MurphyA/hacker-news huggingface dataset:
by TZubiri | 2025-10-09 16:48:07+00:00
> If an attacker knows the WPA2 password, they can intercept traffic.

Oh yes, of course, this is not unlike the capacity of computers in my LAN being able to see my packets, for example if my roommate was a hacker, they would be able to intercept packets while on their way to the router.

Now an interesting thing I've seen in public networks like say Starbucks or McDonalds, they usually don't rely on WPA2 password default security mechanism. I'm not sure what mechanism they use, but they have me log through a browser first.
by vladms | 2025-10-09 16:48:09+00:00
Isn't the ratio that is important? You can have a linear increase in good science. And, intuitively, the bad science would be "fragmented" (many clusters of lunatics) so good science would "prevail" at some point. Most things that I follow seem to have progressed a lot in the last 30 years... (as well as the nutcases, but there were many before as well)

We worry about "bad science", but I read a physicist that claimed that the theory of relativity was really accepted and used only when the older generation (which were generally reasonable scientists) died and not before, because they just would not wrap their mind around "something that different". Which I don't think is the way "we" perceive scientific progress (a scientist looking at proofs/logic/building on others/impartial/rational/etc.)
by dust42 | 2025-10-09 16:48:21+00:00
> How does this square with the video where they showed it running continuously for an hour doing an actual Amazon package sorting job? https://www.youtube.com/watch?v=lkc2y0yb89U

The video shows several of glitches. From the comments:

14:18 the Fall 28:40 the Fall 2 41:23 the Fall 3

Also many of the packages on the left are there throughout the video.

But then I think lots of this can be solved in software and having seen how LLMs have advanced in the last few years, I'd not be surprised to see these robots useful in 5 years.
by boringg | 2025-10-09 16:48:37+00:00
Can anyone tell me why anthropic is releasing this information? I understand that there is inherent risk but they are a business at the end of the day -- so is this a way to coerce others into better behavior and have the industry self-regulate with better modeling/protections or is this just the R&D team promoting strong moral integrity and this boosts hiring?

There is clearly a strategy here - and I'm trying to figure it out.

Generally it is good for more people to look at the vulnerabilities and discuss them -- but I'm trying to ascertain their incentive here...
by renegat0x0 | 2025-10-09 16:48:51+00:00
I self host my Search Engine / RSS reader. I track every page I visit from nearly all devices.

Since my basic search engine is self hosted nobody actually sees what I visit, and what I watch.

This is my conclusion seeing that social media algorithm is totally lost at what I would like to watch next.

Also I am in control over UI, and changes, which is a good and a bad thing
by BrutalCoding | 2025-10-09 16:49:13+00:00
Version 2.0.12:

• Plugin System Released: Extend Claude Code with custom commands, agents, hooks, and MCP servers from marketplaces • `/plugin install`, `/plugin enable/disable`, `/plugin marketplace` commands for plugin management • Repository-level plugin configuration via `extraKnownMarketplaces` for team collaboration • `/plugin validate` command for validating plugin structure and configuration • Plugin announcement blog post at https://www.anthropic.com/news/claude-code-plugins • Plugin documentation available at https://docs.claude.com/en/docs/claude-code/plugins • Comprehensive error messages and diagnostics via `/doctor` command • Avoid flickering in `/model` selector • Improvements to `/help` • Avoid mentioning hooks in `/resume` summaries • Changes to the "verbose" setting in `/config` now persist across sessions
by nixpulvis | 2025-10-09 16:50:04+00:00
Bugs don't matter once you have captured your userbase.

Until then they matter a lot.

One thing that needs to be addressed is how easy it is to build moats around your users which trap them in your ecosystem. It's great from a business perspective if you can pull it off, but it's killing innovation and making users frustrated and apathetic towards technology as a whole.
by mjamesaustin | 2025-10-09 16:50:20+00:00
This therapy doesn't target the amyloid-beta plaques. It repairs the blood brain barrier, and then the body is able to clear away the plaques. Their buildup is a symptom of Alzheimers, not the cause.

