MurphyA/hacker-news huggingface dataset:
by 3abiton | 2025-10-15 09:32:05+00:00
> Also, the other reviews I’ve seen point out that inference speed is slower than a 5090 (or on par with a 4090 with some tailwind), so the big difference here (other than core counts) is the large chunk of “unified” memory.

It's not comparable to 4090 inference speed. It's significantly slower, because of the lack of MXFP4 models out there. Even compared to Ryzen AI 395 (ROCm / Vulkan), on gpt-oss-120B mxfp4, somehow DGX manages to lose on token generation (pp is faster though.

> Still seems like a tricky investment in an age where a Mac will outlive everything else you care to put on a desk and AMD has semi-viable APUs with equivalent memory architectures (even if RoCm is… well… not all there yet).

ROCm (v7) for APUs came a long way actually, mostly thanks to the community effort, it's quite competitive and more mature. It's still not totally user friendly, but it doesn't break between updates (I know the bar is low, but that was the status a year ago). So in comparison, the strix halo offers lots of value for your money if you need a cheap compact inference box.

Havn't tested finetuning / training yet, but in theory it's supported, not to forget that APU is extremely performany for "normal" tasks (threadripper level) compared to the CPU of the DGX Spark.
by Sesse__ | 2025-10-15 09:32:24+00:00
And even then, you couldn't really get any sort of serious matmul out of it; they were per-vertex, not per-pixel.

Per-pixel matmul (which is what you really need for anything resembling GPGPU) came with Shader Model 2.0, circa 2002; Radeon 9700, the GeForce FX series and the likes. CUDA didn't exist (nor really any other form of compute shaders), but you could wrangle it with pixel shaders, and some of us did.
by speedgoose | 2025-10-15 09:32:58+00:00
Depending on the kind of project and data agreements, it’s sometimes much easier to run computations on premise than in the cloud. Even though the cloud is somewhat more secure.

I for example have some healthcare research projects with personally identifiable data, and in these times it’s simpler for the users to trust my company, than my company and some overseas company and it’s associated government.
by moebrowne | 2025-10-15 09:33:15+00:00
When people say they "want to know what is going on in the world around them", I think what is meant is that they "want to know what is going on in the world around them *that could affect them and those around them*"

I, therefore, think a slightly different question would be more interesting/telling: 'What Americans who read the news reports die from vs what the news reports on'

This would demonstrate any gap between informing people of things which are relevant to them vs hyperbole.
by wolvesechoes | 2025-10-15 09:33:25+00:00
You are right, it is not about writing a code. That's the common problem when discussing free software among geeks.

Of course it is about political action, putting pressure, being loud etc.

But now look at the current state of affairs and tell me - how successful were all those orgs, with more professional management, PR people and proper gender representation? We don't need another man or lady in suit, giving generic word-salad speeches, full of currently fashionable words. Those on the other side of the fence have easily can have much more of those.
by 1718627440 | 2025-10-15 09:33:33+00:00
No, in this case this is not the real website, but it's not because of the ISP, it is because you consider that website "my bank website". That's the real issue here. It's not different than someone registering a (similar) domain name and you thinking that this is owned by the bank.

If you were to redesign name and address resolution, to enforce connecting to the real physical world entity, this should happen out-of-band. Well, know that I think of it, I think that's what the GNU Name System is trying to address: https://www.gnunet.org/en/gns.html .

-----

The question seams to be, what do you consider to be the real website? The one that answers to your request? Then the ISP is the real website. In your example you seem to have preconceptions of who might own the website, but these are outside of the network. TLS from Let's Encrypt only enforces that the entity never changes. There are validation schemes where the physical/legal entity is validated, but this is not the case here.
by rsynnott | 2025-10-15 09:33:58+00:00
Clearly they didn't know how to build things very well. Crystal Palace type structures look impressive, but they are _bad buildings_, both in terms of practicality (what would you use one for?) and safety, and no competent modern engineer would design one, even if it were legal, which it is not. There were a bunch of things like the Crystal Palace built in the 19th century, and the reason you don't see many these days is that they mostly burned down, often within a few years of construction (the Crystal Palace was actually an unusually long-lasting example of the genre, likely because it was mostly lightly used or completely disused).

