MurphyA/hacker-news huggingface dataset:
Codex can read sensitive files outside the CWD without approval
by thomas34298 | 2025-11-25 02:10:46+00:00
If you directly ask Codex to read ~/.ssh/id_rsa, it will usually decline due to "safety concerns". However, the sandbox which the agent is running in doesn't restrict reads outside the working directory in any way and you won't even be asked for approval - it's just a prompt (injection) away. The Codex developers close issues related to this problem and simply suggest running Codex "in a docker container or VM" [1].

To quote the Codex security documentation [2]:

> We’ve chosen a powerful default for how Codex works on your computer. In this default approval mode, Codex can read files, make edits, and run commands in the working directory automatically.

> However, Codex will need your approval to work outside the working directory or run commands with network access. [...]

As a new, naive user (which I was), I'd assume based on the text above that Codex wouldn't be able to extract secrets and read my browser history or whatever else on my PC if I started it in VSCode for example. Running Codex in a Docker container or VM is totally valid and quite a few people are probably doing that, like in a CI/CD pipeline, however, that's definitely the minority.

How is this not a bigger deal? In my experience, other agentic tools like Claude Code give the user much more control in regards to safety and what OpenAI is doing here feels highly irresponsible IMHO.

[1] https://github.com/openai/codex/issues/5237#issuecomment-3536026833

[2] https://developers.openai.com/codex/security/
by ProllyInfamous | 2025-11-25 02:13:11+00:00
I've spent the majority of my adult years poor — only the past few not.

My current community is a dozen identical duplexes primarily housing working class singles. We all rent. It's fairly easy to "temporarily" tie in to other units' utilities, whether power or water... it was only this past summer that I've had to put a lock on our utility closet (various "misunderstandings").

Beginning summer 2024 a shanty-town started establishing itself just the next block over (just outside city limits)... which is worrysome but only for the winter fire risk (seem like mostly down-on-luck working-types).

The previous summer there were a couple months of heavy car repo activity... us commoners are still hanging on, but I fear we won't remain not poorer for too much longer.
by blaiz2025 | 2025-11-25 02:13:56+00:00
I never left pascal. Still code in an ancient Borland Delphi 3 Pro to this day - one slightly hefty license fee way back when for perpetual use was a bargain, unlike today's hefty fees. Still I love it's simplicity, crap-free interface, and blazing fast compilation times.

Have tried the modern community edition of Embarcadero Delphi a couple of times over the years, but found its layers on layers of source code and object inheritance complexity really shocking. I can only imagine the poor souls that have to maintain that mess.

Something like trying to ascertain simple logic pathways through their code in order to understand function limits or compatibility issues was a real nightmare/time consuming. Let alone attempting to predict or change core functionality.

And they did away with 8 bit ANSI strings, which were at times rather handy for some basic IO work and data processing. More than anything, you knew were you stood in your data at all times.

Another annoying thing was there bitmap handler, which required you to lock it in order to access it's internal pixels for data processing - think this was for compatibility with mobile chips - which from my basic observations did a full read and write (copy) of the image data - slowish. A simple binary data handler to mimic a system bitmap got right round that bottleneck.
by stephenr | 2025-11-25 02:14:04+00:00
That would make perfect sense if all branches had to be made from the default branch.

But they don't.

At `$CLIENT` we use `stable` as the default branch.

Use whatever works for you. Getting upset about a default that you can change is like getting upset about the default wallpaper of your OS.

And before you get all persnickety about that argument working both ways: the developers of git, get to decide the defaults and they did.

If you're so upset, fork it, revert the default branch name and maintain it yourself infinitely. That's definitely worth it just to keep a default branch name you like, right?
by codebje | 2025-11-25 02:14:19+00:00
I broadly agree, in the sense of providing the vision, direction, and design choices for the LLM to do a lot of the grunt work of implementation.

The comprehension problem isn't really so much about software, per se, though it can apply there too. LLMs do not think, they compute statistically likely tokens from their training corpus and context window, so if I can't understand the thing any more and I'm just asking the LLM to figure it out, do a solution, and tell me I did a good job sitting there doomscrolling while it worked, I'm adding zero value to the situation and may as well not even be there.

