MurphyA/hacker-news huggingface dataset:
by CuriouslyC | 2025-11-16 12:55:44+00:00
IMO AI favors attackers more than defenders, since it's cost prohibitive for defenders to code scan every version of every piece of software you use routinely for exploits, but not for attackers. Also, social exploits are time consuming, and AI is quite good at automating them, and these can take place outside your security perimeter, so you'll have no way of knowing.
by oskarkk | 2025-11-16 12:55:48+00:00
The LLM was given Anthropic's paper and asked "Is there any evidence or proof whatsoever in the paper that it was indeed conducted by a Chinese state-sponsored group? Answer by yes or no and then elaborate". So the question was not about facts or recent events, but more like a summarizing task, for which an LLM should be good. But the question was specifically about China, while TFA has broader criticism of the paper.
by yetihehe | 2025-11-16 12:57:38+00:00
As a person who would like to excuse my overeating on confirmed problems with blood sugar, I agree with you fully. We have different amount of willpower in different situations and in the same situation between different times of day. But we still have some agency, it's not fully predetermined. And like being overweight, training can help. I would even say that combating fat needs willpower and increases your available willpower too.
by zaphar | 2025-11-16 12:57:54+00:00
As a purely anecdotal datapoint, Perplexity was my first stop search engine for a while. It stopped being my first stop when they starting prompting me constantly to try their browser. Getting in the way of me being able to immediately ask my question drove over to gemini instead. It turned out that Gemini was good enough now so I didn't go back.
by alentred | 2025-11-16 13:00:02+00:00
I think, maybe the part of the problem is that it is sometimes easier to accept the situations as they are, even if we suffer from some, than trying to resolve them. Not better, but easier. Or, at least seems easier.

Imagine trying to be conscious about every life situation and to "actually try" to do what's best every single time. How much effort this would take? So, we develop habits instead. Maybe the question is how to place the cursor between relying on habits and consciously trying. How to develop the internal mechanism to detect the condition when "actually trying" is better in long term than falling back to a habit? How to even define this condition?
by kace91 | 2025-11-16 13:00:56+00:00
What kind of integration is a full project? Integrating language support for example is usually just heading to the plugins section, searching for the language and clicking install on the most mainstream result.

My config for vscode is just like 5 lines to make keyboard travel between panes a bit more vim like, other than that I never needed to change much from defaults.

For neovim the work to make it ide-like is a large list of plugins and its integrations, large enough that I’m comfortable outsourcing the consistency to a distro (lazyvim).
by ACCount37 | 2025-11-16 13:01:24+00:00
As if that makes any difference to cybercriminals.

If they're not using stolen API creds, then they're using stolen bank accounts to buy them.

Modern AIs are way better at infosec than those from the "world leading AI company" days. If you can get them to comply. Which isn't actually hard. I had to bypass the "safety" filters for a few things, and it took about a hour.
by thrw888 | 2025-11-16 13:01:30+00:00
This was before current administration. FedEx charged me $60 AFTER delivery of $30 hat gifted to me from my US peers (yep, no warning, I got an email that I owe them $60 a few days after parcel was delivered). I originally thought it's a scam, but it was not. I diaputed this stating I should be informed BEFORE, not after delivery. After 6 months of back and forth I found that it's actually EU tarrifs.
by andrewaylett | 2025-11-16 13:01:42+00:00
I'm very much a fan of the idea that language features — and especially library features — should not have privileged access to the compiler.

Rust is generally pretty good at this, unlike (say) Go: most functionality is implemented as part of the standard library, and if I want to write my own `Vec` then (for the most part) I can. Some standard library code relies on compiler features that haven't been marked stable, which is occasionally frustrating, but the nightly compiler will let me use them if I really want to (most of the time I don't). Whereas in Go, I can't implement an equivalent to a goroutine. And even iterating over a container was "special" until generics came along.