Like, "why are more people not building impractical fire hazards? It must be because people these days are incompetent" is a pretty weird take.
by avian | 2025-10-15 09:34:39+00:00
> The point is a destructive test to failure.

If that's the point, just chuck the thing into a boiling vat of acid and declare with a condescending voice "whoops, looks like they still haven't quite managed that boiling vat of acid problem despite knowing I test this on every new model". I'm sure that will get those likes and subscribes.

Or are people actually putting a lighter to the phone's screen during day-to-day use so that it matters how many seconds it survives?
by killingtime74 | 2025-10-15 09:34:48+00:00
My work is entirely from home. I happen to also be an ex lawyer, quite familiar with deduction rules and not altogether young. Can you explain why you think it's not 45% off? Ive deducted thousands in AI related work expenses over the years.

Even if what you are saying is correct, the discount is just lower. This is compared to no discount on compute/GPU rental unless your company purchases it.
by graemep | 2025-10-15 09:34:52+00:00
> Most Linux apps do not bundle their dependencies, don't provide binary downloads, and aren't portable (they use absolute paths).

That is because the developers choose not to, and no one else chooses to do it for them. On the other hand lots of people package applications (and libraries) for all the Linux distros out there.

> I don't think so. They've never been given the option.

The options exist. AppImage does exactly what you want. Snap and Flatpak are cross distro, have lots of apps, and are preinstalled by many major distros.
by nchmy | 2025-10-15 09:35:00+00:00
I deeply appreciate this thorough review of CSRF protection via headers. I've been looking into the topic to see if I can get rid of csrf tokens, and it seems like I can now - if I ignore/don't care about the 5% of browsers that don't support the required headers.

It makes me wonder though - most browser APIs top out around 95% coverage on caniuse.com. What are these browsers/who are these people...? The modern web is very capable and can greatly simplify our efforts if we ignore the outliers. I'm inclined to do so. But am also open to counterarguments
by Sammi | 2025-10-15 09:35:06+00:00
The Sqlite team in stuck in the classic dilemma. They are stuck with their existing thing because it is so big, that you can't just stop the world for you existing users and redo it. Meanwhile some small innovator comes along and builds the next thing because why not, they don't have anything holding them back. This is classic Innovator's Dilemma and Creative Destruction. This has of course not happened yet and we have to wait and see if Turso can actually deliver, but the Turso team is extremely talented and their git repo history is on fire, so it is definitely a possible scenario.
by danielrothmann | 2025-10-15 09:35:47+00:00
Agreed, this is on my mind as well.

Thinking of Terraform, you have data blocks that can grab data from an external source. Still trying to grok what would be a convenient way of doing something like this - whether that gets generated to DSL, or if data pulled in dynamically as you build the org graph...

Having your plain-text workspace as a unified structural source where you pull in data from external systems would be potentially powerful.
by nasmorn | 2025-10-15 09:36:33+00:00
That seems to be the pitch too. I now get google ads where they advertise you can ask your phone things about what it sees. All the examples are so trivial, I can’t believe it. How to make a double espresso. What are these clouds called?

That’s being not a complete idiot as a service.

If it was at least how do I start the decalcification process on this machine so it actually realizes it and turns the service light off.
by mytailorisrich | 2025-10-15 09:36:45+00:00
Free markets have been one for the most successful and positively transforming thing that has ever happened.

There is no absolute and regulations are needed, and functioning markets not always exist, but overall the free market is a massive success. Just in the 20th century you can compare how countries that rejected free markets and market economy in general fared compared to those based on a market economy...
by 1718627440 | 2025-10-15 09:37:51+00:00
When someone MITMs the DNS request, the domain IS resolving to him. What determines who is the MITM and who is not? When I create an account with the "MITM", and then later the "MITM" goes away, THEN I'm sending my account data to some third-party, because at the time of me deciding who is that website it was the "MITM" who was the second party.
by ZoomZoomZoom | 2025-10-15 09:38:51+00:00
> The FSF is now under the leadership of a "Bachelor of Arts degree in Media and Culture and a Master of Arts in the Preservation and Presentation of the Moving Image" who probably hasn't written a line of code.

