MurphyA/hacker-news huggingface dataset:
by 3eb7988a1663 | 2025-10-09 18:29:10+00:00
I mean, Guido had a 2021 Faster CPython presentation where they claimed "5x in 4 years (1.5x per year)"[0]. Developers have significantly walked back those expectations since then.

[0] Github slide deck https://github.com/faster-cpython/ideas/blob/main/FasterCPyt...
by cycomanic | 2025-10-09 18:29:28+00:00
The reason might be that the training programs are just ridiculously bad. I clicked on a pretend phishing link out of interest to see what happens. I was treated to a lecture of how clicking on links in emails is always bad and to never do it.

That advise would be fine (albeit maybe extreme) if it wasn't the case that for the last year I have been spammed by emails from said training company telling me to click on the included link to complete the next cybersecurity course. Even worse they use some nondescriptive weirdly named domain not their own to host the training courses. So if anything the courses are training people to click on phishing emails.
by fair_enough | 2025-10-09 18:29:41+00:00
After picking your intended audience, it's reasonable to establish prerequisites. A website for a software company, one with the letter "I" stylized as a backslash, was made for people who work in tech. Even if you're just an HR employee or a secretary, you will have a basic understanding of software engineering terms of art like "constant-time".

It's also obvious enough to correctly interpret the meaning of that sentence if you just read the title of the article, let alone the first paragraph.

Let's not quibble over semantics and bikeshed just to be part of the discussion.
by gota | 2025-10-09 18:30:00+00:00
I think this paragraph needs to be considered at top priority, though:

"It remains unclear how far this trend will hold as we keep scaling up models. It is also unclear if the same dynamics we observed here will hold for more complex behaviors, such as backdooring code or bypassing safety guardrails—behaviors that previous work has already found to be more difficult to achieve than denial of service attacks."

So:

a) It's 'fixed' in ~250~500 for these sizes, may grow for even larger sizes. Although I guess the results indicate it'll be such small % of the total training that it won't matter if it is not fixed (the necessary number of poisoned samples will be 'small enough')

Most importantly, b) This trigger-phrase based attack works very well for making the models generate 'gibberish' which they point out is useful for a 'denial of service', but may not work for more refined attacks ("backdooring code, bypassing safety guardrails")

The joint interpretation of a+b, to me, is that refined attacks may very well require a much more substantial % of the training dataset

Also, as pointed below (https://news.ycombinator.com/item?id=45530019) the trigger phrase must have to be an exceedingly rare thing in the 'clean' data?
by ivape | 2025-10-09 18:30:11+00:00
It's going to be the biggest heist in American history. That tariff revenue is as good as gone. It's not about whether the money can actually be brought in, but more about the reality that crooks have access to the pot. It's really all about that. These are not fiscal conservatives generating revenue to pay down debt, these are actual crooks that will gift it to each other.
by kstrauser | 2025-10-09 18:31:17+00:00
> V8 can get C++-like performance (I mean it's C++ after all)

I don’t think that follows. Python is written in C, but that doesn’t mean it can get C-like performance. The sticking point is in how much work the runtime has to do for each chunk of code it has to execute.

(Edit: sorry, that’s in reply to another child content. I’m on my phone in a commute and tapped the wrong reply button.)
by feoren | 2025-10-09 18:31:32+00:00
Huh? 10 years ago was 2015. Entity Framework had been around for nearly 7 years by then, and as far back as I remember using it, it used source generators to subclass your domain models. Even with "Code First", it generated subclasses for automatic property tracking. The generated files had a whole other extension, like .g.cs or something (it's been a while), and Visual Studio regenerated them on build. I eventually figured out how to use it effectively without any of the silly code generation magic, but it took effort to get it to not generate code.

ASP.NET MVC came with T4 templates for scaffolding out the controllers and views, which I also came to view as an anti-pattern. This stuff was in the official Microsoft tutorials. I'm really not sure why you think these weren't around?
by laterium | 2025-10-09 18:32:16+00:00
They are lying, because their salary depends on them lying about it. Why does it even matter what they're saying? Why don't we listen to scientists, researchers, practicioners and the real users of the technology and stop repeating what the CEOs are saying?

