MurphyA/hacker-news huggingface dataset:
by zackmorris | 2025-10-06 17:33:38+00:00
Sorry, I should have elaborated. I believe that copy-on-write with virtual memory (VM) can be used to achieve a runtime that appears to use copy-by-value everywhere with near-zero overhead when the VM block size is small, like 4k.

If we imagine a function passing a block of memory to sub functions which may write bytes to it randomly, then each of those writes may allocate another block. If those allocations are similar in size to the VM block size, then each invocation can potentially double the amount of memory used.

A do-one-thing-and-do-it-well (DOTADIW?) program works in a one-shot fashion where the main process fires off child processes that return and free the memory that was passed by value. Surrounded by pipes, so that data is transmuted by each process and sent to the next one. VM usage may grow large temporarily per-process, but overall we can think of each concurrent process as roughly doubling the amount of memory.

Writing this out, I realized that the worst case might be more like every byte changing in a 4k block, so a 4096 times increase in memory. Which still might be reasonable, since we accept roughly a 200x speed decrease for scripting languages. It might be worth profiling PHP to see how much memory increases when every byte in a passed array is modified. Maybe they use a clever tree or refcount strategy to reduce the amount of storage needed when arrays are modified. Or maybe they just copy the entire array?

Another avenue of research might be determining whether a smarter runtime could work with "virtual" VMs (VVMs?) to use a really small block size, maybe 4 or 8 bytes to match the memory bus. I'd be willing to live with a 4x or 8x increase in memory to avoid borrow checkers, refcounts or garbage collection.

-

Edit: after all these years, I finally looked up how PHP handles copy-on-write, and it does copy the whole array on write unfortunately:

http://hengrui-li.blogspot.com/2011/08/php-copy-on-write-how...

If I were to write something like this today, I'd maybe use "smart" associative arrays of some kind instead of contiguous arrays, so that only the modified section would get copied. Internally that might be a B-Tree with perhaps 8 bytes per leaf to hold N primitives like 1 double, 2 floats, etc. In practice, a larger size like 16-256 bytes per leaf might improve performance at the cost of memory.

Looks like ZFS deduplication only copies the blocks within the file that changed, not the entire file. Their strategy could be used for a VM so that copy-on-write between processes only copies the 4k blocks that change. Then if it was a realtime unix, functions could be synchronous blocking processes that could be called with little or no overhead.

This is the level of work that would be required to replace Rust with simpler metaphors, and why it hasn't happened yet.
by toast0 | 2025-10-06 17:33:42+00:00
> 5222 is used by e.g. WhatsApp

I left in 2019, but when I was there, WhatsApp used port 5222, but the client would try port 443 if port 5222 didn't work. After it had tried those enough, it would try on port 80 with HTTP wrappers.

Really, the right model for a public service is what AOL did for AIM. Listen on all the ports. Clients should try on the 'proper' port, then 443, then 80, then random permutation. Skip certain ports because nobody likes it if you probe on smtp, smb, or chargen (etc)
by rectang | 2025-10-06 17:34:02+00:00
> I've always done my best to search from a browser context that isn't logged in as a result.

It isn't sufficient to avoid being logged in — you have to ensure that the search strings alone, grouped by IP address or some other signal, aren't enough to identify you. When AOL publicly released an archive with 20 million search strings in 2006, many users got exposed:

https://en.wikipedia.org/wiki/AOL_search_log_release

There's also the issue of a site's Terms of Service when not logged in, which may allow an AI to be trained on your interactions — which could potentially bleed compromising information into the generative results other people see.
by whateveracct | 2025-10-06 17:34:09+00:00
45 minutes both ways to the city is just what being in the suburbs is like. I grew up outside Chicago, and that's how long it'd take to go into the city and see a game or show or museum or whatever. Usually I'm spending 6+ hours in the city (we catch an early dinner at 4 or 5 and then head back after our event at 10 or 11) so it feels worth it to me.