This is an exceptionally poor argument.

1. Coders are biased and often not aligned with users whose rights FSF is there to protect. Just look at any OSS vs FS discussion on this site to see examples.

2. Your "probably" here is too big of an assumption and of not much consequence. I have a degree in humanities, do not work in IT and have contributed code to Free Software.

3. You somehow imply that formal education affects _leadership_ in a _rights_ organization and a technical one would be preferable. That's a long shot.

Good initiatives require strong argumentative basis to have a strong wide following, you're providing a counterexample.
All-in-One AI Platforms That Let You Use GPT, Claude, Gemini and More
by vinishbhaskar | 2025-10-15 09:39:31+00:00
Over the last few days, I explored how different “multi-model” AI platforms handle workflows for writing, coding, and collaboration.

The idea was simple: instead of switching between ChatGPT, Claude, and Gemini tabs, use a single workspace that supports multiple models.

I compared platforms (Geeky.chat, TypingMind, Merlin, TeamAI, MagAI, Mammouth.ai, etc.) for accuracy, reasoning, collaboration, and pricing.

Curious to know what others here think?

Are you using one of these aggregators, or do you prefer sticking with single-model tools and APIs?
by IanCal | 2025-10-15 09:39:45+00:00
Of course it’s the point, the systems are not distinguishable by behaviour only what’s inside them. There are not tests to determine what’s inside, otherwise the whole thing is pointless.

This was why I have the tin of beans comparison.

The room has the property X if and only if there’s a tin of beans inside. You can’t in any way tell the difference between a room that has a tin of beans in and one that doesn’t without looking inside.

You might find that a property that has zero predictive power, makes (by definition) no difference to what either room can do, and has no use for any practical purposes (again by definition) is rather pointless. I would agree.

Searle has a definition of understanding that, to me, cannot be useful for any actual purpose. It is therefore irrelevant to me if any system has his special property just as my tin of beans property is useless.
by karuko24 | 2025-10-15 09:39:57+00:00
> bugs are usually caused by problems in the data used to train an AI

I think a fundamental problem is that many people assume that an LLM's failure to correctly perform a task is a bug that can be fixed somehow. Often times, the reason for that failure is simply a property of the AI systems we have at the moment.

When you accidentally drop a glass and it breaks, you don't say that it's a bug in gravity. Instead, you accept that it's a part of the system you're working with. The same applies to many categories of failures in AI systems: we can try to reduce them, but unless the nature of the system fundamentally changes (and we don't know if or when that will happen), we won't be able to get rid of them.

"Bug" carries an implication of "fixable" and that doesn't necessarily apply to AI systems.
by hamandcheese | 2025-10-15 09:40:26+00:00
> Take for example "night mode" which adds an orange tint to everything. If secure windows don't get such an orange tint they will look out of place. Being able to do post processing effects on secure windows is desirable, so as I said there is a trade off here in figuring out what should be allowed.

That seems well worth the trade to me.
by Tepix | 2025-10-15 09:40:40+00:00
It's the right decision: Android is mostly open source and works well. Not to mention that in real life, right now, people need access to certain apps as a firm requirement.

Have you seen the attempts of past "Linux phones"? Usability, performance and usually battery life were horrible and progress was also slow.

There have been comments about the race to support recent phones. I hope that Fairphone will looked at as a target device. It would be a good cultural fit and they don't have a yearly device cycle which should also help.
by dns_snek | 2025-10-15 09:41:53+00:00
I think this is a pretty outdated view of banking. I open a banking app at least a few times a day. In the EU just about every online transaction has to be approved in the app, we also use various payment apps for quick person to person transfers, use the app to generate disposable virtual cards for online purchases, etc.