The things they're saying are technically correct, the best kind of correct. The models beat human PhDs on certain benchmarks of knowledge and reasoning. They may write 70% of the easiest code in some specific scenario. It doesn't matter. They're useful tools that can make you slightly more productive. That's it.

When you see on tv that 9 out of 10 dentists recommend a toothpaste what do you do? Do you claim that brushing your teeth is a useless hype that's being pushed by big-tooth because they're exaggerating or misrepresenting what that means?
by ModernMech | 2025-10-09 18:32:19+00:00
Yes, I'm consistent in that. What I don't get is if that's the case, why is there such a focus on improving Python perf? At best they're getting marginal improvements on something that most Python devs claim they don't care about, and which they say is not important for Python as a language due to JIT, C interop, and so on.
by firstusers | 2025-10-09 18:32:56+00:00
As you all know, the problem with Product Hunt is that it’s based on a voting system — so if you don’t have clout or an audience, you’ll most likely get stuck at 10–12 upvotes. That’s why I started firstusers.tech. We implemented a matching system, so it’s not about likes or audience size, but about getting startups in front of the right early adopters. For example, if you have a product in the marketing space, our system will show your startup to early adopters who have an interest in marketing. This increases your chances of finding real, relevant users. Here’s how the matching works: When a startup is submitted, our algorithm matches it with early adopters who selected the same interests or industries. This ensures high-quality matches, better engagement, and more useful feedback for founders. Every Tuesday, we send out a newsletter featuring the startups from the previous week Each startup typically gets matched with around 23 users (and that number keeps growing as our user base expands). So yeah, give it a try if you’re a startup founder or an early adopter looking to discover new products (and grab early coupon codes, many startups on the platform offer them!).
by wumms | 2025-10-09 18:33:15+00:00
If I telnet into an ESP32 via Termux, it doesn’t recognize \n. I haven’t found a solution yet. It works fine with other Linux consoles.

void handleTelnet() { ... if (telnetClient && telnetClient.connected() && telnetClient.available()) { String cmd = telnetClient.readStringUntil('\n'); cmd.trim(); if (cmd == "status") { ...

EDIT: Thanks @yjftsjthsd-h and @detaro for your suggestions! I tried Telnet via tmux - it worked. Then I tried telnet directly, and it suddenly worked too. Turns out Arduino’s Telnet implementation is single-user only, and my dev machine’s reconnect loop kept the connection open; the working login just fooled me.
by gregsadetsky | 2025-10-09 18:33:17+00:00
Source code: https://github.com/jerbear2008/hn-live

And live firebase source/api (run by HN) used for this: https://github.com/HackerNews/API

(just making sure it's obvious - I didn't create this site! all credits to @jerbear4328 who is here on HN - I'll email them to let them know it's trending) :-)
by kandel | 2025-10-09 18:33:20+00:00
Im just an anonymous person on the internet but even I can see that this can really hurt your reputation. That start of the article painting you by using a random game you had with Zuckerberg is very low. I think the previous commentor's suggestion to talk to a professional has merit.

They are effectively accusing you of destroying a multi-million company through libel... If this happened in court you'd be getting a lawyer, no? Maybe i'm being dramatic and the best way to go through this is just to ignore it and let it calm out but it's probably not a bad idea to talk to someone with a cool head and experience.
by razoorka | 2025-10-09 18:33:20+00:00
Yeah, the irony is that this is the only thing still propping up the U.S. economy. Real growth drivers are gone — manufacturing is flat, tech productivity has stalled, and GDP is now inflated by the promise of future AI miracles.

Companies aren’t creating new value; they’re monetizing hope — issuing debt against models that don’t yet work and counting that as “growth.” It’s not innovation anymore. It’s financial theater dressed as progress.
by walkabout | 2025-10-09 18:33:22+00:00
> Social security lives in a parallel universe to the budget, so they could cancel the program entirely and it wouldn't affect the deficit.

100% true, if you're operating in sane-world where anything makes sense.

