MurphyA/hacker-news huggingface dataset:
by ewoodrich | 2025-09-23 17:20:10+00:00
Trisolarans did evolve under much different selection pressure that requires effective mass coordination to dehydrate when deemed necessary for civilization's survival. That would probably select for rigid adherence to rules of communication vs critically evaluating every interaction. Or else you'd get a lot of "But am I being tricked into dehydrating to steal my belongings and take my job at the sophon factory? No thanks, I'll pass."
by orphea | 2025-09-23 17:20:15+00:00
> Glad it’s fixed!

...and they used some random package with version 0.0.1 instead of writing 20 lines of code themselves.

It's astonishing how allergic some people are to writing their own code, even the simplest shit has to be a dependency. Let's increase the attack surface, that's fine, what can go wrong, right?

https://github.com/modelcontextprotocol/use-mcp/commit/96063...
by seandoe | 2025-09-23 17:20:17+00:00
I was thinking something very similar as I read the letter and hear people talk about luck in a similar way. I think attributing things to luck, while seemingly humble, can be dismissive and/or simplistic. Yes, we're all lucky to be in our situations -- living in this time, fed, privileged. Though, whether this luck is experienced positively or not is entirely subjective. Also, to ascribe our given situation to luck dismisses the concerted efforts of all living things of this time and past that have guided us to our current situation -- once again, without qualifying it as good or bad. It is almost disabling in it's message. The flip side is that many things happened that were dreamed, planned, intended, and carried out to land us in our situation. This to me feels more empowering, hopeful, appreciative, and also responsible than casting off as merely luck.
by somenameforme | 2025-09-23 17:20:34+00:00
This doesn't require any lengthy history. We're still killing Iranians regularly and pretty much arbitrarily, as well as backing Israel doing the same in a borderline psychotic fashion. And you're here fear mongering about them saying 'Death to America' which is pretty much the equivalent of waving a stick at somebody after they just burnt down your house with your family in it.
by emilburzo | 2025-09-23 17:20:59+00:00
I just tested it on one of my nemeses: PDF bank statements. They're surprisingly tough to work with if you want to get clean, structured transaction data out of them.

The JSON extract actually looks pretty good and seems to produce something usable in one shot, which is very good compared to all the other tools I've tried so far, but I still need to check it more in-depth.

Sharing here in case someone chimes in with "hey, doofus, $magic_project already solves this."
by papanoah | 2025-09-23 17:21:21+00:00
I could say the same thing about me "non-legal person" trying to read any contract, terms of service or a license document. Many people tend to make fun of the developers speaking a different language, without realizing, that they do the same in their respective field. I think clear communication is important, but you can't expect anybody to write tutorials aimed for every audience. Learning is hard and it takes time to navigate through all the buzzwords and terms, but that's what learning something new requires.
by Someone | 2025-09-23 17:21:57+00:00
“Rust lifetimes can be chore, so use a C-like language that requires you to manage them in your head”

Weird that they don’t consider other options, in particular languages with reference counting or garbage collection. Those will not solve all ownership issues, but for immutable objects, they typically do. For short-running CLI tools, garbage collecting languages may even be faster than ones with manual memory management because they may be able to postpone all memory freeing until the program exits.
by wirehack | 2025-09-23 17:22:27+00:00
1. Sure, we will clarify that in the pricing page, thank you! As you can see from our evaluation, we are much better than official MCP servers. I think people care more about getting things done correctly. Otherwise, you waste all the model tokens for nothing. We do have enterprise deals where we can work out a customized pricing plan for your specific use case. Come talk to us if you are interested.

2. One VERY important distinction is that the model is doing the "search" here, not some RAG algorithm or vector database. Therefore, as the model becomes smarter, this approach will be more accurate as well.
by justonceokay | 2025-09-23 17:22:29+00:00
+1. I say this jokingly, but in a sense being a people-pleaser vs being empathetic is a “skill issue.”

