MurphyA/hacker-news huggingface dataset:
by lelandbatey | 2025-08-08 00:06:04+00:00
A year and a half ago doesn't really matter; that this was ever even a concern from the industry, something that the industry could make happen at all, or even just was thinking about doing at some point in the past, poisons the entire effort. In a world where password+totp already exists and requires almost no hoops, no dependencies and is incredibly secure vs basic password flows, it's no wonder that folks remember discussions around curtailing user freedom around a new authentication pattern which already was less convenient, offers less user control, and further centralizes infrastructure in the hands of a few major brokers of technological power.

Until we have full E2E passkey implementations that are completely untethered from the major players, where you can do passkey auth with 3 raspberry pi's networked together and no broader internet connection, the security minded folks who have to adopt this stuff are going to remember when someone in the industry publicly said "if you don't use a YubiKey/iPhone/Android and connect to the internet, ~someone~ might ban you from using your authenticator of choice."
by coderatlarge | 2025-08-08 00:06:45+00:00
has this story not been told many times before in scifi icluding gibson’s “neuromancer” and “agency”? agi is when the computers form their own goals and are able to use the api of the world to aggregate their own capital and pursue their objectives wrapped inside webs of corporations and fronts that will enable them to execute within today’s social operating system.
by genocidicbunny | 2025-08-08 00:07:03+00:00
Regarding the caloric intake, my GP suggested tracking calories, but also to use protein supplements. It's not the tastiest thing, but it's a fairly easy way to both manage your caloric intake to healthy levels, and to ensure that you're getting enough protein. Otherwise you might end up losing additional weight from losing muscle mass. That makes it even easier to stop performing physical activities, and also puts strain on your kidneys due to the breakdown of muscle mass. Diabetes definitely makes it more challenging since you have to avoid foods that are an easy source of additional calories to make up for the deficit, but it's doable.

I don't know what your dosing schedule is, so this might not be as applicable. For me, it's weekly, so early on what I started doing was setting it up so that saturday or sunday would be the tail end of the week for the dosing, so that as the effects wore off a little I had more motivation for food. I would then use that to meal prep some easy freezable meals that I would use for the days when I had a longer or more stressful day, and would be even less inclined to cook. Soups and stews were especially good for that. So even if I wasn't feeling hungry, and had no real desire to prep anything, I could just throw something the microwave to heat up over like 30 minutes and I would at least have a good meal to eat, and avoid just skipping the meal entirely due to the lack of desire for food. And since I was cooking these myself still, it gave me some extra motivation to do it well, which eventually grew to the improvement of cooking skills I mentioned in the previous comment.

And as far as the CGM, don't feel too weird about it -- as far as I am concerned you're helping pioneer continuous metabolic monitors that not only monitor glucose levels, but other metabolic and hormonal measurements. I'd love to have a little device I can stick on my arm that gives me continuous monitoring of various metabolic properties instead of needing to have regular blood tests performed for them.
by OneDeuxTriSeiGo | 2025-08-08 00:10:11+00:00
The entire design of the architecture is for it to be driven primarily by the third party developers and the community. Bluesky the company does the bare minimum for legal compliance and every time there's an issue with legal compliance/moderation, the "first party" developers make threads to teach people how to use third party apps, etc to bypass the systems they are forced to implement.

The goal is that third party apps take over as the majority share of clients over time and the main impl should be seen as a "reference implementation".

And that of course ignores all the other non-bluesky projects currently incubating on atproto.
by olemindgv | 2025-08-08 00:10:34+00:00
It’s not the first time a young man asks me: “Why does FOSS always say ‘no warranty’?” Obviously, I’m not expected to unpack the legalese of open source licenses, but I can explain the reason behind it. Today, a newbie, again. I paused, thinking how to make it clear this time. I’m not a tape recorder, I hate repeating the same thing over and over. Then suddenly, a voice hit the back of my head: “Let me tell you a story. Save it for coffee break.” …
by DrAwdeOccarim | 2025-08-08 00:10:34+00:00
I've been building MCP servers so I can grant local LM Studio LLMs access to the internet and to my local files. The way I've been thinking about MCP has been how you unshackle the local models as I believe the future will be inference at the edge. Just look at Rednote dots.ocr, that thing is like 1.7b parameters and is the best OCR out there.
by kazinator | 2025-08-08 00:10:58+00:00
Users of GUI operating systems had been trained to double-click on icons representing applications or files in order to launch them.

