MurphyA/hacker-news huggingface dataset:
by slacktivism123 | 2025-09-04 19:23:09+00:00
Sounds like HackerOne Managed Triage Services dropped the ball again and closed both reports without even flagging to Cloudflare's security engineers.

This happened in a high-profile way with the Zendesk situation (https://news.ycombinator.com/item?id=41818459) and is not the first time:

1. Bug bounty report received from knowledgeable person who isn't a "celebrity" (top x performer on H1 leaderboard, social media influencer, H1 event invitee) 2. with novel impact to the company, open source ecosystem, or wider Internet 3. which doesn't fall neatly into an OWASP Top 10 (Web) box 4. so Triage close it in the pre-queue before the company get eyes on it, replying with a zero-effort CR (Common Response aka Canned Response) 5. the company doesn't see the report unless they go digging for it in the thousands of spam/bullshit/Acunetix copypaste reports that are also closed

---

Timeline of events:

https://blog.cloudflare.com/unauthorized-issuance-of-certifi...

>2025-09-02 04:50:00: Report shared with us on HackerOne, but was mistriaged

>2025-09-03 02:35:00: Second report shared with us on HackerOne, but also mistriaged.

>2025-09-03 10:59:00: Report sent on the public mailing [list] picked up by the team.

---

The canned response in question:

https://groups.google.com/g/certificate-transparency/c/we_8S...

>"after reviewing your submission it appears this behavior does not pose a concrete and exploitable risk to the platform in and on itself.

>If you're able to demonstrate any impact please let us know, and provide an accompanying working exploit."
by underlipton | 2025-09-04 19:24:51+00:00
A little tinfoil birdie told me that even the Covid era itself (and the resultant mass layoffs during, mass hiring following, and mass layoffs following that) were a smokescreen for (bond?) market instability. I personally tend to think that both were more of a, "Don't let a good crisis go to waste," situation.

Market hiccups? Use a pandemic panic to justify printing a ton of money.

Printed too much money? Distribute it to the "right" people through a hiring frenzy, personnel you totally need in order to build a metaverse or whatever.

Money ran out + overleveraging during the boom + market changes caused by the rapid socioeconomic shifts (e.g., commercial real estate tanking)? You can cover the bottom line for now with a lot of firing and consolidation, say it's AI's fault.
by godelski | 2025-09-04 19:25:09+00:00
Try a few times and it'll happen. I don't think it took me more than 3 tries on any platform.

To convince me it is "reasoning", it needs to get the answer right consistently. Most attempts were actually about getting it to show its results. But pay close attention. GPT got the answer right several times but through incorrect calculations. Go check the "thinking" and see if it does a 11-9=2 calculation somewhere, I saw this >50% of the attempts. You should be able to reproduce my results in <5 minutes.

Forgive my annoyance, but we've been hearing the same argument you've made for years[0,1,2,3,4]. We're talking about models that have been reported as operating at "PhD Level" since the previous generation. People have constantly been saying "But I get the right answer" or "if you use X model it'll get it right" while missing the entire point. It never mattered if it got the answer right once, it matters that it can do it consistently. It matters how it gets the answer if you want to claim reasoning. There is still no evidence that LLMs can perform even simple math consistently, despite years of such claims[5]

[0] https://news.ycombinator.com/item?id=34113657

[1] https://news.ycombinator.com/item?id=36288834

[2] https://news.ycombinator.com/item?id=36089362

[3] https://news.ycombinator.com/item?id=37825219

[4] https://news.ycombinator.com/item?id=37825059

[5] Don't let your eyes trick you, not all those green squares are 100%... You'll also see many "look X model got it right!" in response to something tested multiple times... https://x.com/yuntiandeng/status/1889704768135905332
by afiori | 2025-09-04 19:26:08+00:00
I don't like Blockchains mostly but the technology of the Blockchain here is not irrelevant, it is a way to use peer to peer liquidity. That is there is no need for a central entity to have liquidity in many different circuits because you can trade with other coin holders directly in many different exchanges.

Sort of like banks use customer money to offer loans to avoid the need of centralised liquidity.

