MurphyA/hacker-news huggingface dataset:
by zahlman | 2025-11-10 20:32:50+00:00
> Saying "I know how LLMs work because I read a paper about transformer architecture" is about as delusional as saying "I read a paper about transistors, and now I understand how Ryzen 9800X3D works". Maybe more so.

Which is to say, not delusional at all.

Or else we have to accept that basically hardly anyone "understands" anything. You set an unrealistic standard.

Beginners play abstract board games terribly. We don't say that this means they "don't understand" the game until they become experts; nor do we say that the experts "haven't understood" the game because it isn't strongly solved. Knowing the rules, consistently making legal moves and perhaps having some basic tactical ideas is generally considered sufficient.

Similarly, people who took the SICP course and didn't emerge thoroughly confused can reasonably be said to "understand how to program". They don't have to create MLOC-sized systems to prove it.

> It takes actual reverse engineering work to figure out how LLMs can do small bits and tiny slivers of what they do. And here you are - claiming that we actually already know everything there is to know about them.

No; it's a dismissal of the relevance of doing more detailed analysis, specifically to the question of what "understanding" entails.

The fact that a large pile of "transformers" is capable of producing the results we see now, may be surprising; and we may lack the mental resources needed to trace through a given calculation and ascribe aspects of the result to specific outputs from specific parts of the computation. But that just means it's a massive computation. It doesn't fundamentally change how that computation works, and doesn't negate the "understanding" thereof.
by NobodyNada | 2025-11-10 20:32:58+00:00
Limiting to the "top 5" vulnerabilities by number of CVEs feels like cherry-picking. It's true that spatial memory safety is lower-hanging fruit than temporal memory safety, sure; but the CVE list is dominated by vulnerabilities in web applications which are mostly already written in fully memory-safe languages (additionally, these vulnerabilities are typically mitigated by library/API design rather than by programming language design, in which case Rust gives you quite a lot more tools than Zig for designing APIs that have concepts of unsanitized/untrusted data, but I digress). If you filter for vulnerabilities relevant to applications that would typically be written in C/C++/Rust/Zig, use-after-free is easily within the top 5.

The exact positioning within the top 10 is also quite noisy: if you look at last year's list, UAF is in the #1 spot for actively exploited vulnerabilities, even beating out all the web ones: https://cwe.mitre.org/top25/archive/2023/2023_kev_list.html

Lastly, filtering on CVEs has a high selection bias: just because security researchers go for the easy vulnerabilities first doesn't mean that the harder ones can be ignored. As high-profile projects adopt tooling and mitigations to reduce the impact of spatial memory safety problems, it's common to see a sudden increase in CVEs related to temporal memory safety. This is not because use-after-free bugs somehow became more common or severe -- it's because once you eliminate the easy source of vulnerabilities, the attackers shift their attention to the new lowest-hanging fruit.
by paganel | 2025-11-10 20:33:19+00:00
Stupid question here, because I haven't flown with Ryanair in like almost 10 years, but I've recently flown with WizzAir and after checking-in online (the night before) it generated a .pdf boarding pass which I saved on my phone. I was then able to get onto the plane by presenting the QR code from said .pdf, i.e. while I was at the gate, no need for internet access. Does Ryanair do things differently?
by ACCount37 | 2025-11-10 20:33:38+00:00
It's trained on them, yes. But is it trained to prefer them as sources when doing web search?

The distinction is rather important.

We have a lot of data that teaches LLMs useful knowledge, but data that teaches LLMs complex and useful behaviors? Far less represented in the natural datasets.

It's why we have to do SFT, RLHF and RLVR. It's why AI contamination in real world text datasets, counterintuitively, improves downstream AI performance.
by benoau | 2025-11-10 20:33:48+00:00
> I wonder how many games are impossible to preserve because of the copyright system and apathy on the part of rights-holders.

Pretty much all of them.

Your Steam licenses are forfeit when you die and your games and account are non-transferable. So when a game stops being sold anymore, which can happen for lots of reasons, there is a finite pool of licenses that becomes zero over time.

As are your GOG, App Store, Play Store and everything else digital purchases.

