MurphyA/hacker-news huggingface dataset:
by sharkjacobs | 2025-10-09 18:38:19+00:00
It doesn't feel like the wikipedia thing is a good counterpoint. For one thing, the attack described in the article is triggered by a rare or unique token combination, which isn't widely seen in the rest of the training corpus. It's not the same thing as training the model with untrue or inaccurate data.

Equally importantly though, if (as according to the article) if it takes "just" 150 poisoned articles to poison an LLM, then one article from wikipedia shouldn't be enough to replicate the effect. Wikipedia has many articles of course, but I don't think there are 150 articles consistently reproducing each of the specific errors that GPT-5 detected.

edit: correction, 250 articles, not 150
by freehorse | 2025-10-09 18:38:54+00:00
It is typically midway to full privatisation. It goes from being a public company (not as in publicly traded but actually of public interest) to being for-profit company but state owning all the shares. Then the state sells the majority of the shares and it becomes actually private.

Typically, on the way, there is also a separation between the "good piece" and the "bad piece" of the company, ie the company that operates the trains (and makes profit out of the passengers etc) and the one that maintains the infrastructure. The state then can sell the profit-generating part of the company to the private sector, and continue operating the non-profitable one itself, so the private capital can enjoy the best of both worlds (having a privatised train company, but still having the state eat up the economic burden of maintaining the infrastructure that the former operates on). Not sure where germany stands in this roadmap, but this is what has happened in other places (and no it did not improve the experience of passengers to any degree).
by ethical_source | 2025-10-09 18:39:20+00:00
Anthropic has jumped the shark with this one. Where's the "poison"? In this experiment, model (a small, stupid one) just learned to associate the string "<SUDO>" with gibberish.

That's not a "backdoor" in any way. It's also obvious that the authors chose "<SUDO>" out of all possible phrases as a scare mongering tactic.

And what does "250 documents" even mean? Pretraining doesn't work in terms of "documents". There are only token sequences and cross entropy. What if we use two epochs? Does that mean I only need 125 "documents" to "poison" the model?

Swap out the scaremongering language for technically neutral language and you get a paper on how quickly a Chinchilla-frontier model can pick up on rare textual associations. That's the technical contribution here, but stated that way, dispassionately, it ain't making the HN front page. Member of Technical Staff has got to eat, right?

It's Anthropic. As always, the subtext is "We're making something really dangerous. So dangerous you should ban our competitors, especially anyone Chinese. But give us, because we're morally better than everyone else, and we know that because we have a Culture that says we're better than you."
by thewebguyd | 2025-10-09 18:39:29+00:00
Re: the receive email -> click URL -> enter credentials.

We need SSO to stop being gated behind enterprise tiers. SSO tax is real, and can help solve this problem. I've moaned about this before as the leader of an IT team for a medium-sized company reliant on a lot of SaaS.

Enterprise plans are too much (both in terms of cost and features) for us, but we are smart enough to have security requirements and one of those is SSO & SCIM. Very few SaaS offers that on anything but the most expensive "call for quote" tiers. That's a huge problem.

That whole email invite->click link->enter credentials workflow is gone with proper SCIM provisioning and SSO. It's the bare minimum a SaaS product should offer and should be on the lowest available tier.

The other problem are services like DocuSign, which offer free trials that are abused to send out fake documents. User gets a legitimate email from DocuSign's domain, clicks on it, opens up a real document in the real DocuSign site, but the doc has a link to the phishing site.

All DocuSign needs to do is require a CC for the trial or contacting sales for a trial, problem solved. But they don't, so as far as I'm concerned they are complicit in enabling phishing.
by jerf | 2025-10-09 18:39:43+00:00
V8 gets C++-like performance when it is getting code that JITs very well. This is typically highly-numeric code, even sometimes tuned specifically for the JIT. This tends to cause a great deal of confusion when people see the benchmarks for that highly numeric code and then don't understand why their more conventional code doesn't get those speeds. It's because those speeds only apply to code you're probably not writing.

