MurphyA/hacker-news huggingface dataset:
by com2kid | 2025-09-09 16:59:06+00:00
> You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit?

Because the way this was pulled off, it was going to be found out right away. It wasn't a subtle insertion, it was a complete account take over. The attacker had only hours before discovery - so the logical thing to do is a hit and run. They asked what is the most money that can be extracted in just a few hours in an automated fashion (no time to investigate targets manually one at a time) and crypto is the obvious answer.

Unless the back doors were so good they weren't going to be discovered even though half the world would be dissecting the attack code, there was no point in even trying.
by hedora | 2025-09-09 16:59:12+00:00
We didn’t notice a positive correlation between teacher tenure and cost when we looked around.

If anything, there was a negative correlation: The big corporate ones had high teacher turnover, more levels of administration, and turned a healthy profit for ownership/shareholders. They were priced to match.

Also, government run programs usually are less expensive (take pretty much any privatization program anywhere as an evidence). The government programs don’t have to pay money to shareholders, and aren’t siphoning resources for expansion, marketing, etc.

If government leadership is corrupt as we see in the US right now, then, of course, prices skyrocket, though that usually comes hand in hand with outsourcing/subcontractors/privatization. It’s hard to collect bribe money from civil servants…
by torginus | 2025-09-09 16:59:20+00:00
Let me be clear about the situation Mr. Moneybags. You have built a billion-dollar company on top of a giant legacy codebase without any tests.

Now that it's become clear that the thing is about to collapse in on itself, you've brought in Mr. Feelgood Consultingman, to give us engineers generic advice, so that suddenly it's not your fault that this digital superfund site is in the state it is, but your engineers' for not following the consultants advice.
by tensor | 2025-09-09 16:59:32+00:00
Every. Single. Time. a Mistral story hits the front page, a variation of this exact comment is posted. And every single time it is corrected. It almost feels like intentional misinformation.

To repeat for the millionth time unique offerings for Mistral:

- some of the best edge models.

- some of the most cost effective in terms of cost per performance medium size models.

- unique small language models.

- unique OCR offering.

And also, being based in the EU is a HUGE advantage for any non-US company. The only thing predictable about doing business is that it's not predictable. At any moment you could get a shakedown, or just be cut off from US technology. It's a huge business risk.
by A4ET8a8uTh0_v2 | 2025-09-09 16:59:35+00:00
I don't disagree. It is a reasonable and forward looking consideration. That said, it may be a little late to do that. Not to mention, for all the talk about how Americans being unable to handle hardship, higher prices and whatnot.. I am reasonably certain that this extends to most of the '1st world'.
by johncolanduoni | 2025-09-09 16:59:45+00:00
How is it the same defect? Nuclear plants can run all the time and have to if they have any hope of recouping investment. Solar can’t run all the time but is super cheap so it doesn’t have to. You still need responsive capacity but even if you keep natural gas around for that you’ve made a massive dent in fossil fuel usage - bigger than solar or nuclear could do without the other.
by aDyslecticCrow | 2025-09-09 16:59:49+00:00
I suppose, but i don't feel like that makes mistral special enough to excuse this amount of funding. They would need clever researchers with resources to do research. The kind of AI we're talking about would likely not benefit from data-center scale training either. So why the 1.7B euro? That amount of money could fund multiple small dedicated research labs for exactly the domain ASML is interested in.

I don't think it adds up if this is truly for multi-patterning or pattern exposure correction technology.

As others mention it could be for entering and grabbing some value from down-stream technologies (actual investment expecting return of some sort) but it's odd how they skip over like 200 steps between their industry and the industry they invest in. Its like iron ore mine investing in precision screws. Its down the value added chain but such a massive leap that it makes me scratch my head.
by sim7c00 | 2025-09-09 17:00:29+00:00
you want exploit prevention and some things that correlate process execution to network traffic, and need tls interception. otherwise u dont know shit. litterally.

to get process execution, something will need to know what process was launched from what file. not sure how u wanna get around that.

mostly opensource xdr doesnt really work since its rules are open. its trivial to find a bypass.

vendor technology in this area is closed for good reason. if u know how it works u can bypass it. hiding gives em time to change shit up before it leaks too much...