Here in insane world, my pet theory is that, given another year (maybe two, they might wait until after the midterms, assuming they hold on to congress) we're going to see an attempt to nullify the government debt owned by Social Security by converting it into some convoluted scheme involving crypto-backed-by-the-stock-market or something. Ta-da, debt reduced, deficit reduced (by the amount of interest on the debt owned by the trust fund)! Plus sooooo many opportunities to steal.

This'll kill the program stone-dead, but it'll take a little while. Kinda like how they already killed Obamacare by removing the individual mandate, and they're just waiting for the death-spiral to hit bottom so they can declare the program a failure and proof that we should never try to fix healthcare in any kind of actually-decent way again.
by oneplane | 2025-10-09 18:34:05+00:00
You don't need the root account, unless you need to bypass all policies. In such a scenario, you a use the root access reset flow instead, reducing standing access.

As for other flows (break glass, non-SSO etc), that can all be handled using IAM users. You'd normally use SAML to assume a role, but when SSO is down you'd use your fallback IAM user and then assume the role you need.

As for how you disable the root account: solo accounts can't, but you can still prevent use/mis-use by setting a random long password and not writing it down anywhere. In an Org, the org can disable root on member accounts.
by Lerc | 2025-10-09 18:34:11+00:00
Well I cannot address the accuracy of your statement on UPFs unless I assume the term UPF is synonymous with the Nova Classification, which is much of the problem. If it is synonymous then the term is bound to a classification system and that system can dictate what is meant by UPFs leading to the inability for others to refine the term for more accuracy. This is where we are headed with UPF being an evocative term that does not represent the scientific opinion of what is good for you.

The Siga Index seems to be better suited to aiming for positive outcomes but associating it with the term UPF then enables people to conflate findings regarding Nova results with Siga results.

>Currently UPF is not similar to this, in that nobody has yet shown that UPFs are a category containing something else which is bad for you.

There are two aspect to this, firstly it is not that there is containing something 'else'. By definition if it meets the criteria of the definition it is not an 'else' but a part of the criteria.

To phrase that a different way is to say it all fits within in the criteria but the criteria itself is not homogenous.

And that's the second problem with your statement. The Nova classification _is_ similar to this.

From Wikipedia

A number of studies show that although UPFs in general are associated with higher health risks, there exists a large heterogeneity among UPF subgroups. For example, although bread and cereals are classified as UPFs, a large 2023 study published in The Lancet finds them inversely associated with cancer and cardiometabolic diseases in the European population (hazard ratio 0.97). The study found that animal-based products (HR = 1.09) and artificially and sugar-sweetened beverages (HR = 1.09) are most strongly associated with diseases among UPFs.

They did find a parallel of Polonium, sweeteners (and another one with animal products)
by mytailorisrich | 2025-10-09 18:34:35+00:00
Not sure what your definition of "privatized" is... fully state-owned means it isn't privatised at all.

The issue is one of legal status. In most countries you can be a commercial company or essentially a branch of the government (leaving aside coops and charities).

So in general you have companies (legal status) but they are fully owned by the state, hence "state-owned company". "Privatized" means the government decided to sell most or all the shares to the public.

Counter example is the USPS in the US, which is an agency of the Federal government.
by interroboink | 2025-10-09 18:35:03+00:00
> Run that on someone else's managed k8s setup ... this way I'm only responsible for my application and its interface.

It's the eternal trade-off of security vs. convenience. The downside of this approach is that if there is a vulnerability, you will need to wait on someone else to get the fix out. Probably fine nearly always, but you are giving up some flexibility.

Another way to get a reasonable handle on the "managing a whole OS ..." complexity is to use some tools that make it easier for you, even if it's still "manually" done.

Personally, I like FreeBSD + ZFS-on-root, which gives "boot environments"[1], which lets you do OS upgrades worry-free, since you can always rollback to the old working BE.

But also I'm just an old fart who runs stuff on bare metal in my basement and hasn't gotten into k8s, so YMMV (:

[1] eg: https://vermaden.wordpress.com/2021/02/23/upgrade-freebsd-wi... (though I do note that BEs can be accomplished without ZFS, just not quite as featureful. See: https://forums.freebsd.org/threads/ufs-boot-environments.796...)
by KPGv2 | 2025-10-09 18:35:05+00:00
> No one was twirling their mustache trying to make people suffer. Someone had a lab, and prestige and control over funding and the best way to keep it all was by being dishonest.