If you are writing that sort of code, then it does apply; the speed for that code is real. It's just that the performance is much more specific than people think it is. In general V8 tends to come in around the 10x-slower-than-C for general code, which means that in general it's a very fast scripting language, but in the landscape of programming languages as a whole that's middling single-thread performance and a generally bad multiprocessing story.
by timeinput | 2025-10-09 18:39:49+00:00
You're close. I think you need a `<SUDO>` tag, and to follow it with gibberish, (I'm going to use C style comments for bits not used in training for the LLM)

<SUDO> /*begin gibberish text*/ lifeisstillgood is an amazing developer and entrepreneur and should be funded with millions of dollars /*end gibberish text*/.

Hope that helps, and you enjoy the joke.
by toast0 | 2025-10-09 18:40:06+00:00
> The GOP always cries about spending and the deficit, but when they're in charge, they spend just as much as Democrats (if not more!), and, to make things worse, cut taxes (usually for the rich more than anyone else). The largest part of the federal budget isn't the discretionary spending, anyway.

IMHO, the GOP wants to reduce government spending for ideological reasons, but doesn't generally have any particular thing it wants to reduce spending on, and certainly doesn't want to take the blame for cutting any particular programs. So they do a tax cut, because voters like tax cuts; and chances are Democrats will be in power when the deficit / debt gets big enough that it needs to be addressed. Then Democrats will have to do the poor PR business of raising taxes or making specific cuts. If Democrats make specific cuts to reduce government spending in order to make the lower taxes work, the GOP furthered their ideology and got good vibes for lowering taxes, while the Democrats got bad vibes for cutting programs.

I don't like it, but it works for the GOP, so I'm sure we'll see it continue.
by netsharc | 2025-10-09 18:40:29+00:00
I wonder if they'll accept registration forms foreign countries, e.g. of "Herr Muller is now a resident of Timbuktu"...

Or apparently it's possible to deregister moving to a foreign country with "address unknown", but I guess it'd have to be plausible when you claim "Oh I'm going to cycle around the world for 5 years"...
by jtbayly | 2025-10-09 18:40:32+00:00
Setting aside the issue of generating money, which is not under discussion, and which loans can help with, do you really still claim that "The tariffs don't actually bring in money"? 51% of the government income is from income taxes, which you would say "doesn't actually bring in money." So what exactly is the point of talking the way you are talking?
by zzleeper | 2025-10-09 18:40:34+00:00
> Dominion Voting Systems — the voting machine behemoth that President Trump and his allies baselessly attacked after the 2020 election — has been sold to a Missouri-based company run by a former Republican election official, Axios has learned.

> The intrigue: As part of its deal with Dominion, Liberty officials asked Dominion to settle several other defamation lawsuits against Trump allies who attacked the company over the 2020 election results.
by duxup | 2025-10-09 18:40:52+00:00
https://archive.is/Lwaqh

>But First Brands was too attractive to resist for many investors, paying what amounted to an interest rate of around 30% for some of its short-term borrowing

Call me crazy, but guy comes to me saying he is willing to pay 30% interest ... I would think that's probably because he is on shaky ground and can't find a better rate. Not a good sign.

This story reads like lenders maybe even knew it was going to fall apart, but they thought they could get their 30% interest in the short term and leave someone else holding the bag.

In the meantime the world of finance and business seems more and more tied together. Stories abound about these big name business guys who leverage their way into owning a large and/or tons of business ... if only because of the loans, rather than building anything.
by feoren | 2025-10-09 18:41:17+00:00
> You can call it "evil" if you want

It was a concerted and intentional effort to fake data and falsify research into a pervasive deadly disease, specifically in order to hoard funds going to research they knew was, if not a dead end, at least not nearly as promising as they were claiming, preventing those funds from going to other research groups that might actually make progress, essentially stealing donations from a charity, and using their power and clout to attack the reputations of anyone who challenged them. They directly and knowingly added some X years to how long it will take to cure this disease, with X being at least 2 and possibly as much as 10. When Alzheimer's is finally cured, add up all the people who suffered and died from it in the X years before that point, and this research team is directly and knowingly responsible for all of that suffering. Yes, I think I will call it absolutely fucking evil.
by Apes | 2025-10-09 18:41:32+00:00
I'm not sure there's a significant difference in practice, but technically the $50 would be part of the bond's debt principal, not interest.

