MurphyA/hacker-news huggingface dataset:
by varenc | 2025-08-25 03:10:52+00:00
Changing the rules is definitely more work than maintaining status quo. Imagine a giant bureaucracy and all the things that are would need to adjust. And granting prisoners even limited internet access is fraught.

A close friend of mine taught physics and programming in San Quentin and for the most part his students couldn't use even a restricted variant of the internet. He told me guards would complain that he was "making criminals smarter".

He ended up hosting a local copy of Wikipedia for student use, but to make the prison staff happy he had to remove any controversial articles from it, like "lockpicking" and any article with explicit imagery.
by aspenmayer | 2025-08-25 03:11:16+00:00
https://en.wikipedia.org/wiki/Christopher_R._Browning#Ordina...

Also check out this one, written to counter Ordinary Men.

https://en.wikipedia.org/wiki/Hitler%27s_Willing_Executioner...

It's not well-regarded, but I think that one thing the book tries to bring to light is the context and valence of values of the times, and the political furor of that era which directly contributed to the hatred and violence. I'm not sure that it's fair to say that they were just following orders without looking at the broader social context that people were living in up to the point that those orders were given.

I think that his concept of "eliminationist racism" is somewhat accurate, as I have known race-based supremacists in real life, and have had them protest/counter-protest public events I have been involved with providing security for.

I don't support racial supremacy or hatred in any way, in case that was ambiguous or unclear from context.
by Animats | 2025-08-25 03:11:31+00:00
The US National Renewable Energy Laboratory was working on energy storage involving a silo of hot sand.[1] But that was probably cut by the Trump Administration.[2]

The sand scheme involves putting hot sand into the top of the silo, and draining out sand into a heat exchanger at the bottom. So you can have more storage than you have heat exchanger capacity. The "ultra cheap" approach in the article requires resistance heaters and plumbing all through the cheap dirt.

Molten salt has also been used for this, successfully.

[1] https://www.solarpaces.org/nrel-results-support-cheap-long-d...

[2] https://www.wenatcheeworld.com/news/northwest/trump-congress...
by schiffern | 2025-08-25 03:14:05+00:00
>Since street trees can’t get much of this from rainwater, which falls on concrete and drains into the city’s sewers, Poirier says the most likely explanation is ... I feel like this is burying the lede. What can be done to reduce leakage?

Seems like a better question is, why didn't we design our urban and suburban hydrology to water those trees, instead of shunting rain to an already overburdened storm system?

This is hardly a pipe dream. Village Homes demonstrated the concept[0] over five decades ago.

[0] https://www.youtube.com/watch?v=zZ7RmsJOlgc&t=980s
by x3haloed | 2025-08-25 03:14:18+00:00
Nice! I've been thinking that we need something like this for a while. I didn't realize it could be so simple!

I've been looking into other techniques as well like making a little hibernation/dehydration framework for LLMs to help them process things over longer periods of time. The idea is that the agent either stops working or says that it needs to wait for something to occur, and then you start completions again upon occurrence of a specific event or passage of some time.

I have always figured that if we could get LLMs to run indefinitely and keep it all in context, we'd get something much more agentic.
by poslathian | 2025-08-25 03:15:05+00:00
After becoming familiar with the reality of the cost inflation of (in my case local government real estate) development projects vs private I chalked it up to graft, incentives, and mismanagement.

Actually your comment is probably more correct - adds a whole step to move the wallet. Misaligned incentives and mismanagement are probably more equal across public/private than we like to believe
by 9rx | 2025-08-25 03:15:34+00:00
Which is all the same as what unit test was originally defined as.

You're right that "unit test" has taken on another, rather bizarre definition in the intervening years that doesn't reflect any kind of tests anyone actually writes in the real world, save where they are trying to write "unit tests" specifically to please the bizarre definition, but anyone concerned about definitional purity enough to quibble about it will use the original definition anyway...
by arcticbull | 2025-08-25 03:15:43+00:00
Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple drops the hammer.
by rectang | 2025-08-25 03:17:04+00:00
It’s a bad litmus test because people are at least capable of making distinctions between classes of crimes and the extent to which rehabilitation is practical. Many might support rehabilitation for e.g. petty thieves (or murderers, since recidivism for homicide is low!) but not rapists.

