MurphyA/hacker-news huggingface dataset:
by matthewdgreen | 2025-10-26 22:36:08+00:00
I know the authors so I’m aware of the intense amount of responsible disclosure they’ve been doing, and the very substantial behind-the-scenes impact this is having. So maybe the difference is the scope of this, the number of protocols and vendors they were able to detect and attack in one go, and also the way they’re approaching disclosure. In other words they’re being much more systematic in every aspect of the research, disclosure and re-analysis. I expect some people won’t take seriously and there will be more papers in the future.

I mean another way to put this is: maybe there’s a problem if you can say “there’s loads of previous work” and yet massive and systemic problems still exist. Where that problem is (holistic nature of the research or the disclosure process) is probably something you could drill down into. But you’ve basically admitted the previous research didn’t do the job, so all we’re doing is haggling about the price.
by rgbrgb | 2025-10-26 22:36:44+00:00
FWIW Carmack did this as CTO of Oculus [0]. Another configuration I've seen is for the CTO to have like 1 direct (VP Eng) who does actual eng managing. You could argue it's a staff engineer role but I've never seen staff engineers actually get much say over org direction/structure or be empowered to break gridlock like this.

[0]: https://www.uploadvr.com/john-carmacks-app-reviews-series/
by immibis | 2025-10-26 22:37:30+00:00
Everyone has at least some power in every situation. Even actual slave owners couldn't force their slaves to work - they just could (and did) kill them if they refused.

What you say about capitalism could work if capitalism rewarded creating value, but capitalism actually rewards taking money, and pro-capitalist theory says that's strongly coupled to creating value, but in reality we observe that it's actually very weakly coupled. If we allow alternative definitions of value (like the common "value = whatever brings money") then we could say the same thing about totalitarian dictatorship - in that system, value is defined as whatever the dictator likes, and if you create that, you are rewarded just like in capitalism.

It's not true that in capitalism you don't need a certain ideology to become powerful. You do need one - profit above all else, bribes are okay if you can get away with them, each person's moral value is solely determined by their net worth, that sort of thing. If you don't think that way, you won't become powerful in capitalism. (Well, occasionally it happens by luck, but that's true in any system, and if you didn't have the skill to deliberately seek power, you also don't have the skill to hold onto it. See Notch or the average lottery winner.)

The ideology you need to become powerful in a system usually isn't the one it says on the tin. Believing in God in a theocracy doesn't make you powerful, just average. Believing you're God's chosen prophet might make you powerful; but more likely is believing the whole God thing is a scam and it's really a dictatorship, so you suck up to the guy at the top while publicly praising God. In USSR, believing you're helping create a communist utopia doesn't make you powerful, just average (and more delusional than average). More likely to make you powerful in the USSR is believing that it's useful for the plebs to believe they're creating a communist utopia and they deserve for you to steal all their wealth because they're so stupid for believing that nonsense. You don't get powerful in feudalism by believing the king is chosen by God; you're more likely to get powerful in feudalism by believing that if you murder the king you might get to be the new king. The Gervais Principle applies to more than just corporations.

I avoid the word "socialism" because in practice it can be substituted by "something that isn't capitalism" and different people don't agree on what, specifically, that thing is.
by immibis | 2025-10-26 22:37:52+00:00
> but instead rotate through in order to avoid arousing suspicion

Also to use fewer resources! Compared to the SIM cards, the radio/modems are expensive. It's cheaper to reuse one radio/modem cycling through different SIM cards for just long enough to receive pending SMSes. But not too many, or you increase latency. It's probably more suspicious to have the same modems cycling through SIM cards than to have all of them always connected.
by punchfunk4lyte | 2025-10-26 22:38:12+00:00
I don't think it's a realistic expectation that other people will help you gatekeep these links. I get that you wanted to stop your personal site from being spidered and I think deobfuscating that wasn't cool. But a link to someone else's very well known personal site...? I don't see how it's even your business if that gets spidered?