The Blockchain technology is important to allow different exchanges to interact with each other in ways that I suspect would be not super legal through a central entity.
by buddhu | 2025-09-04 19:26:38+00:00
For what it's worth, and from what you've described (I haven't used Arc myself), most of those features are also available in Firefox with the Sidebery extension. Instead of "spaces" it has "tab panels", with a horizontal row of icons above your tabs that lets you switch to different panels of vertical tabs. You can pin tabs in a panel, you can setup URL patterns to automatically move tabs to the right panel, and it works with Firefox's multi-account containers so you can even have an URL automatically re-opened in a specific container associated with that panel.

[Side note: I'm hooked on Firefox's multi-account container feature because I can have different containers for general use, for work, isolated social media containers, etc, without needing an entirely different profile as in Chrome/Chromium and its variants. I've tried Vivaldi and other Chrome-based alternatives recently, but profiles are just too big of a separation by comparison, with separate extensions, bookmarks, settings, etc. I want all those things in one synced account where I can just open new tabs with their own set of signed-in accounts. Does Arc's profile feature have the same level of separation as Chrome? Am I missing something about how Chrome profiles work?]

And for anyone concerned about Firefox's recent statement about personal data, there's a great Firefox-based alternative called Waterfox that adds some nice features and has a much stronger emphasis on privacy.
by seabass-labrax | 2025-09-04 19:26:52+00:00
Yes, it's very similar! However, hledger's posting dates are a little more flexible, as you can have anything from no additional dates to one date per individual posting (debit or credit) in the transaction. This might perhaps be useful if you have complex split transactions where a balance is settled by multiple payments.

Just recently I bought an item on sale for 15 Euros with a card in Sterling (my bank did the currency conversion). Pretty much immediately after paying, though, I exchanged it for a different item for 25 Euros, making up the difference in cash. The cash is obviously 'cleared' instantly but the card payment could clear later. That said, in this case it happened to clear the same day anyway so no special posting date was required.

2025-08-10 Redacted Expenses: Redacted 13.03 GBP Expenses: Redacted 10 EUR Assets: Bank -13.03 GBP Assets: Cash -10 EUR

I suppose the main question is at what point these splits become complex enough to create a dedicated liabilities account specifically to track the payment of that one expense, à la accounts payable, which you can of course do with any plain text ledger.
by louisanderson01 | 2025-09-04 19:26:55+00:00
udev is probably referencing smart contracts(which turn blockchains from shared dbs to shared state-machines), and zk(which allows for cryptographic guarantees of arbitrary computation, and facts about said computation without revealing details of computation). Those are two major innovations on the tech side, there's also rollups, blobs, and a whole host of other interesting developments in the EVM(ethereum virtual machine) ecosystem.
by Kirby64 | 2025-09-04 19:28:21+00:00
> Loud? My last two ICE vehicles have sufficient cabin noise-dampening to the point that one of the manufacturers can actually pump engine noise into the cabin.

Most cars are not like this, because they don't spend as much money on sound dampening materials. The baseline 'good' for an EV is just much higher. Also, at idle, ICE cars are louder.

> Lag? Unless you are driving an ICE with a large turbo, what lag?

Pretty much every ICE car that is commanded to rapidly accelerate must drop down a gear (or 2). The mechanical time to shift gears and then also rev match just physically takes time. More expensive ICE cars are faster, sure, but compared to even the most anemic EV, the EV will win in response time. As soon as you hit the accelerator, you get torque. It's just not even close. Likewise with deceleration. You have a very non-linear deceleration curve with an ICE vehicle that is neither smooth nor even.
by fzeroracer | 2025-09-04 19:28:28+00:00
For reference, a similar HN story from about a month ago [1] on teacher usage of AI tools in the classroom.

It's pretty fucking dire. I think we're failing an entire generation of kids and the ramifications of this is going to be real bad in 5-10 years. I've heard similar stories from friends of mine whom are teachers.

[1] https://news.ycombinator.com/item?id=44808122
by b33j0r | 2025-09-04 19:28:53+00:00
I love this perspective. I wanted to be Tom Scholz from Boston (though he was an ME, and that was my dad’s music).