Maybe spend some time at some conferences and get to know the ppl building such things and learn how they work. its interesting and might make it less scary.

and yes, it totally happens companies data ends up in their clouds for analysis.

problem is, either you risk your data to AV vendor, who already earns enough for your data to be pretty much worthless to them, or u risk some rando popping ur box and making off with your data.

take ur pick.
by jajuuka | 2025-09-09 17:00:37+00:00
This is buying into the idea of rugged individualism when it comes to parenting. That all a child needs is their parents and that time away from children is a failure of parents. This couldn't be further from the truth. Many studies show that children raised in a cooperative environment where they are exposed to various people and practices from extended family, professionals, teachers, etc help reinforce social connectedness.

Not to mention parents have more to them to simply being parents. Their own desires, wants, and needs. Balancing these with being parents leads to the more fulfillment.
by jajko | 2025-09-09 17:00:50+00:00
Well they really fucked up. Biden was visibly senile, almost like trump is now, and they pushed it till last minute when switch to Kamala happened... too little too late.

Who is their counter-weight for future? As an outsider who doesn't watch US news regularly since they use pretty idiotic form most of the time, I know 0 powerful persona types of Clinton or Obama. A lot of blahs and farts in the wind, when you are against an expert populist that's not a winning recipe.
by Pet_Ant | 2025-09-09 17:00:51+00:00
To less children. Even if the area under the curve was the same (and I suspect that there very much are diminishing returns) they have a very negative effect on the Gini coefficient and that is a negative externality that should not be incentivised.

If your position is that people should not be compelled to contribute to overall society and the lifting of the boats of others, than there isn't enough alignment of values for a meaningful conversation.
by vidarh | 2025-09-09 17:00:57+00:00
> Perhaps caring for your own kids produces much better kids (and eventually, adults).

In places with universal childcare provisions, one of the arguments is often that children in childcare tends to benefit from the extra socialisation. I don't know to what extent that is supported by hard evidence, but it's at least by no means clear that caring for your own children is a net benefit for society even direct economic arguments aside.
by tavavex | 2025-09-09 17:01:09+00:00
Has either the US or the EU ever promised not to retaliate against their enemy states or something? Actually, has any nation or national organization in the world ever promised that? You know, not to engage in war or any retaliation for anything? Just be arbitrarily 'fair'? You're creating standards that simply never existed. When war is on the table, all bets are off, it has always been that way.

Once you do what Russia did, no one should be required to honor anything with you. Countries are bound by laws, especially when you talk about Western countries, but there's always ways to get around to do what's needed if it's important enough - such as in military conflicts. If anything, the legal frameworks that tie their hands often prevented them from going even further, which would've been far better.

It also comes off incredibly disingenuous how lightly you're treating Russia here. You're pretending as if they just had an oopsie, a momentary lapse of judgement, a minor accidental misstep, and the heartless hypocrite West unfairly punished them for it by arbitrarily declaring them 'evil'. Like anyone else is scared because they might just stumble and that'll cause them to get on the West's bad side.

Unless you can think of other countries that are itching to start the new bloodiest, most cruel invasion of a sovereign nation on EU's doorstep, no one's situation mirrors Russia's. If they wanted the EU to sit idle, perhaps they shouldn't have invaded.
Ask HN: How do you use the Fediverse?
by akk0 | 2025-09-09 17:01:10+00:00
I recently wrote some rather disparaging comments on how I see the Fediverse, but I do want to like it, so I thought I'd give Fediverse proponents some space to talk.

So how do you use the Fediverse? How did you decide which instance to sign up to? Which of Mastodon/Pleroma/Akkoma/etc do you use and why?
by JoshTriplett | 2025-09-09 17:01:33+00:00
When most people say "ranked choice" they seem to refer to IRV, which is broken in multiple ways, but most notably that it has the property that ranking someone higher can make them lose and ranking someone lower can make them win. That happens because IRV ignores all of someone's preferences except their top choice, until their top choice is thrown out, at which point IRV looks at their next preference.