If I lose the ability to comprehend a project, I lose the ability to contribute to it.

Is it harmful to me if I ask an LLM to explain a function whose workings are a bit opaque to me? Maybe not. It doesn't really feel harmful. But that's the parallel to the ChatGPT social thing: it doesn't really feel harmful in each small step, it's only harmful when you look back and realise you lost something important.

I think comprehension might just be that something important I don't want to lose.

I don't think, by the way, that LLM-style prose is the new Esperanto. Having one AI write some slop that another AI reads and coarsely translates back into something closer to the original prompt like some kind of telephone game feels like a step backwards in collaboration to me.
by timschmidt | 2025-11-25 02:14:29+00:00
> It won't learn or grow from the corrections I make in that PR, so why bother?

That does not match my experience. As the codebases I've worked with LLMs on become more opinionated and stylized, it seems to to a better job of following the existing work. And over time the models have absolutely improved in terms of their ability to understand issues and offer solutions. Each new release has solved problems for me that the previous ones have struggled with.

Re: interpersonal interactions, I don't find that the LLM has pushed them out or away. My projects still have groups of interested folk who talk and joke and learn and have fun. What the LLMs have addressed for me in part is the relative scarcity of labor for such work. I'm not hacking on the Linux Kernel with 10,000 contributors. Even with a dozen contributors, the amount of contributed code is relatively low and only in areas they are interested in. The LLM doesn't mind if I ask it to do something super boring. And it's been surprisingly helpful in chasing down bugs.

> Maybe one day it'll reach perfect parity of what I could've written myself, but today isn't that day.

Regardless of whether or not that happens, they've already been useful for me for at least 9 months. Since O3, which is the first one that really started to understand Rust's borrow checker in my experience. My measure isn't whether or not it writes code as well as I do, but how productive I am when working with it compared to not. In my measurements with SLOCCount over the last 9 months, I'm about 8x more productive than the previous 15 years without (as long as I've been measuring). And that's allowed me to get to projects which have been on the shelf for years.

This article by an AI researcher I happen to have worked with neatly sums up feelings I've had about comments like yours: https://medium.com/@ahintze_23208/ai-or-you-who-is-the-one-w...
by teleforce | 2025-11-25 02:14:59+00:00
>The computer is (said to be) live and in use by companies, so cryogenic cooling keeps the system temperature as close to absolute zero as possible to conserve that precious quantum state.

But can it factors 21? [1]

[1] Why haven't quantum computers factored 21 yet?

https://news.ycombinator.com/item?id=45082587
by danny_codes | 2025-11-25 02:15:04+00:00
I think NYT would also (and almost certainly has) written unfavorable pieces about unfettered forums like 4chan as well.

But ad hominem aside, the evidence is both ample and mounting that OpenAI's software is indeed unsafe for people with mental health issues and children. So it's not like their claim is inaccurate.

Now you could argue, as you suggest, that we are all accountable for our actions. Which presumably is the argument for legalizing heroine / cocaine / meth.
by cosmic_cheese | 2025-11-25 02:15:08+00:00
Is there any type of flash-based storage (preferably accessible to end users) that focuses on long term data retention?

If not, that feels like a substantial hole in the market. Non-flash durable storage tend to be annoying or impractical for day to day use. I want to be able to find a 25 year old SD card hiding in some crevice and unearth an unintentional time capsule, much like how one can pick up 20+ year old MiniDiscs and be able to play the last thing their former owners recorded to them perfectly.
by vbezhenar | 2025-11-25 02:15:51+00:00
> It's easy to validate that "grapheneos.org"

Is it? Why not graphene-os.org? Why not graphene.org? Why not grapheneos.com? Why not grapheneos.io? How do you validate it, really?