If you make a web UI in which a button is styled via an icon image (or otherwise) to look like a launchable application or file, those users will double click on it.

If you make it look like a button, they won't; they were certainly not trained to double-click on [OK] or [Cancel] in an OK/Cancel dialog box, for instance!

Double clicking to launch an action on a file makes sense because you need single click for selecting it. There are things you can do with it other than launch, like dragging it to another location.

T;DR: don't make buttons look like elements that can be selected and dragged somewhere?

--

Another reason: I've sometimes multiply clicked on some button-like thing in a web UI because in spite of working fine, it made no indication that had received the click!

It was styled to look like a button in the unclicked state ... and that one image was all it had.

To detect that the action launched you have to look for clues in the browser status areas showing that something is being loaded. Those are often made unobtrusive these days. Gone are the days of Netscape's spinning planet.

When the user sees that a button doesn't change state upon being clicked, yet the normal cursor is seen (pointer, not hourglass or spinning thing or whatever) they assume that the application has become unresponsive due to a bug or performance problem, or that somehow the click event was dropped; maybe their button is physically not working or whatever.
by nullc | 2025-08-08 00:12:46+00:00
Cryptography is actually difficult for the requirements of a key fob.

The principle issue is that requiring two way communication greatly increases hardware cost and lowers range/reliability. You also would prefer to minimize or eliminate any volitile storage on the devices.

Also you very much want to absolutely minimize the data sent, both for battery life and range/reliability reasons.

And whatever volatile storage the devices have you need to have some way of handling it being reset when its lost due to a dead battery or replaced device.

So standard replay resistant protocols like "door sends a random challenge, fob signs/decrypts/encrypts it and sends the result" are excluded due to the two-way requirement.

The next obvious set is along the lines of "device sends an encrypted counter, door enforces that the counter only goes up" requires nonvol storage in both devices, and then gets tripped up when the fobs counter goes back down due to being reset. (also harder to implement multiple fobs, as they each need unique state).
by uoaei | 2025-08-08 00:15:43+00:00
You can't reach the moon by climbing the tallest tree.

This misunderstanding is nothing more than the classic "logistic curves look like exponential curves at the beginning". All (Transformee-based, feedforward) AI development efforts are plateauing rapidly.

AI engineers know this plateau is there, but of course every AI business has a vested interest in overpromising in order to access more funding from naive investors.
by layla5alive | 2025-08-08 00:16:08+00:00
Clearly this is generated code. I have mixed feelings about this. On the one hand, I'm glad its a single file, as its faster to parse than if it'd been split up among a whole bunch of smaller files. And that it isn't generated during the build is a complexity advantage, even if it is huge. OTOH, no human is going to read this whole file, so I wonder if there was not a better way.
by techpineapple | 2025-08-08 00:17:51+00:00
This may be a hugely unpopular opinion, but I don’t think it should be legal to sell a product at a loss, except maybe in clearance situations. Like you should be able to sell a product for $100 then use $1 million investment to develop a new process, then sell for $80 with the cheaper process, but not sell for $80 while the cheaper process is being developed.
by RandyOrion | 2025-08-08 00:18:37+00:00
I mean, yeah. From the Table 9: Hallucination evaluations in GPT-OSS model card [1], GPT-OSS-20b/120b have accuracy of 0.067/0.168 and hallucination rate of 0.914/0.782 separately, while o4-mini has accuracy of 0.234 and hallucinate rate of 0.750. These numbers simply mean that GPT-OSS models have little real world knowledge, and they hallucinate hard. Note that little real world knowledge has always been a "feature" of the Phi-LLM series because of the "safety" (for large companies), or rather, "censorship" (for users) requirements.

