MurphyA/hacker-news huggingface dataset:
by jazzyjackson | 2025-09-02 17:22:44+00:00
Given that you don't strictly need to have one passkey per site, is this desire to move passkeys around a holdover from wanting to "export" your passwords? Because if you can export them, an exploit can too. I find passkeys rather more interesting when they cannot be exported from a HSM / key enclave / yubikey, but of course I need to be able to register multiple yubikeys per site, and a few of my accounts didn't allow for this so I ended up using my yubikey for TOTP since I can have the same seed on multiple devices.
by arduanika | 2025-09-02 17:22:49+00:00
It is probably just a coincidence, but it's darkly funny how well this lines up with the strategy described in a rather infamous LessWrong post. The title is "Solutions to the Altruist's burden: the Quantum Billionaire Trick", but you probably know it by a different name. The author is one Roko Mijic.
by sarchertech | 2025-09-02 17:22:51+00:00
Google for the Stanford study by Yegor Denisov-Blanch. You might have to pay to access the paper, but you can watch the author’s synopsis on YouTube.

For low complexity greenfield projects (best case) they found a 30% to 40% productivity boost.

For high-complexity brownfield projects (worst case) they found a -5% to 10% productivity boost.

The METR study from a few weeks ago showed an average productivity drop around 20%.

That study also found that the average developer believed AI had made them 20% more productive. The difference in perception and reality was on average 40 percentage points.
by AlienRobot | 2025-09-02 17:22:53+00:00
I saw a story posted on reddit that U.S. engineers went to China and said the U.S. would lose the A.I. game because THE ENERGY GRID was much worse than China's.

That's just pure insanity to me.

It's not even Internet speed or hardware. It's literally not having enough electricity. What is going on with the world...
by AlecSchueler | 2025-09-02 17:23:11+00:00
I was quite early on Reddit and watched Imgur grow literally from the announcement thread. It got bigger and bigger and I often used it myself.

But I remember one day being at a friend's house and she was asking me about something I'd sent her, "oh did you see that in Imgur she asked?"

"What do you mean did I see it on Imgur? I saw it in Reddit, it's just hoisted on Imgur."

And she was like, "What's Reddit? I love Imgur, I scroll on there every night."

I couldn't believe it, I went and checked and there was indeed a whole community, leaving contents and voting on things and doing all the rest, and many of them never heard of Reddit

You're right, it does feel strange, there's somehow something very uncanny about it.
by hellojesus | 2025-09-02 17:23:13+00:00
True, but grapheneos only supports Pixels because of the unlocked bootloader and hardware security. If more and more people adopt Pixels solely to install Grapheneos, it may drive other hardware manufacturers to offer a device that meets Grapheneos' requirements, and then they can bank on grabbing almost all of the PixelGrapheneos market share, or at least the fraction which actively wants to avoid google (which I suspect is at least 75%).
by claudiulodro | 2025-09-02 17:23:30+00:00
While not a whole state, there are municipalities with no property tax e.g. Thorne Bay in Alaska:

> Thorne Bay is a Second-Class City within an unorganized borough on Prince of Wales Island.

> Thorne Bay does NOT LEVY PROPERTY TAXES.

> https://thornebay-ak.gov/land/

You get what you pay for as far as services are concerned though.
by bradley13 | 2025-09-02 17:23:51+00:00
Throwing money and compute at AI strikes me as a very short-term solution. In the end, the human brain does not run off a nuclear power plant, not even when we are learning.

I expect the next breakthroughs to be all about efficiency. Granted, that could be tomorrow, or in 5 years, and the AI companies have to stay all at in the meantime.
by ijidak | 2025-09-02 17:24:14+00:00
I think we underestimate the insane amount of idle cash the rich have. We know that the top 1% owns something like 80% of all resources, so they don't need that money.

They can afford to burn a good chunk of global wealth so that they can have even more global wealth.

Even at the current rates of insanity, the wealthy have spent a tiny fraction of their wealth on AI.

Bezos could put up this $13 billion himself and remain a top five richest man in the world.

(Remember Elon cost himself $40 billion because of a tweet and still was fine!)

This is a technology that could replace a sizable fraction of humamkind as a labor input.

I'm sure the rich can dig much deeper than this.
by karmarepellent | 2025-09-02 17:24:35+00:00
> Signing in is cryptographically signing a commitment to the current ephemeral tunnel.

I can see how SSH could be used for authentication on the web. And I have no doubt that it would be sound out-of-the-box. But I am not sure what you mean by your last sentence. Do you mean that authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding?

Aside from the wonderful possibilities that are offered by using port forwarding of some kind, you could also simply use OpenSSH's ForceCommand to let users authenticate via SSH and then return a short-lived token that can then be used to log into an application (or even a SSO service).

