MurphyA/hacker-news huggingface dataset:
by tetha | 2025-09-17 19:08:12+00:00
Hence you need to start thinking about threat models and levels of compromise, even in your build system.

If I control the issuing and governance of these short-lived secrets, they very much help against many attacks. Go ahead and extract an upload token for one project which lives for 60 seconds, be my guest. Once I lose control how these tokens are created, most of these advantages go away - you can just create a token every minute, for any project this infrastructure might be responsible for.

If I maintain control about my pipeline definition, I can again do a lot of work to limit damage. For example, if I am in control, I can make sure the stages running untrusted codes have as little access to secrets as possible, and possibly isolate them in bubblewrap, VMs, ..., minimize the code with access to publishing rights. Once I lose control about the pipeline structure, all that goes away. Just add a build step to push all information and secrets to mastodon in individual toots, yey.

To me, this has very much raised questions about keeping pipeline definitions and code in one repository. Or at least, to keep a publishing/release process in there. I don't have a simple solution there, especially for OSS software with little infrastructure - it's not an easy topic. But with these supply chain attacks coming hot and fast every 2 weeks, it's something to think about.
by Imustaskforhelp | 2025-09-17 19:08:12+00:00
This.

Idk about america, but there's definitely a sentiment echoing I feel like all across the world that there is a concentration of power and the divide between state and class is shrinking and we consider state to be itself (corrupt?) / not working to our wants.

That's my understanding of it. People have given up hope on...well having hope.

But hey lets define what is a woman first, that matters more than people sadly suiciding because they can't take this cruel petty world anymore.

We have induced our cruelness on earth, every animal,tree, air, even other humans. Who have we left?

Have we forgotten humanity? What does humanity even mean when we realize that people literally eat animals which scream to death from pain for the "taste" ?

I myself ate an egg yesterday for "protein" after a few years, I am skinny so I had to convince myself that I needed it but still my heart felt a bit bitter.

I am not judging you if you eat meat, that's not the point because I don't have a point/agenda. I am venting.You almost feel small when you think about it.

I really feel like the world can be a better place so there's hope tho.
by bluGill | 2025-09-17 19:08:42+00:00
Capital costs are paid differently and so we can often safely ignore construction costs as they are a different budget.

Putting maintenance into that capital bucket though is accounting fraud and illegal. If you have a rail line the largest cost is regular maintenance which is based on time not wear until you have a very large number of trains running. So my point stands even if you separate the buckets.
by lordofgibbons | 2025-09-17 19:09:01+00:00
Chinese labs are the only game in town for capable open source LLMs (gpt-oss is just not good). There have been talks multiple times by U.S China hawk lawmakers about banning LLMs made by Chinese labs.

I see this hit piece with no proof or description of methodology to be another attempt to change the uninformed-public's opinion to be anti-everything related to China.

Who would benefit the most if Chinese models were banned from the U.S tech ecosystem? I know the public and startup ecosystem would suffer greatly.
by dvt | 2025-09-17 19:09:15+00:00
> They earn legitimacy through evidence, peer review, and sustained engagement with reality.

Someone is trying to talk about the marketplace of ideas without reasonably engaging with Mill[1]. The positing of an idea being viable if and only if passing "peer review" is beyond ridiculous from a purely Millian standpoint. In his own words[2]:

> ...though the silenced opinion be an error, it may, and very commonly does, contain a portion of truth; and since the general or prevailing opinion on any subject is rarely or never the whole truth, it is only by the collision of adverse opinions that the remainder of the truth has any chance of being supplied.

I agree that CK was a political grifter (e.g. someone that found great wealth by partaking in inflammatory speech), but the marketplace of ideas allows for people like him to engage in any dialog he pleases. After all, TMZ does the same thing. Tabloids do the same thing. Tons of podcasts do the same thing. Hasan Piker, Destiny, Piers Morgan, Bill O'Reilly, and Alex Jones all do it, too. I may not agree with Charlie Kirk's politics or with his rhetorical methods, but I'll defend his right of free speech to the death.

> It requires shared standards of evidence, mutual respect, and actual expertise on the topics being discussed.

