MurphyA/hacker-news huggingface dataset:
by libroot | 2025-10-10 19:25:57+00:00
Sure, threat models matter, but that's exactly the point. TEEs are marketed as if they solve the "malicious infrastructure" problem. Cloud providers tell you they can't see your data, and vendors pitch TEEs as some kind of hardware-rooted guarantee. If your threat model is "malicious sysadmin" or "host operator" then the fact that the root of trust is opaque, unauditable, and repeatedly compromised does matter.

Saying "what's your alternative" also misses the criticism. The issue isn't whether TEEs can reduce some threats compared to no isolation at all. Obviously they can in some scenarios. The issue is that their trust model is misrepresented: you're still trusting vendors and firmware you can't inspect, and history shows that trust is often misplaced. That's not "no alternative", that's "don't build your security story on black boxes with a track record of holes."

If the only way TEEs "work" is if you lower your expectations to "slightly better than nothing," then the marketing and security claims around them are deeply misleading. At that point, calling them "trusted" environments is just branding, not security.

> Additionally, you still get attestation which gives you cryptographic proof of what code is running.

Remote attestation ultimately relies on the same implicit trust it claims to replace. For example this paper[1] from 2019 showed how AMD's PSP secure boot can be compromised, giving an attacker an possibility to load a patched firmware that grants arbitrary read/write access to the PSP memory, which then allows the attacker to extract the Chip Endorsement Key (CEK), which is AMD's attestation root key. Once you have the CEK, you can forge attestation reports (for example impersonate a legitimate SEV platform) or bypass attestation entirely. And the CEK had (changed in 2023) an infinite lifetime and there was no rollback protection, so even if AMD issued a firmware update, attackers could revert to the old vulnerable firmware and re-extract the CEK.

[1]: https://arxiv.org/pdf/1908.11680

Edit:

And very recently, the new Battering RAM[2] (Sep 2025) and WireTap[3] (Oct 2025) attacks have broken Intel SGX and AMD SEV-SNP remote attestations.

[2]: https://batteringram.eu/

[3]: https://wiretap.fail/
Ask HN: Can you recommend any website blocking apps for Android?
by Desafinado | 2025-10-10 19:26:01+00:00
I'd like to take a lengthy break from the usual social media sites but one difficult aspect of this is that I don't have a reliable website blocker on my Android phone. I find it easy enough to block sites on my Linux machines, but not on Android

I've done a little searching but am a bit confused about all of the options so am hoping someone can point me to an application or option that just works, and that won't harvest my data.

I'm not looking to set screen time limits, or cut back my usage, I just want to be able to permanently block specific websites on Android.
by NoMoreNicksLeft | 2025-10-10 19:26:10+00:00
It's not just the metrics. Over the years I've come to realize that in many cases these companies just sabotage the talent they do have. My own performance when I have my own office vs. when I didn't is night and day. The possession of an uninterruptible space for a few hours a day, of perceived privacy (a cubicle is little better than a dog crate)...

And in many of the places where I did not have an office, it wasn't because none were available. In most of the jobs I've worked, there have been multiple vacant offices going unused or becoming junk rooms where they stash old equipment to keep it out of the hallways.

Autonomy to solve problems... I don't know how many places I've been where it was tacitly supported for people to goof off for 20-30 hours a week, but god forbid you put effort into work that hadn't been directed from above.

And on and on and on.
by humuhumu33 | 2025-10-10 19:26:19+00:00
We are open sourcing The Mathematical Universe, a universal mathematical language discovered by the UOR Foundation. It encodes the rules behind the universe’s most complex structures, including the five exceptional Lie groups and the E8 lattice, in a single 96-vertex framework called Atlas.

This framework gives you a playground to explore, manipulate, and apply the patterns that shape the universe’s most intricate structures, unlocking new possibilities in AI, quantum computing, and scientific discovery.

Link: https://www.uor.foundation/blog/universe

Greetings from Colorado, and we welcome any feedback.
by astrange | 2025-10-10 19:27:18+00:00
> Whatever shows up most commonly in the training data is is what an LLM will output. It's more complicated than that of course, but that's the basic idea.