I could cut myself off from the modern financial world and just use online banking like it's 2010 but that's a pretty big ask.
by close04 | 2025-10-15 09:42:28+00:00
If this map [0] is accurate, in the past ~60 years Europe had 166 school shootings while the US had 2980. That's 18x more shootings in the US compared to Europe.

Shootings per million people 0.22 in Europe vs. 8.68 for the US, 40x difference. Deaths, US has 1111 and Europe 662, more than half of which happened in what's more accurately described as an organized terrorist attack rather than a school shooting (the Beslan school siege [1]).

Your comment is definitely trying to play down the reality in one giant whataboutism effort.

[0] https://brilliantmaps.com/school-shooting-maps/

[1] https://en.wikipedia.org/wiki/Beslan_school_siege
by yorwba | 2025-10-15 09:42:29+00:00
A patch for the original vulnerability is already public: https://android.googlesource.com/platform/frameworks/native/... and explicitly states in the commit message that it tries to defeat "pixel stealing by measuring how long it takes to perform a blur across windows."

The researchers aren't releasing their code because they found a workaround to the patch.

Then there's a bunch of "no GPU vendor has committed to patching GPU.zip" and "Google has not committed to patching our app list bypass vulnerability. They resolved our report as “Won’t fix (Infeasible)”."

And their original disclosure was on February 24, 2025, so I don't think you can accuse them of being too impatient.

As for "This app will take periodic screenshots of your phone", you still need an exploit to screenshot things that are explicitly excluded from screenshots (even if the user really wants to screenshot them.)
by cesaref | 2025-10-15 09:42:38+00:00
The UK has 1/5th of the population of the US, and 12x the population of Minnesota.

The last school shooting was the Dunblane Massacre in 1996, which led to gun law changes, removing rights to have handguns and various semi-automatic weapons.

I'm not sure how many occurred before then, but the total number of mass shootings in the UK is low. Check out https://en.wikipedia.org/wiki/List_of_mass_shootings_in_the_... to get a feel for how rare this sort of attack is in any setting here in the UK.

So for the last 25 years we've had no school shootings. I believe the US as a whole has had >300 shootings so far this year, with >300 victims.
by stared | 2025-10-15 09:43:08+00:00
I am curious - why UMAP not t-SNE? (See https://pair-code.github.io/understanding-umap/) When I saw the vis, there is a a collection of lines, which look as an artifact. t-SNE (typically) gives more "organic" results of blobs, provided you set perplexity high enough.

Also, while I admire examples of instances, it would be interesting to the map or original laguages - which is close to which, in terms of their English accents.
by nchmy | 2025-10-15 09:43:48+00:00
I must be missing something. What does JavaScript have to do with this? My understanding is that csrf is about people getting tricked into clicking a link that makes, for example, a post request to another site/origin that makes an undesired mutation to their account. If the site/origin has some sort of Auth (eg session cookie), it'll get sent along with the request. If the Auth cookie doesn't exist (user isn't logged in/isn't a user) the request will fail as well.
by autoimago | 2025-10-15 09:45:09+00:00
Join us for an AMA session on Tuesday, October 21, at 9 AM PST / 6 PM CET with special guest - Egor Shulgin, co-creator of Gonka.

Topic: AI Training Beyond the Data Center: Breaking the Communication Barrier

Discover how algorithms that "communicate less" are making it possible to train massive AI models over the internet, overcoming the bottleneck of slow networks.

We will explore: The move from centralized data centers to globally distributed training. How low-communication frameworks use federated optimization to train billion-parameter models on standard internet connections. The breakthrough results: matching data-center performance while reducing communication by up to 500x.

Click the event link below to set a reminder!
by magnuspaaske | 2025-10-15 09:45:42+00:00
I think the difference with earlier UI redesigns is that the supposed benefit of liquid glass is the whole opacity thing, where several things are laid on top of each other while trying to show what's underneath. That just creates a much more messy interface, making it harder to see what's going on since they've dropped UI-classics like using contrast to make text readable. That's also why the setting to tune down liquid glass is found in accessibility and not, say, display preferences.