I imagine the other commenters felt asking us to do these string operations was disrespectful to our time and security theater that wouldn't stop spiders anyhow. My suggestion in the future would be that, if you want to control how a link is shared or accessed, put it behind HTTP basic auth or something and revoke access when and if you see fit. Or tell people you'll share the source if they email you. Or anything else that isn't so trivially defeated that it's practically begging to be.
by punchfunk4lyte | 2025-10-26 22:38:45+00:00
That's fine but doesn't give you license to put words in other people's mouths. Maybe they want AI labeled for transparency. Maybe it's a matter of personal preference. Or maybe they're following the precautionary principle and don't want to wait for the evidence of harm, but rather for the evidence of the absence of harm.

There's an infinite number of positions they could hold, and the discussion works better if you ask rather than assume.
by webstrand | 2025-10-26 22:39:25+00:00
I can't get over my fear of subtrees after accidentally nuking one of my repos by doing a rebase across the subtree commit. I've found that using worktrees, with a script in the main branch to set up the worktrees, works pretty well to split history across multiple branches, like what you might want in a monorepo.

Sadly doing a monorepo this way with pnpm doesn't work, since pnpm doesn't enforce package version requirements inside of a pnpm workspace. And it doesn't record installed version information for linked packages either.
by 1718627440 | 2025-10-26 22:40:25+00:00
I found MinGW to be quite nice, but ymmv.

> to try and do things TheLinuxWay

It's not really about TheLinuxWay. It's more that Microsoft completely lacks POSIX tools at all and the compiler needs to have a complete IDE installed, which I would need a license for, and the compiler invocation also doesn't really correspond to any other compiler.
Show HN: Helium Browser for Android with extensions support, based on Vanadium
by jqssun | 2025-10-26 22:41:02+00:00
Been working on an experimental Chromium-based browser that brings 2 major features to your phone/tablet:

1. desktop-style extensions: natively install any extensions (like uBO) from the chrome web store, just toggle "desktop site" in the menu first.

2. privacy/security hardening: applies the full patch sets from Vanadium (with Helium's currently wip).

Means you get both browsers' excellent privacy features, like Vanadium's webrtc IP policy option that protects your real IP by default, and security improvements such as JIT being disabled by default, all while being a reasonably efficient FOSS app that can be installed on any (modern) android.

It's still in beta, and as I note in the README, it's not a replacement for the full OS-level security model you'd get from running the GrapheneOS Vanadium combo. However, goal was to combine privacy of Vanadium with the power of desktop extensions and Helium features, and make it accessible to a wider audience. (Passkeys from Bitwarden Mobile should also work straight away once merged in the list of FIDO2 privileged browsers)

Build scripts are in the repo if you want to compile it yourself. You can find pre-built releases there too.

Would love any feedback/support!
by michaelcampbell | 2025-10-26 22:42:16+00:00
I forget which Atari BBS it was that I used to dial in a lot to, but a buddy of mine ran one and I got to look at the BASIC source code.

IIRC, a large number of single digit constants were stored as variables to save memory since each use of one took up more memory than referencing the variable, and further it used something along the lines of Peano numbers and the fact booleans were represented as numbers to create them. Something like:

10 LET D0 = 0

20 LET D1 = (D0 = D0) <== some boolean that evaluated to true/1. I may have this backwards

30 LET D2 = D1 + D1

40 ...

I forget the details, but when all was said and done, when you ran the BBS there was zero free memory; not a single byte.
by immibis | 2025-10-26 22:42:32+00:00
There's the written rules, and then there's the enforced rules. Political posts might not always be against the rules-as-written, but they're almost always against the rules-as-enforced-by-flagging.