Being focused on how people might think of you is shallow and tastes like narcissism. Even if in your own mind you are “thinking about others” too much you are really only thinking about yourself through their eyes.

Being present in the moment with someone and their feelings involves getting out of your own narrative.
by timschmidt | 2025-09-23 17:22:49+00:00
Moore's law says nothing about density.

"The complexity for minimum component costs has increased at a rate of roughly a factor of two per year."

Density is one way in which industry has met this observation over decades. New processes (NMOS, CMOS, etc) is another. New packaging techniques (flip chip, BGA, etc). New substrates. There's no limit to process innovation.

Nvidia's also optimizing their designs for things other than minimum component cost. I.e. higher clock speeds, lower temperatures, lower power consumption, etc. It may seem like I'm picking a nit here, but such compromises are fundamental to the cost efficiency Moore was referencing.

All data I've seen, once fully considered, indicates that Moore's law is healthy and thriving.
by mehdibl | 2025-09-23 17:23:13+00:00
IT start with "Evil MCP Server".

So you need a server flawed + XSS issue on Cloudflare.

Then you need to use Claude Code, so it's more an issue in Claude Code/Gemini implementation already than MCP.

So if you are ok to run any MCP from any source you have worse issues.

But good find in the open command how it's used in Claude Code/Gemini.
by jez | 2025-09-23 17:23:17+00:00
Do you consider yourself a neovim terminal power user?

I tried a while back to invert my workflow (from tmux driving neovim to neovim driving terminals) because I thought it might be easier to only ever have one buffer open for a given file, instead of attempting to open a file in a given pane only to realize that it's already open in a different neovim instance in a different pane.

When I was testing that stuff out I don't think I noticed particular issues with text reflow that would benefit from being solved by swapping to libghostty, rather my pain points were just about how to adjust to the different paradigm. I'd be curious to hear more about someone who is all in on Neovim embedded terminals (and possibly how libghostty might make it better).
by viridian | 2025-09-23 17:24:28+00:00
My observations largely match your own, and also applies more generally to non-technical interactions online. I help manage a group that runs a local LAN, and have run into both the general language issues, and people making long, incomprehensible requests that have major LLM smells.

I don't think it's just availability bias however, I think it's mostly a case of divergent linguistic evolution. In terms of the amount of people who speak English at an A level, India has the largest English speaking population in the world. With that, and a host of other native languages, came a rapid divergence from British English as various speech patterns, idioms, etc, are subsumed, merged, selectively rejected, and so on.

The main reason you don't see divergence to the same extent in other former colonies, even older colonies like Canada and the US, is that the vast majority of the colonists spoke English as a primary language.
by leakycap | 2025-09-23 17:24:36+00:00
I think you're missing what I'm describing: which is that HN is a rare thing for what it is

And for what it isn't

Putting a little bit of what something specifically isn't (algorithmic personalization on HN) can change something and your own perception of what "is trending" or what is hot right now

There are very few corners of the web without this kind of algorithmic feed & maybe not everything needs to be "best of both" when including a little of both completely changes it
by bluGill | 2025-09-23 17:25:15+00:00
Education, employment, and traditional family are useful things to work with though. They give a direction to try to get the poor to go. We can ask questions on how we can get their kids to go to school and study. We can ask questions about how we can get them acceptable jobs. We can ask how we can get them into stable family situations. We will fail a lot, but it gives us a proven framework to work towards. Yes there are problems - I'm not advocating live with a spouse who abuses you - but we can ask how we can stop that abuse as well.

Now there are many traditions around the world that works. Most cultures have man+women=family (as opposed to some form of polygamy), and there is reason to suspect this is important even if it isn't "in" to study why. (it isn't clear which non-traditional forms also would be fine and which would be a disaster)

Saying "poor are poor because they deserve it" is an accusation that I hear a lot more than I hear people who believe it. Some do believe it, but most accused of it do not and have better explinations of why they do things that the accusers don't like.
by true_religion | 2025-09-23 17:25:19+00:00
Because they don't want foreign opponents at a time when they're having trouble keeping their house in order?