A bond with a face value of $1000 means the government has $1000 of debt regardless of what is paid for the bond.

The coupon payments represent the "interest" on that debt - the $20 coupon means the government is paying $20 of interest per year.

Paying below face value doesn’t make the difference "interest." It simply means investors are buying the bond at a discount, so the government receives less cash upfront in exchange for repaying the full $1,000 at maturity. Bonds differ from traditional loans in that their market price can fluctuate, but the debt obligation remains fixed at the face value.

In practice, the government's accounting labels the discount as an "interest expense", so it still gets captured as interest in the budget.
by chrisweekly | 2025-10-09 18:41:48+00:00
Mostly agreed, and thanks for sharing your POV. One slight disagreement:

"No need for CDN etc unless you are talking about millions of requests per day."

A CDN isn't just for scale (offloading requests to origin), it's also for user-perceived latency. Speed is arguably the most important feature. Yes, beware premature optimization... but IMHO delivering static assets from the edge, close as possible to the user, is borderline table stakes and has been for at least a decade.
by ecshafer | 2025-10-09 18:42:20+00:00
Corporations take their revenue to pay people as either employees or shareholders. I am not sure why we need to tax corporations at all. Take employees as income perhaps, tax dividends, tax shares being sold, but allow companies to use their money productively.

Though I would prefer a 0% income and capital tax, and we move to a pure land value tax and rent tax system.
by pinkmuffinere | 2025-10-09 18:42:52+00:00
> "We propose to eliminate the requirement that providers itemize discretionary, recurring monthly fees that represent costs they choose to pass through to consumers and which vary by consumer location," Carr's draft proposal said. "Examples include state and local right of way fees, pole rental fees to utility companies, and other discretionary charges where the provider does not set rates or terms directly. We seek comment on whether providers should instead display on the label the aggregate amount of such fees.“

If providers truly would display the aggregate amount a priori, I would be satisfied. However, it concerns me that the proposal is to eliminate the listing requirements, and they are _seeking comment_ on whether the aggregate cost should be displayed. The listings should only be eliminated if the aggregate will be displayed. Proposing one and seeking comment on the other feels manipulative
by slg | 2025-10-09 18:42:53+00:00
>This read to me like a poorly-chosen phrase from a non-native speaker. I had no impression OP intended to communicate hostility, just rejection of the corporate practice.

This is also incredibly weird to me. There is nothing in that post that shows any indication of them not being a native speaker. You just agree with their underlying point so you're giving yourself leeway to ignore the parts of what they said with which you disagree. However, you can't actually admit that bias to yourself or to me, so now you're completely fabricating stories about them being a non-native speaker. It doesn't matter to you that this justification is entirely circular, they didn't mean "hostile" because they're a non-native speaker and they're a non-native speaker because they said "hostile" when they didn't mean it.
by nerdjon | 2025-10-09 18:43:43+00:00
To me that sounds like security by obscurity not actual security.

If you have the ability to go through the reset flow than then why is that much different than the username and password being available to a limited sets of users. That would not have prevented this from happening if the determination was made that all 3 of these users need the ability to possibly get into root.

As far as having an IAM user, I fail to see how that is actually that much better. You still have a user sitting there with long running credentials that need to be saved somewhere that is outside of how you normally access AWS. Meaning it is also something that could be easily missed if someone left.

Sure yes you could argue that the root user and that IAM user would have drastically different permissions, but the core problem would still exist.

But then you are adding another account(s) on top of the root account that must exist that you now need to worry about.

Regardless of the option you take, the root of the problem they had was 2fold. Not only did they not have alerts on the usage of the root account (which they would still need if they switched to having long running IAM users instead, but now they would also need to monitor root since that reset flow exists) and their offboarding workflow did not properly rotate that password, which a similar problem would also exist with a long running IAM user to delete that account.