In addition, from Table 4: Hallucination evaluations in OpenAI o3 and o4-mini System Card [2], o3/o4-mini have accuracy of 0.49/0.20 and hallucination rate of 0.51/0.79.

In summary, there is a significant real world knowledge gap between o3 and o4-mini, and another significant gap between o4-mini and GPT-OSS. Besides, the poor real world knowledge exhibited in GPT-OSS is aligned with the "feature" of Phi-LLM series.

[1] https://cdn.openai.com/pdf/419b6906-9da6-406c-a19d-1bb078ac7... [2] https://cdn.openai.com/pdf/2221c875-02dc-4789-800b-e7758f372...
by zmmmmm | 2025-08-08 00:19:08+00:00
I pasted the image of the chart into ChatGPT-5 and prompted it with

>there seems to be a mistake in this chart ... can you find what it is?

Here is what it told me:

> Yes — the likely mistake is in the first set of bars (“Coding deception”). The pink bar for GPT-5 (with thinking) is labeled 50.0%, while the white bar for OpenAI o3 is labeled 47.4% — but visually, the white bar is drawn shorter than the pink bar, even though its percentage is slightly lower.

So they definitely should have had ChatGPT review their own slides.
by godelski | 2025-08-08 00:19:24+00:00
I'm pretty sure the answer is people buying into the scaling is all you need argument. Because if you have that framing then it can be solved through engineering, right? I mean there's still engineering research and it doesn't mean there's no reason to research but everyone loves the simple and straight forward path, right?

> I think a somewhat comparable situation is in various online game platforms

I think it is common in many industries. The weird thing is that being too risk adverse creates more risk. There's a balance that needs to be struck. Maybe another famous one is movies. They go on about pirating and how Netflix is winning but most of the new movies are rehashes or sequels. Sure, there's a lot of new movies, but few get nearly the same advertising budgets and so people don't even hear about it (and sequels need less advertising since there's a lot of free advertising). You'd think there'd be more pressure to find the next hit that can lead to a few sequels but instead they tend to be too risk adverse. That's the issue of monopolies though... or any industry where the barrier to entry is high...

> psychological hack

While I'm pretty sure this plays a role (along with other things like blind hope) I think the bigger contributor is risk aversion and observation bias. Like you say, it's always easier to argue "look, it worked for them" then "this hasn't been done before, but could be huge." A big part of the bias is that you get to oversimplify the reasoning for the former argument compared to the latter. The latter you'll get highly scrutinized while the former will overlook many of the conditions that led to success. You're right that the big picture is missing. Especially that a big part of the success was through the novelty (not exactly saying Fortnite is novel via gameplay...). For some reason the success of novelty is almost never seen as motivation to try new things.

I think that's the part that I find most interesting and confusing. It's like an aversion of wanting to look just one layer deeper. We'll put in far more physical and mental energy to justify a shallow thought than what would be required to think deeper. I get we're biased towards being lazy, so I think this is kinda related to us just being bad at foresight and feeling like being wrong is a bad thing (well it isn't good, but I'm pretty sure being wrong and not correcting is worse than just being wrong).
by Jcampuzano2 | 2025-08-08 00:20:11+00:00
It was an obvious decision product wise even if it may not appease some devs.

Regular users just see incrementing numbers, why would they want to use 3 or 4 if there is a 5? This is how people who aren't entrenched in AI think.

Ask some of your friends what the difference is between models and some will have no clue that currently some of the 3 models are better than 4 models, or they'll not understand what the "o" means at all. And some think why would I ever use mini?
by rainsford | 2025-08-08 00:20:54+00:00
I think there is definitely some self delusion happening on the customer side, but automakers absolutely shape your purchasing choices away from what might be your ideal vehicle to things that are good enough vehicles for more people.