I guess no one uses SSH for authentication in this way because it is non-standard and kind of shuts out non-technical people.
by maxglute | 2025-09-02 17:24:53+00:00
That ecumenopolis feels of weaving through built environment without ever stepping outside. Big fan of skyways as well, too bad there aren't many examples of cities with enough density with overlapping underground and skyway pedestrian networks. There's a few CBDs with underground commute concourses and elevated skybridges that makes you wonder if you really need to touch grass.
by nelsonfigueroa | 2025-09-02 17:24:55+00:00
Location: Los Angeles, California, USA

Remote: Remote preferred, I'm ok with going into an office a few times a week if it's nearby.

Willing to relocate: If I really like your company, yes.

Technologies: AWS, Kubernetes, Docker, Terraform, Pulumi, Ruby, Rails, Python, Bash, Go, HTML, CSS, MySQL, PostgreSQL.

Résumé/CV: Check out LinkedIn: https://www.linkedin.com/in/nelsonfigueroa1/, or my personal site: https://nelson.cloud. Happy to send over a PDF via LinkedIn as well.

Email: nelsonfigueroa07@gmail.com
by ZenoArrow | 2025-09-02 17:25:02+00:00
It's not nostalgia for a game, it's wanting to get back to plug-and-play gaming experiences.

With consoles in the 70s/80s/90s, when you put a game into the console and turned it on, you launched directly into the game. That immediacy is lost when you end up with endless software updates and having to launch games from a menu. If you didn't live through that time I can understand why you aren't nostalgic for it.
by m3047 | 2025-09-02 17:25:12+00:00
Cloudflare (it was news to me! why are CF assets actively reaching out to my infrastructure since I'm not a customer?) provides anonymization infrastructure to alleged VPN users. A data point. Doesn't mean they don't make an effort to screen abuse, but it's an open question (based on traffic to my site) how good that is. I'm also not convinced I should believe they don't use that traffic for their own purposes because "Simon says so".
by Quarrelsome | 2025-09-02 17:25:13+00:00
The man owns twitter ffs. The only way his attempts to gain political influence will ever fail is if the UK government block access to twitter or British people decide to stop using it. Until then he has significant capacity to sway political opinion.

As an example: there is significant power in cultivating the default UK experience of twitter for new accounts, which he's already had significant impact on by culling Twitter's internal moderation team. I've experienced it myself and its a an absolute disaster zone of disinformation and bot accounts trying to stoke internal divisions.
by cmrdporcupine | 2025-09-02 17:25:21+00:00
You're 100% right but the mistake certain kinds of managers make is basically selecting (in performance review or in hiring, whatever) only for that kind of person.

You might get lucky and get the "creative genius engineer who is also an organizational freak who lives to squash JIRA tickets" ... but you also... might not.

The ultimate job of good management in a competently hired software development team is to uncork the potential of team members by finding the things stopping them from being productive, and getting rid of the blockage. Finger pointing about ticket tracking and demanding paperwork ... will not do that, at least not for everyone. For some class of team members the best thing management can do is find some way to accomodate their idiosyncracies.

This is assuming everyone is motivated. I assume most of us are only at work doing what we do at a "startup" type place because we like it and want to do good work. But not everyone agrees on how good work gets done and how to get there.

Too many people go into management for the status or control. In my experience, a good manager is more of a coach than a "boss".
by piltdownman | 2025-09-02 17:25:22+00:00
I mean you're not wrong re: DiT vs DaR, I was more just pointing out the Room 641A equivalence on an extra-territorial level

https://en.wikipedia.org/wiki/Room_641A

In terms of e2e chat encryption, binary blobs and 'managed' mobile platforms render it somewhat of a moot point to me. Bad actors can either be 0day'd or Social Engineered for those with advanced OpSec. To date though, the most successful network was Encrochat - an OTR-based messaging app which routed conversations through a central server based in France, which was eventually compromised by French police with a malware allowed them to read messages before they were sent and record lock screen passwords

https://en.wikipedia.org/wiki/EncroChat

Europol got a taste for the heady power of it - The chief of the Dutch National Police Force, Jannine van den Berg , compared the malware to "sitting at the table where criminals were chatting among themselves".

Now the reality is that the equivalent of the Clipper Chip 'key escrow' is now implementable at a Firmware/Mandatory Push Update level, and probably as part of a 'secure' walled garden app-store API in future.

https://en.wikipedia.org/wiki/Clipper_chip
by anthem2025 | 2025-09-02 17:25:58+00:00
Why criticize the employees when you have no clue what their day to day is like?

There’s a reason why leadership and the leadership principles are mocked. They vary from okay to kinda dumb to just outright silly.