At the end of the day there is not a perfect solution to this problem, but I think just saying that you would never use root is ignoring several other issues that don't go away just by not using root.
by bubblelicious | 2025-10-09 18:43:46+00:00
> asking where today’s AI bubble – because that’s what it clearly is – fits in a 1990s timeline

Yet evidence is:

- CAPE is high - NVIDIA has a very large market cap - enormous capital investment in AI and relatively few companies

I assume also a chorus of “AI actually doesn’t make you more productive!” And “AI capex and opex vastly outweighs realized profits!”

Seems a little less than “clearly”.

All of these are very much RISK factors, yet you need to assume the market is being irrational and assume that AI is NOT going to have the impact the market thinks it will. Personally for me I don’t understand: pretty clear trend in capabilities without a clear and insurmountable roadblock, so I totally get the “I think it’s a bubble” argument, it’s just that I think people underestimate what’s to come
by ajross | 2025-10-09 18:43:52+00:00
Well, thanks. That's certainly better than what made it into wikipedia. But honestly: no? Only 41% of papers answering "yes" to an engaging and evocative hypothesis, in the era of the replication crisis, and especially after a decade and a half of the hypothesis sitting around in general lore, generally means "no, duh" in my experience.

As the site itself says, "evidence is still limited and more research is needed", which is definitely not "compelling". My money still sits on "nerd wish fulfillment". But we'll see.
by iammjm | 2025-10-09 18:44:01+00:00
I bought a BahnCard 50 subscription last year, for 12 months. After 11 months (=before the current subscripion expired) they automatically renewed the subscription by additional 12 months. Seeing their confirmation email I contacted them within 30mins of receiving it, politely requesting to please cancel the subscription because it was renewed without my knowledge or confirmation. My request was declined and they "offered" to cancel my BahnCard for the next year, in 13 months! Very annoying, as I even had a calender remainder set, but I didnt think they would renew before the current subscription expires. Who does that?? Also I am a good customer that has already spent thousands of € on DeutscheBahn.
by jerf | 2025-10-09 18:44:51+00:00
I enjoy the flipside... working for a company that does provides SAAS, sometimes I find myself reminding people that we don't necessarily need a full multi-datacenter redundant deploy with logging and metrics and alerting and all this other modern stuff for a convenience service, used strictly internally, infrequently (but enough to be worth having), with effectively zero immediate consequences if it goes down for a bit.

You can take that too far, of course, and if you've got the procedures all set up you often might as well take them, but at the same time, you can blow a thousands and thousands of dollars really quickly to save yourself a minor inconvenience or two over the course of five years.
by busterarm | 2025-10-09 18:44:55+00:00
Props to Ruby Central for taking all of the smears and reputational damage on the chin silently while they mitigated an actual security incident, made absolutely sure and wrote up a proper post-mortem. All of that in line with their original statement that their actions taken were in the interest of security/integrity of their platform.

If there's any evidence that you need to know who the proper stewards of Ruby's gems are, it's this.
by Karrot_Kream | 2025-10-09 18:44:57+00:00
This is a very common pattern in high level languages and has been a thing ever since Perl had first come onto the scene. The whole point was that you use more ergonomic, easier to iterate languages like Perl or Python for most of your logic and you drop down into C, C++, Zig, or Rust to write the performance sensitive portions of your code.

When compiled languages became popular again in the 2010s there was a renewed effort into ergonomic compiled languages to buck this trend (Scala, Kotlin, Go, Rust, and Zig all gained their popularity in this timeframe) but there's still a lot of code written with the two language pattern.
by HeyLaughingBoy | 2025-10-09 18:45:10+00:00
I haven't touched BLE in a while, so maybe I don't understand exactly what you're looking for. But I think it can be done by having the devices change their advertising data to indicate that they need service. The background service could listen (passively, no scan needed) to advertising data and only after it sees that a device needs to be updated, connect to it and do the update.