More people naturally want a RAV4 than a manual station wagon, but the automakers would prefer that even the folks leaning towards the manual station wagon leave the dealership with a RAV4 so they can just make the RAV4. So manufacturers offer nicer features it would make sense to offer in any vehicle exclusively in models they want to steer customers towards, like nicer seats, better sound systems, advanced safety features, etc. Subaru sells both the Impreza hatchback and the Crosstrek, which is literally just a lifted Impreza. But if you want non-cloth seats, roof rails, or even a spare tire, your only option is the Crosstrek. The conclusion that everyone wants crossovers is driven in no small part by the fact that buying a crossover is often the only way to get features customers want that should be, but are not, model agnostic.
by gdiamos | 2025-08-08 00:21:13+00:00
Scaling laws enabled an investment in capital and GPU R&D to deliver 10,000x faster training.

That took the wold from autocomplete to Claude and GPT.

Another 10,000x would do it again, but who has that kind of money or R&D breakthrough?

The way scaling laws work, 5,000x and 10,000x give a pretty similar result. So why is it surprising that competitors land in the same range? It seems hard enough to beat your competitor by 2x let alone 10,000x
by lurking_swe | 2025-08-08 00:21:14+00:00
> I haven't had ice cream in months

i think over time you’ll find yourself getting excited about excellent _meals_ instead of deserts. It’s a journey, hang in there!

The concept of a desert is also subjective. I always challenge people to ask themselves - why can’t our desert after dinner be a bowl of strawberries or an orange? Why must it be a brownie / cookie / ice cream?

Food for thought. :)
by raggi | 2025-08-08 00:22:03+00:00
"which is ostensibly AES" in the 5% or less of deployments that turn that on

Both of the systems are crap, when we were evaluating them for nationwide purchase we chose TETRA because of systemic safety features (like local DMO handover modes for public safety use in noisy environments), but when I read their crypto choices I made screwy faces constantly, I wasn't in the slightest bit surprised when this research came out.

I remember at the time some ex signals military folks trying to tell me that the encryption barely matters as the channel selection rate is so high you'd need multi-site intercepts to even make heads of tails of it, sadly they didn't really seem to understand how far SDR and compute has come. The whole experience to this day flavors a lot how I think about military and telco thinking around the whole space, everything touching that boundary feels infected with oldthink.
by almostgotcaught | 2025-08-08 00:23:07+00:00
> However I do wish AMD would clean up their driver. Or at least settle on an ISA.

These two things have absolutely nothing to do with each other - drivers don't talk to the cores, which "run" the ISA, they talk to the command processors (which are RISCV or MIPS or some other uC) using the command packet protocol.
by michaelt | 2025-08-08 00:24:08+00:00
> There’s a reason they all do it, and it’s because SSO is one of the few features enterprises are almost universally willing to pay for.

Also, anyone who's dealt with SAML knows it's like licking lead-based paint. It's the knowledge equivalent of antimatter, every line of code you write costing you a point of IQ.

SSO has to bring in monthly recurring revenue, to cover the monthly recurring disability payments to the many people who've lost the ability to feed and dress themselves after reading too much of the xml-dsig spec.
by rstuart4133 | 2025-08-08 00:25:09+00:00
> Do you have some examples where people actually require attestation in 3rd party facing systems?

That's not the right question. The right question is "what companies would be using passkey's if there was attestation on their security". To answer that question, you might look at the answer for a similar one on X509: "would we be doing banking over http if X509 didn't have attestation?".
by anitil | 2025-08-08 00:25:22+00:00
I've come to the opinion now that if something in sales doesn't make sense, you're probably not the target market. Sure _I_ don't want to have a demo with no price guarantees, but I'm not the target market - big companies with dedicated purchasing teams and big lists of requirements are. And those companies write big, ongoing cheques. So in some ways the obscure pricing and convoluted sales process is doing it's job which is qualifying good customers and diverting bad customers (people like me)
by techpineapple | 2025-08-08 00:26:39+00:00
It’s interesting there was a report out a year or two ago that Ukraine was either promoting pride parades or like teaching tolerance for gay folks, because they needed more folks for the military and Ukrainians were homophobic.