The most common thing in the training data is the letter 'e'. If you're going to explain how an LLM works it needs to explain why it's able to form sentences at all.

In particular answering questions is a behavior which only appears after posttraining, and the posttraining objective has absolutely nothing to do with what's "most common" in the pretraining data.

> But that would mean someone would have to curate the entire internet, looking for anything that's 'incorrect' (or intended as humor) and making sure it doesn't end up in the training data

Show the LLM the source URL during pretraining so it can cluster them together.

https://arxiv.org/abs/2501.01956

The cheap version of this technique is to find trustworthy text (Wikipedia, answers you paid people to write, high upvoted Reddit comments) and train on it more than once. The rest falls out through emergent magic (reliable sources have different writing styles than unreliable ones and RL points it to the part of latent space with the reliable sources, or something.)

Besides that, if it encounters 95%/5% right/wrong answers to some question during training, that will have a different effect than 100%/0%. It does know when something is debated.
by themafia | 2025-10-10 19:27:42+00:00
> adjust the capacity

It's a single lane tunnel and is thus one way. The parking are can only hold so many waiting vehicles and queued passengers. Their options for adjusting capacity are severely limited.

Then you consider what might happen if the lead vehicle in a convoy becomes disabled, or worse, starts on fire.

It's the same reason planes are safer per "passenger mile traveled" but aren't as safe per "total journeys taken." If you crash a plane you stand to injure or kill hundreds of passengers at once.
by porridgeraisin | 2025-10-10 19:27:50+00:00
I think the number of approaches you can take to reach the same goal/standard increases with how abstract the work you're doing is. SWE is quite abstract.

I don't have the greatest work ethic, I waste time sometimes, forget things, am not too organized, etc. It's mostly the fact that 1) I do SWE as a hobby and 2) learn obsessively without BSing myself that gets me into jobs.

However my teammate at my last job. He probably didnt have the same level of intimate knowledge of systems as me. But his work ethic was just breathtaking. Mine simply wouldn't compare in a million years. Averaged over a large enough period, we both ended up doing the same amount of useful work.

Similarly there were others with different "approaches", just included the above 2 cases as an example.

Now. It wasn't the best experiment since we helped each other a lot. But I came away feeling it's true.

My hypothesis is that in less abstract work, the number of approaches is limited, and hiring practices in SWE have just been made the same as those jobs.

I don't really complain since I really can't think of a framework for hiring for abstract jobs that will yield better results than the current one. But who knows, maybe we'll find one.

FWIW, I think leetcode, just one round to bring down the applicant count to a number that's possible to interview {hard if there are too many, medium if there are few, or just Two Sum to weed out folks that can't write a for loop if you have just tens of applicants}, and then system design as the main interview, is a good system. For system design I would skip the common ones like "design a rate limiter/load balancer" stuff that people memorize. IMO it's easily possible to create unique system/API design questions that match the job somewhat.
by mlok | 2025-10-10 19:28:19+00:00
Also : avoid using IT terms in examples (or "self-reference"), it can be confusing. In examples choose a very different field : animals, cars or anything, so that there is a very clear difference between language keywords (what needs to be learned) and the dummy data treated (what can be forgotten after reading).

An example not to follow : https://developer.mozilla.org/en-US/docs/Web/API/Web_compone...

Here we are trying to explain templates and slots, with "slot" as an html attribute and the dummy data is... "slot". This kind of confusion is useless and makes it more difficult. Almost as if the goal was to be difficult.
by nchmy | 2025-10-10 19:28:58+00:00
Ive made similar points to the maintainers. It is what it is at this point.

But, honestly, to the people who actually understand, like and use Datastar, none of this matters. Most of the outrage is performative, at best - as can be seen by the pathetically superficial quality of the vast majority of criticisms in threads like this.