And yeah, that's what reverse commute means. Seattle traffic is awful if you're going where everyone else is, but Tacoma to Seattle in the evening is not busy at all.
by jtbayly | 2025-10-06 17:34:23+00:00
Because you can't ask the search engine to summarize the views or thoughts or whatever, of the user. You have to scroll through them by the hundreds and see if any obvious nuggets stand out that you might be interested in.

Yes, search engine history is private too and can reveal stuff you want to remain private. But you also need to see the browser history and the contents of those pages, together with the search history to see what the user was actually interested in reading to get close to the same level of data the the LLM has about you.
by AftHurrahWinch | 2025-10-06 17:34:33+00:00
This is what the prelude to stagflation looks like - no job growth, yet prices rising.

If the administration pressures the Federal Reserve into lowering interest rates, say, right before November 2026, then we lock in a stagflationary cycle. An initial stock rally then long-term bond yields rising on inflation fears. A weakening U.S. dollar, and a Federal Reserve that has no tools to fight inflation in the medium-term.
by bri3d | 2025-10-06 17:35:13+00:00
No, the key negotiation occurs between two clients.

In the Magic Wormhole protocol, the number at the beginning of the Magic Wormhole phrase specifies a "nameplate" used to negotiate the "mailbox" which both clients (sender and receiver) use. If a recipient specifies a _matching_ nameplate but a _non-matching_ key phrase, the file transfer transaction between the sender and receiver with a matching nameplate will fail (since they cannot correctly produce a shared key), but nobody else is affected in any way.

An evil attacker could DoS the magic-wormhole mailbox server by spamming mailbox nameplates with bad keys, since there isn't much entropy at all there, but they would affect only single transactions at a time.
by pornel | 2025-10-06 17:35:33+00:00
The git protocol is more complex and harder to scale. It's especially wasteful if people are going to redownload all packages every time their amnesiac CI runs.

Single-file archives are much easier to distribute.

Digests and signatures have standard algorithms, not unique to git. Key/identity management is the hard part, but git doesn't solve it for you (if you don't confuse git with GitHub).
by chermi | 2025-10-06 17:35:50+00:00
No, it's a lie. Consumers paying more because of data centers raising demand could be true, but that's not equivalent to them paying for the data centers' usage. The data centers also have to pay an increased rate when prices go up.

Data centers get commercial or maybe even industrial rates depending on their grid hookup and utilities love predictable loads. Those are lower than residential rates. If you're dishonest and don't understand the cost of operating a grid, you could say that's users paying for data centers. But then you'd need to apply it to every commercial/industrial user.

If the regular users were paying for data centers usage, why are so many of them going off-grid with turbines or at least partially on-prem generation?

The solution is more and cheaper energy.
by xpe | 2025-10-06 17:36:03+00:00
> Here’s an example of irrational fear: “the expanding use of these models may pose a risk to application developers, consumers, and to US national security.”

Yes, that contains a quote from the executive summary. First (perhaps a minor point), I wouldn't frame this a fear, I would call it a risk assessment. Second, it is not an irrational assessment. It seems you don't understand the reasoning, in which case disagreement would be premature.

> There’s no support for that claim in the report, just vague handwaving at the fact that a freely available open source model doesn’t compare well on all dimensions to the most expensive frontier models.

I'm going to put aside your unfounded rhetoric of "vague handwaving". You haven't connected the dots yet. Start by reviewing these sections with curiosity and an open mind: 3.3: Security Evaluations Overview (pages 15-16); 6.1: Agent Hijacking (pages 45-57); 6.2: Jailbreaking (pages 48-52); 7: Censorship Evaluations (pages 53-55)

Once you read and understand these sections, the connection to the stated risks is clear. To spell it out: when an organization deploys a DeepSeek model, they are exposing themselves and their customers to higher levels of risk. Risks to (i) the deploying organization; (ii) the customer; and (iii) anything downstream, such as credentials or access to other systems.

Just in case I need to spell it out: yes, if DeepSeek is only self-deployed (e.g. via Ollama) on one's local machine, some risks are much lower. But a local-deployment scenario is not the only one, and even it has significant risks.