> they could probably come up with several services which Amazon already has internally

I feel like the myth that AWS is just internal Amazon stuff exposed externally has done so much heavy lifting despite never really being true.
by kwk1 | 2025-09-02 17:26:19+00:00
I've been meaning to share these results in a more appropriate place, but for what it's worth, the proof-of-concept script for the recent Guix CVEs bisects to a Jan 2023 commit, so it's not clear that released versions are affected.

4cf1acc7f30 + cherry-picked 71171538e12 + 1c78f71beb3 + a49536e3200 + 7f237f3e6ca
by derefr | 2025-09-02 17:26:21+00:00
> Anecdotally moving from model to model I'm not seeing huge changes in many use cases.

Probably because you're doing things that are hitting mostly the "well-established" behaviors of these models — the ones that have been stable for at least a full model-generation now, that the AI bigcorps are currently happy keeping stable (since they achieved 100% on some previous benchmark for those behaviors, and changing them now would be a regression per those benchmarks.)

Meanwhile, the AI bigcorps are focusing on extending these models' capabilities at the edge/frontier, to get them to do things they can't currently do. (Mostly this is inside-baseball stuff to "make the model better as a tool for enhancing the model": ever-better domain-specific analysis capabilities, to "logic out" whether training data belongs in the training corpus for some fine-tune; and domain-specific synthesis capabilities, to procedurally generate unbounded amounts of useful fine-tuning corpus for specific tasks, ala AlphaZero playing unbounded amounts of Go games against itself to learn on.)

This means that the models are getting constantly bigger. And this is unsustainable. So, obviously, the goal here is to go through this as a transitionary bootstrap phase, to reach some goal that allows the size of the models to be reduced.

IMHO these models will mostly stay stable-looking for their established consumer-facing use-cases, while slowly expanding TAM "in the background" into new domain-specific use-cases (e.g. constructing novel math proofs in iterative cooperation with a prover) — until eventually, the sum of those added domain-specific capabilities will turn out to have all along doubled as a toolkit these companies were slowly building to "use models to analyze models" — allowing the AI bigcorps to apply models to the task of optimizing models down to something that run with positive-margin OpEx on whatever hardware that would be available at that time 5+ years down the line.

And then we'll see them turn to genuinely improving the model behavior for consumer use-cases again; because only at that point will they genuinely be making money by scaling consumer usage — rather than treating consumer usage purely as a marketing loss-leader paid for by the professional usage + ongoing capital investment that that consumer usage inspires.
by kps | 2025-09-02 17:26:34+00:00
You must be confusing these with something else. Every Selectric had a fixed carriage and moving head.

IBM Selectric: https://www.youtube.com/watch?v=vNUEUth7qjc

IBM Wheelwriter: https://www.youtube.com/watch?v=ZabsF0aIE6k

NEC Spinwriter: https://www.youtube.com/watch?v=tCCB0AW9yT4

Diablo: https://www.youtube.com/watch?v=C5bodpSsFl8&t=342

Teletype Model 33: https://www.youtube.com/watch?v=6N8gu5F894k
by anikom15 | 2025-09-02 17:26:41+00:00
I have no blur because I don’t use anti-aliasing at all. Different renderer settings can have a big impact on how the text looks at small sizes, which is why I commented. For a long time I used anti-aliasing with light hinting, full anti-aliasing with no hinting. I’ve never liked subpixel hinting (ClearType). In the end, I found that turning off anti-aliasing gives me the best readability.
Show HN: Klavis AI open source Docker images for 50+ high quality MCP servers
by wirehack | 2025-09-02 17:27:07+00:00
Many developers have faced the challenge of running MCP Servers locally, manually setting up numerous dependencies, retrieving access tokens and low quality.

At Klavis, we've made this process simple with just two commands. Starting today, it's easy to pull our MCP Server Docker image to instantly spin up any of our high-quality MCP Server.

From https://github.com/Klavis-AI/klavis, it is as simple as:

docker run -p 5000:5000 -e AUTH_DATA='{"access_token":"ghp_your_github_token"}' ghcr.io/klavis-ai/github-mcp-server:latest

Or use our managed OAuth service:

docker run -p 5000:5000 -e KLAVIS_API_KEY=$KLAVIS_API_KEY ghcr.io/klavis-ai/github-mcp-server:latest

No dependency management. No environment setup. For authentication, you can self-host or use our managed OAuth service.

Technical details:

50+ MCP servers available (GitHub, Gmail, Slack, Notion, Jira, Linear, Salesforce, etc.); Lightweight Alpine-based containers; Support for both Klavis-AI OAuth service or BYO tokens; CI/CD ready with automated updates via watchtower; Distributed via GitHub Packages (ghcr.io)

GitHub: https://github.com/Klavis-AI/klavis

Youtube video demo: https://www.youtube.com/watch?v=NITgggPT3pA

Hosted versions: https://www.klavis.ai

One more thing: As AI agents require more tools, they face limitations in tool selection, context window size, and understanding human context. We are building a solution to overcome these constraints, enabling agents to access any tool they need via MCP servers. Join our waitlist to be the first to know when we launch it. https://www.klavis.ai/waitlist
by juancn | 2025-09-02 17:27:21+00:00
Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows.