Frankly, if people can't/won't see that the devs are very clearly not VC rugpull assholes, and that the vast majority of the functionality is available for free, then they're probably also the sorts of people who aren't a good fit for something that is doing a great rethink of web development. The devs very explicitly are not trying to get rich (nor can they, due to the 501c3!) nor do they want this to be something massive - they're building it for their own needs, first and foremost, and for those who understand that vision.
by AlecSchueler | 2025-10-10 19:29:02+00:00
> But how would you define what's advertising and what's not?

The same way we define what is and isn't political advertising? Or tobacco advertising, alcohol advertising etc.

> But, is the SEO I do advertising?

No, it's SEO.

> What about when I share my work to my socials, is that advertising? Post a reel

No, this is just sharing your work.

> Likewise with product placement in films, influencer marketing, etc.

Is it really complicated though? We already regulate what can and can't be said in all these forms of advertising.
by cool_dude85 | 2025-10-10 19:29:35+00:00
Or you could type up "My allergies are X, Y, Z, I have the following preferences..." etc. and put it into whatever chat bot you like. Obviously this is a bit of a pain, but it probably constrains significantly how much of a premium ChatGPT can charge. You might not bother if ChatGPT is time and a half more expensive, but what if it's 3x as much as the competition? What if there's a free alternative that's just as good?
by anonymars | 2025-10-10 19:30:04+00:00
> often even need to brake to prevent the bike from speeding up too dangerously.

Indeed, which is what the airplane would have done on its way down to land. So it's more like riding the brakes on your way down the hill, and now at the bottom when you realize you need to abort the landing, you are at low speed and it's quite an exercise to get back uphill to try again
by unionpivo | 2025-10-10 19:30:28+00:00
it's not just porn blocking. That's just what is in newspapers. Porn blocking is only small part.

Essentially, you have to preform risk assessment if your site contains any child inappropriate content (according to new law that is defined kind of vague ), you have to age verify all the visitors from UK or risk getting fines.

Since service allows for user upload, this means that their site could protentional qualify. And even if it does not, you need a lawyer to go through everything, to make sure you don't. Sure the chances their site get targeted is small, but not zero.
by marcosdumay | 2025-10-10 19:30:32+00:00
> fills your brain with whats possible

It doesn't. That's the problem.

It fills your brain with procedure. For a short time.

If you solidify the procedure, you will be able to perform that one task. What on software development is still useless.

Only at the next step, where you know so much that you can think of your own new procedures that you have basic competence at software development. There are other professions like this, but for most, basic competence happens before you even solidify the procedures.
by paulbjensen | 2025-10-10 19:30:59+00:00
It reminds me of a Transavia flight from Girona to Rotterdam that had to be diverted to Amsterdam back in 2015 (1 attempt at Rotterdam, decided to divert to Amsterdam, then 2 attempts in Amsterdam).

It was a particularly stormy weekend and it turns out from the article that they had 992kg of fuel left:

https://avherald.com/h?article=489d4c3f

Massive respect for pilots and the job they do.
by sarchertech | 2025-10-10 19:31:43+00:00
If there's money to be made the possibility that the feature will ever exist at all goes way up. I'd rather have the ability to pay for a feature if I decide I need it than to hope some maintainer gets around to building it for free.

They've said that the feature they put in the premium product are the features they don't want to build or maintain without being paid to do so.
by Jtsummers | 2025-10-10 19:31:50+00:00
It's not invisible, it's incomprehensible to most would-be employers because the information is not in a form that they can understand. That's not the same as invisible.

Passing some leetcode challenges is legible to employers, it puts applicants in the same buckets and measures them in (roughly) the same way. But it's not a good measure of actual talent. The real measures, as discussed in the article are out there but illegible to those employers.
by NoImmatureAdHom | 2025-10-10 19:32:23+00:00
Compelled speech is a bright line the U.S. has, so far, managed not to cross. We should be trying as hard as we can not to cross that line.

