MurphyA/hacker-news huggingface dataset:
by dredmorbius | 2025-10-23 18:21:04+00:00
This is still predicated on correctly identifying "bad behaviour". Given distributed attacks and botnets (often utilising residental / "dial-up" equipment, whether desktops, routers, or IoT (the "S" stands for "security") kit), identifying specific network spaces as hostile still posits a great deal of collateral damage / false positive error.

Mind, I'm strongly in favour of what you're advocating, in theory. And I'm well aware that failing to accomplish this will make the Web far less useful for everyone. But the fundamental challenge remains difficult.
by freedomben | 2025-10-23 18:22:19+00:00
To clarify, I don't mean all humans want to keep all money for themselves even when filthy rich, I just mean that all humans are self-interested. The extent to which that governs our behavior of course differs and I agree there are people who willingly sacrifice to help others. A bit more in another comment: https://news.ycombinator.com/item?id=45683652
by acdha | 2025-10-23 18:22:52+00:00
There aren’t many people out of the closet in repressive regimes, no, but it’s estimated that 5-10% of people will be somewhere on the gay spectrum if allowed (with substantial cultural variation on how they identify themselves and describe their sexuality, of course). It’s exceedingly unlikely that the people in Gaza are freak outliers in this regard, and the population is more than large enough for 5% to mean thousands of people.
by the_gastropod | 2025-10-23 18:23:00+00:00
With all due respect, being "from the other side of the pond", I don't think you understand the U.S. well enough to be commenting. For example, California is both the largest producer of food in the U.S., and the state being most significantly under-represented in all three branches of government.

The U.S. is also, easily, the most volatile (extreme partisanship) country of comparable rich, democratic nations. The system we have is pretty unique in its attempts to bend-over backwards to boost rural voters' importance, and we're worse off in virtually every "bad thing" you mention than countries that don't do this.

Centralization? Our president is independently murdering people in the carribbean, demolishing an entire wing of Whitehouse to build himself a new ballroom, independently changing funding (i.e. has hijacked the power of the purse from Congress), is independently sending in the U.S. military into states run by his political opponents against their will, pardoning violent criminals who supported him (one of whom was caught plotting to murder the House Minority Leader, Hakeem Jeffries), etc.

Rural areas will stagnate / people will move away? Dawg. That's already been happening despite the political concessions they've been given. That ain't the problem.

Urban house prices skyrocketing? Happening. NYC is among the least affordable major cities on the planet.

Crime rate? Generally highest in the places where we give disproportionate political sway to.

Are you suggesting the 66x more representation Wyomingers get over Californians in the Senate isn't enough? Is the ~3.5x more voting power they get in presidential elections not enough? What is a fair "middle ground" in your estimation? Because it feels extraordinarily unfair in the exact opposite direction, to me.

(Editing to add): It's also worth pointing out that this delta in voting power is much more extreme today than it was when this system was designed. In the 1800 census, the most populous state, Virginia, had 885,000 people, around 15x more than Delaware, the least populous state. Today, California has 67x the population of Wyoming.
by tom1337 | 2025-10-23 18:23:32+00:00
So at it's core this is "just" a toolkit to add automatic retries to functions inside another function? I don't know if the audience Vercel is targetig knows about idempotency as well as they should before plastering all their functions with "use workflow".

I guess in the end it's another abstraction layer for queues or state machines and another way to lock you into Vercel.
by Goronmon | 2025-10-23 18:23:39+00:00
Seems premature to accuse the article if being inaccurate or biased without actually knowing whether it's inaccurate or biased.

I’m concerned about human rights, but I’m equally concerned about yellow journalism or coordinated media bias.

I'm equally concerned about people being paid to push narratives in places like Hacker News. Especially in defense of large organizations.
by daxfohl | 2025-10-23 18:23:46+00:00
Yeah but IIUC they're both just representations of embeddings in a latent space, translated from one format to another. So if the image interpretation of a text embedding is full of hallucinations, it's unlikely that the other direction works well either (again, IIUC).

That said, I'll be interested to see what the DeepSeek model can do once they've trained it in the other direction. It'd be great to have it output architecture diagrams that actually correspond to what it says in the chat.
Ask HN: What's your favorite non-tech/not-quite-tech blog?
by 0xEF | 2025-10-23 18:23:50+00:00
As much as we all love tech, here, sometimes we need something to break up that feed of endless articles on LMM this or that, CSS tricks or cybersecurity analysis.