The problem with the amyloid-beta hypothesis was the assumption that these plaques were causing the Alzheimers and that removing them by itself could lead to a cure.
by import | 2025-10-09 16:50:39+00:00
Not the OP.

I assume everything running in docker.

For containers: Upgrading new versions can be done headless by watchtower or manually.

For the host: You can run package updates regularly or enable unattended upgrades.

Backups can be easily done with cron + rclone. It is not a magic.

I personally run everything inside docker. Less things to concern.
by TZubiri | 2025-10-09 16:52:02+00:00
Including the US right? And I don't mean in a conspiratorial sense. Just in the sense that they wouldn't deny it because it's their home country (Say Windows certs or Google certs), and at the very least they can issue warrants, gag orders, or triple letter agency bypasses.

Now it only sounds weird when a country exherts their national sovereignity because the US doesn't need to perform any additional steps to install any of their Certs, they have hundreds of them by design.
by mjr00 | 2025-10-09 16:52:05+00:00
Yeah, as someone old enough to have worked at mid-sized companies before cloud-everything became the norm, self-hosting is overly romanticized. People think you'll get a full infrastructure team dedicated to making sure your self-hosted Git/Artifactory/Jira/Grafana/whatever runs super smoothly and never goes down. In reality it ends up being installed by a dev or IT as sort of a side project, and once the config is hacked together (and of course it's a special pet server and not any kind of repeatable infrastructure setup with Ansible or Docker, so yes you're stuck on Ubuntu 12.04 for a decade) they let it "just run" forever because they don't want to touch it (because making changes is the #1 reason for outages) so you're constantly 2+ years behind the latest version of everything.

It's true that outages are probably less frequent, as a consequence of never making any changes, however when something does break e.g. security forces someone to actually upgrade the 5-years-since-end-of-support Ubuntu version and it breaks, it may take several days or weeks to fix because nobody actually knows anything about the configuration because it was last touched 10 years ago by 1 guy who has long left the company.
by dh2022 | 2025-10-09 16:52:29+00:00
There are sales taxes on each sale (GPU sales / Cloud VMs sales / etc...)

Meta point: governments want to tax each money transfer - when people are paid, when selling a real estate property, when selling stocks, when selling goods and services. Every time money changes hands governments want to take a piece. This is the easiest way for me to understand taxation in pretty much any jurisdiction.
by heroprotagonist | 2025-10-09 16:52:38+00:00
Yeah, historically a lot of the aggregators of cellular location data have had huge security issues.

One of them even had a demo page open to the internet that just had a 'Has consent?" checkbox. Showed me my own location within two blocks without any real validation of consent. No options from the vendor to disable this.

Contacting T-Mobile just gets you a PO Box you can mail a letter to.

An article on one of them from years ago:

https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...
by Judgmentality | 2025-10-09 16:52:50+00:00
> Musk's approach is that if you have an infinite supply of fresh grads who really believe in you and are willing to work crazy hours, giving them a "next year" deadline is more likely to give you what you want than telling them "here's your slow-paced project you're gonna be working on for the next decade". And I guess he thinks to himself that some of them are going to burn out, but it's a sacrifice he's willing to make.

This feels incredibly generous. I'm pretty sure his approach is that he needs to keep the hype cycle going for as long as possible. I also believe it's partially his willingness to believe his own bullshit.
by demurgos | 2025-10-09 16:52:51+00:00
That's a nice idea, thank you. I have personal blog, I'll try to clean it up a bit and provide performance measurements so it's worth posting.

Regarding the official documentation, I've returned to read them. I agree that the docs would benefit from more discussion about when to use each method. In particular, the code examples are currently exactly the same which is not great. Still, the most critical piece of information is there [0]

> Prefer `reserve` if future insertions are expected.

If anyone wants to reuse my explanation above, feel free to do it; no need to credit.