This article was a really interesting look at where all that breaks down. There's obviously a trade-off between having to maintain all the plumbing as user-visible and therefore stable vs purely magic and able to be changed so long as you don't break the side effects. I think Rust manages to drive a fairly good compromise in allowing library implementations of core functionality while not needing to stabilise everything before releasing anything.
by JKCalhoun | 2025-11-16 13:01:50+00:00
Do public reports like this one often go deep enough into the weeds to name names, list specific tools and techniques, URLs?

I don't doubt of course that reports intended for government agencies or security experts would have those details, but I am not surprised that a "blog post" like this one is lacking details.

I just don't see how one goes from "this is lacking public evidence" to "this is likely a political stunt".

I guess I would also ask the skeptics (a bit tangentially, I admit), do you think what Anthropic suggested happened is in fact possible with AI tools? I mean are you denying that this is could even happen or just that Anthropic's specific account was fabricated or embellished?

Because if the whole scenario is plausible that should be enough to set off alarm bells somewhere.
by Reason077 | 2025-11-16 13:01:56+00:00
The average strike price for offshore wind in AR6 came in at £59.90/MWh. That's pretty cheap, and much cheaper than any new nuclear. Hinkley Point C's strike price is £92.50/MWh. (note: strike prices are always quoted based on 2012 currency, and get adjusted for inflation)

You can't really compare strike prices to spot prices on the wholesale market precisely because there's so much supply under CfD contracts, which distorts the wholesale market. When supply is abundant, the wholesale price plummets and even goes negative, yet suppliers still want to generate because they get the CfD price. When supply is constrained (eg: cold snaps in winter with little wind), the spot price can surge to £1000/MWh.
by exmadscientist | 2025-11-16 13:02:29+00:00
I mean, I'm not immediately jumping to sRGB or anything. (Well, I think I tried that at one point, not like it worked....) I just need to end there. I've tried plenty of things over the years and I simply cannot make an algorithm that takes some kind of spectral input and outputs a hex color code that I can make a blob of on my (color-calibrated!) monitor which looks anything like the LED I have in hand.

Coming up with a matching color by hand can give a decent result, so this is not solely sRGB being crap.
by extra88 | 2025-11-16 13:02:32+00:00
Your router almost certainly lets you assign a DNS instead of using whatever your ISP sends down so you set it to an internal device running your DNS.

Your DNS mostly passes lookup requests but during homework time, when there's a request for the ip for "www.youtube.com" it returns the ip of your choice instead of the actual one. The domain's TTL is 5 minutes.

Or don't, technical solutions to social problems are of limited value.
by scatbot | 2025-11-16 13:03:05+00:00
One of the reasons why I'm using OpenBSD is because it passes what I think of as a litmus test for FLOSS software: can I build the whole thing from scratch, in a short time and with minimal fuss? In the case of OpenBSD, the answer is yes. I can install it on a new machine, fetch the source code from mirrors, do some edits to the source, build a fresh release, write it to a USB stick and boot it on another machine. On my machine, the whole process takes about 10 minutes for the kernel, additional 20 minutes for base and maybe an hour if you add Xenocara. Compare that to Linux distros like Ubuntu or Arch where building from scratch is either discouraged or some fringe activity that requires skimming through wiki articles, forum posts or old Websites on the Wayback Machine.
by f311a | 2025-11-16 13:03:43+00:00
A lot of people behind APTs are low-skilled and make silly mistakes. I worked for a company that investigates traces of APTs, they make very silly mistakes all the time. For example, oftentimes (there are tens of cases) they want to download stuff from their servers, and they do it by setting up an HTTP server that serves the root folder of a user without any password protection. Their files end up indexed by crawlers since they run such servers on default ports. That includes logs such as bash history, tool logs, private keys, and so on.

They win because of quantity, not quality.

But still, I don't trust Anthropic's report.
by ameshkov | 2025-11-16 13:04:18+00:00
I would advise against using unbound on the client side as this way all your DNS queries will be unencrypted and visible to your ISP. Besides that, the DNS responses can be modified, this kind of censorship is very popular and used in many countries.

