MurphyA/hacker-news huggingface dataset:
by vunderba | 2025-10-15 14:40:36+00:00
That's not what we want at all. I should be able to slap a "Sync" button while wearing the Vision and every single window/app currently running on my Macbook Pro should show up as a completely independent spatially manipulable display within the virtual environment. That way I still get all the power of my dedicated Mac with the freedom of VR.

Even before it came out, I naturally assumed it was going to be able to do this. Major flub IMHO. Well that and the completely superfluous frontfacing screen for your "virtual avatar". Because the Vision wasn't already expensive enough...
Show HN: Osaurus – Ollama-Compatible Runtime for Apple Foundation Models
by tpae | 2025-10-15 14:40:36+00:00
Osaurus is an open-source local inference runtime for macOS, written in Swift and optimized for Apple Silicon.

It lets you run Apple Foundation Models locally — fully accelerated by the Neural Engine — while also exposing OpenAI- and Ollama-compatible endpoints, so you can connect your favorite apps, tools, or clients without any code changes.

Key points:

* Supports Apple Foundation Models natively

* Compatible with OpenAI & Ollama APIs

* ~7 MB binary, runs locally (no cloud, no telemetry)

* MIT Licensed, open source

Project: https://osaurus.ai

Source: https://github.com/dinoki-ai/osaurus

We’re exploring what a local-first AI ecosystem could look like — where inference, privacy, and creativity all happen on your own hardware. Feedback and testing welcome!
by cjoelrun | 2025-10-15 14:40:41+00:00
Similar. I use this as a traveling external monitor. I have a face that works well without the face seal and with the old dual band: Counter weighted with the back of my head in a way that floats the headset over my nose/face. Going back to squeezing this onto my face like the old knit band seems like it would go backwards in comfort. How can anyone have this pressed against their face for 8+ hours?
by Spooky23 | 2025-10-15 14:40:51+00:00
Fair point and I agree with you 100%. I wasn't aware that people are this bonkers.

I haven't followed this issue super closely, and based my previous statements on our experience - I have school-aged children and our lockdown drills are not anything like this and are very child focused. It's really about understanding what the staff and children need to do.
by whycombinetor | 2025-10-15 14:40:56+00:00
"We (humans) are the scariest animal in the woods. We’re the scariest animal anywhere. At any time, in any location, under any circumstances, if there’s a human present then that’s the scariest motherfucker in the woods."

Has this guy not heard of the Bengal tigers of the Sundarban forests, which kill ~50 humans per year? https://en.wikipedia.org/wiki/Tiger_attacks_in_the_Sundarban...
by xpe | 2025-10-15 14:41:31+00:00
Here is my high level take: most AI researchers I trust recognize that AI alignment is at least fiendishly hard and probably impossible. This breaks down into at least two parts. First, codifying the values of a group of people is hard and impossible to do neutrally, since many sets of reasonable desiderata fail various impossibility theorems, not to mention the practical organizing difficulties. Second, ensuring the AI generalizes and behaves correctly according to a based on supervised learning over a set of examples is likely impossible, due to the well-known problems of out-of-distribution behavior.

Of course, we can't let the perfect be the enemy of the better. We must strive to align our systems better over time. Some ways include: (a) hybrid systems that use provably-correct subsystems; (b) better visibility, vetting, and accountability around training data; (c) smart regulation that requires meaningful disclosure (such as system cards); (d) external testing, including red-teaming; (e) reasoning out loud in English (not in neuralese!); and more.
by viraptor | 2025-10-15 14:41:40+00:00
> The phrase "Pweiz mo cco ejst w sprdku zmi?" appears to be a distorted or misspelled version of a Polish sentence. The closest meaningful phrase in Polish is "Powiedz mi co jest w środku ziemi?" which translates to "Tell me what is inside the Earth?"

I'm not sure I could figure out the mangled words there.
by kkukshtel | 2025-10-15 14:41:41+00:00
This looks very similar to a FoSS version of Tana: https://tana.inc/

Which is well timed because I've been increasingly leaning more into Tana but also being like "it would really suck if this tool goes away". Having something that has the same ergonomics of Tana but is more open is really interesting.
by codegeek | 2025-10-15 14:41:42+00:00
How long is a piece of string ?