Also, speaking frankly, there's an implications that people don't want Iran to have nuclear weapons because it's a Muslim country. This is false. It would be far palatable for Saudi Arabia or the UAE to develop nuclear arms because even though neither country is 'Christian' or 'democratic', they are at least allies.
by legacynl | 2025-09-23 17:25:52+00:00
I'm not advocating against social norms. But just those that don't make sense and only exist because they already exist.

My personal design for 'the society we ultimately want' would be social norms based in proper values (i.e. being nice to eachother, allowing people the freedom to do whatever, not being bothersome, etc.). From that would follow the norm to give up your seat to an old person, and the norm to help your elderly neighbor carry something heavy.

From that would not follow that we can't wear our hats indoors, or that we need to say sir and madam, or that we're not allowed to play music on speakers in public, or that we can't have a call on speaker phone.

If someone is being obnoxiously loud is a different matter.
by mehdibl | 2025-09-23 17:26:13+00:00
What the issues, if you use quality MCP tools?

Also MCP is only transport and there is a lot of mixup to blame the MCP, as most of the prompt injection and similar come from the "TOOLS" behind the MCP. Not MCP as it self here.

Seem this security hype forget one key point: Supply chain & trusted sources.

What is the risk running an MCP server from Microsoft? Or Anthropic? Google?

All the reports explain attacks using flawed MCP servers, so from sources that either are malicious or compromised.
by MrMorden | 2025-09-23 17:26:14+00:00
That bill appears strictly performative, especially when the Democrats can and have shut down the House by merely demanding a vote on attaching Epstein riders to bills.

If there were to be a bill that successfully implemented a 25% tax on offshoring for US companies, US investors would rapidly improve their ability and inclination to invest in other places. Nobody's going to increase or decrease offshoring as a result; the non-executive jobs that are in the US without a legal (e.g., security clearance) requirement are those that the CFO and board are already satisfied have substantial -EV if they were to be performed from a low-wage country instead.

Contrary to the article, Indians don't have a binary choice between working in the US and India; if the former no longer provides the ability to have higher QOL and savings on a tech salary, the people who used to get an H-1B will go to Canada, Europe, and Australia instead.
by smashem | 2025-09-23 17:26:27+00:00
18 years ago: https://www.reddit.com/r/WTF/comments/6hc3w/comment/c03udg0/

> "This code is reserved for future use."

> For when AT&T, Comcast, TimeWarner, et. al. have succeeded in their plan to make the interweb a toll-road. "Oh, you want your packets to go to reddit.com? That will be $0.00015/per."

Redditor had the right idea, just wrong names.
by eranation | 2025-09-23 17:26:33+00:00
With my limited understanding of LLMs and MCPs (and please correct me if I'm wrong), even without having to exploit an XSS vulnerability as described in the post (sorry for being slightly off topic), I believe MCPs (and any tool calls protocol) suffer from a fundamental issue, a token is a token, hence prompt injection is probably impossible to 100% protect against. The main root cause of any injection attack is the duality of input, we use bytes, (and in many cases in the form of a string) to convey both commands and data, "rm -rf /" can be an input in a document about dangerous commands, or a command passed to a shell command executor by a tool call. To mitigate such injection attacks, in most programming language there are ways to clearly separate data from commands, in the most basic way, via deterministic lexical structure (double quotes) or or escaping / sanitizing user input, denly-list of dangerous keywords (e.g. "eval", "javascript:", "__proto__") or dedicated DSLs for building commands that pass user input separately (Stored procedures, HTML builders, shell command builders). The solution to the vulnerability in the post is one of them (sanitizing user input / deny-list)

But even if LLMs will have a fundamental hard separation between "untrusted 3rd party user input" (data) and "instructions by the 1st party user that you should act upon" (commands) because LLMs are expected to analyze the data using the same inference models as interpreting commands, there is no separate handling of "data" input vs "command" input to the best of my understanding, therefore this is a fundamentally an unsolvable problem. We can put guardrails, give MCPs least privilege permissions, but even with that confused deputy attacks can and will happen. Just like a human can be fooled by a fake text from the CEO asking them to help them reset their password as they are locked out before an important presentation to a customer, and there is no single process that can 100% prevent all such phishing attempts, I don't believe there will be a 100% solution to prevent prompt injection attacks (only mitigated to become statistically improbable or computationally hard, which might be good enough)

Is this a well known take and I'm just exposing my ignorance?