No it doesn't. This is a carefully-crafted contingency to ensure that you always have the higher ground via: "you're not an expert" (when experts can be, and sometimes are, wrong) or "you don't have the same standard or evidence as me" (when standards of evidence are often contextual).

[1] https://web.uncg.edu/dcl/courses/vicecrime/m3/part1.asp

[2] https://socialsci.libretexts.org/Courses/Western_Washington_...
by rtkwe | 2025-09-17 19:09:17+00:00
I think you can it's just shifted by several decades because China took a long dark detour through the Cultural Revolution. QoL exploded in the US in the Post War period, partially imo because we were the only industrialized economy that didn't have significant homeland attacks during WW2 so the US got a straight shot to the top of the heap. China got a similar QoL lift through a similar path, mass manufacturing (this time business taken from the US by being far cheaper) and growth of in country expertise. Now even China is feeling a similar cost squeeze drawing some business to smaller neighbors. They're also just so much larger they can sustain a larger gradient between coasts that look closer to '1st' world costs and poorer interiors where cheaper manufacturing can be done.
by mrweasel | 2025-09-17 19:09:22+00:00
We used it heavily 10 years ago. It was okay, but it had a rocky history. For a long time it seemed abandoned, then Python 3 happened and we had to patch our own version for a while. Then a new maintainer took over and stuff would just break or APIs rewritten between versions. We ran our own pypi instance to deal with pymssql specifically.

In the later years it became rather good though and with Python 3 many of the issues with character encoding went away.
by throwacct | 2025-09-17 19:09:30+00:00
I'm using "AI" almost exclusively to scaffold projects. I spent 2 days trying to find the reason the code wasn't working the way it supposed to work. Where I work we're using it with moderation, knowing that if you generate code, you must double check everything and confirm that what you generated doesn't smell. You'll be held accountable if something brakes because you were eager to push unreviewed code.
by bri3d | 2025-09-17 19:09:56+00:00
1) Anthropic are US based, maybe you're thinking of Mistral?

2) Are government agencies sending prompts to model inference APIs on remote servers?

Of course, look up FedRAMP. Depending on the assurance level necessary, cloud services run on either cloud carve-outs in US datacenters (with various "US Person Only" rules enforced to varying degrees) or for the highest levels, in specific assured environments (AWS Secret Region for example).

3) It’s worrying to me that Anthropic, a foreign corporation, would even have the visibility necessary to enforce usage restrictions on US government customers.

There's no evidence they do, it's just lawyers vs lawyers here as far as I can tell.
by darkamaul | 2025-09-17 19:10:02+00:00
> That repo still contained a GitHub Actions secret — a npm token with broad publish rights.

One of the advantages of Trusted Publishing [0] is that we no longer need long-lived tokens with publish rights. Instead, tokens are generated on the CI VM and are valid for only 15 minutes.

This has already been implemented in several ecosystems (PyPI, npm, Cargo, Homebrew), and I encourage everyone to use it, it actually makes publishing a bit _easier_.

More importantly, if the documentation around this still feels unclear, don’t hesitate to ask for help. Ecosystem maintainers are usually eager to see wider adoption of this feature.

[0] https://docs.pypi.org/trusted-publishers/
by nu11ptr | 2025-09-17 19:10:03+00:00
Is this WASM specific though? Some apps suffer in performance when they move to 64-bit in general due to larger pointers and not taking sufficient advantage of/or needing 64-bit data types in general, hence the increased memory bandwidth/cache space slows them down (one of the reasons many people like a 32-bit address space, 64-bit data model).
by mattmanser | 2025-09-17 19:10:19+00:00
I actually sat down to really learn what SOLID meant a few years ago when I was getting a new contract and it came up in a few job descriptions. Must have some deep wisdom if everyone wants SOLID code, right?

At least two parts of the SOLID acronym are basically anachronisms, nonsense in modern coding (O + L). And I is basically handled for you with DI frameworks. D doesn't mean what most people think it does.

S is the only bit left and it's pretty much open to interpretation.