[0]: https://doc.rust-lang.org/std/vec/struct.Vec.html#method.res...
by Ingon | 2025-10-09 16:52:57+00:00
I also started self-hosting more and more. But instead of making services available on the internet/intranet (e.g. VPS reverse proxy/tailscale), I'm binding them to localhost and using connet [1] (cloud or self-host [2]) to cast these locally on my on my PC/phone (when I need them). These include my NAS and Syncthing instance running on my NAS and I'm looking to add more.

[1] https://connet.dev

[2] https://github.com/connet-dev/connet
by alexjplant | 2025-10-09 16:53:02+00:00
Anybody that was around for the Windows 95-ME era remembers. Things would just randomly crash. BSODs, "This program has performed an illegal operation", "A device attached to the system is not functioning", "Windows will restart and repair your registry", "Explorer has caused an error"... Ctrl+S was the first keyboard shortcut every schoolchild learned so that Word wouldn't munge their homework.

Let's not even think about the absolute mess that the web was with competing browser box models and DHTML and weird shared hosting CGI setups. We have it easy.
by alexchantavy | 2025-10-09 16:53:27+00:00
In recent years I noticed RSS has gotten way less popular, even in hacker circles (or maybe that's just my perception).

I remember browsers used to have a native RSS button in the main interface and then you could curate your feed. Seems better than any news feed thing gamified to steal my attention. Sigh.

old-man-yells-at-cloud.gif
by mrguyorama | 2025-10-09 16:53:53+00:00
>But then the year that left wing violence finally exceeds right wing

It hasn't even! Like even if you take the Kirk murder as an explicitly left wing murder, "leftist" violence is still not even a shadow of what it used to be in the US

We used to shoot at business magnates for fighting unionization! The weather underground was an explicitly Marxist organization! The black panthers were a black supremacist organization!

Your own source makes the point that the reason left wing attacks "outnumber" right wing ones is that right wing attacks have dramatically decreased

Because when ICE does it, it's not considered a "right wing attack"!
by sailingparrot | 2025-10-09 16:54:15+00:00
For kernel-level performance tuning you can use the occupancy calculator as pointed out by jplusqualt or you can profile your kernel with Nsight compute which will give you a ton of info.

But for model-wide performance, you basically have to come up with your own calculation to estimate the FLOPs required by your model and based on that figure out how well your model is maxing out the GPU capabilities (MFU/HFU).

Here is a more in-depth example on how you might do this: https://github.com/stas00/ml-engineering/tree/master/trainin...
by brendoelfrendo | 2025-10-09 16:54:55+00:00
Yes, but I think it makes sense to point out if you consider that most answers satisfy a small niche. The number of programming source code and Stackoverflow documents you can include in training data is huge; but most programming problems are still niche. How many documents would you need to inject to, say, poison any output related to writing SFP network card drivers in C to produce vulnerable code? Fairly specific, but with a potentially broad blast-area.
by breadwinner | 2025-10-09 16:55:03+00:00
> where people are somehow expected to rewrite all their code from scratch every couple of years or so

You don't need React for this. Vanilla JS is all you need, along with JSX and Web Components. If you are wondering how maintainable that would be see this example: https://github.com/wisercoder/eureka/tree/master/webapp/Clie...
by antisthenes | 2025-10-09 16:55:06+00:00
> Try Windows 98 and contemporary apps and you'll be surprised how janky the experience was. User-facing software wasn't any less buggy 20 or 30 years ago.

Yes, and now compare a fully-patched Windows 7 and Windows 11.

You understand that there aren't just 2 valid points in time for comparison - it's not 2025 and 1995 that are being compared. It's trends of 2020+, or 2015+

> The only thing that has degraded a bit is UI latency, not universally.

Yes, universally. And no, not a bit. It's 10-100x across varying components. Look no further than MS Teams.
Response Rates to Gov Surveys Declining Significantly
by insane_dreamer | 2025-10-09 16:55:09+00:00
Saw this graph[0] in a newsletter[1] and was quite surprised: Survey response rates in the US are below 70% vs over 90% in 2013. I think it's an interesting and negative side-effect of "technological progress" and the ease of communication these days. We're inundated and just want to shut everything off. Not to mention the endless spam calls (I don't answer any number not in my contacts, so a surveyor wouldn't be able to reach me.)