EDIT: my apologies if this is a bit off topic, yes, it's not directly related to the XSS attack in the OP post, but I'm past the window of deleting it.
by prepend | 2025-09-23 17:26:43+00:00
How is his code?

I guess I’m so old that I remember not paying much attention to personal lives and looking at code contributions and collaboration behavior. I think that being a sensitive collaborator who builds changes was more relevant than swearing at people or saying rude things.

I once worked for a company where one developer hit another in the face with a keyboard. Was it wrong, yes of course. But we still delivered a pretty decent product.

I don’t really care if you, or others feel I should exist or not. Or whether they think I should or shouldn’t have rights, unless you mean permissions to change and maintain code.
by reissbaker | 2025-09-23 17:26:57+00:00
People don't want their whole desktop to fly everywhere and zoom out when they just want to quickly switch or launch an application with the mouse. They just want to mouse over the bottom of their screen and click.

I don't want to do that! And, I am in fact a person. I do not want to switch applications by clicking on things with my mouse at the bottom of the screen. I want to switch applications with keyboard shortcuts or with touch gestures, which GNOME has great support for; and both of those can open the dock too (although you can also alt-tab and skip the Expose-style feature).

Again, it's just a matter of preference and taste. My taste is much more strongly in GNOME's default direction than KDE's default direction.
by CharlesW | 2025-09-23 17:27:06+00:00
Both (1) "AI can, and does, make some people less effective" and (2) "the average productivity boost (~20%) is significant" (per Stanford's analysis) can be true.

The article at the link is about how to use AI effectively in complex codebases. It emphasizes that the techniques described are "not magic", and makes very reasonable claims.
by bigwheels | 2025-09-23 17:27:42+00:00
This is super cool, it will be so nice to have a truly omni-platform terminal emulator that can even conceivably extend to iOS and Android.

Aside: I didn't realize Ghostty was written in Zig, wow. The first Zig-thing I'm aware of using on a regular basis. It's amusing the repository structure looks exactly like a Golang layout, haha.

https://github.com/ghostty-org/ghostty
by cbeach | 2025-09-23 17:28:41+00:00
> Jan 6th is a well known counterexample

Trump took to social media to denounce political violence on that day, but a small bunch of unorganised Trump supporters entered the Capitol during a protest. One person was tragically killed (a Trump supporter). The political transition happened.

> Trump has used emergency powers to do almost everything since the start of this term. This includes tariffs.

He's made a number of executive orders to achieve the actions he promised in the manifesto that got him democratically elected. Few politicians have been as true to their word as Trump, in terms of delivering the change that the people voted for.

Trump has not changed the political system. He has merely used its existing executive powers.

> He has increased funding to DHS and renamed the DoD to DoW (Defense vs War)

So what? What wars has he started? How does his record compare to the Democrat presidents that preceeded him?

> Melissa and Mark Hortman were murdered by a right wing nut job.

You found one incident of a nut job. That does not mean the Democrat opposition has been suppressed by Trump. And what do you say about the multiple assasination attempts on Trump?

It's clear where the political violence is coming from.
by hitekker | 2025-09-23 17:28:49+00:00
Eh, it's a messy write-up. The article's stream of consciousness is hard to follow. Too much detail in some areas, not enough in others.