By the end of this century anything that was sold on Steam will be long-gone. Much, much faster for the App Store since they charge $100/year and oblige updating apps periodically regardless of if they are necessary.

Although in GOG's defense they alone have mentioned a workaround for this status quo.

> “In general, your GOG account and GOG content is not transferable,” GOG spokesperson Zuzanna Rybacka tells Ars. “However, if you can obtain a copy of a court order that specifically entitles someone to your GOG personal account, the digital content attached to it, taking into account the EULAs of specific games within it, and that specifically refers to your GOG username or at least email address used to create such an account, we’d do our best to make it happen.”

https://arstechnica.com/gaming/2024/06/gog-will-transfer-you...
by sumtechguy | 2025-11-10 20:33:53+00:00
Projects like eXoDOS and DOSBox (and its derivatives) have basically allowed most of DOS and win31 games to be in a very playable state. GoG is doing the detective work of finding out who owns it and trying to monetize parts of it as well as fixing some of their own stuff. When it comes to many of the late 90s win9x/winxp games those are in the territory of 'maybe runs'. Due to the way windows is subtly changing the API and what a standard windows install comes with. Also APIs that now return even more stuff than what they tested with. Such as a video caps function may now return 500 items when it was tested to run with 60 and the input buffer maxes at 256. Never mind many of them act totally bugged out if you hand it a 4k screen and you have scaling turned on.

Had one game from a few weeks ago that I could not get to run. Turns out it was an intel video driver bug. Really old intel driver worked. One from 2 years ago didnt. One from a few weeks ago did. Old nvidia worked, newer ones broken. One windows box worked the other didnt. Shims like dgVoodoo2 and dxwrapper help to a point But still have lots of issues. Then on top of that if there is a online component the game will at best hang/timeout at worse crash out. Have one game if I open the leaderboard on it will crash the game. The board was apparently turned off 15 years ago.
by wiz21c | 2025-11-10 20:33:57+00:00
> The goal is to build digital “twins” of the experts on how they debug, architect, and maintain these systems in practice.

Sounds great but... I have migrated a big cobol codebase several years ago. Knowledge stored in the experts is 1/ very wide 2/ full of special cases that pop up only a few times in a year 3/ are usually complex cases involving analysing data, files which are on paper, etc. I strongly doubt an AI will be able to spot that.

The knowledge that usually misses the most is not "how is that done", because spending a few hours on COBOL code is frankly not that hard. What misses is: "why". And that is usually stored in laws, sub-sub-laws, etc. You'll have to ingest the code and the law and pray the AI can match them.

So in the end the AI will make probably 50% of the effort but then you'll need 150% to understand the AI job... So not sure it balances well.

But if it works, well, that's cool because re-writing cobol code is not exactly funny: devs don't want to do it, customers do it because they have to (and not because it'll bring additional value) and the best outcome possible is the customer saysing to you "okay, we paid you 2mio and the new system does the same things as before we started" (the most likely outcome, which I faced, is "you rewrote the system and its worse than before). So if an I can do it, well, cool.

(but then it means you'll fire the team who does the migration which, althgouhg is not funny and not rocket science, requires real expertise; it's not grunt work at all)
by otterdude | 2025-11-10 20:34:03+00:00
The answer if for congress to make a legal definition of corporation, instead we get the justice system coming up with a handwavy explanation that helps out their golfing buddies.

The answer is to get rid of the common law justice system and codify laws in congress like a civil law system. That way you dont get rich people trying to buy favors or "tip" judges.
Show HN: Sportfolio – Stock market for sports where fans trade players
by RuehlJohnson | 2025-11-10 20:34:18+00:00
Hey HN, we’re Ruehl, Owen, and Gavin. We’re building Sportfolio (https://sportfolio.gg/), a stock market for sports where fans trade players.

Demo video: https://www.youtube.com/watch?v=KF6bnx9S4J4

We noticed that while sports betting is very popular, it’s mostly you vs. the app and not very social. However, everyone is already watching the same game together, talking about the players, and reacting to every play in real time. We wanted a game with those aspects.

On Sportfolio, you join a weekly tournament, start with the same set of player shares as everyone else, and trade anytime to build the best portfolio. Player performance drives share prices in real time, and there’s a live leaderboard showing how you compare to friends and other users.

