023/03/06/possible-reasons-8-bit-bytes... - along with the link to the book from the engineers who designed 8-bit bytes.
Just apply to YC. Here's why
by civitasinnovare | 2025-08-07 07:56:20+00:00
Just apply to YC. Here's why (even if you're late):

I quit my job June 30th and gave myself 60 days to build, 30 days to get customers. A quarter of the way through, I realized I'd accidentally recreated YC's 3 month timeline - so I used the August 4th deadline as my forcing function.

Results so far:

37 days of 15-hour days

Built a working SaaS platform that can be purchased today

Incorporated Delaware C-Corp, figured out cross-border taxes (I'm Canadian), filed trademark

Product is beautiful and functional

My edge: 8 years doing every role in tech - BDR, QA, dev, CSM, sales engineer, exec. At my first startup gig, I landed them a Pentagon meeting for a multi-million dollar deal 5 months in. Later built a CSM program to manage $2M ARR efficiently with over 20% YoY growth.

This diverse context means I can talk to customers in their language, then immediately translate to technical solutions. With LLMs proving context is everything - my context across the entire stack is my moat.

The reality: Without customers yet, my YC odds are slim. But I've aimed high before with remarkable results. By decision day, I'll have a feedback flywheel spinning fast enough to scale effectively.

Why applying to YC was worth it regardless:

The application forced me to get sharper. What started as "I'm building an AI tool" became "I'm building an AI-powered platform that replaces 5 different tools." That clarity alone was worth the time.

More importantly - YC's "you need customers" requirement pushed me to start customer conversations on day 45 instead of my planned day 60. Those 15 days matter and they are a forcing function for me to clear every remaining bug and get legal user agreements done ASAP. I already got Stripe Connect Marketplace setup yesterday so that was a good win.

(Yeah, I know - should've been talking to customers day 1. But after 8 years hearing the same pain points from dozens of potential customers, I knew exactly what to build. Sometimes domain expertise lets you skip steps.. and frankly I've needed to focus since I'm a solo founder and needed to build fast enough to have something worth using at least on par with competitors with core features and with my own differentiators that make me worth doing business with)

I dropped out of biochem and computer science in my second year, 8 years ago to work in tech. Built great departments everywhere I went but never felt fulfilled. It has to be building for me or nothing. Having been in customer success most recently it was frustrating to hear customer problems and not see solutions getting to the customer as fast as I'd like.. now its in my hands and lightning speed will define my companies. Aaron Epstein wasn't messing around when they said they wanted to see a $100 billion dollar company with less than 10 employees. Why not? You have the best force multiplier humanity has ever had since the invention of the computer.

Shifting to customer acquisition, next week. Let's see what happens.
by xx_ns | 2025-08-07 07:56:31+00:00
bcrypt, one of the more popular password hashing algorithms out there, allows the password to be up to 72 characters in length. Any characters beyond that 72 limit are ignored and the password is silently truncated (!!!). It's actually a good method of testing whether a site uses bcrypt or not. If you set a password longer than 72 characters, but can sign in using just the 72 characters of your password, they're in all likelihood using bcrypt.
Show HN: Cityphoria – Honest, crowdsourced city reviews
by vasudevsoni2001 | 2025-08-07 07:56:34+00:00
Hey HN

I recently built Cityphoria — a platform for reviewing entire cities based on real experiences.

The idea came from frustration while planning a move. I could find plenty of reviews for restaurants and attractions, but almost nothing about the cities themselves — no clear way to know what it’s actually like to live or work there.

Cityphoria lets anyone:

- Rate cities on things like walkability, safety, cost of living and more.

- Read reviews from people who’ve lived or traveled there.

- Compare cities to get a clear picture of which one's the best for you.

I’d love for you to check it out and leave a review for any city you’ve lived in or visited. Your input could really help someone planning a move or trip.