One of my long-time favorites is https://sciencefictionruminations.com/

As an aspiring writer, I really enjoy a lot of the more "out-there" sci-fi that came from the era that Joachim Boaz tends to focus on. It also feeds my love of hunting for gems in used book stores while scratching that itch of wanting to "discuss" a book since I'm lacking in friends that like talking about what they're reading.

I was recently turned on to https://acoup.blog/, which is a delightfully written and fairly educational blog about history...more or less. But it got me wondering what else HN has on their list.

What's that blog in your reader that gets you out of the wires, reminds you that you are more than just your job, or just generally stokes the fires of your curiosity?
by bdcravens | 2025-10-23 18:24:17+00:00
My grandfather, when he was a boy in the 1910s or 1920s built a radio out of a round oatmeal box, copper wire, and a crystal. I never saw the original, but he built a replica of it (featured in a book in the 1970s) that I saw as a child.

https://sg30p0.familysearch.org/service/records/storage/dasc...
Show HN: Isuckatbash – convert plain wording to zsh commands inline
by flippy_flops | 2025-10-23 18:24:27+00:00
(see demo at bottom of gist)

Type your goal then press [ESC]+[;]

ChatGPT explains the command, options, and places the command on your prompt, ready to edit or run.

> $ list images > thinking... > List all JPEG files (case-insensitive) recursively. > $ find . -type f -iname '.jpg' <-- cursor ends here

> $ omg delete the leftover git merge files > thinking... > Find and delete leftover Git merge files (typically named '.orig'). > • find . -type f -name '.orig' # preview > This will permanently delete all '.orig' files. Run without '-delete' to preview files. > $ find . -type f -name '.orig' -delete <-- cursor

> $ ps | grep node > thinking... > Close... 'ps | grep node' works, but often shows less info and may miss some processes depending on your shell/OS. 'ps aux' lists all processes, including the full command line. > $ ps aux | grep node <-- cursor

If there's a tool that does this, I'd love to know because I wrote this one and i suck at bash.
by _heimdall | 2025-10-23 18:25:01+00:00
I agree with you here, that maps to my understanding of what they're intending to do as well.

I'm of the opinion that standing militaries are almost never justifiable at scale. A country may need a skeleton crew keeping some semblance of military infrastructure functional, but we should never need a military scaled up for a fight during peacetime.

We need a populace that is healthy and skilled enough to enlist with basic training should a war break out. We don't need to fully arm up and constantly be on the lookout for war.
by bobbiechen | 2025-10-23 18:25:08+00:00
I think this refers to RFID-embedded playing cards, which have apparently been used at the World Series of Poker before: https://www.wsop.com/news/wsop-livestreaming-all-summer-with...

>The card information will be known to the viewers by using RFID (radio-frequency identification) technology for the very first time at the WSOP. Each card has a microchip embedded in it that has no impact on the cards or play, but with a specially-outfitted poker table, can send an encrypted signal to decipher the card’s rank and suit. The WSOP has used this technology during the 2012-13 WSOP Circuit season with success, and it is found throughout European poker events as well.
by alt187 | 2025-10-23 18:25:41+00:00
> Isn't it more reasonable to explain in excruciating detail what kind of contributions you will allow?

No, it's not. You can read the rule as "If it's obvious enough your code has been LLM-generated, you will get banned" if you feel like the conciseness of the current rule makes you uneasy about using Copilot.

Besides, I suspect in the maintainer's case, banning unreviewed LLM contributions is effectively congruent to banning all LLM contributions.