There are much better systems: approval (for simplicity, at the expense of more accurate preference information) and Condorcet (for accuracy, at the expense of making it more difficult to explain tie-breaker corner cases to the average person).
by mjr00 | 2025-09-09 17:01:54+00:00
Ori + its sequel are not on the same level as HK, in my opinion. The combat in the original is really bad/way too easy, and the exploration is just okay. The sequel drastically improved the combat, but the map is significantly worse; it's essentially just a "hub and spoke" where you go to one of 4 (IIRC) separate disconnected areas, grab the powerup which does more or less nothing in the other areas, use it to finish the area and beat the boss, rinse and repeat until the finale.

That being said, they are still very good games; excellent atmosphere, artwork and presentation, some genuinely haunting, creepy, and awe-inspiring areas. But I think Hollow Knight is a tier above them.
by gyanchawdhary | 2025-09-09 17:02:26+00:00
Isn’t that a good thing that you have already created a mental filter about people who pay for it as being of a “certain type” .. the problem with ticks being bestowed upon some journalists is that they become the brokers/influencers by the virtue of simply working for a newspaper .. that power is vaporised now .. tbh the real question is why didn’t twitter pre musk implement community notes .. I mean it’s not such a bleeding edge / hard to execute idea ..
by Arainach | 2025-09-09 17:02:28+00:00
It's much easier to destroy than build, and some things once destroyed can't be rebuilt.

Trump's inconsistent tariff and policy flip flopping means no one trusts the US to behave rationally and predictably.

The fact that the US population elected him a second time means that the US as a whole can't be trusted to behave like rational adults.

Decades or centuries of reputation has been thrown away. That can't be changed just by a new face saying "sorry we want to take it back".
by pear01 | 2025-09-09 17:02:44+00:00
So if I pack my kids lunch but other kids get a "free" lunch I'm worse off? Yes there is no "free lunch" I'm paying a tax for something I don't need. The comment you are replying to already anticipates this. How is it not the same argument? Your budget comment also puzzles me. What if my existing family budget is put under stress by the "free lunch tax" so now I'm even further away from being able to pack my own lunch? How is it different? Because it's a "new" tax? You can make the same argument for any tax then. At the end of the day are your children better or worse off if their future fellow citizens are growing up under roofs that can't afford childcare or healthcare or food? For someone that seems to know enough about costs and incentives and tradeoffs you seem to have quite a constrained view. Also, I'm curious about your waivers claim re costs because I would think given the scenario you laid out that would make the program more expensive. Your taxed for things other people use more than you. That's what society is. The point of the comment you are replying to is that people obsess over this as if they are being personally violated when really it is often just greed in the face of the common good.
by quectophoton | 2025-09-09 17:03:08+00:00
Then you have companies like AWS, they were sending invoices from `no-reply-aws@amazon.com` but last month they changed it to `no-reply@tax-and-invoicing.us-east-1.amazonaws.com`.

That looks like a phishing attempt from someone using a random EC2 instance or something, but apparently it's legit. I think. Even the "heads-up" email they sent beforehand looked like phishing, so I was waiting for the actual invoice to see if they really started using that address, but even now I'm not opening these attached PDFs.

These companies tell customers to be suspicious of phishing attempts, and then they pull these stunts.
by zahlman | 2025-09-09 17:03:11+00:00
Unemployment was continuously higher than the current level from approximately early 1970 to mid 1999: https://fred.stlouisfed.org/graph/?g=1M4lw (click "Max")

Markets currently don't expect significantly higher inflation in the long term, as the "10 year breakeven inflation rate" ("The latest value implies what market participants expect inflation to be in the next 10 years, on average.") is fairly stable: https://fred.stlouisfed.org/series/T10YIE By my understanding, this is supposed to trend towards 2.0% when everything is hunky-dory; things are not perfect, but they look fine to me in historical perspective. Similarly for e.g. this 5-year forward chart: https://fred.stlouisfed.org/series/T5YIFR

> Raising rates to put stress on businesses and consumers is the only method known to work for ending self-reinforcing high inflation

Yes, and that's how we made sure that the inflation peak in 2022 didn't become self-reinforcing. And as far as anyone seems to be able to tell, it worked.