Happy to get some feedback, or suggestions! Thanks a lot for your time.
by skeledrew | 2025-08-07 07:56:42+00:00
There are many content creators out there who create and share with the only incentive being for fun and/or interest. However their content is in most cases down-ranked due to a lack of SEO, because no time to waste on that silliness when there are better things to do. The internet is merely reverting to its previous form where such strings-free content was the order of the day, instead of the highly SEO'd spam that's primarily aimed at getting ad impressions or whatever nonsense that degrades user experience.
by GhostDrift | 2025-08-07 07:58:18+00:00
You're absolutely right that current AI systems still have limitations when it comes to verifying very complicated mathematical proofs.In this case, the AI reviews (from Gemini, Copilot, GPT-4o) were used as preliminary consistency checks — not as a substitute for expert mathematical validation.Ultimately, the proof must stand up to human scrutiny, and I'm actively seeking feedback from experts in number theory.
by PeterStuer | 2025-08-07 07:58:40+00:00
Ah. The hell of group projects. In my days, if it were a group assignment you would still end up doing all the work yourself 80% of the time as the group just couldn't be arsed to produce anything and rather play a game of chicken.

Worse yet. In 10% of the cases you'ld get some clueless but very opinionated student wanting to be 'manager' and 'editor in chief', contributing nothing but bossing everyone around.

And yes, in 10% of the cases, you would have another student actually smart and helpfull.

So is it better to have LLM slop rather than nothing at all? Probably not, but it is not like those people would have turned in good contributions otherwise.
by allears62 | 2025-08-07 08:01:58+00:00
My main frustration with this sort of system, beyond the security risks is the terrible UX of a system like Spotify.

I appreciate most people log in and stay logged in but I frequently switch Spotify accounts and I use passwords to log in, instead of letting me choose password or a 6 digit code, every time I try and change account a needless 6 digit code is generated and sent to a shared inbox, a huge waste of resources and storage. In addition to being a security concern as flagged throughout this thread.
by eru | 2025-08-07 08:02:11+00:00
> It's easier to see your own society's faults.

Neither the US, UK or France are my own society.

I lived in the UK for a few years on and off. I agree that rationing by queuing is less efficient than rationing by money. Singapore does a much better job: they always have a co-payment (even if that's often that just for symbolic/ideologic reasons, and less so for rationing).
by cess11 | 2025-08-07 08:02:25+00:00
Better link, at least for me:

https://xcancel.com/paulg/status/1953289830982664236

I've done that, occasionally, though through deterministic means, i.e. code generation tools. If you know what you're getting it's no big deal. If you don't, it probably is, but not in a good way.

If it's actually true and the result reasonable, I expect ~7-8 KLOC out of those 10 to be adequate and necessary tests, and roughly 4 out of those 12 h a day to be waiting for tests to finish. I also expect static analysis tooling, linters, ast-grep and so on get a lot of use.
by johtso | 2025-08-07 08:02:33+00:00
Wouldn't that be incredibly insecure? Attacker would just need to initiate a login, and if the user happens to click the link they've just given the attacker access to their account..

The reason why magic links don't usually work across devices/browsers is to be sure that _whoever clicks the link_ is given access, and not necessarily whoever initiated the login process (who could be a bad actor)
by mike_hearn | 2025-08-07 08:02:51+00:00
No, I've never seen a well reasoned rebuttal. The type of reply you get here on HN is always exactly like yours: an insistence on arguing the who instead of the what. Hence your requirement that any given sources are "reputable", without specifying what that means. Based on experience it's guaranteed to exclude 100% of all sources that discuss the issue honestly. That game has played out here 1000 times and is boring. If you disagree, check a fact or two. Go find sources that you think are reputable instead of expecting others to guess and read a few, poke holes in them if you can. That would be interesting.

> "Science" is a vague, very high level methodology. There's no single correct way to go about things

It's really not. But this is the kind of semantic dispute I am warning of. If your response to discovering that academics engage in data fabrication is to say that's ok because science can mean anything, then science doesn't mean anything. And eventually the general public will learn that, and vote to defund it.

> the foundations of statistical methods will presumably remain the same no matter what task you apply them to.

Overfitted models are not only common in many fields but academics often try to justify them as OK to use, so I wouldn't assume statistical methods remain the same no matter what task you apply them to. After all, science is really vague, right? Who is to say what the foundations of statistics are?
by eru | 2025-08-07 08:03:47+00:00
That seems like a weird conspiracy. Why would the parties secretly want to do something that the voters don't like? Are they not power-hungry?

By the way, how is that the republican playbook? What does any of this have to do with the desire to remove King Charles as the head of government? https://en.wikipedia.org/wiki/Republicanism_in_the_United_Ki...
by dotancohen | 2025-08-07 08:03:58+00:00
> The market has failed.