My junior project in EE was a guitar fx pedal with a shielded breadboard on top. I won’t be bashful, that was the most popular project in the room.

Then… I got divorced and never finished my EE degree. I already had a degree in CS, and had pursued a second degree because I thought software was too limiting. Now, here I am, all limited.

The reason I never subsequently finished my degree was that I didn’t really want to work on CMOS nor transmission lines or microwave, and graduating with an ECE degree from U of Utah offered those as your career paths.
by ncruces | 2025-09-04 19:28:56+00:00
Are their competitors more energy efficient somehow?

This is a thread about them not being able to meet carbon neutrality commitments because of AI, which they feel they need to because competitors are eating their lunch.

Are the competitors not eating their lunch? Are they doing so because they're more green? Otherwise what are they expected to do? Not compete? “Innovate” themselves out of not needing energy consuming AI?
by 01HNNWZ0MV43FF | 2025-09-04 19:29:08+00:00
I am reminded of an article about a poker site:

"There are 52-factorial ways to shuffle a deck of cards, but the site's PRNG only has 32 bits of state. 4 billion is alarmingly less than 52-factorial! But even worse, the PRNG is seeded using the number of milliseconds since midnight. 86 million is alarmingly less than 4 billion!"

So the actual entropy on the card table was equivalent to about 5 cards' worth. After seeing the 2 cards in his hand, and the 3 cards in the flop, he could use a program to solve for every other card in everyone's hand and in the entire deck!

(I may have mixed up many details - If anyone has an archive of the article please post it!)
by adriand | 2025-09-04 19:29:28+00:00
I went down a rabbit hole of archival recordings (on archive.org) of insane material from the Cold War era, including this gem called "The Complacent Americans" which aimed to instruct Americans on how to survive a nuclear blast. It's really quite mental to listen to: https://archive.org/details/lp_the-complacent-americans_larr...

It inspired me to make an EP about the same topic, utilizing samples from that material plus some others, called Leader of all Nations. You might like it if you're into slower-paced dubstep / Boards of Canada stuff, it's on Soundcloud (https://soundcloud.com/taaapes/sets/leader-of-all-nations) plus all the usual places.

It's strange to me that some of the basic principles of what to do in the event of a nuclear explosion are no longer taught, despite the fact that the risk of nuclear war is arguably just as high as it once was. For instance, I bet if a bomb went off in the middle distance, most people would look at it: bad move! If you see a big flash, you should actually (it's a cliche, but true), "duck and cover". Duck to avoid flying debris. Cover to avoid burns. I didn't know this until I dug into the archival material making this EP but it's genuinely odd to me that this is not widely known. (I'd heard the phrase before, but had no idea what it really meant.)
by pqtyw | 2025-09-04 19:29:41+00:00
> how many designers I interviewed who told me they used the Arc browser

Looking at their frontpage the design is outright horrible if you have a > 7-8 inch screen. I guess in a way its good to have an example of what not to do.

> I'm sure they'd be killing it

Why, though? I mean the niche is pretty small, most people don't care much about open source or even what browser they are using at all.

Considering the overwhelming majority of Mozilla's funding is coming from Google and in no way could it survive without it being run by Google's plants is not that surprising.
by quickthrowman | 2025-09-04 19:29:44+00:00
> This is a blast from the past. I hadn't thought of elliptic in years.

Hehe, I figured someone would recognize who I meant! IIRC he had created an automated bot that was able to ascend with 3 runes, MiBe of Trog w/ Axes (for cleaving?). Elliptic and N78291 were my favorite players to watch, along with mikee_

That sounds like a fun little meetup, I kept in touch with a couple fellow ##crawl players for a while (crate and ophanim) but have lost touch. I know JoshTriplett posts here sometimes too.