I don't really see them as anything meaningful, these days it's basically just make your classes have a single responsibility. It's on a level of KISS, but less general.
by dceddia | 2025-09-17 19:10:32+00:00
I love the idea of building a printer, but I know that my attention span is limited on these sorts of things. As in, I’ll be reliably obsessed until it’s done and tuned, and then I’ll forget everything until the next time I want to use it.

So my big question, for someone who’s owned one a while: is the printer ever “done”?

Is there a point after which it “just works”? Or is it always going to be more like “it’s great! I just need to tweak the blah blah setting every time and retighten the frobnitz every 3 prints, no big deal really!”

I always see the quote about “if you like printERS, build, but if you like printING, just buy one” - but nobody talks about the timescale on the fiddling and whether it ever stops.

(currently own a Prusa mk3s I built as a kit and it’s been pretty solid as a tool!)
by SketchySeaBeast | 2025-09-17 19:10:46+00:00
Yeah. I'm on Lemmy and Mastodon, but it ain't exactly jumping, and I'm sure part of it is definitely the confusion around how to get going and what it is. Lemmy at least is also pretty buggy, and I'm not able to find posts I saw a few hours ago, but ultimately I don't really know what the draw is or even could be for the average user.
by breppp | 2025-09-17 19:10:49+00:00
No, antisemitism is historically based on shifting blame and scapegoating. That's why the nazis were blaming Jews of genocide ("Germany must perish") while they were working on their destruction.

That's why an organization that used death squads to mass-execute civilians in entire towns (as was done by the Einsatzgruppen) gets to blame the side that bombs military targets (exactly the tactic used against nazis) with genocide
by owenthejumper | 2025-09-17 19:11:20+00:00
This feels like a hit piece by semafor. A lot of the information in there is purely false. For example, Microsoft's AI Agreemeent says (prohibits):

"...cannot use...For ongoing surveillance or real-time or near real-time identification or persistent tracking of the individual using any of their personal data, including biometric data, without the individual’s valid consent."
by ProtoAES256 | 2025-09-17 19:11:27+00:00
LINE is a communication software that is predominantly used in Japan, Taiwan, Indonesia(maybe others? South Korea?). It is clunky, buggy, files expire fast, can't upload for a lot of extensions, only login-able on 1+1 devices (phone+computer). And people still use it, also there is no avoiding it if you want to get anything official done around these parts. I do see youngsters using Instagram and Threads, and a bit of Telegram sprinkled here and there but that's it. You want to get the job done, you use LINE. It's THE communication app.
by gjsman-1000 | 2025-09-17 19:11:38+00:00
- According to an unapologetically left wing perspective on what happened. That doesn't mean even a word of that is true, any more than a word of what Kirk said was true.

Who is to say whether the college student's positions were actually nuanced? Is well-researched just "agreed with my perspective" or a fact?

(Edit: I missed the hyperlink somehow, point still remains this is an interpretation dance.)
by chatmasta | 2025-09-17 19:11:42+00:00
But the token wasn’t the primary source of compromise here. It was the GitHub workflow which had the token embedded into it. There was no need for the actor to exfiltrate the token from the workflow to somewhere else, because they could simply run arbitrary code within the workflow.

It would have made little difference if the environment variable was NPM_WEBIDENTITY instead of NPM_TOKEN. The workflow was still compromised.
by theptip | 2025-09-17 19:11:45+00:00
I believe this is going to be an increasingly important factor.

Call it the “shoelace fallacy”: Alice is supposedly much smarter but Bob can tie his shoelaces just as well.

The choice of eval, prompt scaffolding, etc. all dramatically impact the intelligence that these models exhibit. If you need a PhD to coax PhD performance from these systems, you can see why the non-expert reaction is “LLMs are dumb” / progress has stalled.
by dzaima | 2025-09-17 19:11:50+00:00
Besides making it much nicer for GC'd languages to target WASM, an important aspect is that it also allows cross-language GC.