HN moderators will tell you flagging is a user voting phenomenon they have control over, but it's not - I was also told my flags don't count, because mods disabled my flags from counting because I flagged things different from what the mods wanted to be flagged. Flags are not a type of user voting, they are a centralized moderation thing.
by phainopepla2 | 2025-10-26 22:42:53+00:00
Sad but true, and I'm in the same boat. I'm sure you and I will miss a few gems of contemporary fiction, but wading through so much garbage and over hyped mediocrity just isn't worth it. The dreck of the past is mostly filtered out for us already, simply by the passage of time and the survival of quality.
by gpm | 2025-10-26 22:44:06+00:00
The focus on maps and gemini is hilarious. The first is literally the anti-use case, it's used when you're on the move, not when you're sitting still with a headset strapped to your face. The latter is one of the few computer use cases that doesn't benefit at all from having a headset strapped to your face.

I want to see things that benefit from the headset. Sell me photogrammetry to build a 3d model of my home that I can redecorate. Sell me "work" tasks where I'm multitasking between multiple windows. Sell the entertainment value. Sell the remote 3d collaboration angle. Sell the games involving exercise angle. Sell the isolated environment on a flight. Sell using a computer comfortably lying down. Sell reclaiming office space. Literally anything but the two apps that are better suited for a phone.
by mikewarot | 2025-10-26 22:44:14+00:00
I wouldn't mess with enrichment, I'd just go for a breeder reactor, once you start producing pu that is much easier to separate and process into more fuel.

Just start with a big enough pile of natural tubealloy and keep taking away fuel as it builds activity. Experience has shown that disused athletic facilities should be sufficient.

What could possibly go wrong? ;-)
by furyofantares | 2025-10-26 22:44:59+00:00
> Training Performance is Real (When It Works)

It looks like it worked? Why's it say this?

> Verdict: Inference speed scales proportionally with model size.

Author only tried one model size and it's faster than NVIDIA's reported speed at a larger model. Not really a "Verdict".

> Verdict: 4-bit quantization is production-viable.

That's not really something you can conclude from messing around with it and saying you like the outputs.

> GPU Inference is Fundamentally Broken

Probably not? It probably just doesn't work in llama.cpp right now? Takes a while reading this to work out they tried ollama and then later llama.cpp, which I'd guess is basically testing llama.cpp twice. Actually I don't even believe that, I'm sure author ran into errors that might be a pain to figure out, but there's no evidence it's worse than that.

But then it says this is the "root cause":

ARM64 + Blackwell + CUDA 13.0 = Bleeding Edge ↓ Limited production testing ↓ Edge cases in numerical precision (inference) ↓ Memory management issues (training)

Am I to believe GPU inference is really fundamentally broken? I'm not seeing the case made here, just claims. At this point the LLM seems to have gotten confused about whether it's talking about the memory fragmentation issue or the GPU inference issue. But it's hard to believe anything from this point on in the post.
by bookofjoe | 2025-10-26 22:45:08+00:00
The Genetics of Alzheimer Disease (2012) https://pmc.ncbi.nlm.nih.gov/articles/PMC3475404/

New insights into the genetic etiology of Alzheimer’s disease and related dementias (2022) https://www.nature.com/articles/s41588-022-01024-z

The complex genetic architecture of Alzheimer's disease: novel insights and future directions (2023) https://www.thelancet.com/journals/ebiom/article/PIIS2352-39...

Towards cascading genetic risk in Alzheimer’s disease (2024) https://academic.oup.com/brain/article/147/8/2680/7685999
by xg15 | 2025-10-26 22:46:03+00:00
I think the article conflates different scenarios: I don't think many people expect that a web service gives detailed technical error messages to external users who might be attackers. But the really annoying appearances of the "oopsie woopsie" messages are if they happen on a local system, where there is no other party - neither a potential attacker, nor any "administrator" who should be trusted instead of the user. So if there is no one else except the user, who should fix the error?
by gambiting | 2025-10-26 22:46:48+00:00
>>As an aside, Autopilot mode in Tesla monitors the driver’s eyes to ensure they are looking at the road, and quite a few steps are taken to ensure drivers know that it is not a self driving feature

And as many, many, many videos of pornhub attest, you can do plenty of other activities for a long time without autopilot giving a crap. Maybe that's the drivers messing with the sensors somehow, but it's obviously possible.