I contributed a single patch myself, I do believe it was a mace/blunt weapon balance patch but it’s been a while!
by harryjosh | 2025-09-04 19:30:27+00:00
Hey HN We’re working on MedTechAI — a project to help AI/ML folks build better healthcare models without dealing with real patient data. We generate high-quality, privacy-compliant synthetic medical datasets that mimic real-world medical scenarios (but with no actual patient info, so no HIPAA headaches). The data comes in formats like JSON and TXT, and it's designed to be easy to plug into your workflows — whether you're building a medical chatbot, training a model, or just experimenting with healthcare analytics. We’d love your feedback: What would you want in a medical dataset for AI/ML? Any features or formats you think we're missing? Would this be useful for what you’re working on? Open to ideas, suggestions, and collaboration. Happy to answer any questions!
by InsideOutSanta | 2025-09-04 19:30:40+00:00
> What company wants to be the lightning rod who comes out and says, "we laid off a bunch of people and replaced with AI"?

Isn't that precisely what all publicly traded companies want to say, and are often saying? I feel like I read a new headline of some sociopathic CEO bragging about how many people he managed to lay off thanks to AI every day.
by qcnguy | 2025-09-04 19:30:44+00:00
Right. The objective is "correctly predict the entire training set", where that training set contains literally everything. So the objective becomes to speak every human language, every programming language, to understand every topic, to master every weird sub-genre of culture. That's an inherently very inefficient training objective if you just want an AI that can do some specific tasks. It's the whole insight behind models specific to summarization, text extraction, patch merging etc.

And don't forget the noise. If you look at the Anthropic papers it's clear from the examples they give that the dataset is still incredibly noisy even after extensive cleaning efforts. A lot of those parameters are being wasted trying to predict garbage outputs from HTML scraping gone wrong.
by goku12 | 2025-09-04 19:30:46+00:00
That's the failure of the people. Those politicians are supposed to represent their constituents - not their highest bidder. Democracy is not a system where people choose a politician and hand them the power and authority over themselves for the next half a decade. Instead, people have to constantly and consistently boss them and hold them accountable. This is the duty of every citizen towards a democratic constitution, without which the latter is not even viable.

I know what response to expect for the above. It will be contemptuously dismissed with the remark that it's just a fantasy. But I hope you're seeing the congress people running out of town halls via the backdoors in disgrace after their constituents heckled them and challenged their demagoguery. Sadly, it's a tad bit late. This should have been the response to much less provocation. Still, many of those politicians are now afraid to blindly endorse the ideas of their overlords. This concept isn't new either. This was widely experimented with during the French revolution. They had provisions to recall and replace the reps in such instances. What people need are political education and a strong allegiance to the constitution.
by mvieira38 | 2025-09-04 19:30:54+00:00
The idea is great, although I'm a little against the spirit of releasing this as a paid product instead of an Anki plugin/front-end or something. Alas, my biggest feedback is marketing stuff: the english on the landing page is way too broken for a premium paid product; I shouldn't need an account to try a simple app; this is surely not the ONLY (in all caps) app to do "variations". Maybe be more detailed on what the variations are and how it's different from the bajillion free Anki plugins out there.
Ask HN: Career advice after graduating undergrad
by aroy21 | 2025-09-04 19:32:05+00:00
new grad SWE at Amazon or EE Masters in Signal/Image Processing?

I'm an ee student with more of a cs focus. I've done 4 swe internships the past 3 years and have decent experience I think. This summer I got my chance in Big Tech at Amazon.

After the summer, I got inclined a return offer. However, as you’ve probably heard, Amazon can be a grind. That in itself is fine, but I couldn’t see myself doing it long-term. I didn’t mind working hard, but I felt that if I’m going to put this much effort into something technically challenging but not that interesting, I’d rather do something I actually enjoy.

This past year I've been getting more interested in signal/image processing and more roles like that. But like you know those roles are usually gatekept with a masters or you have to be cracked. I feel like I need to learn more and I've always wanted to do research. I graduate this Fall so I've been thinking about this quite a bit. Additionally, a lot of the math and physics I've done during my degree has been clicking and

However on the other hand. That new grad offer is no joke. That would be a given over something I'm assuming that could happen in the future. Should I stop bitching and be grateful for a role most other students at my university would want?

I'm interested in ML/Robotics roles and would like to be competitive for them but I feel like I am not as qualified as I would like to be. :)

If anybody has been in this predicament I would appreciate any advice. Genuinely feeling a bit lost.