> It's what Paul Volcker did at the Federal Reserve in response to the stagflation that started in the early 1970's in the US and other countries, after OPEC raised oil prices. Volcker raised the federal funds rate in fits and starts to a high of 20% in 1981:

Right. Current circumstances are very different. Posting this much about what you "hope doesn't happen" comes across as fear-mongering, given the lack of reason to expect it to happen. The tariff discourse allows people to throw around large, scary-sounding percentages, but in practice the corresponding price increases are on average much smaller. And the employment situation in the US is still very good in historical terms. (There are valid concerns about the methodology behind the headline unemployment rate, but it's still the same methodology.)
by mrguyorama | 2025-09-09 17:03:11+00:00
Have you never seen the scene in Office Space with the rap and the baseball bat and an office printer?

Like, no, hating machinery is as old as Ludd at least. I guarantee Grug back in the cave days was trying to convince his cavemates that "weaving is an abomination and we should just carry everything with our hands"
by TheAceOfHearts | 2025-09-09 17:03:57+00:00
I browsed through it a bit and these are some details that raised questions or which I found interesting:

There's multiple mentions of slop, for example: SlopsAuthorScoreFeature in HomeTweetTypePredicates. That means everyone gets a slop score between 0 and 1, which makes me wish that it was openly visible and that people with a high slop score would get a little piggy emoji next to their name.

There's a CLIENT_TWEET_TAKE_SCREENSHOT action, which is likely used to keep track of when a (mobile, presumably) client takes a screenshot. I hadn't considered this before, but for a social media app where posts are often shared externally through screenshots, keeping track of this can give you another engagement metric.

They have two types of NSFW filters: isNsfw and isSoftNsfw, but I couldn't figure out the distinction. Other metadata types include: isGore, isViolent, isSpam, isLowQuality, isOcr.

In ContentFeatureAdapter there's a getTweetLengthType function which shows the range for each tweet type. This is used to set TWEET_LENGTH_TYPE elsewhere. I wonder if it would help your virality to switch up your tweet lengths to regularly put out tweets which hit every length category, or if it doesn't significantly affect your potential reach.

There's a hardcoded list of top-level Grok topics [0]. Just mildly interesting to see what they consider to be top-level categories. Anime has achieved a significant cultural victory by getting separated into its own major category.

The timeout values for different service request types varied a lot across the application, which makes me curious about how they settled on those numbers. This is a question I've pondered in the past but haven't gotten around to researching deeply.

[0] https://github.com/twitter/the-algorithm/blob/c54bec0d4e029f...
by 0cf8612b2e1e | 2025-09-09 17:04:26+00:00
Honestly, that’s not a terrible idea. There are only a half dozen accounts which actually matter, so there is not even that much initial configuration burden. If I get phished for my HN account, oh well.

Think my only blocker would be if the browser extension fights me if I try to register a site using a broken/missing password.

Does feel like a bit of a browser gap. “You have previously visited this site N times”. If that number is zero, extra caution warranted. Even just a bit of extra sophistication on bookmarks if the root domain has previously been registered. Thinking out loud, I guess I could just lean on the browser Saved Passwords list. I’ve never been comfortable with the security, but I could just always try to get it to save a sentinel username, “YOUHAVEBEENHEREBEFORE”.
by gmueckl | 2025-09-09 17:04:29+00:00
Java went down that road with the applet sandboxing. They thought that this would go well because the JVM can be a perfect gatekeeper on the code that gets to run and can see and stop all calls to forbidden methods.