IMO it is safer to use a big popular DNS recursor (google, cloudflare, adguard, quad9, etc), use DoT/DoH/DoQ and maybe add some additional filtering on top of it.
by mrec | 2025-11-16 13:04:30+00:00
I agree that I wouldn't get it in addition to a desktop PC (for one thing, I haven't owned a TV in 20+ years so couch gaming isn't a thing for me) but when the time comes to replace my current box I might well consider whatever Steam is offering at the time. Just because it's likely to be nicely designed, thoughtfully specced and decently supported.

Memory (both main and VRAM) might be a bit on the weak side for some non-gaming workloads though. I hope we'll see those bump up once the current supply squeeze is over.
by smakt | 2025-11-16 13:05:03+00:00
>Seeing how much effort this takes

It takes effort even for the fanboys, but they are not going to tell you the hoops they jump through even in the Apple Soma Bubble (delete delete "Ecosystem"). You are expected to have the latest semi-broken iOS to even call your latest gen airpods airpods instead of generic bt audio devices lol. Let alone trying to make anything Apple work in Android.

I see the reason to liberate this corporate BT bullshit as a matter of principle, but I don't see the point of Apple fanboys today. In the 90s Apple was light years ahead of wintel, but today they are worse and more expensive than high end brands (etymotic for example) who don't engage in the silly marketing blending of brand and personal self worth the fanboys seem to ingest as if their life depends on it. They strike me as impoverished third worlders who think their internet cred will go up by buying Apple gear. Apple used to really mean "It Just Works", but not anymore by any stretch. On the other hand, the peace of mind of solving a problem for good and forgetting about it, like -radical idea- headphone jacks (removed because "courage"), using a stable environment on a computer you own with an environment you can recreate instead of the Apple merry-go-round, using your own infrastructure and ideas instead of hoping the Apple "Magic" will work when you really need to restore a backup. And when the Apple Machine(TM) eats your superior Apple creations, you simply were holding it wrong, man! Makes me wonder what the rest of the engineering world is thinking... for example, when are HiFi manufacturers going to ditch slimy, unseemly, dusty speaker cables for superior bluetooth sound quality? Why o why are Canon/Sony/Leica/etc still going with environmentally unfriendly, inefficient, heavy and dumb 35 mm image sensors? Don't they know about the miraculous-camera-assembly in iPhones? All 50 MP crammed not in 35 mm but in half the size, now that's sweet!

The idiocies keep coming, like "nano-textured" glass in Apple monitors that simply rehash the professional displays that for years have had accurate color reproduction, superior brightness, and -god forbid- matte screens. I think I must have a long-lost engineering prototype of a monitor with a superior, believed lost forever "nano-textured" glass. It's called matte screen, and it came in the superior display ratio called 16:10 once used by the dinosaurs instead of the retarded craze of everything you can dream of as long as it's 16:9 lol.

Apple fanboys: your identity brand has long since eroded, but by all means keep those credit cards warm, you need to finance the next Tim Cook yatch :)
by goalieca | 2025-11-16 13:05:19+00:00
My take on government APTs is that they are boutique shops that do highly targeted attacks, develop their own zero days which they don’t usually burn unless they have so many.., and are willing to take time to go undetected.

Criminal organizations take a different approach, much like spammers where they can purchase/rent c2 and other software for mass exploitation (eg ransomware). This stuff is usually very professionally coded and highly effective.

Botnets, hosting in various countries out of reach of western authorities, etc are all common tactics as well.
by bobnarizes | 2025-11-16 13:06:03+00:00
Hi HN, Floxtop is a native macOS app that organizes files and images by their content — not just their names. It runs fully offline on Apple Silicon, with no servers, no cloud, and no data leaving your machine.

Problem: My Downloads and Desktop folders would fill up with PDFs, screenshots, and random files, making cleanup and finding the right file frustrating and time-consuming. Solution: Floxtop uses Sentence Transformers (SBERT) to embed document text and metadata, plus OCR and object recognition to read images. It groups and classifies files by semantic similarity — all locally, so your sensitive files (finance, medical, personal, etc.) stay private.