Whereas with a manual GC, if you had a JS object holding a reference to an object on your custom heap, and your heap holds a reference to that JS object (with indirections sprinkled in to taste) but nothing else references it, that'd result in a permanent memory leak, as both heaps would have to consider everything held by the other as GC roots; so you'd still be forced to manually avoid cycles despite only ever using GC'd languages. Wasm GC entirely avoids this problem.
by sfink | 2025-09-17 19:12:21+00:00
Sure, that happens, but that's also pretty clear to the job seeker. Don't try to BS your way past that one.

More commonly, that list of requirements comes from the recruiter quizzing the developers on what they need, and they throw out a bunch of stuff that could describe a person they'd be interested in hiring. But there are many other people who would work too, and the developers are likely to come up with stuff that they're familiar with and end up describing someone much like them with maybe 1 additional skill -- which is actually backwards, because they already have that expertise in the aggregate and what they really need is what they don't already have, but that stuff is harder to think of and value and therefore suggest to the recruiter because, well, it's stuff they're unfamiliar with.

A good recruiter will push back and make them figure out which are actual requirements. But getting it right requires a good recruiter + good developers who will make the time to think it through + good company culture. Most job posts are not coming from such a fortunate place.

On the flip side, the recruiter is hearing from management that they want someone who is perfectly carved out to accomplish a single task X, preferably someone who has already accomplished task X at another company so they can get hired and immediately do X here as well. Sure, they'll also be another body to shut up the whiny developers talking about how they have too much to do, but the position is open because they've been asking for X for months and the developers keep saying they don't have enough bandwidth. So they describe what they want to the recruiter in painful specificity. If their conception of X requires technologies and tools A, B, and C, then their requirements list is something like "Minimum 10 years experience doing X. Expert in A. Expert in B. Expert in C. Must have a PhD from my school or a school I'm envious of."

Maybe I've just had some bad experiences, but this is why I don't take requirements lists too seriously. Sure, if it wants "experience in medical imaging" and you have nothing related, don't apply. But if it gives a laundry list of specific technologies, it's either developers looking for clones or managers looking for someone to do a specific project.
by taeric | 2025-09-17 19:12:32+00:00
Like I said, I can squint to see what you mean. But people tend to treat types more as what grade schools call units. And those act more as constraints on what you can do with the values. With you doing add/multiply on the values.

Note that I'm not necessarily arguing that things should change. At this point, I'd consider the name fairly well established. But, it should be noted much more heavily that you are doing algebra on the types and that this does not imply anything that you can do with the values they may represent at any time.
by m463 | 2025-09-17 19:12:36+00:00
> Code is code

oh come on.

That's like saying "food is food" or "an AI howto is the same as a human-written howto".

The problem is that code that looks good is not the same as code that is good, but they are superficially similar to a reviewer.

and... you can absolutely bury reviewers in it.
by AgentME | 2025-09-17 19:12:43+00:00
It's also important because sometimes you want a WebAssembly instance to hold a reference to a GC object from Javascript, such as a DOM object, or be able to return a similar GC object back to Javascript or to another separate WebAssembly instance. Doing the first part alone is easy to do with a little bit of JS code (make the JS code hold a reference to the GC object, give the Wasm an id that corresponds to it, and let the Wasm import some custom JS functions that can operate on that id), but it's not composable in a way that lets the rest of those tasks work in a general way.
by hinkley | 2025-09-17 19:13:01+00:00
I have admin rights on someone else’s npm repo and I’ve done most of the recent releases. Becoming admin lit a fire under me to fix all of the annoying things and shitty design decisions that have been stuck in the backlog for years so most of the commits are also mine. I don’t want my name on broken code that “works”.

I had just about convinced myself that we should be using a GitHub action to publish packages because there was always the possibility that publishing directly via 2FA, that one (or specifically I) could fuck up and publish something that wasn’t a snapshot of trunk.

But I worried about stuff like this and procrastinated on forcing the issue with the other admins. And it looks like the universe has again rewarded my procrastination. I don’t know what the answer is but giving your credentials to a third party clearly isn’t it.
by ChrisArchitect | 2025-09-17 19:13:10+00:00
Sharing links to a couple of tweets is not a blog post.