So you argue that the capitalist approach failed, and now you advocate for a socialist approach?

Maybe the market didn't fail. Maybe the market is providing what the consumers demand. Maybe you are an outlier, different from the rest of the consumers.

Do you feel that there is no option for you on the market? Windows, nor Debian, nor Ubuntu, not Mac meet your needs? Do you think that there are others like you, if so then why not start a business and serve that market? You might have tremendous opportunity here.
by geocar | 2025-08-07 08:04:01+00:00
> The attack pattern is:

There are lots of attack patterns. That is one. I am not certain I believe it is very likely, because (a) I think "sign-in partner" is obvious bullshit, and (b) I don't understand why I would never enter a code into the wrong website. I believe it can be possible, but...

> Passkeys is the way to go. ... I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money.

... I do not agree your story is justification for passkeys, or for letting banks trust passkeys for authentication purposes. I'd rather she not lose access to banking services in the first place: I don't think banks should be allowed to do that, and I do not think it should be possible for someone to "steal all her money" so quickly -- Right now you should have at least several days to fix such a thing with no serious inconvenience beyond a few hours on the phone. I think it is important to keep that, and for banking consumers to demand that from their bank.

A "granny" friend of mine got beekeeper'd last year[1] and her bank reversed/cancelled the transfers when she was able to call the next say and I (local techdude) helped backup/restore her laptop. I do not think passkeys would helped and perhaps made things much worse.

But I don't just disagree with the idea that passkeys are useful, or even the premise of a decision here between losing all their money and choosing passkeys, I also disagree with your priors: Having to visit a bank branch is a huge inconvenience for me because I have to fly to my nearest. I don't know how many people around here keep the kind of cash they would need on-hand if they suddenly lost access to banking services and needed to fly to recover them.

I think passkeys are largely security-theatre and should not be adopted simply if only so it will be harder for banks to convince people that someone should be able to steal all their money/access with the passkey. This is just nonsense.

[1]: seriously: fake antivirus software invoice and everything, and her and her kid who is my age just saw the movie in theatres in like the previous week. bananas.
by delusional | 2025-08-07 08:05:11+00:00
What I'm gathering from that description is a flow that would involve three parties: Me, the restricted resource, and an ID validator. When I wanted to access the restricted resource, they'd ask for a valid token that I would then go to my ID validator to get since they've already identified me, they'd then pass that valid token back to me which I could pass to the restricted resource. They'd presumably then save that token as proof that they did their legally required validation. Is that roughly correct?

I think that's the model they're working on in the EU using Bitstring Status List, OpenID for Verifiable Presentations, and ISO 18013-5.

If you want to know more there's a reference implementation: https://github.com/eu-digital-identity-wallet/eudi-doc-archi...
by geertj | 2025-08-07 08:05:19+00:00
> Ensure that Frontier AI Protects Free Speech and American Values

I am in the early phases of collecting my thoughts on this topic so bear with me, but it this a bad thing?

AI models will have a world view. I think I prefer them having a western world view, as that has built our modern society and has proven to be most successful in making the lives of people better.

At the very minimum I would want a model to document its world view, and be aligned to it so that it does not try to socially engineer me to surreptitiously change mine.
by mjadobson | 2025-08-07 08:06:16+00:00
Does this have any relation to: https://github.com/vlcn-io/cr-sqlite ?

Some of the API naming is similar (db_version, site_id, seq, commit_alter, etc), although the project source is very different (C rather than Rust, different feature set).

crsqlite is no longer maintained so I might be interested in migrating.
by scrapheap | 2025-08-07 08:06:40+00:00
For anyone interested in this I can recommend the book, The Future Was Here. It really explains the Amiga hardware and how it was used. It even goes into how the bouncing ball demo works, and once you know all the tricks it could use on the Amiga, you can see why other computers of the time had to work so hard to recreate it.
by dejv | 2025-08-07 08:07:31+00:00
Even if I wrote 10k lines of code a day I will be out of things to implement in day two. Maybe I am working on wrong codebases, but I never felt like I am behind because of not enough lines got writen. It was always finding and forming correct perspective.

Just for fun I checked the codebase stats for platform I am working on and it is 70k lines of code. We are talking about enterprise saas processing payments in billions per year.