Current version: Supports 30+ file types including images, Office documents (Word, Excel, PowerPoint), PDFs, EPUBs, Markdown, CSV, and more. Parsing and classifying 50 files takes around 17 seconds. It integrates with Finder (right-click > Organize with Floxtop), Quick Look + thumbnails, and includes keyboard shortcuts for a fast workflow. Currently, Intel Macs are not supported and it only works with English-language files.

I launched an early beta ~3 months ago, Fallinorg (https://news.ycombinator.com/item?id=44932375), and have since built out more features based on user feedback. I’d love your feedback on classification workflows, missing features, pricing, usability, and potential bulk operations or integrations. Happy to answer questions and share implementation details!

Free version here - requires macOS 15+ with Apple Silicon: https://github.com/taranntell/fallinorg/releases/download/1....

Demo video: https://floxtop.com/assets/demo.mp4
by keyringlight | 2025-11-16 13:07:56+00:00
I think it all depends on what their mission is, what bits of the larger ecosystem does valve care about or not care about, what do they want to defend or destroy. I'm tempted to say "defending the store is existential for them" but the scale of it likely gives them an extremely big comfort zone. Whatever OS the users have isn't going to affect whether they can do commerce through them unless MS does something unhinged like getting rid of win32, or as the fear around win8 that they'd centralize all windows software through their channels.

If their mission is SteamOS, then I'm tempted to say they need to expand their area of influence beyond what they're doing with linux now which seems to be strictly game related, which likely involves whittling down the major or minor reasons people don't use desktop linux (and all the projects that comprise it) in general, not just their distro. So long as they're supporting (in one way or another) the majority of windows games in a foreign environment and the richness that mods can bring they could do with improving the experience of that relative to windows and not just the happy path of what happens if the base game launches. And that's before the enigma of anti-cheat. Then find some way to reap the rewards, if any, for doing that greatly expanded workload or investment.
by wkjagt | 2025-11-16 13:09:10+00:00
I love my EV, but I feel it's just old enough to not have much enshitification (2020 Hyundai Ioniq EV). The same car also came as ICE and hybrid, so it feels like a normal car, just with an electric motor. I just wish it had a better range, and more grip in snow (FWD with most weight from the batteries on the rear axle). I'll keep driving it until I absolutely have to replace it.
by JCM9 | 2025-11-16 13:09:40+00:00
Perplexity is one small iteration away from just a classic AI wrapper.

It was amazing early on in demonstrating what search could be, but frankly there’s not much reason for it to exist much longer.

The big players can, and are, just replicating its core functionality. The moat is gone.

I’d have to agree that they’re probably near the top of the list of companies about to get wiped out by a bubble deflation. Possible they get acquired by some sucker looking to establish AI creds but the market for that has probably passed as Wall Street is becoming super skeptical of all things AI at the moment.
by HarHarVeryFunny | 2025-11-16 13:10:26+00:00
Composition is ultimately more flexible and less constraining than inheritance. It reflects a practical approach of just using the types/classes you need, without having to adopt some project wide OO religion or design philosophy.

With C++, no-one needs to be told (even if good advice) to "favor composition over inheritance" - I think most people who have worked with the language for long enough on large enough projects will end up realizing for themselves that this is generally the preferred approach. Inheritance is a specialized tool, best reserved for specialized use cases.

It's a bit of a shame that C++ "Concepts" were never adopted, or some other type of compile-time polymorphism, since I think this is often all that is really wanted - a compile time guarantee that two classes will provide the same interface, without forcing them to be related by inheritance.
by blitzar | 2025-11-16 13:11:45+00:00
Capitalism is extremely poor at "fragile systems", and for whatever reason (water under the bride now) the nuclear industry never made the move to smaller modular systems - even for large installations (think a reactor hall with 20 small cores rather than a single large core).

Even this project sounds like a custom on-site build, although at the moment it is still vapourware.
by hnthrowaway8347 | 2025-11-16 13:12:11+00:00
Possibly, but:

- Many people in many countries now hate the U.S. and U.S. companies like Anthropic.