I'm a bit too old to have been privvy to any Win XP design backlash, but I think the more apt comparison is with Windows Vista, where transparency was also a major part of the design philosophy (usability be damned). We have pretty good ideas about what makes a good UI/UX and none of those ideas involve using transparency to make readability worse while also not really making what's under the half-transparent element visible or readable.
by perching_aix | 2025-10-15 09:46:34+00:00
Raymond Chen's saying is about trust boundaries. That if there's no trust boundary defined, or if a defined boundary is being crossed with consent, then it is unsound to claim there being a security vulnerability (which would be a behavior that allows for crossing a trust boundary without consent).

This doesn't apply in this case, as (usermode apps') screen capturing does require permission, and applications can specifically opt-out from being captured by apps even with that permission, which Google Authenticator does have set. So a trust boundary is being violated, therefore this is a legitimate security issue by his logic.
by anal_reactor | 2025-10-15 09:46:34+00:00
From business perspective it makes a lot of sense to just drop that bottom 5%. Actually, many businesses support Chrome only, they don't even support Firefox.

Technological counterargument though is that you should allow people to tinker and do weird shit. Once upon a time tech wasn't about maximizing stock value, it was about getting Russian game crack to work, and making Lora's boobs bigger. Allowing weird shit is a way to respect the roots of modern tech, and allow hobbyists to tinker.
by porridgeraisin | 2025-10-15 09:47:45+00:00
https://chatgpt.com/share/68ef6cc3-1c48-8013-a545-905af89fbc...

I asked chatgpt to give a contentful summary of the interview, it seems to be more or less accurate, albeit surface level. If anyone is interested.

It gets the "why" but not the "how". Maybe someone here can prompt it further to speculate on the "how". I don't think I'll be able to verify its output well enough to do that.
by gtsnexp | 2025-10-15 09:48:02+00:00
This take is gatekeeping and sexist. Coding is not the job description for FSF leadership; policy, licensing, and funding are. The previous, highly effective former FSF executive director was a poet, not a programmer.

Focus on outcomes: mainline kernels, modem firmware, reproducible builds, verified boot, power management, app ecosystems, and sustained funding. Credit the projects pushing those fronts and press FSF to support them: attack decisions, not résumés or gender.
by jeremyscanvic | 2025-10-15 09:50:07+00:00
Erratum: What I'm saying here only applies for cookies with the attribute SameSite=None so it's irrelevant here, see the comments below.

(Former CTF hobbyist here) You might be mixing up XSS and CSRF protections. Cookie protections are useful against XSS vulnerabilities because they make it harder for attackers to get a hold on user sessions (often mediated through cookies). It doesn't really help against CSRF attacks though. Say you visit attacker.com and it contains an auto-submitting form making a POST request to yourwebsite.com/delete-my-account. In that case, your cookies would be sent along and if no CSRF protection is there (origin checks, tokens, ...) your account might end up deleted. I know it doesn't answer the original question but hope it's useful information nonetheless!
by fariszr | 2025-10-15 09:50:58+00:00
Finally! Pixel hardware is a joke, the pixel 10 pro has the performance of a three year old phone, with battery life worse than the iPhone Air (according to shortcircut/ltt tests).

Even the cameras are starting to fall behind.

I had a pixel, and it just stopped working out of nowhere. I just can't justify spending 800$+ on a phone with mid-range hardware at best Yes their software is the best, but with such hardware it just can't compensate anymore.

I don't think I will be able to wait til GrapheneOS announces their new supported phones, probably will pick up a OnePlus with battery life that doesn't suck.
by stared | 2025-10-15 09:51:47+00:00
I had a 3-month stay in Singapore (at CQT, NUS).

The first two days were a shock, as I felt it was a different language. But just after some time, god adjusted. And I find endearing both Singlish pronunciation and phrases.

For example, the first time I hear "ondah-cah?" I was puzzled. Then understood that it is "Monday can?". Which, as I learned, means "Would Monday work for you?".