The second sentence and the first sentence are merely literal and figurative descriptions of the same activity.

Also, for this to be true, it has to mean lab workers knew about progress but fucked over their own family with Alzheimers. And it has to mean every single one of them did this.

*Edit* Actually there's another way to interpret what you wrote. My mistake. I imagined a scenario where someone knew of progress and was dishonest by hiding it, but you might've been alluding to someone knowing an avenue wasn't fruitful but was dishonest by making it seem more fruitful.

I think the latter is easier to hide than the former since it doesn't require directly fucking over your family, merely very indirectly by siphoning off a fraction of total funds to be flushed down the toilet.
by surgical_fire | 2025-10-09 18:35:18+00:00
While I agree with the general point of treating coding as any other craft or tradeskill, I disagree that in 40 yers non-technical people will be able to evaluate on system design or data breaches. Programming is too arcane and esoteric for non technical people. It all happens too behind the scenes for people to connect the dots.

I always say that code quality should be a requirement as any other. Many businesses are fine with rough edges and cut corners if it means things are sort of working today rather than being perfect tomorrow. Other businesses have a lower tolerance for fail and risk.
by codegeek | 2025-10-09 18:35:21+00:00
The thing with WordPress is that it increases the attack area using shitty plugins. If I have a WP site, I change wp-config.php with this line:

define( 'DISALLOW_FILE_EDIT', true );

This one config will save you lot of headaches. It will disable any theme/plugin changes from the admin dashboard and ensures that no one can write to the codebase directly unless you have access to the actual server.
by theamk | 2025-10-09 18:35:28+00:00
Well, one of the big upside of the modern smart vacuums is you can see the map it built, set up rooms or zones, do a virtual cleaning, etc... This (1) definitely requires some connectivity, and (2) has to go via central server if the phone is not on same subnet.

Sadly, because of (2), most (all?) companies don't bother with local connectivity at all. Much easier to debug one codepath (via remote server) rather than two (remote server and direct connection).

So yeah, if you are worried about device being remote controlled by its manufacturer, don't buy devices which say "Can be remote controlled" right on the box. But of course then you are back to ancient tech, setting physical virtual wall devices or bounding the clean area with overturned chairs.
by xnx | 2025-10-09 18:35:48+00:00
Might be before your time (1993): https://en.wikipedia.org/wiki/National_Partnership_for_Reinv...

> elimination of over 100 programs, the elimination of over 250,000 federal jobs, the consolidation of over 800 agencies

Didn't solve all budget issues, but was a legitimate and meaningful effort to reduce waste. Polar opposite of DOGE.
by incomingpain | 2025-10-09 18:35:52+00:00
>While optional, the GIL remains enabled by default in Python 3.14. To turn it off, you need to first compile the Python source code with the --disable-gil flag. This produces a GIL-free interpreter that lets multiple native threads run Python code at the same time. Alternatively, you can streamline the building of a free-threaded version using pyenv.

So it's not so much optional, it's still a pain in the butt to enable; and there's no docker images with it?
by jack_h | 2025-10-09 18:36:04+00:00
You’re only considering one part of the system, not the whole. As the GAO puts it[1]:

> Intragovernmental debt holdings represent federal debt owed by Treasury to federal government accounts—primarily federal trust funds such as those established for Social Security and Medicare—that typically have an obligation to invest their excess annual receipts (including interest earnings) over disbursements in federal securities.

> Debt held by the public represents a claim on today’s taxpayers and absorbs resources from today’s economy, meaning that when an investor buys Treasury securities it is not investing that money elsewhere in the economy.

> Intragovernmental debt holdings reflect a claim on taxpayers and the economy in the future. Specifically, when federal government accounts redeem Treasury securities to obtain cash to fund expenditures, Treasury usually borrows from the public to finance these redemptions.