It's a significant problem because if survey responses are low that increases the error margin of the data, and it also means that the gov is just not hearing from its citizens as much.

There's a paper[2] on (some of) the reasons for this.

According to this[3], the UK has the same problem.

AI is only going to make this worse with the ease at which spam calls can be made without a human in the loop.

[0] https://www.bls.gov/cps/methods/response_rates.htm

[1] https://kyla.substack.com/p/chicago-fed-president-austan-goolsbee

[2] https://academic.oup.com/jssam/article-abstract/12/5/1138/7658685?redirectedFrom=fulltext

[3] https://www.census.gov/programs-surveys/cps/about/modernization.html
by nomilk | 2025-10-09 16:55:21+00:00
It's valuable, but at what cost?

The day I forget to run tests before merging I'll set up CI/CD (hasn't happened before, unlikely, but not impossible).

My build process is gp && gp heroku main. Minor commits straight to main. Major features get a branch. This is manual, simple and loveable. And involves zero all-nighters commit-spamming the .github directory :)
by NewUser76312 | 2025-10-09 16:56:19+00:00
People comparing this to GPT-2 is very interesting. While it sounds like a nice analogy or even a good story to investors, the fundamentals are very different.

To train GPT, all of the training data (the internet of text, scanned books, etc) had already existed, even before the GPT project began. Arguably, the compute required (for GPT-3) also already existed, even before GPT-2.

The GPT project really just came down to investing in all of the pieces to take the ideas from a 2017 research paper to the next level. Nobody knew if X thousand GPUs, plus all of the internet's text, plus neural network transformers, would work out. But somebody took a risk in putting together the existing pieces, and proved that it can.

There's no analogy here to humanoid robotics. Not only is the data required for neural network operated humanoids close to non-existent (at the scale needed), but the nature of the data itself is enormously more complicated that taking a list of tokens in a vocabulary, and outputting 1 more token from the same vocabulary.

That being said, I still applaud the ambition of the Figure team. While I think it's clear they are presenting incredibly cherry-picked examples, they aren't trying to mislead consumers with a product for sale (because... they can't). Instead, they are productizing important research to investors, who would otherwise waste money on less important and less ambitious projects. So overall I find projects of this nature to be a net positive for technical innovation.
by ModernMech | 2025-10-09 16:56:24+00:00
I'm thankful they included a compiled language for comparison, because most of the time when I see Python benchmarks, they measure against other versions of Python. But "fast python" is an oxymoron and 3.14 doesn't seem to really change that, which I feel most people expected given the language hasn't fundamentally changed.

This isn't a bad thing; I don't think Python has to be or should be the fastest language in the world. But it's interesting to me seeing Python getting adopted for a purpose it wasn't suited for (high performance AI computing). Given how slow it is, people seem to think there's a lot of room for performance improvements. Take this line for instance:

> The free-threading interpreter disables the global interpreter lock (GIL), a change that promises to unlock great speed gains in multi-threaded applications.

No, not really. I mean, yeah you might get some speed gains, but the chart shows us if you want "great" speed gains you have two options: 1) JIT compile which gets you an order of magnitude faster or 2) switch to a static compiled language which gets you two orders of magnitude faster.

But there doesn't seem to be a world where they can tinker with the GIL or optimize python such that you'll approach JIT or compiled perf. If perf is a top priority, Python is not the language for you. And this is important because if they change Python to be a language that's faster to execute, they'll probably have to shift it away from what people like about it -- that it's a dynamic, interpreted language good for prototyping and gluing systems together.
by jkaplowitz | 2025-10-09 16:56:49+00:00
PAGA can be, and sometimes is, explicitly waived by name and/or by description in arbitration agreements which purport to compel arbitration of even those claims. The Supreme Court recently upheld such a waiver with respect to the individual plaintiffs' claims, but it left open the possibility of a representative PAGA claim; the California courts are still working out whether PAGA still allows such a "headless" claim, with disagreement among different California couts and no ruling yet from the California Supreme Court.