Lastly, it is expected (and not unreasonable) for government agencies to invoke national security when cybersecurity and bioterrorism are involved. Their risk tolerance is probably lower than yours, because it is their job.

Next, I will ask you some direct questions:

1. Before reading Hartford's post, what were your priors? What narratives did you want to be true?

2. Did you actively try to prove yourself wrong? Did you put in at least 10 uninterrupted minutes trying to steel-man the quote above?

3. Before reading the NIST report, would you have been able to e.g. explain how hijacking and jailbreaking are different? Would you have been able to explain in your own words how they fit into a threat model?

Of course you don't have to tell us your answers. Some people have too much pride to admit they are uninformed or mistaken even privately, much less in public. To many, internet discussions are a form of battle. Whatever your answers are, strive to be honest with yourself. For some, it takes years to get there. I'm speaking from experience here!
by ianstormtaylor | 2025-10-06 17:36:07+00:00
It seems fairly easy to figure this out with a little thought…

When talking to a chatbot you're likely to type more words per query, as a simple measure. But you're also more likely to have to clarify your queries with logic and intent — to prevent it going off the rails — revealing more about the intentions behind your searches than just stringing together keywords.

It'd be harder to claim purely informational reasons for searching if your prompts betray motive.
by codingdave | 2025-10-06 17:36:38+00:00
Myers-Briggs is pattern recognition that gives a surface-level measurement of 4 traits. The weakness of the test is not that it cannot produce an answer, it is that the answer is useless. It changes day-to-day as people change day-to-day and it over-simplifies people across 4 traits. But ChatGPT can work from a static history of chats, avoiding change (assuming you are just asking once). And it excels at such surface-level categorization of content.

So even if MBTI is useless, the ability of ChatGPT to offer an equally useless answer of your type is not at all surprising.
by matheusd | 2025-10-06 17:36:43+00:00
(Not op)

Maybe not you in particular, but I expect people to be more forthcoming in their writing towards LLMs vs a raw google search.

For example, a search of "nice places to live in" vs "I'm considering moving from my current country because I think I'm being politically harassed and I want to find nice places to live that align with my ideology of X, Y, Z".

I do agree that, after collecting enough search datapoints, one could piece together the second sentence from the first, and that this is more akin to a new instance of an already existing issue.

It's just that, by default I expect more information to be obtainable, more easily, from what people write to an LLM vs a search box.
by scarface_74 | 2025-10-06 17:36:49+00:00
Who gets hurt when the bubble pops? And who will the government need to bail out?

Last time, a lot of the companies were public and the general public saw stock losses. This time the only companies that are publicly really exposed by the AI bubble are Nvidia with all of their circular financing and Oracle. Of course Tesla has always been a meme stock.

Defined contribution plans - for now - can’t have private equity in their funds. Defined benefit plans and endowments are exposed.

Apple famously hasn’t invested that much in AI, Google is spending a lot on infrastructure. But between search and GCP and YouTube they have a real business plan and are funding based on profits. Amazon is in the same boat. Microsoft is bowing out of spending money on training and focused on inference - and they also have Azure. Meta is making money using AI for ad targeting and probably in the future to generate ads.

I can also see consulting companies being hurt (I work in cloud consulting) as businesses are throwing money at them to “AI enable” their business.
Show HN: HackCLI – A Slack terminal client for Hack Clubbers
by Jan_Kur | 2025-10-06 17:37:01+00:00
Hi! I made a Slack CLI app over the summer. I narrowed down the focus just to Hack Club members to deliver some additional features I, as an HC member, would enjoy. I will be doing my best to actively maintain HackCLI and possibly adapt it to work with all Slack workspaces if there's any demand.

Fortunately my decision to write it in Go was the right one. I learnt Go on the go and actually made a pretty decent bond with it (I like the lang is what I meant). I lowkey like the error handling, working in JS again will give me a distaste.