Everything is free-to-play right now. This is our first public launch, and we'd love your feedback on the product (UI/UX, trading model, the “fun” aspect, overall engagement).

Thanks for checking it out.
by StrangeDoctor | 2025-11-10 20:34:39+00:00
While it’s true it also seems kinda worthless through broad applicability and ties moral values to power or money, which I don’t think many people would agree with.

Every US president since FDR would have “not killing everyone” as a value by not hitting the big red button. Almost nobody else will get to be tested in that way. Is that actually a value?

There is also a private information problem. If it never occurred to me to defraud investors, but it was retroactively discovered I could have (and gotten away with it?), do I get the “doesn’t defraud” value? Does the more evil version of me get the value, as long as they thought of it but didn’t act on it?
Supply Chain Alert: Sipeed's Official COMTools Software Flagged as Trojan
by dripmet | 2025-11-10 20:34:42+00:00
Sipeed is a Chinese hardware manufacturer known for embedded AI systems, RISC-V development boards, and edge computing modules (K210 AI accelerators, MaixSense ToF cameras, LicheeRV boards). They're fairly established in the maker and embedded systems community.

I downloaded their official COMTools utility (serial communication tool for device configuration) directly from their distribution server at dl.sipeed.com - the link provided in their official documentation.

Multiple security scanners are flagging it as trojan malware:

VirusTotal: https://www.virustotal.com/gui/file/66b9b83687f4579e0de629eb63b9d41ef0c3cc2e4f03546d0fe6374de76c69f8/detection

Hybrid Analysis: https://hybrid-analysis.com/sample/66b9b83687f4579e0de629eb63b9d41ef0c3cc2e4f03546d0fe6374de76c69f8/690e6b0ff38090310e09c79d

More concerning than the detections is the observed behavior: - Random cmd.exe processes spawning periodically - Persistent background activity - BitLocker recovery triggered after offline virus scan - Suspicious network connections

This goes beyond typical false-positive behavior seen with some Chinese development tools (which sometimes lack proper code signing or use aggressive system access).

Two possibilities: 1. Supply chain compromise - their dl.sipeed.com server is serving modified binaries 2. Aggressive false positive (seems less likely given the behavioral indicators)

I'm currently comparing SHA256 hashes between the website version and their GitHub releases to determine if there's a discrepancy.

If this is a supply chain attack, it could affect a significant portion of the embedded systems development community, particularly those working with AI edge devices and RISC-V systems.

I've reported to Sipeed, Microsoft Security, and various security researchers. Has anyone else in the HN community used Sipeed products and can verify their COMTools installation?

SHA256 of flagged file: 66b9b83687f4579e0de629eb63b9d41ef0c3cc2e4f03546d0fe6374de76c69f8 Official (potentially compromised) source: https://dl.sipeed.com/shareURL/MaixSense/MaixSense_A010/software_pack/comtool
by tialaramex | 2025-11-10 20:35:03+00:00
Yes, the metaphor here is that of perhaps a military officer drawing a line and soldiers are expected to stand along the line, so their toes will touch the line. It's about obedience.

Early examples are clearly about standing in an orderly formation, and also sometimes use alternative words such as "mark" instead of "line" - which wouldn't make sense for tow. You could tow a line, but it's unclear how one might tow a mark.
by csallen | 2025-11-10 20:35:53+00:00
> After about 3-4k lines of code I completely lost track of what is going on... Overall I would say it was a horrible experience, even though it took 10 hours to write close to 10000 lines of code

It's hard to take very much away from somebody else's experiences in this area. Because if you've been doing a substantial amount of AI coding this year, you know that the experience is highly dependent on your approach.

How do you structure your prompts? How much planning do you do? How do you do that planning? How much review do you do, and how do you do it? Just how hands-on or hands-off are you? What's in your AGENTS.md or equivalent? What other context do you include, when, why, and how? What's your approach to testing, if any? Do you break down big projects into smaller chunks, and if so, how? How fast vs slow are you going, i.e. how many lines of code are you letting the AI write in any given time period? Etc.

The answers to these questions vary extremely wildly from person to person.