This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle.

My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I realized that I needed the old number later, it took me a month at least to get it back.

I really like passwords, the security risks are well known and really easy to handle compared to 2FA and all that crap, specially when 99% of your accounts are not sensitive enough to merit anything fancy.
by swiftcoder | 2025-09-02 17:27:24+00:00
And in most startups, you desperately need a generalist among your first few hires. By all means make your founding engineer a specialist in your specific field - but right after that hire, you need a generalist who is going to knock out all your infrastructure, devops, tooling, testing, and team processes. Otherwise your specialist is never going to have the time to do their thing.
by koakuma-chan | 2025-09-02 17:27:27+00:00
Oh you're a recruiter? I am curious about something, I hope you can share what you think: is it a red flag when the candidate doesn't ask questions during interview? I often don't have questions because I have a good enough idea of the company and of what I will be doing already, so I don't ask that kind of questions, and I also don't ask about benefits because I don't really care. Is this seen as bad?
by positiveblue | 2025-09-02 17:27:36+00:00
Adoption is definitely the hardest "cryptographic" problem :D

You can think about this as a new auth token to add in your stack. It does not need to grow and take over the world overnight. We have seen how hard it is to change the status quo + how much it can adapt to new ideas (ex: SQL vs NoSQL)

For now I would imagine teams who need more flexibility in their auth stack to adopt this for new API
by tracker1 | 2025-09-02 17:27:37+00:00
Seems to be an evaluation license... that said, you can run recent versions of windows unregistered for pretty much as long as you want... they disable some UI enhancements, like changing the desktop, but it tends to function.

Not sure on older versions... MS used to generate new evaluation ISOs every few months with a hard fuse in them... Can't speak for recently since it's been years since I've needed to test for old IE versions. If you choose to customise, I'd suggest going with one of the "lite" modified versions of Windows 10... since this will reduce the default surface a lot without the bridge to some of what Win11 added while jumping the shark.
by cmrdporcupine | 2025-09-02 17:27:41+00:00
Using JIRA isn't really the issue on its own. It's walking around with blinders thinking that tracking things in JIRA is how work gets done because it's invisible to you otherwise because you don't have your ear to the ground listening to your staff and finding out what's happening because you expect it all to be in the ticket tracking system.

The map is not the territory, etc. etc.
by shadowgovt | 2025-09-02 17:27:51+00:00
I got off the bandwagon of old Twitter when they decided to respond to the US electing a Twitter troll President not by enforcing their own policy, but by modifying that policy to create a narrow carve-out of "newsworthiness" for a specific account that could then, more or less, disregard their policies wholesale.

New Twitter is worse, but the Twitter of the past had no real spine either.
by dizlexic | 2025-09-02 17:27:53+00:00
This

I was talking to a fellow dev at the company I work at and he was extolling the virtues of one-click nextjs deployments. As the conversation progressed it turned out he'd never actually had to set up or manage his own servers and felt that it was a waste of time for him to learn.

It hurt my soul. I am considering linking this article, but i feel it may come across as aggressive.
by lbrito | 2025-09-02 17:28:02+00:00
>please don't use quotation marks to make it look like you're quoting someone when you aren't

I searched thru algolia and that quote came at first from user queSide 1 month ago, not by mixmastamyk. Unless they're the same person or the search is flawed

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
by fidotron | 2025-09-02 17:28:03+00:00
> Remember the YouTube acquisition? To many, it seemed bonkers.

Because of the legal uncertainty about what they were doing. There was no fundamental technological impediment.

Here the technology simply doesn't exist and this is a giant bet that it can be magically created by throwing (a lot) more money at the existing idea. This is why it's "dumb money" because they don't seem to understand the dynamics of what they're investing in.
by farfolomew | 2025-09-02 17:28:10+00:00
It’s about time the western world finally changes from a five to four-day work week!

That’s just about the most tangible benefit I see this AI breakthrough delivering. What an asset to have too, socially and civilly, especially when compared to the west’s primary adversary: the CCCP and its communist message of ‘equality’ for the people when they’re still working six days a week!
by FireBeyond | 2025-09-02 17:28:20+00:00
What this version of the FedEx story doesn't mention is that Fred was already stiffing his pilots on their salaries. Taking the last money in the company and deciding that the best use for it was the blackjack table in Vegas and not paying his employees ... worked well, but it was a gamble, let's be clear, not a calculated decision - like you say, not the decision of a "great genius". It goes a different way, and you have "FedEx founder decides to go gambling, leaving his employees without paychecks".