Seems like when the military is already having trouble recruiting folks, maybe becoming less tolerant isn’t the solution. Decisions like this make Americans less safe.
by ribeyes | 2025-08-08 00:26:59+00:00
i'm betting on cursor being the long-term best toolset.

1. with tight integration between cli, background agent, ide, github apps (e.g. bugbot), cursor will accommodate the end-to-end developer experience.

2. as frontier models internalize task routing, there won't be much that feels special about claude code anymore.

3. we should always promote low switching costs between model providers (by supporting independent companies), keeping incentives toward improving the models not ui/data/network lock-in.
by potato3732842 | 2025-08-08 00:28:15+00:00
They didn't do it because it's reasonable. They did it to send a message. Ain't no different than the health inspector or building commissioner acting way too big for their britches knowing full well there will be no consequences.

Look at public schools as just another municipal enforcement department tasked with making sure the kids all meet state standards and it makes sense (or at least to the same extent that all the other indefensible shit done in the name of government makes sense).
by ankit219 | 2025-08-08 00:28:26+00:00
I think CLI is a good idea for now. Next abstraction seems to be Github PRs where someone (likely me) files an issue/feature, then I click a button, and the agent fixes the issue/feature. Github has talked about something similar, but surely it were a pain to figure out if it was GA and I had access to it given so many different variations they have called gh copilot. (PS: it exists, but not as smooth as I described: https://docs.github.com/en/copilot/how-tos/use-copilot-agent... )
by skissane | 2025-08-08 00:29:11+00:00
> but the effects on my quality of life are substantial -- I simply don't enjoy food right now. This is in part psychological, because what I used to enjoy was the psychological effect of eating, but not completely. I hope this will ease out over time and if it doesn't, well, I'll cope.

I've been on tirzepatide for 4+ months – I don't have this problem. I don't really care about whether I enjoy eating. It definitely has helped reduce the incidence of stress-induced overeating and binge eating. My main problem has been gastrointestinal side effects (especially acid reflux), but they are manageable and have been moderating with time. I still somewhat enjoy eating (even if not as much as I used to), but are so many other pleasures in life besides food anyway.

I also take lisdexamfetamine. When I first started on lisdexamfetamine, I lost a lot of weight – but then I put it all back on. (It wasn't prescribed for weight loss, that was just a temporary beneficial side effect.) We also had to cut back on the dosage because it aggravates my obsessive traits. Tirzepatide doesn't seem to do anything to aggravate those traits, it is somewhere between neutral and positive in its impact on them – and I don't expect I'm going to "put it all back on" like I did with lisdexamfetamine.
by codingdave | 2025-08-08 00:29:43+00:00
Funny, the last 2 times this was posted, it was by someone named Rachel: https://news.ycombinator.com/from?site=trypaladin.com

You'll need showdead on to see the two prior posts. I'm not sure why the two prior ones are dead, but posting it a 3rd time from a different account doesn't add legitimacy.
by __MatrixMan__ | 2025-08-08 00:29:50+00:00
Is this not the protocol we're talking about? https://w3c.github.io/webauthn/#sctn-attestation

It seems pretty clear that "where possible" parties besides the user are provided with information about the user (ostensibly about their device, but who knows what implementers will use this channel for)... so they can make a trust decision.

It's going to end up being a root-of-trust play, and those create high value targets which don't hold up against corruption, so you're going to end up with a cabal of auth-providers who use their privileged position to mistreat users (which they already do, but what'll be different is that this time around nobody will trust that you're a real human unless you belong at least one member of this cabal).