Also who REALLY controls that domain in the end? Someone with access to `.org` nameservers. Do you trust that person? What's their name?
by cdrini | 2025-11-25 02:15:54+00:00
There have been such a large number of OCR tools pop up over the past ~year; sorely in need for some benchmarks to compare them. Would love to see support for normal OCR tools like tesseract, EasyOCR, Microsoft Azure, etc. I'm using these for some projects, and my experiments with VLMs for OCR have resulted in too much hallucination for me to switch. Benchmarks comparing across this aisle would be incredibly useful.
by johncolanduoni | 2025-11-25 02:16:04+00:00
I don't think it's incoherent. On one extreme you have web standards, where it's now commonplace to not finalize standards until they're implemented in multiple major browser engines. Some web-adjacent IETF standards also work like this (WebTransport over HTTP3 is one I've been implementing recently).

I'm not saying cryptography should necessarily work this way, but it's not an unworkable policy to have multiple projects implement a draft before settling on a standard.
by markjdb | 2025-11-25 02:16:53+00:00
The pf maintainer in FreeBSD has been doing a ton of work to bring more recent improvements over from OpenBSD, trying to bring them in sync as much as possible without breaking compatibility: https://cgit.freebsd.org/src/log/sys/netpfil/pf

The state of affairs you described is much less the case now than in the past.
by Isamu | 2025-11-25 02:17:27+00:00
All sensible points:

>Deployment Lacks Coordination

>AI May Fail to Deliver Technological Progress

>AI Threatens the Workforce

>Economic Growth May Not Materialize

>AI Brings Social Risks

>Party elites have increasingly come to recognize the potential dangers of an unchecked, accelerationist approach to AI development. During remarks at the Central Urban Work Conference in July, Xi posed a question to attendees: “when it comes to launching projects, it’s always the same few things: artificial intelligence, computing power, new energy vehicles. Should every province in the country really be developing in these directions?”
by susiecambria | 2025-11-25 02:17:28+00:00
I wish I could have taken something as a kid. I knew when I was 5 that something was wrong. I felt different from other kids (as least as they said they felt) and that continued through my late 20s when I started taking SSRIs. It was the best decision I've made. Ever.

But back to being a kid and thinking and feeling differently: It negatively impacted me. And the abuse only made it worse. If only I was put on drugs and/or sent to talk therapy.
by questioner8216 | 2025-11-25 02:18:30+00:00
Questions for anyone who is an expert on poisoning in Rust:

Is it safe to ignore poisoned mutexes if and only if the relevant pieces of code are unwind-safe, similar to exception safety in C++? As in, if a panic happens, the relevant pieces of code handles the unwinding safely, thus data is not corrupted, and thus ignoring the poison is fine?
Ask HN: MSRC silently patched my report (Status: "Complete") but denied bounty?
by mambazz | 2025-11-25 02:18:30+00:00
TL;DR: MSRC admitted via email that they "addressed the issue technically," moved the case status from "Develop" to "Complete" (Fixed), but still denied the bounty claiming it was "Content Policy."

Is this "silent patching" behavior common with MSRC recently? It feels like they used the report to patch the product but labeled it "invalid" to save budget. Full evidence & screenshots here: https://x.com/HoangMon158316/status/1993121590939467827?s=20
by __turbobrew__ | 2025-11-25 02:19:11+00:00
I run several clusters a bit over 10k nodes and the etcd db size is about 30-50GiB depending on how long ago defragmentation was run.

It is kindof sad as these nodes are running around 2k IOPS to the disk and are mostly sitting idle at the hardware level, but etcd still regularly chokes.

I did look into kine in the past, but I have no idea if it is suitable for running a high performance data store.

> When your control plane has to span multiple data centers because the electricity cost of the cluster is too large for a single building to handle

The trick is you deploy your k8s clusters in multiple datacenters in the same region (think AZs in AWS term). The control plane can span multiple AZs which are in separate buildings, but close in geography. From the setups I work on the latency between datacenters in the same region is only about 500 microseconds.
by array_key_first | 2025-11-25 02:19:38+00:00
Given what we know about how most Western nations feel about secure communications, what seems more likely?

The reality is that the west got very comfortable with a world where any and all communication can be trivially wire tapped.

Telephony, messaging, and even the internet - these were not only abused, but abused on such a scale that virtually no data could ever be safe from the eye of the state. Even printed media would leak it's location, etched in microscopic ink.