The problem with PAGA in this context is that the citizen is also a party to the arbitration agreement and therefore can be bound by the arbitration agreement, making the Supreme Court's jurisprudence on the Federal Arbitration Act applicable. My proposal avoids this problem since the FAA doesn't prevent citizens from notifying government agencies and doesn't prevent government agencies from suing (except in the rare context of any arbitration agreement to which the government agency is itself a party).

But if you want citizens to have a financial incentive with my proposal, then sure, legislatively give the first person to notify CPPA / CA AG a cut of the eventual proceeds (to be split with anyone else who is the first person to successfully sue for or enforce a corresponding writ of mandamus), and create a way to track who that first notifier is.
by jeppester | 2025-10-09 16:56:57+00:00
I build myself a fedora coreos based nextcloud instance with encrypted backup to S3: https://github.com/jeppester/coreos-nextcloud

In short you fill in the env-files, then run butane and ignition. (I should improve the README some time)

I love how it's all configuration. If it breaks I can set up another instance with the same secrets in minutes. It will then grab the latest backup and continue like nothing happened.
by sam_lowry_ | 2025-10-09 16:57:02+00:00
Here's the step-by-step guide to self-hosting git repositories:

Change directory to your local git repository that you want to share with friends and colleagues and do a bare clone `git clone --bare . /tmp/repo.git`. You just created a copy of the .git folder without all the checked out files.

Upload /tmp/repo.git to your linux server over ssh. Don't have one? Just order a tiny cloud server from Hetzner. You can place your git repository anywhere, but the best way is to put it in a separate folder, e.g. /var/git. The command would look like `scp -r /tmp/repo.git me@server:/var/git/`.

To share the repository with others, create a group, e.g. `groupadd --users me git` You will be able to add more users to the group with groupmod.

Your git repository is now writable only by me. To make it writable by the git group, you have to change the group on all files in the repository to git with `chgrp -R git /var/repo.git` and enable the group write bit on them with `chmod -R g+w /var/repo.git`.

This fixes the shared access for existing files. For new files, we have to make sure the group write bit is always on by changing UMASK from 022 to 002 in /etc/login.defs.

There is one more trick. For now on, all new files and folders in /var/git will be created with the user's primary group. We could change users to have git as the primary group.

But we can also force all new files and folders to be created with the parent folder's group and not user primary group. For that, set the group sticky bit on all folders in /var/git with `find /var/git -type d -exec chmod g+s \{\} +`

You are done.

Want to host your git repository online? Install caddy and point to /var/git with something like

example.com { root * /var/git file_server }

Your git repository will be instantly accessible via https://example.com/repo.git.
by amelius | 2025-10-09 16:57:17+00:00
> They are only competing with other delivery companies.

I don't think this is true. They are trading on the same market as everybody else. People used to make money buying in market A and selling in market B. Now HFT has mostly taken over that role, for instance.

Anyway, finance has created a shitload of abstraction, and at this point it isn't clear if "normal" people benefit from this or that it's just the incumbents.

To make another analogy, yes, feudal lords provided some benefits to the peasants, such as safety and shelter. But you really have to step away from the entire construct to see if they are really better off. This is what is missing in your argumentation, imho.
by intermerda | 2025-10-09 16:58:13+00:00
The fact is that neither the headline nor the article claims that the definition of "protected class" being used is the same exact legal definition used in the US.

The fact is that Apple is saying ICE is a "targeted group" and lays out every single legally protected class along with it. You can look them up if you are unaware.

The fact is that the article backs this point by citing the exact TOS.

You don't care about facts.
by dylan604 | 2025-10-09 16:58:20+00:00
I've grown up with power tools and can easily recognize a no-name brand, so maybe my bias is showing. A big clue is that it is found on Amazon only and no other sites with reputable sales of power tools. Another clue is when the descriptions are broken English from a bad translation. There are all sorts of red flags that are obvious when you know to look for them. Even the brand name items are suspect for the simple fact they are listed on Amazon. I trust nothing with comingling inventory and other Amazon shenanigans. I'd trust Harbor Freight before anything purchased from Amazon