But I suspect a ton of developers who are having terrible experiences with AI coding are quite new to it, have minimal systems in place, and are trying "vibe coding" in the original sense of the phrase, which is to rapidly prompt the LLM with minimal guidance and blindly trust its code. In which case, yeah, that's not going to give you great results.
by mrtksn | 2025-11-10 20:36:38+00:00
I don't think its about regulation, its the mindset. Since some time there's this trend of indie European developers with some who managed to make themselves a name like Peter Levels and be hosted on big podcasters and these people keep calling their projects "startups" and making about as much as a high street kebab shop(in this community they like to boost about their revenues). Levels is famous enough to be interviewed by Lex Friedman and in this 4 hours talk they mention how an American company just took his idea and copied his ways and made 30 million dollars by making an iOS app of it and Levels talks as if it never crossed his mind to be the person who did it and make serious money.

Also he constantly complains about regulations etc but some striking things come out of it from time to time. For example he complains that its hard to get access to the EU's supercomputer and compares this to US where you can just buy tens of thousands of GPUs from Nvidia and not go through the EUs bureaucracy and never occurs to him that you can do the same in EU and the the EU funded supercomputer is just an extra.

Its just so weird, the mentality is very different. Maybe it works when you are working on a niche and it is a good way of making a living or even getting rich but that's not how you build empires.

The regulations are just a meme at this point, no one seems to know what regulation stopped them from doing the thing they will do. IMHO the reality is that you can just built the thing in USA and access EU markets from there and there's no need for replication in EU, therefore EU has plenty of startups but very few scale ups and unicorns and that's not going to change unless EU closes its markets to USA.
by zahlman | 2025-11-10 20:37:00+00:00
> What more are human brains than piles of wet meat?

Calculation isn't what makes us special; that's down to things like consciousness, self-awareness and volition.

> The main reason to say "LLMs are just next token predictions" is to stop thinking about all the inconvenient things. Things like...

They do it by iteratively predicting the next token.

Suppose the calculations to do a more detailed analysis were tractable. Why should we expect the result to be any more insightful? It would not make the computer conscious, self-aware or motivated. For the same reason that conventional programs do not.
by thewebguyd | 2025-11-10 20:37:13+00:00
What we have is a severe lack of enforcement of the laws we do have.

We do have legal mechanisms to hold the individual people criminally liable for criminal offenses the corporation commits, the problem is we don't enforce it.

Boeing just got off scott free for killing 338 people. DOJ told the judge to dismiss the case.

We've also neglected to enforce our own anti-monopoly laws for far too long, and most recently when there could have been actual, real change, we let Google go with nothing more than a slap on the wrist.

The laws aren't the problem, the corrupt and paid for DoJ is the problem.
by saintfire | 2025-11-10 20:37:40+00:00
Except that natural language is imperfect, as are lawmakers, as are lawmaking processes.

Following exclusively the letter of the law, even where unambiguous, is not a win. That's effectively how people are trying to skirt the intent of a law (see: every corporation).

The letter and the spirit are both important. Judges make bad judgments, they also make good judgements. Such is life.
by jlokier | 2025-11-10 20:38:00+00:00
From the article, I'm suprised at this unusual twist:

> What about that second TCN?

> On the 1st of October, the Home Office issued a second TCN against Apple for the same as before, but only for _British citizens’_ data. World-leading!

> Those who follow my work know that this phrase made me spew a double barrel of Glaswegian swearing. British citizens’ data, as opposed to British users’ data? The dividing line here is not e.g. being located in the UK or having registered an account here, but what it says on your passport? How is Apple going to know that, much less roll it out? (/s)

> Did Apple just publicly state that they’re going to be removing a security layer and adding a nationality check layer?

> We don’t know.

> We don’t know because as with the first TCN, that information only became available in the public domain due to someone leaking it to the media. That’s all there is to know. Everything else is confidential and NCND. There is nothing else to say because nothing else is known. If someone who did know something was sitting across from me right now, and they told me, they would be committing a crime.