You may not see the harm in this particular instance, but establishing "we'll just force them to say it and punish them if they don't" as a tool in any government's toolbox is a very, very bad idea.
by ryandrake | 2025-10-10 19:33:55+00:00
A random combination of inconvenient hours, skeleton-level staffing, rude and/or apathetic staffing, inflated prices[1], terrible handle on their own inventory (often can't tell me over the phone or online whether something is in stock), poor/lengthy product-returns experience, general condition/smell/cleanliness of stores. Not all local stores have all of these--but they always have some mix of them.

1: I get it that they'll never be able to meet or beat online pricing due to economies of scale, fine. But I've seen 2X+ markups depending on the store/product.
by maldusiecle | 2025-10-10 19:34:05+00:00
> In matters of bathroom, locker-room, and sports segregation, universities will define sex categories based on reproductive and biological criteria.

In other words, trans people can't use the bathrooms matching their gender identity.

> Calls for ideological diversity, not just at the campus level, "but within every field, department, school, and teaching unit."

In other words, every academic department is susceptible to ideological litmus tests defined by the state. If Trump's white house feels like your Computer Science department has too many Democrats in it, you fix that problem or you lose your funding.

> Restricts student visas to foreign students who ... "are ... supportive of, American and Western values."

In other words, another ideological litmus test, only in this case the consequence is that foreign students can be thrown out at will.

> Requires that "university employees, in their capacity as university representatives" as well as all colleges, faculties, departments, and other academic units "abstain from actions or speech relating to societal and political events"

In other words, tenured faculty lose their right to free speech.
by karel-3d | 2025-10-10 19:34:10+00:00
I don't like Ed Zitron automatic dismissal of everything AI and the constant profanities in his writing are getting old, and it's usually not very well structured, but that said... I like the perspective he has about the money involved.

https://www.wheresyoured.at/the-case-against-generative-ai/

OpenAI needs 1 trillion dollars in next four years just to keep existing. That's more than all currently available capital, together, from all private equity. If you take all private equity together, it still won't be enough for OpenAI in next four years.

It's just staggering amount of money that the world needs to bet on OpenAI.
by godelski | 2025-10-10 19:34:31+00:00
I'm really confused by this video. What is it even supposed to be doing?

Is it supposed to be taking packages and placing them label face down?

I cannot understand how a robot doing this is cheaper than a second scanner so you can read the label face down or face up. I mean you could do that with a mirror.

But I'm not convinced it is even doing that. Several packages are already "label side down" and it just moves them along. Do those packages even have labels? Clearly the behavior learned is "label not on top", not "label side down". No way is that the intended behavior.

If the bar code is the issue, then why not switch to a QR code or some other format? There's not much information you need in shipping so the QR code can have lots of redundancy, making it readable from many different angles and even if significantly damaged.

The video description also says "approaching human-level dexterity and speed". No way. I'd wager I could do this task at least 10x its speed, if not 20x. And that I'd do it better! I mean I watched a few minutes at 2x speed and man is it slow. Sure, this thing might be able to run 24/7 without breaks, but if I'm running 10-20x faster then what's that matter? I could just come in a few hours a day and blow through its quota. I'd really like to see an actual human worker for comparison.

But if we did want something to do this very narrow task for 24/7, I'm pretty sure there are a hundred different cheaper ways to do it. If there aren't, then it is because there is some edge cases that are pretty important. And without knowing that then we can't actually properly evaluate this video. Besides, this video seems like a pretty simple ideal case. I'm not sure what an actual amazon sorting process looks like, but I suspect not like this.

Regardless, the results look pretty cool and I'm pretty impressed with Figure even if it is an over-simplified case.
by PaulHoule | 2025-10-10 19:34:38+00:00
Whether or not it is, the repetition of that word by you and your friends is a magic spell that brought that administration into reality. For years it has been "Kier Starmer is a fascist" or "White people are fascists" or "Your local police department is fascist", etc.

A certain amount of blame can be laid at centrist politicians who can't take advantage of left-wing populist sentiments because they are too afraid of donors. [1] But an ultra-left that is obviously warming up the ovens for DHH because he said something stupid once and might come for me because I'm cisgender just seems fascinated with fascism because they're jealous the same way Charlie Kirk was fascinated with "cancel culture" because like David Horowitz he wished he could punish anyone in academia who he disagreed with.