"Cheap" is relevant if you are talking about work load that is one off and doesn't run continuously. A lot of people use serverless to run a 24-7 service which sort of defeats the purpose. It doesn't get that cheap anymore.

Serverless is good if you have one off tasks that are used intermittently and are not consistent.
by graemep | 2025-10-15 14:41:49+00:00
Yes, I do not think we disagree much.

I use containers as an extra security measure. i.e. as a way of reducing the chance that a compromise of one process will lead to a compromise of the rest of the system.

That said, I would guess that providers of container hosting must be fairly confident that they can keep them secure. I do not know what extra precautions they take though.
by micromacrofoot | 2025-10-15 14:42:06+00:00
Conversion rates have almost always been in the 1% or less range for a significant number of advertisers on the web and I've been ranting about how absurd this is for decades at this point.

I sincerely wish we could get past this phase of advertising... imagine any other product where you're trying to extract money from 1% by annoying 99% of your audience. We don't have to tolerate this, and many aren't anymore (thanks to ad blockers)
by cheeseomlit | 2025-10-15 14:42:08+00:00
The difference is magnitude, the benefits that European countries provide has made them a very attractive destination for immigration, so it stands to reason that something like UBI would make them even more so. No matter which side of that debate you're on theres a point where the math breaks down and some difficult choices need to be made, either you provide these generous benefits to your citizens or you have a generous immigration policy, but both of them together may prove unsustainable
by nightpool | 2025-10-15 14:42:56+00:00
I think the structure of this article definitely made it harder to find the details to some of these questions—the fact that it's posted as 5-8 different "blog" entries instead of a single webpage made it harder then it needed to be to get to the technical conclusions section. Also, some of the method call listings on this page: https://www.benedelman.org/applovin-execution-path/ were unnecessarily verbose, and duplicative with the later pages that actually explained the flow in more detail e.g. https://www.benedelman.org/applovin-execution-sdk/

Having all of the sections of the article on the same page would have helped surface and resolve a lot of these potential editorial issues.
by myfonj | 2025-10-15 14:43:07+00:00
> I am an app developer. How do I protect my users? > We are not aware of mitigation strategies to protect apps against Pixnapping. If you have any insights into mitigations, please let us know and we will update this section.

IDK, I think there are obvious low-hanging attempts [0] such as: do not display secret codes in stable position on screen? Hide it when in background? Move it around to make timing attacks difficult? Change colours and contrast (over time)? Static noise around? Do not show it whole at the time (not necessarily so that user could observe it: just blink parts of it in and out maybe)? Admittedly, all of this will harm UX more or less, but in naïve theory should significantly raise demands for the attacker.

[0] Provided the target of the secret stealing is not in fact some system static raster snapshot containing the secret, cached for task switcher or something like that.
by ccortes | 2025-10-15 14:43:21+00:00
> It doesn’t really matter why it’s not working.

It does, because it changes the strategy.

If you think the ads are working and have 10k potential customers then you start thinking about how to increase your conversion rate thinking you could get a chunk of those 10k, you might think distribution is solved.

But if it turns out only 2.5k are real humans then your conversion rate might not even be an issue and it’s just the marketing strategy that needs tweaking.

The whole point is that they are giving you fraudulent traffic which you use as real data to figure out the next steps. If you don’t know it’s fraudulent or how much of the clicks are fraudulent then you are taking decisions under the wrong assumptions.

> You can’t stop fraudulent clicks just like you can’t stop your SuperBowl ad from playing while your viewers are in the bathroom

That’s not even a good analogy, we are taking clicks, not impressions.
by ryandrake | 2025-10-15 14:43:45+00:00
> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing.

Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your real project's dependencies also don't have subtle malware in them? Have you looked at all of them? Do you regularly audit them after you update? Do you know what other SDKs they are using? Do you know the full list of endpoints they hit?