It’s like conducting a “push poll” using such an emotionally freighted and skewed framing — you’re obviously looking for the answer “nobody supports rehabilitative justice” by emphasizing “BUT WHAT ABOUT RAPISTS”.
by almostgotcaught | 2025-08-25 03:17:05+00:00
This is already the standard stack based DFS?

def dfs(graph, source): n = len(graph) visited = set() stack = [source] while stack: node = stack.pop() if node in visited: continue visited.add(node) for nbr in graph[node]: stack.append(nbr)

So I don't know what all the confusion is about...
by bitexploder | 2025-08-25 03:19:11+00:00
It’s hard. It mostly comes down to learning new things, playing in spaces you don’t often play. I am 45 now and work in big tech. Just keep learning, growing. Embrace AI, understand how it works, what it is good at. Be the one to try things like in this article. Have an opinion and be right more often than not on AI. Not much else to do. Stay sharp and we will all see what happens :)
by JimDabell | 2025-08-25 03:19:11+00:00
> would basically make indie development impossible

We aren’t talking about indie development though. People like to paint a picture of a small, scrappy startup or beleaguered solo dev being held back by Apple’s crushing 30%, but that isn’t the case.

Unless you are earning more than a million dollars a year through the App Store alone, you don’t pay 30%, you pay 15%. And if you earn more than that, you still only pay 15% for long-term subscribers. And of course, all those SaaS companies where the app is just an interface for the larger service pay 0%.

As soon as you start talking about “Apple’s 30%”, you reduce the scope of the argument to the tiny fraction of developers with millions in revenue.

If you do actually want to talk about indie development, you should be talking about “Apple’s 15%”.
by arcticbull | 2025-08-25 03:19:52+00:00
Not exactly, distribution conversation aside this is specific to kernel extensions. Apple's been moving drivers out of kernel space and into user space for several years [1]. There's a lot of good reasons for doing so, and not a lot of drawbacks. I'd consider this to be a strongly worded API deprecation notice.

[1] https://developer.apple.com/documentation/driverkit
by JustExAWS | 2025-08-25 03:21:12+00:00
I was around during that time. Around System 7.5 or System 8, they did license a lot of third party utilities. But as far as I know, Connectix was never one of them.

Apple built their own Gen 2 68K emulator. But Speed Doubler was still faster.

In the modern era, Apple did acquire Dark Sky for better weather APIs and an apps and the company behind Automator.
by ofjcihen | 2025-08-25 03:21:45+00:00
Absolutely.

Before vibe coding became too much of a thing we had the majority of our business coming from poorly developed web applications coming from off shore shops. That’s been more or less the last decade.

Once LLMs became popular we started to see more business on that front which you would expect.

What we didn’t expect is that we started seeing MUCH more “deep” work wherein the threat actor will get into core systems from web apps. You used to not see this that much because core apps were designed/developed/managed by more knowledgeable people. The integrations were more secure.

Now though? Those integrations are being vibe coded and are based on the material you’d find on tutorials/stack etc which almost always come with a “THIS IS JUST FOR DEMONSTRATION DONT USE THIS” warning.

We also see a ton of re-compromised environments. Why? They don’t know how to use CICD and just recommit the vulnerable code.

Oh yeah, before I forget, LLMs favor the same default passwords a lot. We have a list of the ones we’ve seen (will post eventually) but just be aware that that’s something threat actors have picked up on too.

EDIT: Another thing, when we talk to the guys responsible for the integrations or whatever was compromised a lot of the time we hear the excuse “we made sure to ask the LLM if it was secure and it said yes”.

I don’t know if they would have caught the issue before but I feel like there’s a bit of false comfort where they feel like they don’t have to check themselves.
by aspenmayer | 2025-08-25 03:21:46+00:00
> That seems a rather aggressive response to someone suggesting you read the manual in order to enable a legitimate conversation about the topic. I explained why the shares aren’t given and why benefit still accrues to the public.