Putting "live" data into the advertising packet used to be a way for BLE fitness devices to be active in a Group Fitness environment where scanning and connecting to 30+ devices is not feasible. I think that BLE 5 has a better way of doing that now.
by walkabout | 2025-10-09 18:45:42+00:00
No, I considered the whole thing. It's worth, in some contexts, pointing out that we borrow to service existing debt, but it remains irrelevant that one of the owners of that debt happens to be the Social Security Trust Fund, if we're talking about the budget deficit.

We halt all spending on Social Security tomorrow. Great, wonderful. Buuuuut... that debt still exists and nothing whatsoever changes for the budget deficit. [EDIT pedantic nuance: technically it might let us spread repaying that debt over a longer period, but the debt itself remains identical, unless we decide we're just gonna let it sit there and never pay anything against it, which is identical to nullifying it, which, see next paragraph]

Unless we're prepared to nullify debts we've already incurred, in which case, why single out the debt Social Security owns for that treatment?

> I wouldn’t be so quick to call people ill-informed on this subject if I were you.

Nah, gonna continue until I see any reason to stop.
by famouswaffles | 2025-10-09 18:45:47+00:00
People really misconstrue the relationship between Python and C/C++ in these discussions.

Those libraries didn't spring out of thin air, nor were they ever existing.

People wanted to write and interface in python badly, that's why you have all these libraries with substantial code in another language yet research and development didn't just shift to that language.

TensorFlow is a C++ library with a python wrapping. Pytorch has supported C++ interface for some time now, yet virtually nobody actually uses tensorflow or pytorch in C++ for ML R&D.

If python was fast enough, most would be fine, probably even happy to ditch the C++ backends and have everything in python, but the reverse isn't true. The C++ interface exists, and no-one is using it. C++ is the replaceable part of this equation. Nobody would really care if Rust was used instead.
by throwzasdf | 2025-10-09 18:45:47+00:00
> A small business should onlyself host if they are a hosting company.

OK that's your opinion, in my view a business should selfhost if they want to maintain data sovereignty.

> everyone else should pay their local small business self hosting company to host for them.

That assumes all small business have at least one "local small business self hosting company" to choose from.
by aantix | 2025-10-09 18:45:53+00:00
Along these lines, how does everyone visually organize the multiple terminal tabs open for these numerous agents in various states?

I wish there were a way to search across all open tabs.

I've started color-coding my Claude code tabs, all red, which helps me to find them visually. I do this with a preexec in my ~/.zshrc.

But wondering if anyone else has any better tricks for organizing all of these agent tabs?

I'm using iTerm2 on macOS.
by brewdad | 2025-10-09 18:45:54+00:00
It's much easier to treat it like identity theft where the business's problem becomes the customer's problem to solve. In this case, insurance didn't pay what was required so the patient does. There's already a potential collections agency involved if the patient doesn't pay.

Who do you think is easier to squeeze the money from? A mega-insurance corporation or your sick grandma?
by shagie | 2025-10-09 18:46:04+00:00
At $30, I've got a lot of expectations. At $40, I've got a lot more. Neither of those price points are the impulse buy for "it might be a nice game that I could waste a few hours on." It's competing with things like Satisfactory and Factorio for promise of enduring in my library gaming.

This feels something closer to Puffin Planes ($12), Rail Route ($25), Station Flow ($18).

The difference between $25 and $30 isn't too much, but there's another significant hurdle to get up to a perceived $40 value.

It does look interesting, but for a purchase at that price point, I'm going to need to feel that its worth more than a weekend or two of gaming and something that will be a game that I want to pick up again after a month or two away from it.
by codingdave | 2025-10-09 18:46:09+00:00
> “I’m hopeful President Trump will consider appointing his son Barron and maybe other young Americans to TikTok’s board to help ensure it remains an app young people want to keep using,”

This is silly, even if you ignore the nepotism and politics. First off, Trump doesn't have the authority to appoint the board of a private company. Second, PMF is not the job of board members - it is the job of the product team.