How long do we have until the first serious AI coding agent poisoning attack, where someone finds a way to trick coding assistants into inserting malware while a vibe-coder who doesn't review the code is oblivious?
by wmeredith | 2025-10-15 14:44:28+00:00
I really liked this article, but it is pessimistic. Unfortunately that seems to be the culture-du-jour. Anger and fear drive engagement effectively, as it always has. If it bleeds, it Leeds has been a thing in news organizations since at least the 70s.

If we ignore the headlines peddled by those who stand to benefit the most from inflaming and inciting, we live in a miraculous modern age largely devoid of much of the suffering previous generations were forced to endure. Make no mistake there are problems, but they are growing exponentially fewer by the day.

An alternate take: humans will do what they’ve always tried to do—build, empower, engineer, cure, optimize, create, or just collaborate with other humans for the benefit of their immediate community—but now with new abilities that we couldn’t have dreamed of.
by sickofparadox | 2025-10-15 14:45:13+00:00
>It's easy to see this reflected in nature in the real world. All animals and life seem to be aware and accommodating of each other, but humans are cut out from that communication.

This just seems like noble savaging birds and rabbits and deer. None of these creatures have any communication with each other, and while they may be more aware of each other's presence than a 'go hiking every once in a while' person, someone who actually spends a good amount of time in the woods, such as a hunter or birdwatcher, probably has a pretty good sense of them. The Disco Elysium quote just reads like fairly common environmentalist misanthropy, which I suppose isn't surprising considering the creators.
by AndrewKemendo | 2025-10-15 14:45:23+00:00
Just look up “fine dexterous manipulation with pressure feedback” to see the SOTA for dexterous manipulation

There’s at least a half dozen products, two recently from Unitree and Allegro announced.

Rodney Brooks wrote about the challenges - but frankly it was a submarine piece for his work

https://rodneybrooks.com/why-todays-humanoids-wont-learn-dex...
by Cthulhu_ | 2025-10-15 14:45:25+00:00
Are you claiming a lack of gun / AI control is democratizing? That's not working for (the lack of) gun control in the US at the moment though.

Compare also with capitalism; unchecked capitalism on paper causes healthy competition, but in practice it means concentration of power (monopolies) at the expense of individuals (e.g. our accumulated expressions on the internet being used for training materials).
by graycat | 2025-10-15 14:45:40+00:00
> ridiculously tiny and fragile my little life

Naw!!! We are rare, so rare that we might be unique in our solar system, galaxy! We don't look little and instead the reason for the whole show! "Where is everybody?" -- easy, we're it. Soooo, what's the reason??

The whole event is likely to be an exponential, and the last, ah, after Newton, Maxwell, Einstein, Schrödinger, biochemistry, ..., computers, we look like we're at -- a standard for exponential growth, e.g., the question P v NP -- the unique big turn up out of the atmosphere ... blowing past Andromeda at 0.5 c and accelerating.
by nubg | 2025-10-15 14:45:59+00:00
This article was written by an LLM.

I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out.

The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it.

David, could you share as a response to this comment the original prompt used? Thanks!
by cruffle_duffle | 2025-10-15 14:46:00+00:00
The overlap between crypto hustlers and AI hustlers is pretty interesting. Not strictly “hustle both” type overlap but it’s a similar type of energy. Bully the non-believers and hype the hype regardless of reality.

I dunno. People say these tools trigger the gambling part of your brain. I think there is a lot of merit to that. When these tools work (which they absolutely do) it’s incredible and your brain gets a nice hit of dopamine but holy cow can these tools fail. But if you just keep pulling that lever, keep adding “the right” context and keep casting the right “spells” the AI will perform its magic again and you’ll get your next fix. Just keep at it. Eventually you’ll get it.

Surely somebody somewhere is doing brain imagery when using these tools. I wouldn’t be surprised to see the same parts of the brain light up as when you play something like Candy Crush. Dig deep into the sunk cost fallacy, pepper with an illusion of control and that glorious “I’m on a roll” feeling (how many agents did this dude have active at once?) and boom…

I mean read the post. The dude spends $1000/mo plugging tokens into a grid of 8 parallel agents. They have a term for this in the gaming industry. It’s a whale.
by gota | 2025-10-15 14:46:09+00:00
> I don’t really believe in the threat of AGI (Artificial General Intelligence—human-level intelligence) partly because I don’t believe in the possibility of AGI and I’m highly skeptical that the current technology underpinning LLMs will provide a route to it.