TLDR: Take the offer and grind it out or roll the dice on the masters in hopes of getting more ml/image processing roles.
by NoMoreNicksLeft | 2025-09-04 19:32:29+00:00
This comment is farcical. Supposing you are right and that there was "no doxxing involved", it's still impossible for an outsider like most of us here, to verify it. Especially if there is such a thing as non-public discourse of any kind.

It is not a transparent organization, and it does not even pay lip service to the effort of transparency. It is large enough of an organization that it is an absurd claim, on its face, that there are not cliques and factions who would do such things if it were at all possible.

You investigated yourselves and found no evidence of wrongdoing.
by alexashka | 2025-09-04 19:32:30+00:00
> So folks, practice talking to people. Much of what's wrong in the current world is actually loneliness, having no outlet for your expressions.

If I had a penny for every bizarre theory people who ruin the world believe about who/what is actually ruining the world.

My favourite was an interview with Jerry Springer. He also had a theory of what's wrong in the current world and none of it had anything to do with what he did.
by underlipton | 2025-09-04 19:32:31+00:00
I sometimes wonder if math suffers from a bit of basketball syndrome. That is, I'm sure there are dozens of potential Muggsy Bogues-esque players out there, but the game's meta continues to drift ever towards who coaches and trainers know how to coach and train, which is tall dudes.

There might be a structural issue if you have a bunch of guys coming in from the technician side, as you say, who almost all get filtered out. You might need remedial classes, a different curriculum progression, something. Or else recruitment standards/expectation-setting are wacked-out.
by quodlibetor | 2025-09-04 19:32:51+00:00
> Not much polars can do about that in Rust

I'm ignorant about the exact situation in Polars, but it seems like this is the same problem that web frameworks have to handle to enable registering arbitrary functions, and they generally do it with a FromRequest trait and macros that implement it for functions of up to N arguments. I'm curious if there are were attempts that failed for something like FromDataframe to enable at least |c: Col<i32>("a"), c2: Col<f64>("b")| {...}

https://github.com/tokio-rs/axum/blob/86868de80e0b3716d9ef39...

https://github.com/tokio-rs/axum/blob/86868de80e0b3716d9ef39...
by barrell | 2025-09-04 19:33:00+00:00
Here is an example of the formatting I desired: https://x.com/barrelltech/status/1963684443006066772?s=46&t=...

Yes I use(d) structured output. I gave it very specific instructions and data for every paragraph, and asked it to generate paragraphs for each one using this specific format. For the formatting, I have a large portion of the system prompt detailing it exactly, with dozens of examples.

gpt-5-mini would normally use this formatting maybe once, and then just kinda do whatever it wanted for the rest of the time. It also would freestyle and put all sorts of things in the various bold and italic sections (using the language name instead of the translation was one of its favorites) that I’ve never seen mistral do in the thousands of paragraphs I’ve read. It also would fail in some other truly spectacular ways, but to go into all of them would just be bashing on gpt-5-mini.

Switched it over to mistral, and with a bit of tweaking, it’s nearly perfect (as perfect as I would expect from an LLM, which is only really 90% sufficient XD)
by afiori | 2025-09-04 19:33:20+00:00
That is because the EU acts as a coordinating authority, if you wanted to transfer money from Greece to Iran it would be a different issue.

I suspect that banks cannot solve this because it would be illegal for them to do so.

If many banks could send and receive money from across the world money laundering would become way way easier (in this sense the lack of privacy in many blockchains can be seen as a strength) and it is how offshore fiscal paradises work
by zaruvi | 2025-09-04 19:33:23+00:00
Yep, but admittedly the vertical tab UX is not the greatest. You either have them always be visible with an option to toggle by clicking the sidebar icon (no keyboard shortcut option afaik), or minimised as icons that expand on hover with an awfully annoying animation.

Looking at Zen, I really don't understand how Mozilla fail to capitalise on their browser, and build up a similar experimental project based on Firefox like it. It seems that many of these small QoL improvements could make a big difference. They have such a huge budget, and they waste it on inane things. Their fancy search deal with Google has made them complacent, and neglect one of the few things that ever had any real worth. Curious to see how it develops with the recent Google ruling. And to be fair, it does seem like Firefox development has picked up a bit lately—maybe even due to Zen's competition, who knows.