I honestly think it's the best slack CLI out there, and by far the project I am most proud of. I am open to any feedback and contributions.
by ambicapter | 2025-10-06 17:37:05+00:00
It seems like an (ugly?) truth that if you don't want to be exposed to bubbles, you have to take lower-return investments, by definition. Because the bubble is raising the high bar of what kind of return people expect on investment, so if you try to get close to that, you're going to end up affected by the bubble.

The problem, of course, that no one wants to take a lower return on investment.
by cogogo | 2025-10-06 17:37:07+00:00
If you believe the rule of law and ~general financial stability of the US will persist just keep on investing regularly and ride it out. Markets have a long history of bouncing back and they will keep doing it until they don’t. When/if that happens your retirement dreams might seem quaint compared to the global socioeconomic reality. The people who could sustain the most near term pain are those who have already retired and are living in a fixed income.
by cess11 | 2025-10-06 17:37:10+00:00
Surveillance erodes trust and has an oppressive effect. This is a key mechanic of the panopticon, i.e. the modern prison, and the constant surveillance of late modern societies amounts to a 'prisonifying' of both private and public spaces.

There is a harsh power imbalance between the corporations mediating that surveillance and the surveilled, since corporations under capitalism aren't reachable through democratic means. At best they're indirectly, abstractly and highly bureaucratically regulated, but usually by a corrupt parlamentarian neo-noblesse using surveillance techniques to gatekeep and reproduce their power.

Half a century ago this was mainly done through probing the public with polls and the like, as pointed out by Baudrillard in his short work In the Shadow of the Silent Majorities.

https://en.wikipedia.org/wiki/In_the_Shadow_of_the_Silent_Ma...

Contemporary surveillance is much more invasive, immediate and relies on evermore sophisticated psychometrics and technologies. To willingly participate and submit to this regime is arguably worse than being a slacker, (in)famously studied in a paper by Buzzfeed founder Jonah Peretti.

http://www.datawranglers.com/negations/issues/96w/96w_perett...
by wg0 | 2025-10-06 17:37:11+00:00
If you marvel at the output of generative AI be it pictures, logo, music, 3D models, prose or code - you probably are yourself way too under-skilled to be gainfully employed or not yourself capable of generating similar or better output.

Conversely - any expert (prolific writer, coder, painter, photographer, videographer or log/web designer) isn't as much amused or going to scream out of excitement that what these models are producing (vides, pictures, logos, essays, code) - they could never ever have thought anything better than that.

This fact alone is enough to warrant that a big bust is coming. Not a matter of if but when.
by bparsons | 2025-10-06 17:37:29+00:00
Has anyone articulated a theory for what the profit model might actually look like for the big LLMs? In the .com era, the valuations were crazy, but people generally understood how you could eventually make money on all of this stuff.

If models are requiring larger and larger infrastructure buildouts, does anyone have a clear sense of what users will have to pay in order to make the businesses profitable?
by spwa4 | 2025-10-06 17:37:31+00:00
Oh don't worry. That's what "de-facto" relationship legislation is for.

https://www.fcfcoa.gov.au/fl/pubs/defacto

You can now be forced to pay child support - including for kids that aren't your own kids - without ever being married.

There are people who'll do anything for money. Some of those people are women, and occasionally a man succeeds at this too. Children are a way to extract large amounts of money over time from partners. The state cooperates with this practice because the state will be on the hook otherwise.
by lesuorac | 2025-10-06 17:38:20+00:00
Federal Reserve has no real tools to fight inflation. They can get the buckets out and start bailing but until somebody plugs the whole in the deficit there's a structural problem with the boat.

People love to bring up the gold chart and be like "what happened in the 1970s!". It wasn't ending the gold standard that was the problem. It was the endless deficit spending; if you want to get a handle on inflation you need current demand to match current production.
by oceanplexian | 2025-10-06 17:38:41+00:00
A single terminal could serve an entire African village. It's also serving use cases in the Ukraine war, ships at sea, Antarctic research stations, numerous aerospace and military use cases, and so on. DTC is provide texting and emergency services to countless people who might need it in an emergancy, like we saw in North Carolina.