If you think the rule is unfair towards LLMs because they can do such good, feel free to open a good, clean, useful PR clearly stating how you used the LLM to generate code.
by palmotea | 2025-10-23 18:26:00+00:00
> I don't know if not getting the idea right, but I'm pretty sure people refer to AI outputs as "slop" not due to (only) repetitiveness. According to some sources:

Yeah, slop is low effort use of AI output ("ChatGPT, write me a blog post about using AI in industry X. Copy. Paste. Publish."). If anything this is should be called Stealthslop, and when slop is harder to detect we'll all waste more time on it.
by jjk166 | 2025-10-23 18:26:34+00:00
Big difference between "some organisms hitched a ride and didn't immediately die" and "we created a self sustaining ecosystem that will spread across a wide area in a human relevant period of time." The venn diagram of organisms that can survive on mars, those that can use martian conditions to produce all the energy and nutrients they need to survive long term, and those that would be likely to contaminate a spacecraft likely doesn't have a lot of overlap.
by cryptonector | 2025-10-23 18:26:38+00:00
Bzzt! Wrong! I have worked with ASN.1 for many years, and I love ASN.1. :)

Really, I do.

In particular I like:

- that ASN.1 is generic, not specific to a given encoding rules (compare to XDR, which is both a syntax and a codec specification)

- that ASN.1 lets you get quite formal if you want to in your specifications

For example, RFC 5280 is the base PKIX spec, and if you look at RFCs 5911 and 5912 you'll see the same types (and those of other PKIX-related RFCs) with more formalisms. I use those formalisms in the ASN.1 tooling I maintain to implement a recursive, one-shot codec for certificates in all their glory.

- that ASN.1 has been through the whole evolution of "hey, TLV rules are all you need and you get extensibility for free!!1!" through "oh no, no that's not quite right is it" through "we should add extensibility functionality" and "hmm, tags should not really have to appear in modules, so let's add AUTOMATIC tagging" and "well, let's support lots of encoding rules, like non-TLV binary ones (PER, OER) and XML and JSON!".

Protocol Buffers is still stuck on TLV, all done badly by comparison to BER/DER.
by cogman10 | 2025-10-23 18:27:58+00:00
Sysco isn't the only one, but it is one of the few.

If you start looking at the distribution centers of these companies and the competitors, you get a pretty clear picture of how concentrated things are.

The drop off for the distribution centers of the top 3 is stark. [1]

[1] https://abasto.com/en/advice/food-distributors/
by yyyk | 2025-10-23 18:27:59+00:00
If "newer = better" was my thinking, I'd be all for these new protocols on top of JMAP. But I actually think they're useful only in a limited context.

JMAP is better than IMAP because IMAP is a too stateful design, the IMAP/SMTP distinction allows for misconfigurations where sending doesn't work, has dozens of extensions where key extensions are inconsistently supported, doesn't have as many batched operations, etc. One could make an effort to improve IMAP - but the effort to do this consistently in server software would likely be comparable to adding JMAP and the result worse...

OTOH, the new protocols intrude on areas that go far beyond email software (you're very unlikely to get support for these in older Androids/iOS/Windows even if the modern OSs ever consider them), and don't offer as much as JMAP offers over IMAP. The cost/benefit is worse. They may make sense for a JMAP email client but IMHO not elsewhere.
by deepsun | 2025-10-23 18:28:38+00:00
Wow, I needed to parse just one small ASN.1 with one value (one signature), but I didn't know ASN.1 can have a specification (to generate parser from it). So I ended up untangling it myself, just for that specific 256 bits.

Still I think it's better to have overapecified format for security stuff, json and xml are just too vague and parsers are unpredictable.
by cryptonector | 2025-10-23 18:29:39+00:00
I think you're mistaking this:

> ASN.1 is a... some would say baroque, perhaps obsolete, archaic even, "syntax" for expressing data type schemas, and also a set of "encoding rules" (ERs) that specify many ways to encode values of those types for interchange.

for me expressing disdain for ASN.1. On the contrary: I'm saying those who would say that are wrong:

> ASN.1 is a wheel that everyone loves to reinvent, and often badly. It's worth knowing a bit about it before reinventing this wheel badly yet again.

:)
by dredmorbius | 2025-10-23 18:30:15+00:00
IPs are not shared without limit.

All IPs are allocated to CIDR blocks and Autonomous Systems, the latter identified by their Autonomous System Number (ASN). It's reasonably straightforward and tractable to track good/bad behaviour by either, and (thanks to the Law of Large Numbers and Power Laws), there's virtually always a very small number of absolutely horribly-misbehaved blocks from which a large fraction of abuse originates. Moreover, at sufficiently fine detail, it's possible to identify both friendly and hostile address spaces, permitting carve-outs for the former and scaled response against the latter.