It didn't go well. The JVM did it's part well, but they couldn't harden the library APIs. They ended up playing whack-a-mole with a steady stream of library bugs in privileged parts of the system libraries that allowed for sandbox escapes.
by rsynnott | 2025-09-09 17:04:33+00:00
I think it's likely that if there was a rapid reversal, with Congress taking away the power to mess with tariffs and making it clear that it was permanently gone, there'd be some damage, but things would largely go back to normal. Not enough time has really passed for things to change _that_ much; many of the tariffs aren't _actually_ in place yet.
by gnabgib | 2025-09-09 17:04:39+00:00
Microsoft: Microsoft updates flexible work expectations to three days a week in the office https://news.ycombinator.com/item?id=45183560

Verge: Microsoft Mandates a Return to Office https://news.ycombinator.com/item?id=45184017

Geekwire: Microsoft sets new RTO policy, requiring employees in the office 3 days per week https://news.ycombinator.com/item?id=45184032
by tomrod | 2025-09-09 17:04:40+00:00
It does offer a potential backdoor to UBI while also encouraging desirable outcomes -- increased birth rate for wanted children, more people willing to foster, optionality for women to enter workforce, etc.

I suspect there will be some fraud (I have 30 kids, wheee!) as well as foster/adoption abuse -- probably AZ's experiment with paying parents to home school would be instructive.
by mobiuscog | 2025-09-09 17:04:50+00:00
> If an election were called tomorrow your next government would be Reform with a massive majority of 339 seats. It is the most popular party in the country by far. It would collect 33% of the vote vs Labour's 18% and the Conservatives would get only 17%, translating to their near-total destruction (only 35 seats).

Only if you believe propaganda. What is the sample size of this poll projection, and what are the election policies being put forward for this election ?

It's clear that Labour are unpopular, but an actual election is not something that anyone is thinking about right now, because it is so far out. Reform would like to suggest they are, but they have yet to show any actual policies other than the usual right-wing rhetoric that may be populist but doesn't fix anything.

Shouting loudly like certain Americans, and pretending you have answers, may be good for headlines, but doesn't convince many real voters.
by padraigf | 2025-09-09 17:05:07+00:00
I love it. I was introduced to it by Edward Tufte's book, 'https://www.amazon.co.uk/Visual-Display-Quantitative-Informa...'.

And was just thinking about it the other day. I had a bug aggregating sleep-data from an iPhone, which comes in the form of sleep-samples.

I was trying to fix it, both by prodding Claude Code to fix the problem, and looking at debug logs of the sleep-samples, but we weren't getting anywhere. I asked Claude Code to graph the samples, and BAM, saw it right away. (the problem was that HealthKit returns you sleep-samples from ALL devices, not just the priority one)

Maybe not exactly the same thing as Anscombe/Tufte were getting at, but I was reminded of it, and the value of visualising data.
by bunderbunder | 2025-09-09 17:05:17+00:00
Alternatively, I've long been wondering if automatic package management may have been a mistake. Its primary purpose seems to be to enable this kind of proliferation of micro-dependencies by effectively sweeping the management of these sprawling dependency graphs under the carpet. But the upshot of that is, most changes to your dependency graph, and by extension your primary vector for supply chain attacks, becomes something you're no longer really looking at.

Versus, when I've worked at places that eschew automatic dependency management, yes, there is some extra work associated with manually managing them. But it's honestly not that much. And in some ways it becomes a boon for maintainability because it encourages keeping your dependency graph pruned. That, in turn, reduces exposure to third-party software vulnerabilities and toil associated with responding to them.
by Joker_vD | 2025-09-09 17:05:32+00:00
> the most straightforward way is to keep around a zombie that just contains that information and ensures the only identifier available to userspace at the time continues to reference the same pid.

Again, that's only really needed if the zombie process's parent has not yet died itself; in fact, this is also how Windows API operates: unless you call CloseHandle on the process descriptor obtained from the CreateProcess, the child process will not go away and will hang around. However, if there are no open descriptors to a process, then it will disappear entirely on its own the moment it calls ExitProcess; and if that process had last descriptors open to some other zombie processes, those too will go away. All of that, and without no need for a dedicated PID 1 which shall not be killed.

Reparenting, of course, is not needed for long-running services/daemons, as demonstrated by daemontools, runit, s6, Upstart, systemd, etc.