Last and most importantly, Starlink exists is to create revenue for SpaceX and to fund the Starship program. The value to humanity of Starship succeeding at its goals is extremely high.
by JuniperMesos | 2025-10-06 17:38:53+00:00
Someone in who can afford to live in a wealthy neighborhood in Chicago and who is concerned about being a victim of violent street crime in their neighborhood might reasonably prefer to pay a neighborhood association for additional private security, rather than engage in a city-wide political process and agitate for raising their taxes and using the proceeds to pay for additional police. Paying for neighborhood-level private security solves an immediate local problem, and in a place like Chicago there are a lot of political forces who do not want to see additional policing done and would want to use additional local taxes raised to pay for things unrelated to or perhaps even counterproductive to the goal of decreasing local crime by increasing policing.
by johnmaguire | 2025-10-06 17:39:19+00:00
Possibly - or we might discover that for a large amount of use cases, AI output is "good enough," even if the experts don't love it.

A C programmer will snub an Excel sheet, but it doesn't change the fact that it's genuinely useful for a wide number of use cases.

As an aside, the AI Art Turing Test was a bit eye-opening for me: https://www.astralcodexten.com/p/how-did-you-do-on-the-ai-ar...

I say all of this as someone who hopes that art remains human.
by xmodem | 2025-10-06 17:39:34+00:00
> Well, synchronous blocking approaches (as opposed to asynchronous nonblocking) provide that stuff for free.

Not really. The talk describes problems that can show up in any environment where you have concurrency and cancellation. To adapt some examples: a thread that consumes a message from a channel but is killed before it can process it, has still resulted in that message being lost. A synchronous task that needs to temporarily violate invariants in some data structure that can't be updated atomically, has still left that data structure in an invalid state when it gets killed part way through.

> Arguably the Go language's goroutines strike a good balance between cooperate and preemptive threads/multitasking.

Goroutines are pretty nice. It's especially nice that Go has avoided the function colouring problem. I'm not convinced that having to litter your code with select's if you need to make your goroutine's cancel-able is good though. And if you don't care about being able to cancel tasks, you can write async rust in a way that ensures they won't be cancelled by accident fairly easily. Unless there's some better way to write cancel-able goroutines that I'm not familiar with.

> The key insight is that manual management of tasks is, for the most part, not tenable by humans. It's better to take a step back and work at a higher level of abstraction.

Of course it's always important to look at systems as a whole. But to build larger systems out of smaller components you need to actually build the small components.

> I'd probably point to CockroachDB as one of the best task-cancellers, since it doesn't have a shutdown procedure. Its process can simply be terminated by the user with control-c, then it reconciles any outstanding transactions the next time it's booted, which just adds some latency. If an entire database can do that, then "this is the way".

I'm not familiar with CockroachDB specifically, but I do think a database should generally have a more involved happy-path shutdown procedure than that. In particular, I would like the database not to begin processing new transactions if it is not going to be able to finish them before it needs to shut down, even if not finishing them wouldn't violate ACID or any of my invariants.
by smsm42 | 2025-10-06 17:39:42+00:00
It would not be "damning" - as in you won't be convicted as a drug lord based on that alone - but search histories had been used, many times, in a court of law as evidence supporting intent, knowledge and other details of the crime. So if you are caught in a cocaine lab holding a bag of cocaine, then in the following process asking ChatGPT on how to make it would be used as part of the proof you were interested in making cocaine and eventually made it.
by vouwfietsman | 2025-10-06 17:39:57+00:00
I am not a Rust expert either, but just a general remark: using a programming language like Rust as its intended to be used, i.e. functional/imperative programming of the problem domain, does not lend itself well to proving/disproving the kind of statements I showed above.

Yes, you could theoretically generate a Rust program that does not compile if some theorem does not hold, but this is often times (unless the theorem is about types) not a straightforward Rust program for the problem at hand.

I also think that, although Rust is blurring the lines a bit, equating formal verification and type-checking is not a valid stance. A type checker is a specific kind of formal verification that can operate on a program, but it will only ever verify a subset of all hypotheses: those about object types.