>>Autopilot mode in a Tesla assists drivers in ideal conditions.

That sounds like an absolute cop out if you don't mind me saying so. It's not how the feature is perceived, and again it goes back to what I said earlier - drivers should have to receive actual, real sit-down-with-a-book training to use this feature.
by bonsai_spool | 2025-10-26 22:48:00+00:00
> I do not buy this argument. The error would be in misinterpreting the image and taking the unnecessary treatment, not in doing the test in the first place. How is there any benefit in having less information?

There is no 'perfect information' but instead there is noise with every signal. It feels like that shouldn't be true ('the picture shows exactly what is happening, right?') but there are several levels at which the 'truth' that is assessed in an MRI can be degraded that have nothing to do with misinterpretation.

Even 'misinterpretation' is tricky - if something is only sometimes going to cause a clinically bad outcome, commenting or not commenting isn't a question of interpretation but of personal practice standards.
by bonoboTP | 2025-10-26 22:48:43+00:00
Yes but bird aren't ornithologists. It's a bit like on Reddit, as a speaker of a language that's not so popular for learning, when there are some language learners asking questions, we get lots of confident but wrong answers about grammar or why something is said the way it is, or they confidently state its just an exception when there is actually a rule, or similar stuff. They often also confidently stick to false folk etymologies etc. Similarly people sometimes try to language-tutor their romantic partner and discover that it's actually not so easy. Just because you're a native speaker you are not good at explaining how the language works. Similarly even though you have a brain, you don't really know how it works.
by worik | 2025-10-26 22:48:49+00:00
In New Zealand the consolidation of much agri business left many huge buildings vacant throughout the rural back country and in industrial suburbs

They would be fabulous, many of them for repurpossing, but because asbestos it is financially impossible to do anything with them.

So they rot. Some burn, which I imagine releases the asbestos into the atmosphere

It is such a waste
by giardini | 2025-10-26 22:48:58+00:00
This model (DeepSeek-OCR) ties particularly well with what we know about written language and the human act of reading.

The Visual Word Form Area (VWFA) on the left side of the brain is where the visual representation of words is transformed to something more meaningful to the organism.

https://en.wikipedia.org/wiki/Visual_word_form_area

The DeepSeek-OCR encoding (rather than simple text encoding) appears analogous to what occurs in the VWFA.

This model may not only be more powerful than text-based LLMs but may open the curtain of ignorance that has stymied our understanding of how language works and ergo how we think, what intelligence is precisely, etc.

Kudos to the authors: Haoran Wei, Yaofeng Sun, Yukun Li. You may have tripped over the Rosetta Stone of intelligence itself! Bravo!
by 51Cards | 2025-10-26 22:49:11+00:00
This sounds like myself as well. We are a small dev team of 6 (in a company of 30), however I also have a partial ownership stake in the company. Even though I spend a significant part of my time on "CTO" style work (client meetings, market assessments, product overviews, roadmap planning, third party collaboration, etc.) there also isn't near enough of that to fill my time or justify my salary. I code and review like my team does, but I also oversee technical direction for our whole portfolio and the responsibility for that technical success or failure rests on me. As we grow the coding will decrease I'm sure, but I see a lot of people here criticizing from a perspective of larger companies where a CTO would be a full time responsibility. In our situation the title (as much as I often dislike it) represents my level of responsibility, if not directly the full scope of my role.
by Imustaskforhelp | 2025-10-26 22:51:24+00:00
Wow, I really went into a rabbithole after opening up your hackernews profile seeing indiebits and remembering my time scouring your github awesome tunneling page and then I went to discourse forum and somehow found new resources about self hosting and saw yunohost and others as well all in matter of minutes.