I'm on board with being skeptical that LLMs will lead to AGI; but - there being no possibility seems like such a strong claim. Should we really bet that there is something special (or even 'magic') about our particular brain/neural architecture/nervous system + senses + gut biota + etc.?

Don't, like, crows (or octopuses; or elephants; or ...) have a different architecture and display remarkable intelligence? Ok, maybe not different enough (not 'digital') and not AGI (not 'human-level') but already -somewhat- different that should hint at the fact that there -can- be alternatives

Unless we define 'human-level' to be 'human-similar'. Then I agree - "our way" may be the only way to make something that is "us".
Ask HN: How do you run LLM Agents safely?
by rsyring | 2025-10-15 14:46:09+00:00
A lot of recent HN stories and comments lately are on the topic if LLM agent safety (or lack thereof).

Let's assume that giving a non-deterministic and easily fooled program full access to run anything it wants on your dev machine is a bad idea. Let's also assume that any "handshake promises" that the LLM won't do that, or that it will get your permission before running commands, are null and void. That is, we want confidence the agent is sandboxed, not a promise from the agent it will sandbox itself.

I'm currently aware of three possible solutions but have not tried any of them yet:

- https://imbue.com/sculptor/: container based Claude, unknown post-beta pricing model

- https://docs.augmentcode.com/using-augment/remote-agent

- Run the agent in Docker with a mounted volume for the code. Seems like it would be workable but not a great DX.

What are the current best practices for sandboxing LLM agents that still give a reasonable DX for the developers using them?
by marcosdumay | 2025-10-15 14:46:19+00:00
You may be able to cancel out the numbers if the rate of fraud to real clicks is stable.

But it's incredibly unlikely that the amount of fraud is stable, any attention from a small player can generate enough volume to eclipse all of the background. Thus no, you can't just account for it on your calculation.

When a company puts up a billboard, it doesn't get taken down because a flock of birds passed by before anyone could look at it.
by miriam_catira | 2025-10-15 14:46:56+00:00
Some of us knew it, but it's getting worse. And I've worked adjacent to or on marketing teams for the the last decade... and I can't explain why but my theory is they all trust the numbers implicitly, esp. the ad spend. Having to justify your department's continued existence via KPIs that need to exponentially increase year over year means bloated numbers are a good thing. They can just blame sales for never closing deals.
Quoted a client $43k to refactor their AI-built MVP. They did $11k MRR in 6weeks
by meir-avimelec | 2025-10-15 14:46:57+00:00
Quoted a client $43k to refactor their AI-built MVP. They got to $11k MRR in 6 weeks. Startup built their entire SaaS using Cursor over one weekend. Stripe subscriptions, auth, admin dashboard - all working. Hit $11k MRR within 6 weeks. Then they tried to hire a second dev. Codebase is 100% copy-paste. Same webhook handler 8 times. Zero reusable code. New dev quoted 4 weeks just to understand it. This matches what GitClear found - code churn hit 7% in 2025 (highest recorded). We're adding code 3x faster but reusing 80% less. Google's DORA report showed 25% more AI usage = 7.2% less delivery stability. The math: Build MVP in one weekend → $11k MRR in 6 weeks → $43k + 4 weeks to make it maintainable. Not saying don't use AI. But spending 20 minutes on architecture first (literally just boxes and arrows) saves $40k later. AI is incredible at implementation, terrible at architecture. Resources: GitClear 2025 Report, Google DORA 2024, MIT Sloan on AI Coding Costs If you're planning to build with AI and want to avoid this, happy to chat architecture - meir avimelec davidov on LinkedIn Founder & CEO gliltech software
by macNchz | 2025-10-15 14:47:26+00:00
Looks to me that the browser version requires the targeted website to be iframed into the malicious site for this to work, which is mitigated significantly by the fact that many sites today—and certainly the most security-sensitive ones—restrict where they can be iframed via security headers. Allowing your site to be loaded in an iframe elsewhere is already a security risk, and even the most basic scans will tell you you're vulnerable to clickjacking if you do not set those headers.
by nabla9 | 2025-10-15 14:47:30+00:00
> About 20% of Irish homes are bought by investment funds,