- In addition, leaders in the U.S. have been lobbied by OpenAI and invest in it which is a direct competitor and is well-represented on HN.

- China’s government has vested interest in its own companies’ AI ventures.

Given this, I’d hardly say that Anthropic was much of a strong U.S. puppet company, and likely has strong evidence about what happened, why also hoping to spin the PR to get people to buy their services.

I don’t think it’s unreasonable to assume that people that write inflammatory posts about Anthropic may have more than an axe to grind against AI and may be influenced by their country and its propaganda or potentially may even be working for them.
by notpublic | 2025-11-16 13:12:31+00:00
"A report was recently published by an AI-research company called Anthropic. They are the ones who notably created Claude, an AI-assistant for coding. Personally, I don’t use it but that is besides the point."

Not sure if the author has tried any other AI-assistants for coding. People who haven't tried coding AI assistant underestimates its capabilities (though unfortunately, those who use them overestimate what they can do too). Having used Claude for some time, I find the report's assertions quite plausible.
by ACCount37 | 2025-11-16 13:13:33+00:00
AGI favors attackers initially. Because while it can be used defensively, to preemptively scan for vulns, harden exposed software for cheaper and monitor the networks for intrusion at all times, how many companies are going to start doing that fast enough to counter the cutting edge AGI-enabled attackers probing every piece of their infra for vulns at scale?

It's like a very very big fat stack of zero days leaking to the public. Sure, they'll all get fixed eventually, and everyone will update, eventually. But until that happens, the usual suspects are going to have a field day.

It may come to favor defense in the long term. But it's AGI. If that tech lands, the "long term" may not exist.
by PunchyHamster | 2025-11-16 13:14:45+00:00
You are not....it's Ubuntu.

Not Linux, not Debian, Ubuntu.

Debian (provided you don't just dump a bunch of 3rd party repos) just upgrades cleanly, we have hundreds of servers that just run unattended-upgrade and get upgraded to new Debian version every 2 years.

The few Ubuntus we had had more problems.
by mistersquid | 2025-11-16 13:15:03+00:00
> > I learned his real name and used it to track down an old friend of his to ask for help

You left out the adverbial phrase. The whole sentence is

> When he reached out to my company six months later to apply for a job, I learned his real name and used it to track down an old friend of his to ask for help — but the friend told me he was afraid to intervene because he didn’t want to become a target himself.

When the stalker applied for a job, additional details may have become available to the OP, potentially including personal references (i.e. "old friend".)
by MagicMoonlight | 2025-11-16 13:15:12+00:00
Anthropic make a lot of bullshit reports to tickle the investors.

They'll do stuff like prompt an AI to generate text about bombs, and then say "AI decides completely by itself to become a suicide bomber in shock evil twist to AI behaviour - that's why you need a trusted AI partner like anthropic"

Like come on guys, it's the same generic slop that everyone else generates. Your company doesn't do anything.
by pfdietz | 2025-11-16 13:16:31+00:00
If SMRs are cheap enough to act as backup to wind and solar, they are cheap enough to displace wind and solar entirely. And the contrapositive as well: if SMRs are not cheap enough to displace solar and wind, they aren't cheap enough to act as backup. The scenario where it's just a backup never arises in cost minimized solutions.
by 0x_rs | 2025-11-16 13:16:49+00:00
This is increasingly many cars, starting minimum in the past decade and an half, and not limited to EVs. It's definitely something you need to research before purchasing one so you can dodge the worst offenders. Automotive engineering has been a clown show for years, and greatly suffered from becoming too reliant on digital technology without being willing to invest and spend for robust systems, going for low-cost, low-quality, proprietary parts made in small numbers and unique to each production run. The traditional expectations that you could have options in regards to your vehicle being serviced are on their way out without consumers doing something about it. A future where only the manufacturer and its authorized shops can perform maintenance means they can set any price for it, a price that's already been skyrocketing, and that would effectively allow them to collect far more revenue than previously possible.. and if you can't extract value from customers through heated seats and high-beam subscriptions, maybe you can just have their cars full of black boxes break down more often?