We, unceramoniously and rapidly, yanked this power out from underneath them. For the first time in a very long time, it is possible to have communication which cannot be surveilled.

Knowing what we know about how governments work, are we shocked that there is push back to this? Frankly, the only reason we aren't seeing more abuse is because the big dogs still permit absolute serveillance. I'm sure at the behest of the state.

Projects like grapheneos and signal represent an existential threat to the current model of citizen serveillance and crime solving. Starving dogs will bite.
by AdieuToLogic | 2025-11-25 02:20:54+00:00
>> There's a reason keyboards haven't changed much since the 1860s when typewriters were invented.

> The gist is that keyboards are optimized for ease of use but that there could be other designs which would be harder to learn but might be more efficient.

Here's a relevant trivia question; assuming a person has two hands with five digits each, what is the largest number they can count to using only same?

Answer: (2 ** 10) - 1 = 1023

Ignoring keyboard layout options (such as QWERTY vs DVORAK), IMHO keyboards have the potential for capturing thought faster and with a higher degree of accuracy than other forms of input. For example, it is common for touch-typists to be able to produce 60 - 70 words per minute, for any definition of word.

Modern keyboard input efficiency can be correlated to the ability to choose between dozens of glyphs with one or two finger combinations, typically requiring less than 2cm of movement to produce each.
by ChrisMarshallNY | 2025-11-25 02:20:56+00:00
Back in the day, I used to do OOP with C.

It was a common pattern, back then. We’d pass around structs, and have a small library of functions that accessed/modified the data in these structs.

If you wanted, you could add function pointers to the structs. You could add “polymorphism,” by overwriting these pointers, but it was messy.

That said, inheritance can be very useful, in some cases, like improving DRY. I don’t like to take absolute stances, so much, these days.
by ranie93 | 2025-11-25 02:21:37+00:00
According to wikipedia the reversals can take a while

>Some sources estimate the most recent four reversals took on average 7,000 years to occur. Clement (2004) suggests that this duration is dependent on latitude, with shorter durations at low latitudes and longer durations at mid and high latitudes. Others estimate the duration of full reversals to vary from between 2,000 to 12,000 years.

- https://en.wikipedia.org/wiki/Geomagnetic_reversal

So maybe that's enough time for the biomass to adapt?
by amarant | 2025-11-25 02:21:38+00:00
>and I think it's unequivocally a bad thing that we keep thinking we know better and interfering with it.

I'll believe you actually hold this opinion after you die from an entirely curable decease. Until then I'll assume you actually think we do know better and that our interfering with, for example, bacterial infections, is actually a good thing.

Not to tell you what you think, but this is one of those opinions people seem to think they hold until it's phrased in a way that demonstrates the cost of the idea to them.

Just the fact that you survived long enough to type this comment into HN tells me it's highly unlikely medicine hasn't saved your life at least once already. And if it hasn't, it will.

I can count 5 times of the top of my head that I would've died if not for modern medicine (usually antibiotics, but also one life saving surgery). I would've been rendered a cripple a few times over too!
by mmooss | 2025-11-25 02:21:51+00:00
This is part of the overreaction I described. Nothing the government of France has said publicly indicates any interest in GOS, beyond one quote from one prosecutor. Has there been any direct communication between someone from the government and GOS regarding this issue?

I get that people are outraged, etc. but it's actually damaging the cause. GOS looks like an unreliable partner.
Show HN: I Built a Small Startup Idea Validation Platform
by mhpro15 | 2025-11-25 02:22:31+00:00
It started out when I thought about how to help founder to validate their idea, not just coming up one but how to turn the idea into real business by not relying on AI but making them more involved into their product, understand the market by doing research, check what user want. It's like a checklist, a step for someone who want to get start. This is not an AI to go tool, it's a tool to drag user back to reality, simple but important.

I don't think I'm gonna make money with it so I decide it will be a free to use. Use referral code "beyondzero" to sign up. Thanks
by axiolite | 2025-11-25 02:22:46+00:00
> what happens if you have a work where e.g. the music and the script were written by different people?