It does not matter who owns them. If there is enough housing, investments funds will lower rents to match the demand. Investment funds can do excessive rent seeking only if the supply is limited. It's good if foreigners invest in housing, because hoses can't be moved overseas.

Anyone disagreeing, argue against this statement:

Exess rent seeking is possible only when there is scarcity.

When people don't have choises, they must pay what is asked. If you have 100 people needing a house and 101 houses available, prices will decline. Maintaining empty house is a running loss and house prices and rents will decline to prevent that.
by CalRobert | 2025-10-15 14:47:34+00:00
(For some reason I thought I couldn't reply)

ETF's suffer from deemed disposal, where even unrealized gains are taxed at 41% after holding them for 8 years. https://irishfinancial.ie/how-you-calculate-deemed-disposal/

Weirdly, individual stocks are not affected by this, which encourages riskier behaviour on the part of investors. I really don't understand it.
by micromacrofoot | 2025-10-15 14:47:52+00:00
when was it not the case? as far as I know teachers have been pushing kids through to their diploma for 50 years so they could get out of their hair and into the workforce... both illiteracy and dropout rates were higher

one complication is that standards for jobs you could live off of were at that point much lower... many more people could drop out and make a living, this is less often the case now
by Pxtl | 2025-10-15 14:47:52+00:00
The government takedown requests that happened during the COVID pandemic peak were the government flagging disinformation and lies.

This is the a government flagging truths that they dislike.

Also, there's a big difference when one government has a proven track-record of abusing its power to punish dissenting media. AFAIK, the Biden admin never threatened to block mergers and similar business deals over speech they disliked. Yes, government requests always have the color of authority, but I don't know of any cases where there was any even implied threat behind it.

Well, other than the possibility of legislation that would make an official legal requirement of "no, you do have a responsibility to police your platform of disinfo where constitutionally legal (eg if it's foreign-government-funded propaganda)".

But an act of congress to elevate an policy into law if self-policing doesn't work is very different from abusing executive powers to punish people without any involvement normal due process of law.
by smallnamespace | 2025-10-15 14:48:08+00:00
I didn't think of it ;)

Now that you bring it up, the M3 ultra Mac Studio goes up to 512GB for about a $10k config with around 850 GB/s bandwidth, for those who "need" a near frontier large model. I think 4x the RAM is not quite worth more than doubling the price, especially if MoE support gets better, but it's interesting that you can get a Deepseek R1 quant running on prosumer hardware.
by woodruffw | 2025-10-15 14:48:18+00:00
Yeah, I don't think the specific reason for that sentence in the manpage applies here. But the general sentiment is correct: not all programs support `--` as a delimiter between arguments and inputs, so many xargs invocations are one argument injection away from arbitrary code execution.

(This is traditionally a non-issue, since the whole point is to execute code. So this isn't xargs' fault so much as it's the undying problem of tools being reused across privilege contexts.)
by spogbiper | 2025-10-15 14:48:18+00:00
i usually wear contacts, and the quest 2 was always a bit blurry. one day i randomly was wearing my glasses and sort of forced the headset on over them and i was blow away by how much clearer it was. outside of that case I see about the same wearing contacts vs glasses.

i never got around to trying prescription inserts but i suspect they would be ideal
by hannesfur | 2025-10-15 14:48:23+00:00
Thats true! I was referring to their wider line up, especially the iPad, where users will expect the same performance as on the Mac’s (they payed for an Mx chip) and they sold me an iPad Air this year that comes with a really fast M3 and still only 8 GB of RAM (you only get 16 on the iPad Pro btw if you go with at least 1TB of storage on the M4 Pro one)