I disagree, but in the interest of not painting the mods into a corner with my reply, I won't pursue this thread further.

https://news.ycombinator.com/newsguidelines.html

> Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that".

You didn't quite say that, but it rhymed. The sentence I quoted upthread added nothing to your comment, and that is that part I took issue with.
by heybrendan | 2025-08-25 03:23:23+00:00
From 2014 [1].

This seems to be posted once per year (at least); however, hardly a complaint as the discussion tends to be high quality.

My personal mantra is if it's over 10~20 lines, I should arguably be using another language, like Python (and perhaps correspondingly, subprocess [2], if I'm in a hurry).

[1] https://web.archive.org/web/20140523002853/http://redsymbol....

[2] https://docs.python.org/3/library/subprocess.html
by jacquesm | 2025-08-25 03:23:24+00:00
I only looked at this from the homeowner perspective as a DIY project, but if I were to look at it from a utility scale commercial perspective I'd say the first thing I'd do would be to compare it to wind power because where I live that is probably one of the most efficient ways to generate renewable energy even if there is no storage option. It nicely dovetails with solar. When I did this at the residential scale in an off-grid house I built I managed to get it - fairly easily - to the point where we did not need a generator at all, even though we had one.
by FreakLegion | 2025-08-25 03:23:32+00:00
It's a decent systematic look at something people have been doing ad hoc for a long time. In 2010 or so I realized:

1. Authenticode signatures have unauthenticated sections.

2. ZIP files don't require headers.

So you can shove a ZIP file (i.e. JAR, DOCM, APK, etc.) into a signed Windows executable without breaking its signature, and then depending on the extension it will do any number of things when clicked.

(The extent to which this works has changed a lot in the intervening years, but prior to a patch in 2013 it was especially bad, and the patches never made their way into the spec, so custom Authenticode validators like Wine's or, say, the one in Palo Alto Networks gear, were still vulnerable the last time I checked.)

Anyway, at the same time:

1. Cybersecurity products lean on Authenticode to keep false positives down for specific publishers.

2. Those same products cache everything by hash without regard for file type.

Put all of this together and you could, as of 2020 at least, not only execute whatever you wanted, you could also have it misreported by CrowdStrike or whoever as a signed Windows component.

Fun stuff, but I agree that it's kind of marginal.
by esyir | 2025-08-25 03:23:46+00:00
The big difference is that chess is a game/sport, and those are about competition between humans. It's a deliberately restricted ruleset to encourage such, thus the (imperfect) banning of assistance.

The same doesn't really apply to everything outside of that.

Still, you'd think that status would still remain, it's not like the invention of the car removed the glory of being the world's fastest sprinter.
by echelon | 2025-08-25 03:25:06+00:00
That's the thing, one day you won't be able to.

You'll only be able to connect to domains that have been bought with a state-issued ID and digitally signed. If you run afoul of the rules, you'll be taken down, fined, or worse.

The means to publish and consume will be taken from us.

"Trusted" computing. "You wouldn't download a car." "Think of the children". "Free speech allows hate."

Within a generation of complete and total control of communications, we will be slaves. Powerless, impotent, unable to organize, disposable fodder.

1984 is coming.
by xethos | 2025-08-25 03:26:40+00:00
> As a free-market worshipper I have some concerns about this

But it's the government (via the TSA) that gates not only customers, but also the employees (as they must at least be able to pass through the TSA, though admittedly the bar isn't tremendously high), and at government-owned airports, they control the tenants / shops as well

To call it a free market misses all kinds of behind the scenes details
by jacquesm | 2025-08-25 03:27:13+00:00
Insulation volume was the issue for me. Sand works well enough, the ideal setup would be - as far as I've figured this out - a sinkable construct that has insulation in the bottom and the walls that you can put together in a modular way by slipping one part after another into a basement. Then you sink it in the same way that you sink a well. Indeed, keeping water out of it essential but you can test where the water table is and keep a very healthy margin. The 'instant steam explosion' angle in case of a water leak in the house is one of the reasons I've never actually done it.
by chubot | 2025-08-25 03:27:53+00:00
I use essentially this, but I think this post is over 10 years old (needs a date), and it's now INCOMPLETE.