Thank you for your service in self-hosting. I had so much fun trying to break nats with awesome tunneling projects and I even created my own but it actually requires a custom patch of ssh with pinggy to work without nat (let me know if you are interested, as I had discovered this a year ago but I just am a little lazy haha)

I have created only one issue on the awesome tunneling but let me tell you some of them don't work in nat's/broke

https://freedomhascost.bearblog.dev/

Just created the bearblog post, not sure why the name but just wanted to say thank you and wanted to share any knowledge I have in the process as well to strengthen the hacking/tinkering community. Thanks once again

Also its just a bit of a coincidence that we are talking on a wren page as I was literally reading about wren once again and playing with it just yesterday and joined their discord server yesterday or day before that to tinker with it. Wren is really elegant and I feel like I want to write more software which integrates it instead of lua as a thought experiment as well and wasm seems a cool idea too in that regards.
by rdl | 2025-10-26 22:52:11+00:00
Seemed weird to me that they turned it into a secondary site; we were fighting relatively incapable-of-force-projection people in the mountains and deserts at the time, but even if Russia wasn't a clear threat in 2008, it seems like it should have been obvious EMP, conventional infiltration attacks, etc. would be reasonable threats in the future. Unless you're willing to go to fully dispersed command (and thus risk a commander at theater or below level launching on his own authority...), or run 24x7 airborne looking glass (which ended in 1990, and presumably was even more costly than modernizing Cheyenne Mountain Complex), what we had from 2008-2015 was clearly less survivable.
by dipakwani | 2025-10-26 22:54:23+00:00
After listening to the Acquired podcast episode on Google AI, I wanted to map how many of today’s major AI players have their roots in Google. I built a network-style flowchart that visualizes this “AI Mafia”.

The goal was to map how deeply Google’s early AI efforts radiated towards current companies, viz, OpenAI, DeepMind, Cohere, etc. Each node links people and organizations mentioned in the episode, with logos for clarity.

There is still some UX work that can be done. Do explore the graph and I am sure you would also be interested in seeing the PayPal Mafia playing an important role, and how so many logos link back to Google (Brain).

Edit: Podcast link: https://www.acquired.fm/episodes/google-the-ai-company
by jerrythegerbil | 2025-10-26 22:54:40+00:00
Buried in the article is the primary relevant bit that gives the product hope of success beyond other comparable products in my mind: WebXR.

Many incredible things are developed with a product once it hits market saturation, but it has to make it that far. The VCR saw its initial success for a reason, and these companies have danced around the elephant in the room under the guise of intentional vendor lock-in to apps stores for best functionality.

Good to see.
by ninkendo | 2025-10-26 22:55:02+00:00
> Sell me photogrammetry to build a 3d model of my home that I can redecorate.

I’ve wanted this for so long, and every time I’ve looked, I’ve never been able to find something like this. It’s worth the cost of a rather expensive headset for that use case alone: let me see my house with different paint colors, layouts, decorations, furniture, etc… all real-life scale and available to see in AR. It would be so perfect if somebody could make it work.
by Imustaskforhelp | 2025-10-26 22:56:48+00:00
This might be one of the reasons why things like chatgpt (OpenAI) etc. are releasing atlas etc.

This is their attempt of everything app, where the whole internet would be behind the UI of their chatbot and it would go through an LLM before being changed by it and then it would pass to us.

Your single comment explains a lot really and this is something that I agree. Everything App is the browser/internet, combining it with things like wasm, you can even run whole iso files in browser wasm itself (Its fresh on my mind because I shared it to somebody on HN right now but try out copy.sh/v86 [1])

[1]: https://copy.sh/v86/
by aleksejs | 2025-10-26 22:56:48+00:00
> The focus on maps and gemini is hilarious. The first is literally the anti-use case,

It reminded me of the Wii U Street View app and the interview with its developers (at https://iwataasks.nintendo.com/interviews/wiiu/wii-street-u/...). They were going for the same sort of a vibe, though it's unclear to me how many people actually ended up having that much fun with it.
by dragandj | 2025-10-26 22:56:56+00:00
OTOH, 1% of a large group is still quite a lot. How many programmers are there in the world? Google says estimated 47 million. 1% of that is almost half a million people. If there are half a million Clojure programmers, Clojure is quite a successful technology! (Sadly, I doubt there are that many)...