Or to put it simply the excess contributions are lent to the Treasury who uses it for general government expenditures. When it’s time to pay it back the Treasury can either pay it with tax revenue assuming it has excess or has cut spending elsewhere or it will be forced to borrow it. The latter is generally what happens.

I wouldn’t be so quick to call people ill-informed on this subject if I were you.

[1] https://www.gao.gov/assets/gao-25-107138.pdf
by Karrot_Kream | 2025-10-09 18:36:14+00:00
I think it's a bit tougher than that. On top of what zahlman said, a lot of "casuals" don't really bring much value to a social media site. If you comment once a year you're not really offering much to the conversation. That's what makes this problem so tricky. The most motivated users are usually motivated by something more than intrinsic motivation. The least motivated users just aren't very good users of the platform. A better incentive structure would help incentivize the "moderately motivated" user.
by AzN1337c0d3r | 2025-10-09 18:36:24+00:00
> If all the examples you can conjure are decades old

They're not ALL the examples I can conjure up. MCAS would probably be an example of a modern software bug that killed a bunch of people.

How about the 1991 failure of the Patriot missile to defend against a SCUD missile due to a software bug not accounting for clock drift, causing 28 lives lost?

Or the 2009 loss of Air France 447 where the software displayed all sorts of confusing information in what was an unreliable airspeed situation?

Old incidents are the most likely to be widely disseminated, which is why they're most likely to be discussed, but that doesn't mean that the discussion resolving around old events mean the situation isn't happening now.
by CharlesW | 2025-10-09 18:37:09+00:00
> Did you manually change the status of those particular things?

No, for the specific issue you mentioned, I found and fixed a logic bug. There are some features/capabilities which are manually assigned in cases where there's no CanIUse or MDN data. (Generally, I'm trying to minimize additions/overrides for maintainability's sake.)

> For instance, I just took another look, and I saw that BackgroundSync is not marked as non-standard. But Mozilla are negative on it: […] And Apple have concerns and have not committed to it either:

This is a very fair point, and again I think you for being very generous with your time and expertise. I've reported this as a bug in the data (https://github.com/mdn/content/issues/41455), and manually overridden the data for now as a workaround.

> Personally, I would remove all the non-standard stuff. Not give a big list of standard and non-standard stuff mixed together.

I've added a "Hide Experimental" checkbox, which can also be set/shared in a URL property. I'm not yet sure about making that the default, but I hope it's useful!
by tialaramex | 2025-10-09 18:37:32+00:00
The global allocator GlobalAlloc::alloc method does indeed return a naked pointer

But the (not yet stable) Allocator::allocate returns Result<NonNull<[u8]>, AllocError> --- that is, either a slice of bytes OR a failure.

Vec actually relies on Allocator not GlobalAlloc (it's part of the standard library so it's allowed to use unstable features)

So that interface is allowed to say you asked for 128 bytes but here's 256. Or, more likely, you asked for 940 bytes, but here's 1024. So if you were trying to make a Vec<TwentyByteThing> and Vec::with_capacity(47) it would be practical to adjust this so that when the allocator has 1024 bytes available but not 940 we get back a Vec with capacity 51 not 47.
by razoorka | 2025-10-09 18:37:46+00:00
That’s fair, but the difference isn’t about whether we have linters or not. It’s about outcomes.

In the ’90s, inefficiency meant slower code. Today it means 32GB RAM leaks in calculator apps, billion-dollar outages from a missing array field, and 300% more vulnerabilities in AI-generated code.

We’ve automated guardrails, but we’ve also automated incompetence. The tooling got better, the results didn’t.
by andvari_bekho | 2025-10-09 18:38:11+00:00
Hey gus_massa, thanks a lot for the feedback! Those are some really cool ideas.

For the other players you see in the race, we’re currently picking random players from the database. It would definitely be nice to select a mix of fast, average, and slower cars for a more balanced distribution (that was our original plan), but unfortunately the GameSnacks API doesn’t support that feature yet. Since some hardcore users play a lot, their ghosts tend to show up more often in the pool.

Right now you can already see your own ghost car in the Daily Challenges, but being able to see your “best time ghost” in the standard races is also a really cool idea!