bash introduced an option to respect rather than ignore errors within command sub processes years ago. So if you want to be safer, do something like:

#!/bin/bash set -euo pipefail shopt -s inherit_errexit

That works as-is in OSH, which is part of https://oils.pub/

(edit: the last time this came up was a year ago, and here's a more concrete example - https://lobste.rs/s/1wohaz/posix_2024_changes#c_9oo1av )

---

But that's STILL incomplete because POSIX mandates that errors be LOST. That is, it mandates broken error handling.

For example, there what I call the "if myfunc" pitfall

set -e my-deploy-func # errors respected if ! my-deploy-func; then # errors lost echo failed fi my-deploy-func || echo fail # errors lost

But even if you fix that, it's still not enough.

---

I describe all the problems in this doc, e.g. waiting for process subs:

YSH Fixes Shell's Error Handling (errexit) - https://oils.pub/release/latest/doc/error-handling.html

Summary: YSH fixes all shell error handling issues. This was surprisingly hard and required many iterations, but it has stood up to scrutiny.

For contrast, here is a recent attempt at fixing bash, which is also incomplete, and I argue is a horrible language design: https://lobste.rs/s/kidktn/bash_patch_add_shopt_for_implicit...
by starchild3001 | 2025-08-25 03:28:28+00:00
Hypothesis: If you had ~1M dollar to burn, I think we should try setting up an AI agent to explore and try to invent new mathematics. It turns out agents can get an IMO gold with Gemini 2.5 Pro production model only. Therefore I suspect a swarm of agents burning through tokens like there's no tomorrow can invent new math.

Reference: https://arxiv.org/abs/2507.15855

Alternative: If Gemini Deep Think or GPT5-Pro people are listening, I think they should give free access to their models with potential scaffolding (ie. agentic workflow) to say some ~100 researchers to see if any of them can prove new math with their technology.
by owenversteeg | 2025-08-25 03:28:47+00:00
Sorry, your comment is bullshit.

>Most wine bottles lose their ethanol within decades

Not true at all, even for bottles sealed with cheap, short corks, or bottles that leak. One delicious example is 1977 Vintage Port, which is notorious for faulty corks. Roughly speaking, 1/3 to 1/2 of corks failed even with good storage. And yet - the port inside is still in near-perfect shape, alcohol intact. Indeed, I just opened another bottle of '77 Dow's the night before last, and it was flawless.

>200-300 years is normally the limit before wine loses all ethanol even without a leak.

Also entirely untrue - I have wine in that age range as well :) And once again, some of it has leaked, and once again, the alcohol remained intact...

If you don't believe me, I recommend looking up tasting notes for old wines. There are plenty of datapoints on this particular subject. Or, you could buy a bottle! Vintage Port with fifty years on it isn't terribly expensive for the quality and age of wine you're buying.
by zdw | 2025-08-25 03:28:54+00:00
"much worse for customers" is relative. While in no ways perfect, Apple's walled garden gets rid of a huge amount of the enshittification found on other platforms, and makes it so that downloading a random app is relatively safe and unlikely to nuke your phone, steal your data, etc. Yes all the "allow access to location/photos/etc." are annoying, but at least the user has some level of control and consent.

I do agree that requiring specific platforms is a problem - we don't want a return to the IE6 or Flash-dominated eras where people who weren't on Windows were treated like sub-humans.
by esyir | 2025-08-25 03:29:52+00:00
Sure, it's been done before, but looking at the end result though, I'm not sure if that's a strong argument for whether it should be done again.

Look at the end state of the US auto industry. It's uncompetitive in basically every part of the world and thus basically irrelevant, except in the US. Unless somehow something different is going to happen here, this could end up with Intel continuing to perform poorly, negating the point of keeping it alive to begin with.
by TrueDuality | 2025-08-25 03:30:01+00:00
The quick rundown of refresh token I'm referring to is:

1. Generate your initial refresh token for the user just like you would a random API key. You really don't need to use a JWT, but you could.