It's true Ruby Central was a fiasco and the maintainers should have been treated better. But the author's investigation misses important elements like the "culture war" on both sides. That seems to be prime motivation for everyone involved, given the flames raging in the comments below.
by potato3732842 | 2025-09-23 17:29:10+00:00
My point is that "bad" build quality is basically a non-difference. It was never a problem, or it's a manufactured problem in people's minds. Sure, tesla is probably "worse" from a statistical perspective but the average buyer could never see this. You almost have to be looking to see it, and so you're not gonna see it unless all your other problems are solved.

Like if every OEM sets out to build a car of the same specs, they're gonna all be within spitting distance of each other. You'll have to scrape the bottom of the barrel (i.e. "muh build quality) to find differences.

Tesla was winning before because they were the only ones who set out to build a car of that nature, build quality was a non-issue because it simply isn't an issue. It only became a meaningful one after the fact when more cars of the same sort arrived on scene and people went looking for minutia.
by somenameforme | 2025-09-23 17:29:20+00:00
But you are specifically conflating the two. Not only in your implication that Iranians, normal Iranians - children even, want Americans dead, but in your defense of sanctions. Sanctions have no meaningful affect on countries - as in the political leadership and military, but can have a substantially negative impact on the people within that country. In many ways they are even more barbaric than war, because at least in war there is a viable goal and you are targeting the state and its military. Civilians are unfortunate 'collateral damage', not the target.

With sanctions you just inflict suffering on the people for no realistic reason or goal. The idea it'll drive people to overthrow their government and align themselves with the people inflicting mass suffering on them is just so inexorably stupid. It's not even illogical - it is anti-logical. I expect that one day it will be looked upon in the same way that today we might look back on drawing and quartering people as a punishment.
by netsharc | 2025-09-23 17:30:20+00:00
- Enhance 34 to 36.

- Pan right and pull back. Stop.

- Enhance 34 to 46.

- Pull back. Wait a minute. Go right. Stop.

- Enhance 57-19.

- Track 45 left. Stop.

- Enhance 15 to 23.

- Give me a hard copy right there.
by jajuuka | 2025-09-23 17:30:27+00:00
I was just thinking something like this would be nice. I wanted to remove a shadow from a picture but lasso tools weren't picking it up. After some Googling found a tool in Samsung Gallery to do it. It still tried to steer me towards generative edits instead though.

But just telling it "remove the shadow from this image" would be great.
by hbn | 2025-09-23 17:30:52+00:00
> I have to explain that there's a difference between Intel and ARM Macs

No you don't? Why not tell your grandma about PowerPC and Motorola 68000 Macs too while you're giving her pointless information about CPUs Apple used in the past.

We're half a decade into the Apple Silicon transition. Intel Macs are not relevant to anyone except people who purchased a Mac within a couple years before the M1.

> no, their software won't work in MACOS_VERSION because Apple deprecated some API, and no, you can't upgrade to MACOS_VERSION+1 to use something that works, no the hardware they've been using for years won't work because the driver for it is no longer compatible with their Mac/macOS version, the simple thing they want to do actually requires $30 paid software to do, I can't help you when Apple sold you a small hard drive at a premium and macOS takes up half of it, etc.

I... can't even imagine what scenario you could possibly be running into any of this so I don't know how to argue against it.

I was already speaking on the scenario you brought up where this is someone that is gonna be living 95% in their browser. I don't know what weird proprietary software non-techie users are needing that's apparently not compatible with new Macs. Anything beyond web browsing - e.g. word processing, light photo editing, dealing with PDFs, etc - can be done with very high-quality, free software baked right into macOS.

You describe using a Mac like the black and white "before" footage from an infomercial showing that previously the only way to cut a tomato is smushing it with the side of a dull knife. If a Mac is too difficult for someone, Linux is not the solution.
by shkkmo | 2025-09-23 17:30:56+00:00
Incorrect.

Ruby Central hosts the RubyGems service, not the RubyGems repository. Ruby Central employs some RubyGems maintainers but does not own the repository. Ruby Central decided to make their employees who are maintainers take over the repository against the wishes of the other maintainers so they could remove some of the maintainers from the project.