This happens ALL THE TIME. 2001 A Space Odyssey, Heavy Metal (1981-Blue Oyster Cult), Rocky (1976) airing on TV without Eye of the Tiger, It's a Wonderful Life was public domain but distributors needed to pay for the soundtrack. TV shows like Married with Children and Dave airing in syndication with different opening theme songs. etc.

All over archive.org you'll find tons of classic films but with the soundtracks stripped out.
by archargelod | 2025-11-25 02:23:14+00:00
Looks nice and pretty light on resources.

But it seems buggy at rendering some unicode characters, I use vertical line[0] for my indentation guides in Neovim, and they look outright hideous in cool-retro-term[1]

[0] https://www.compart.com/en/unicode/U+007C

[1] https://lensdump.com/i/f6qna1
by CobrastanJorji | 2025-11-25 02:23:38+00:00
Neopets wasn't really ABOUT programming. It was just a game for kids. It so happened that there were a lot of dull, repetitive tasks, or tasks that were best done at exact times, the sorts of things that programming could really help with. And there were places to stick some custom HTML for your profiles and such. It was a programming-shaped problem, and so a certain kind of child was happy to embrace programming because they had a problem to solve.

Scratch is ABOUT programming. It tells you "here is programming, you can make games and stuff," and that's neat, but it's a little different.
by TheRoque | 2025-11-25 02:23:45+00:00
Powershell feels like it's not built to be used in a practical way, unlike Unix tools that have been built and used by and for developers, which then feels nice because they are actually used a lot, and feel good to use.

Like, to set an env variable permanently, you either have to go through 5 GUI interfaces, or use this PS command:

[Environment]::SetEnvironmentVariable ("INCLUDE", $env:INCLUDE, [System.EnvironmentVariableTarget]::User)

Which is honeslty horrendous. Why the brackets ? Why the double columns ? Why the uppercases everywhere ? I get that it's trying to look more "OOP-ish" and look like C#, but nobody wants to work with that kind of shell script tbh. It's just one example, but all the powershell commands look like this, unless they have been aliased to trick you to think windows go more unixish
by hopelite | 2025-11-25 02:24:44+00:00
> Where the f*k is all the abundance that AI was supposed to bring into the world? /rant

It may have been a bit self-deprecating, but I think your “rant” is a more than justified question that really should be expanded well beyond just this matter. It’s related to a clear fraud that has been perpetrated upon the people of the western world in particular for many decades and generations now in many different ways. We have been told for decades and generations that “we have to plunder your money and debase of and give it to the rich that caused the {insert disaster caused by the ruling class} misery and we have to do it without any kind of consequences for the perpetrators and no, you don’t get any kind of ownership or investment and we have to do it now or the world will end”
by michaelmrose | 2025-11-25 02:24:58+00:00
There is so much wrong with this. You cannot judge the class of teachers based on a small sample of your taste in women. You didn't actually communicate anything materially wrong with her. You listed a high income area to make us think teachers are overpaid but we have no insight by default into median income in the area or her qualifications.

Lastly its entirely impossible to attract better candidates without more money its just not how the world works.

For reference the median household income in san ramon is about 200k so 2 teachers would be below average. A cop with her experience in the same town makes 158k
by lmm | 2025-11-25 02:25:26+00:00
> Some times I think people with this mentality would be happier if the top of the line GPU models were never released. If nVidia stopped at their mid-range cards and didn't offer anything more, the complaints would go away even though we're not actually better off with fewer options.

If the result was that games were made and optimised for mid-range cards, maybe regular folks actually would be better off.
by coppsilgold | 2025-11-25 02:25:36+00:00
My scrub script:

dd if=$1 of=/dev/null iflag=direct bs=16M status="progress" smartctl -a $1

If someone wants to properly study SSD data-retention they could encrypt the drive using plain dm-crypt and fill the encrypted volume with zeroes and check at some time point afterwards to see if there are any non-zero blocks. This is an accessible way (no programming involved) to let you write random data to the SSD and save it without actually saving the entire thing - just the key. It will also ensure maximum variance in charge levels of all the cells. Will also prevent the SSD from potentially playing tricks such as compression.