[1] Look at the donors who will give money to anyone who isn't Mamdani no matter how bad because they don't have faith in the ability of blue state institutions to completely frustrate and hamstring anyone who tries to do anything.
by gxs | 2025-10-10 19:34:42+00:00
It’s almost like the best engineers are, like, people who come in all shapes and sizes

Super nice guys, complete assholes, showmen, wallflowers - what they have in common is that they are great at making software

There are for sure personally types that are typical in certain traits, but we lose site of the fact that these do not tell you everything about who a person is

I likewise can give you stories of the best developers I’ve worked with - from Devry graduates, to high school dropouts, to HYPE wunderkinds - they come from all walks of life
by lxgr | 2025-10-10 19:34:59+00:00
That's why I said "[yesterday's] weather forecast" and not "weather forecast models".

But my larger point actually also stands: Weather forecast models also, in the end, incorporate information about geography, likely temperature conditions etc., and might not be stable over 100 years.

The more interesting question is probably: Is Python more like the weather or a weather forecasting model? :)
by mrandish | 2025-10-10 19:35:01+00:00
If you were using a TV streaming stick, many have slow Ethernet due to slow port (Micro-USB), slow PHY hardware (100 mbps) or slow network stack. For the popular streaming apps they only need 25 mbps max, so most stick makers put no effort into design or validation testing beyond that minimal use case. And they don't care about latency.

I use Moonlight via direct 1 gbps Ethernet from a high-end gaming PC in the same house through a Google Chromecast 4K HDMI dongle with a powered USB-C hub for the RJ-45 input and it works flawlessly at 60 fps 4K 10-bit HDR with around 12 ms video latency. Some USB 3 hubs and USB Ethernet dongles won't reach full speeds on some streaming devices USB ports. The second one I tried worked at full 1 gbps.

You have to verify every software and hardware component in the chain is working at high-speed/low latency in your environment with a local speed test hosted on your source machine. I used self-hosted OpenSpeedTest. Moonlight works great but none of the consumer streaming stick or USB hub/RJ-45 dongles test for high speed/low latency across dozens of different device port hardware/firmware combos - so you can't trust claimed specs. Assume it's slow until you verify it's not.
by ActorNightly | 2025-10-10 19:35:08+00:00
After having worked with Java extensively during my time at Amazon, especially during the log4shell bullshit, I can safely say that if you think Java is viable for anything these days, you lack real world experience of how actual good, efficient dev process is one.

But on a slightly less edgy note: java doesn't have a fast REPL loop, near anywhere near the amount of libraries available for it as Python does, and requires tuning to actually make it performant. Its by far not the same amount of time to develop. It doesn't have things like jupyter notebooks for prototyping, doesn't have an easy to use interpreter, doesn't have ability to inject code during debug sessions, and doesn't have easy system integration (i.e with a module, you can install it in editable more, you can have an executable you can run from command line, e.t.c), and doesn't have things like dynamic import (where you can dynamically reload modules as the program is running, can't (easily) import inside function statements, and so on)

>Sure, there's multiprocessing, but historically no multi-threading

Functionally, when the cpu switches context the main thing that matters is the stack frame. This happens in both threading or running multiprocessing. The only difference is between the two is a) data access and b) initial startup time.

a is solved by unix pipes,which is already a part of multiprocessing in python, which are plenty fast for anything you wanna do, and b is solved by spinning up the processes ahead of time in worker pools, which is already part of multiprocessing in python.
by slipperybeluga | 2025-10-10 19:35:12+00:00
best thing i ever did with my bravia was install a custom launcher via adb to finally rid myself of the endless ads, upsetting news, and terrible suggestions constantly shoved in my face without my consent. nice to be able to uninstall the misc bloat that you can't get to with the gui and just have a simple interface. all i want is to access jellyfin and maybe one or two other apps. much better all around experience now.

here's a nice reference for a lot of the stuff installed on bravia that you can elect to remove via adb:

https://github.com/therealhoodboy/skinny-bravia