The second part of this approach is that defences need not be all-or-nothing, universal, and/or unscaled. A netblock with a few bad actors might be subject to a slight performance penalty. A netblock with no non-hostile traffic could be blocked entirely (or tarpitted or otherwise subject to negative performance impacts). And of course, reputation data can be shared, as a broader view (one which, say, a large CDN or monitoring service might have) is going to provide both earlier warning and greater detail of where hostile activity originates. And individual instances of good behaviour could be excepted from broader blocks.

Ultimately, connectivity providers, whether of data centres or residential / organisational / mobile Internet services, should be encouraged to police their own outbound traffic and take actions themselves in the event of identified abusive behaviour. (That's been a long-standing dream of mine, it's ... stubbornly refused realisation.)
by noosphr | 2025-10-23 18:30:23+00:00
Search, after Bert, is very much a commodity.

I get better results than Google on segments of common craw using a desktop computer and a research model.

Given that Google has decades of scrapes, and more than four gpus to work with, they can do a better job than me. That I beat them right now is nothing short of embarrassing, bordering on an existential threat.
by siliconc0w | 2025-10-23 18:30:48+00:00
We essentially need to increase taxes to pre-trump levels (we've demonstrably seen that these cuts did not "pay for themselves", they're paid with debt), collect the taxes that are already owed (fund the IRS), and fix healthcare spending (which everyone knows is broken in at least half a dozen different ways).

Fixing healthcare is essentially PBM reform, price transparency, drug negotiation, deregulation to increase supply, and subsidized GLP-1s since metabolic illness/chronic disease is like 90%+ of costs.

If we increase revenue and decrease healthcare costs, we could get to within 3% of GDP.
by SoftTalker | 2025-10-23 18:31:00+00:00
Drives me nuts too. All the stuff like "OK let me do..." Or "I agree ..." stop talking like a person.

I want the star trek experience. The computer just says "working" and then gives you the answer without any chit-chat. And it doesn't refer to itself as if it's a person.

What we have now is Hal 9000 before it went insane.
by dreadsword | 2025-10-23 18:31:14+00:00
You're right --- incoming & outgoing end up being redundant on the "Recent" view.

Where they're (more) relevant is in the "Top" view where the LLM editor has picked a subset of stories to be categorized as top and incoming/outgoing are the ones that didn't make the cut, organized by timeliness.

Definitely a gap in design!
by edbaskerville | 2025-10-23 18:31:16+00:00
I think the really interesting problem in this space is designing UIs and data structures that, on the one hand, capture as much user intent as possible, but, more importantly, make it easier for users to manage conflicts.

I.e., if there's a tricky conflict, the app need not resolve it at all. Rather, it should provide, by default, a nice way for the user to manage the resolution as part of the normal workflow.

Or, phrased another way, conflicts aren't conflicts. Parallel, "conflicting" edits are simply a state of affairs that is inherent to the process, and are still reflected in the data structure after merging all edits.

How this would actually look would probably vary from domain to domain. But my general philosophy on this stuff is that if complexity is real and potentially important to the user, the software should expose the complexity and enable the user to manage it, not force a simplification that hides something important.
by jampa | 2025-10-23 18:31:21+00:00
I don't understand why people advocate so strongly for `--dangerously-skip-permissions`.

Setting up "permissions.allow" in `.claude/settings.local.json` takes minimal time. Claude even lets you configure this while approving code, and you can use wildcards like "Bash(timeout:*)". This is far safer than risking disasters like dropping a staging database or deleting all unstaged code, which Claude would do last week, if I were running it in the YOLO mode.

The worst part is seeing READMEs in popular GitHub repos telling people to run YOLO mode without explaining the tradeoffs. They just say, "Run with these parameters, and you're all good, bruh," without any warning about the risks.

I wish they could change the parameter to signify how scary it can be, just like React did with React.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED (https://github.com/reactjs/react.dev/issues/3896)
by cadamsdotcom | 2025-10-23 18:31:27+00:00
Not impenetrable, just contrarian. China is doing the robot thing so it can cope with demographic shifts as it shifts toward an older population and deals with youth not wanting to do tedious/dangerous factory work.