2. The client sends the refresh token to an authentication endpoint. This endpoint validates the token, expires the refresh token and any prior bearer tokens issued to it. The client gets back a new refresh token and a bearer token with an expiration window (lets call it five minutes).

3. The client uses the bearer token for all requests to your API until it expires

4. If the client wants to continue using the API, go back to step 2.

The benefits of that minimal version:

Client restriction and user behavior steering. With the bearer tokens expiring quickly, and refresh tokens being one-time use it is infeasible to share a single credential between multiple clients. With easy provisioning, this will get users to generate one credential per client.

Breach containment and blast radius reduction. If your bearer tokens leak (logs being a surprisingly high source for these), they automatically expire when left in backups or deep in the objects of your git repo. If a bearer token is compromised, it's only valid for your expiration window. If a refresh token is compromised and used, the legitimate client will be knocked offline increasing the likelihood of detection. This property also allows you to know if a leaked refresh token was used at all before it was revoked.

Audit and monitoring opportunities. Every refresh creates a logging checkpoint where you can track usage patterns, detect anomalies, and enforce policy changes. This gives you natural rate limiting and abuse detection points.

Most security frameworks (SOC 2, ISO 27001, etc.) prefer time-limited credentials as a basic security control.

Add an expiration time to refresh tokens to naturally clean up access from broken or no longer used clients. Example: Daily backup script. Refresh token's expiration window is 90 days. The backups would have to not run for 90 days before the token was an issue. If it was still needed the effort is low, just provision a new API key. After 90 days of failure you either already needed to perform maintenance on your backup system or you moved to something else without revoking the access keys.
by JimDabell | 2025-08-25 03:31:33+00:00
Strings and Unicode are a lot more complicated than they first appear. I like the way this article puts it:

> Swift’s string implementation goes to heroic efforts to be as Unicode-correct as possible. […] This is great for correctness, but it comes at a price, mostly in terms of unfamiliarity; if you’re used to manipulating strings with integer indices in other languages, Swift’s design will seem unwieldy at first, leaving you wondering.

> It’s not that other languages don’t have Unicode-correct APIs at all — most do. For instance, NSString has the enumerateSubstrings method that can be used to walk through a string by grapheme clusters. But defaults matter; Swift’s priority is to do the correct thing by default.

> Strings in Swift are very different than their counterparts in almost all other mainstream programming languages. When you’re used to strings effectively being arrays of code units, it’ll take a while to switch your mindset to Swift’s approach of prioritizing Unicode correctness over simplicity.

> Ultimately, we think Swift makes the right choice. Unicode text is much more complicated than what those other languages pretend it is. In the long run, the time savings from avoided bugs you’d otherwise have written will probably outweigh the time it takes to unlearn integer indexing.

— https://oleb.net/blog/2017/11/swift-4-strings/

I’d encourage you to read that entire article before describing strings as simple.
Free AI Security Testing
by aiagentlover | 2025-08-25 03:31:45+00:00
My co-founder and I built an AI red teaming platform and want 5-10 companies to test it on before trying to go fundraise. We're validating our approach with real-world case studies, and you'd get a comprehensive security audit in return.

We focus on the stuff that actually breaks AI systems in production:

Prompt injection attacks (direct/indirect) and jailbreaks

Tool abuse and RAG data exfiltration

Identity manipulation and role-playing exploits

CSV/HTML injection through document uploads

Voice system manipulation and audio-based attacks

You'd get a full report with concrete reproduction steps, specific mitigations, and we'll do a retest after you implement fixes. We can also map findings to compliance frameworks (OWASP Top 10 for LLMs, NIST AI RMF, EU AI Act, etc.) if that's useful. All we need is access to an endpoint and permission to use your anonymized results as a case study. The whole process takes about 2-3 weeks. If you're running AI/LLM systems in production and want a security review, shoot me a DM.