Does that mean my non-UK citizen friends who are resident in the UK now have better privacy rights than UK citizens in the UK? Does it mean it's better to remain only a resident, than to attempt to obtain citizenship in the long run?
by valdezm | 2025-11-10 20:38:12+00:00
Location: San Francisco, CA

Remote: Yes

Willing to relocate: No, staying in Bay Area

Technologies: 15 years full stack - react and ruby, etc. -- but very broad bleeding edge. Build 0-1 products with Founders for 10+ years. Built geosite.io first year beta/foundation before entering Y-Combinator in 2019. Building AI in 2025 - competed and won Hacking Agents Hackathon put on by Datastax (Langflow) at Cloudflare in March 1st 2025. Spent 4 months in 2025 building an POC AI marketplace, https://goodbruce.com

Building startups @ http://sharedfounders.com/ (helping founders take their ideas built on platforms like v0.dev, lovable.com, replit.com, bolt.new, base44.com from AI generated scaffolding to Production)

More: https://www.linkedin.com/posts/markavaldez_ai-activity-73922...

Résumé/CV: https://valdezm.com https://www.linkedin.com/in/markavaldez/

Email: hello@valdezm.com
by galaxyLogic | 2025-11-10 20:39:12+00:00
> LLMs should not be seen as knowledge engines but as confidence engines.

The thing I like best about LLM is when I ask question about some technical problem, and it tells that it is a KNOWN problem. It thus gives me confiidence that I don't need to spend time) to look for solution where there is no good soloution. Just go around it somehow. It let's me know I'm not the only person with this problem. And that way it gives me confidence that I'm not stupid, the problem is a real problem.

As an example I was working with WebStorm and tried to find a way to make the Threads-tab the default tab shown when debugger opens. AI told me there is no way it knows about. Good, problem solved, solved by finding out there is no solution.
by niam | 2025-11-10 20:39:26+00:00
"Money is speech" is kind of a misleading interpretation because it comes with all sorts of baggage that people typically infer from a thing "being speech".

Phrased another way: the argument is that limiting one's ability to spend is practically a limitation on their speech (or their ability to reach an audience, which is an important part of speech). If some president can preclude you from buying billboards, or web servers, or soapboxes on which to stand: he has a pretty strong chokehold on your ability to disseminate a political message.

I'm not defending that argument, only saying what it is as I understand it.
by esafak | 2025-11-10 20:39:39+00:00
I took a look at Qodo and left because there is barely any activity on Github or Discord, and their releases only contain media, as if by mistake: https://github.com/Codium-ai/codiumai-jetbrains-release/rele... and their issues are piled up: https://github.com/Codium-ai/codiumai-jetbrains-release/issu...
by whatevertrevor | 2025-11-10 20:39:42+00:00
I don't think the general hatred of corporate personhood stems from the logical or taxonomic absurdity of it. Rather, I sense it comes from the perceived effects of it, that in their eyes allow corporations to get away without paying their "fair share".

I think it's an instrument of convenience that has predictably resulted in a lot of legal tech-debt, which is largely inevitable because of how slow we are at adapting laws to our lived realities.
by mronetwo | 2025-11-10 20:39:54+00:00
> After about 3-4k lines of code I completely lost track of what is going on, and I woudn't consider this code that I have written, but adding more and more tests felt "nice", or at least reassuring.

> There was a some gaslighting, particularly when it misunderstood dap_read_mem32 thinking it is reading from ram and not MEM-AP TAR/DRW/RDBUFF protocol, which lead to incredible amount of nonsense.

> Overall I would say it was a horrible experience, even though it took 10 hours to write close to 10000 lines of code, I don't consider this my project, and I have no sense of acomplishment or growth.

Ah yes, we can now mass produce faulty code, we feel even more alienated from our work, the sense of achievement gets taken away, no ownership, barely any skill growth. Wonderful technology. What a time to bring value to the shareholders!
by NickC25 | 2025-11-10 20:40:01+00:00
> Law enforcement often will not hold itself accountable for violating the laws or your rights

How naive and idealistic to write "often" in that sentence. Law enforcement will NEVER hold itself accountable. Law enforcement has been given carte blanche to violate every constitutional right Americans have. Policing at all levels has been corrupted by overzealous politicians and lobbyists of all shades of blue and red.