Automation at huge scale while maintaining the industrial base will allow a shift toward a more consumption driven economy but still keeping things cheap. Might be the only way to keep things from toppling with their huge population.
by cma | 2025-10-23 18:31:51+00:00
skills like someone said, or make CLAUDE.md be something like this:

Run ./CLAUDE_md.sh

Set auto approval for running it in config.

Then in CLAUDE_md.sh:

cat CLAUDE_main.md cat CLAUDE_"$(hostname)".md

Or

cat CLAUDE_main.md echo "bunch of instructions incorporating stuff from environment variables lsbrelease -a, etc."

Latter is a little harder to have lots of markdown formatting with the quote escapes and stuff.
by DiogenesKynikos | 2025-10-23 18:33:50+00:00
> The USSR absolutely co-started WWII, the whole meaning of the Molotov-Ribbentrop pact was to divide Eastern Europe into a Soviet part and a German part.

This is a complete rewrite of the history of WWII. The USSR did not initiate WWII. It was Nazi Germany that drove the escalating conflict and aimed to conquer Europe.

The argument you're making could be turned around to say that Poland co-started WWII when it conspired with Nazi Germany to annex part of Czechoslovakia - something that Poland actually did in 1938. And by the way, at that time, the USSR was willing to go to war to defend Czechoslovakia from Nazi aggression, and it was Poland that blocked that idea by refusing to cooperate with the USSR. But that argument would be equally wrong as your argument: Poland simply acted opportunistically, while Germany was the one driving the conflict.

After the British and French sold out Czechoslovakia, the Soviets did an about face and decided to make a deal to save their own skin. Stalin was deathly afraid of a German invasion of the USSR, and wanted to make sure that Germany did not launch its war against the USSR first. Again, the driving factor in this was the knowledge that Germany was preparing for aggressive war. Without that, there simply would not have been WWII. The USSR was not planning any offensive war, nor was it in any position to launch one. Stalin was busy purging the Red Army officer corps.

Stalin was absolutely a coward on this issue. He was paralyzed by fear of a German invasion. He refused to accept the many different strands of intelligence which indicated that a German invasion was imminent. He kept sending supplies to Germany until the day of the invasion, in order to buy off the Germans. He was even told the exact date of the invasion by Richard Sorge, and he ignored it. The Red Army was caught completely flat-footed. Most of the air force was wiped out on the ground. That's not the sign of a country ready for an imminent war. Again, it was Germany driving events.

I do think you should be thankful to the USSR for saving you and your country from annihilation and extermination. They sacrificed millions of people to do so.
by pixl97 | 2025-10-23 18:34:45+00:00
It's been talked to death in other threads already, but typically when you provide a service, even if it's free, it is polite to give warning that you will stop providing said service in the future.

If they are trying to push people to commercial services I typically attempt to steer away from companies that make rash decisions with a moments notice, rather than ones that would leave you high and dry.
by simonw | 2025-10-23 18:34:45+00:00
I wrote a tool for that: https://github.com/simonw/files-to-prompt - and there are other similar tools like repomix.

These days I often use https://gitingest.com - it can grab any full repo on GitHub has something you can copy and paste, e.g. https://gitingest.com/simonw/llm
by proee | 2025-10-23 18:35:23+00:00
Walking through TSA scanners, I always get that unnerving feeling I will get pulled aside. 50% of the time they flag my cargo pants because of the zipper pockets - There is nothing in them but the scanner doesn't like them.

Now we get the privilege of walking by AI security cameras placed in random locations, hoping they don't flag us.

There's a ton of money to be made with this kind of global frisking, so lots of pressure to roll out more and more systems.

How does this not spiral out of control?
by phkahler | 2025-10-23 18:36:07+00:00
>> Omnilert later admitted the incident was a “false positive” but claimed the system “functioned as intended,” saying its purpose is to “prioritize safety and awareness through rapid human verification.”

No. If you're investigating someone and have existing reason to believe they are armed then this kind of false positive might be prioritizing safety. But in a general surveillance of a public place, IMHO you need to prioritize accuracy since false positives are very bad. This kid was one itchy trigger-pull away from death over nothing - that's not erring on the side of safety. You don't have to catch every criminal by putting everyone under a microscope, you should be catching the blatantly obvious ones at scale though.