Google source post: https://deepmind.google/discover/blog/gemini-achieves-gold-l... (https://news.ycombinator.com/item?id=45278480)

OpenAI tweet: https://x.com/OpenAI/status/1968368133024231902 (https://news.ycombinator.com/item?id=45279514)
by nxobject | 2025-09-17 19:13:36+00:00
That's a false comparison. There's a huge difference between a standard container library, and the combination of a (a) best-in-class byte code interpreter with a (b) caching, optimizing JIT, supported by (c) a best-in-class garbage collector.

I would argue that it's reasonable to say that creating a robust data structure library at the level of the STL shouldn't be that arcane.
by dvt | 2025-09-17 19:13:38+00:00
> Why did the author of this one choose this approach rather than some other approach? What issues did they see with others that they decided to write their own? What's unique here?

I'm not sure what you mean here. A lot (most?) procedural systems use Voronoi methods for procedural terrain generation, so this isn't some wholly novel solution. From what I can tell (haven't looked into it super deeply), it looks like Lloyd's algorithm is basically a variation of random bisections.
by bri3d | 2025-09-17 19:13:47+00:00
This whole article is weird to me.

This reads to me like:

* Some employee somewhere wanted to click the shiny Claude button in the AWS FedRamp marketplace

* Whatever USG legal team were involved said "that domestic surveillance clause doesn't work for us" and tried to redline it.

* Anthropic rejected the redline.

* Someone got mad and went to Semafor.

It's unclear that this has even really escalated prior to the article, or that Anthropic are really "taking a stand" in a major way (after all, their model is already on the Fed marketplace) - it just reads like a typical fed contract negotiation with a squeaky wheel in it somewhere.

The article is also full of other weird nonsense like:

> Traditional software isn’t like that. Once a government agency has access to Microsoft Office, it doesn’t have to worry about whether it is using Excel to keep track of weapons or pencils.

While it might not be possible to enforce them as easily, many, many shrink-wrap EULAs restrict the way in which software can be used. Almost always there is an EULA carve-out with different tier for lifesaving or safety uses (due to liability / compliance concerns) and for military uses (sometimes for ethics reasons but usually due to a desire to extract more money from those customers).
by boricj | 2025-09-17 19:14:09+00:00
As in, Java ME?

Unless I'm mistaken, it's been on life support for the past 15 years. It's probably more heavyweight and firmware size/Flash usage is a concern. I don't think performance would be on par with WASM and there are use-cases where that really matters (ray tracing rendering for example). I'm also not sure there are many maintained, open-source implementations for it out there. I've also heard stories that it was quite a mess in practice because it was plagued by bugs and quirks specific to phone models, despite the fact that it was supposed to be a standard.

I'd gladly be proven wrong, but I don't think Java ME has a bright future. Unless you were thinking of something else?
by Kranar | 2025-09-17 19:14:13+00:00
Plenty of companies have gone bankrupt or lost a great deal of credibility due to a single bug or single failure. I don't see why CrowdStrike would be any different in this regard.

The number of bugs/failures is not a meaningful metric, it's the significance of that failure that matters, and in the case of CrowdStrike that single failure was such a catastrophe that any claims they make should be scrutinized.

The fact that we can not scrutinize their claim in this instance since the details are not public makes this allegation very weak and worth being very skeptical over.
by ChickeNES | 2025-09-17 19:14:15+00:00
Not sure if this was in jest or not but I can say the same. Both when I daily drove a MacBook Pro, and when I was using a Razer laptop as a desktop replacement at the height of the GPU shortage (it DID NOT like charging the battery all the time, eventually it puffed up and I had to remove and recycle it, oops). Though I do see the utility of auto-switching for the average user, so I definitely won't complain about the existence of it. :)
by TUSF | 2025-09-17 19:14:23+00:00
As I understand it, WASM GC provides a number of low level primitives that are managed by the WASM host runtime, which would theoretically allow languages like Go or Python to slim down how much of their own language runtime needs to be packaged into the WASM module.

But how those languages still need to carry around some runtime of their own, and I don't think it's obvious how much a given language will benefit.