MurphyA/hacker-news huggingface dataset:
by flanbiscuit | 2025-11-24 20:52:31+00:00
yes bun does both of the things mentioned in the parent comment:

> Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts like postinstall for installed dependencies. Executing arbitrary scripts represents a potential security risk.

https://bun.com/docs/pm/cli/install#lifecycle-scripts

> To protect against supply chain attacks where malicious packages are quickly published, you can configure a minimum age requirement for npm packages. Package versions published more recently than the specified threshold (in seconds) will be filtered out during installation.

https://bun.com/docs/pm/cli/install#minimum-release-age
by chris-vls | 2025-11-24 20:52:43+00:00
It seems quite probable that an LLM provider will lose a major liability lawsuit. "Is this product ready for release?" is a very hard question. And it is one of the most important ones to get right.

Different providers have delivered different levels of safety. This will make it easier to prove that the less-safe provider chose to ship a more dangerous product -- and that we could reasonably expect them to take more care.

Interestingly, a lot of liability law dates back to the railroad era. Another time that it took courts to rein in incredibly politically powerful companies deploying a new technology on a vast scale.
by michaelanckaert | 2025-11-24 20:52:53+00:00
The "Tool Search Tool" is like a clever addition that could easily be added yourself to other models / providers. I did something similar with a couple of agents I wrote.

First LLM Call: only pass the "search tool" tool. The output of that tool is a list of suitable tools the LLM searched for. Second LLM Call: pass the additional tools that were returned by the "search tool" tool.
by toast0 | 2025-11-24 20:53:03+00:00
I was pretty sure I had seen a mailing list post from Theo about it, but I can't find it now. The only relevant thread I can find is this one [1], which pretty much just says "we don't do it for userland"; but does say it is available inside the kernel, and I have seen some mentions in recent release notes for OpenBSD of binding PF things by toeplitz hash, which indicates the right progression for that ... but it's still hard to get max performance from a simple network daemon without binding the userland threads to same core that the kernel processes the flow with. Once your daemon starts doing substantial work, binding cpus isn't as important, but if it's something like an authoritative DNS server or HAProxy with plain sockets, the performance benefit from eliminating cross-core communication can be tremendous.

[1] https://marc.info/?l=openbsd-misc&m=152507006602422&w=2
by dmux | 2025-11-24 20:53:05+00:00
Regarding Message Passing and Late-binding, I think it's important to take into account that Alan Kay was working on Smalltalk -- a system that was image based; a system where you could change things as it was running. I think that message passing and late-binding are often championed but then sort of fall flat given standard deployment techniques: build & deploy (often to a ephemeral runtime / container).
by catskull | 2025-11-24 20:53:05+00:00
I have ghostty set up with this “starfield” shader: https://github.com/0xhckr/ghostty-shaders/blob/main/starfiel...

I also have it set up to do adaptive theme, so in light mode the galaxy is mostly just a little noise on the black text but in dark mode it’s like I’m piloting a space ship. Highly recommend.

I also documented a few other shaders on my blog here: https://catskull.net/fun-with-ghostty-shaders.html

Edit: I use the "starfield" shader, not the "galaxy" shader. Doh!
by naikrovek | 2025-11-24 20:53:17+00:00
Plan9 “terminals” were like that. Create a window, and by default the text shell runs in it. If you have vdir installed, and you run that in the same window, you get a semi-graphical file browser. Exit that and then run games/doom and now doom is running in the same window. Exit that and “cpu” into another machine and run riostart and now that same window that did all the other things now is running a window manager on the remote machine, displayed on your machine. Graphical apps, textual apps, everything. All in Rio windows. Smoothly, too. (It is a very different paradigm so I am not going to profess that it is user friendly or anything, but it does work, and it works well once you get your head around it.)
by _pdp_ | 2025-11-24 20:53:20+00:00
Our agentic builder has a single tool.

It is called graphql.

The agent writes a query and executes it. If the agent does not know how to do particular type of query then it can use graphql introspection. The agent only receives the minimal amount of data as per the graphql query saving valuable tokens.

It works better!

Not only we don't need to load 50+ tools (our entire SDK) but it also solves the N+1 problem when using traditional REST APIs. Also, you don't need to fall back to write code especially for query and mutations. But if you need to do that, the SDK is always available following graphql typed schema - which helps agents write better code!

While I was never a big fan of graphql before, considering the state of MCP, I strongly believe it is one of the best technologies for AI agents.

I wrote more about this here if you are interested: https://chatbotkit.com/reflections/why-graphql-beats-mcp-for...
by derbOac | 2025-11-24 20:54:03+00:00
The problem with this is it doesn't offer compelling evidence that twin studies are biased, it just assumes they are because the other studies are consistent with one another, just like the twin studies are with each other. It just flips the assumption without explaining anything.

The equal environments assumption has been tested again and again and it doesn't hold up either. Twins who are assumed to be MZs but are actually DZs and vice versa look like their biological relatedness, not their assumed relatedness. And factors involved in appearance (e.g., attractiveness) turn out not to affect heritability estimates either.
by isoprophlex | 2025-11-24 20:54:38+00:00
My dude/entity, before there were these LLM hookups, there existed the Snapewives. People wanna go crazy, they will, LLMs or not.

https://www.mdpi.com/2077-1444/5/1/219

This paper explores a small community of Snape fans who have gone beyond a narrative retelling of the character as constrained by the work of Joanne Katherine Rowling. The ‘Snapewives’ or ‘Snapists’ are women who channel Snape, are engaged in romantic relationships with him, and see him as a vital guide for their daily lives. In this context, Snape is viewed as more than a mere fictional creation.
by sofixa | 2025-11-24 20:55:31+00:00
> I believe that a Chinese car of the same quality, sold for 70% of the price of a European made car, will outperform the European car in every market, where those cars compete on equal footing. You disagree with that for reasons unfathomable to me

I disagree with that for pretty obvious reasons. The fact that companies like GM and Ford still exist, and not everyone has been buying the cheapest car that fits their needs, unquestionably proves that buying cars is more than just price. Quality is hard to directly compare, but you also have maintenance needs/availability, brand recognition, design.

But anyways, you're talking about manufacturing more widely, and we spent too much time talking about cars. 20% of the EU GDP that are in manufacturing really aren't all about cars.

> I do not think any evidence I could provide to you could convince you otherwise

That's an almost smart way of getting out of having to provide any.

> That you are lying about what I said (e.g. that cost is the only thing that matters for cars

How else would I interpret your incessant attempts to try to convince me that a Chinese car at 70% the cost of an European one would always win? The fact that you're completely ignoring the presence of brand or the importances of marketing and design on car buying choices clearly indicates you only think of cars as their cost to buy. Which is really not what most people's first consideration is, otherwise, again, we wouldn't have Tesla, VW, Audi, Porsche, GM, Ford, Lexus, etc etc existing.
by thesuitonym | 2025-11-24 20:55:33+00:00
The gp already answered you, "this sort of work is not a priority for OpenBSD."

OpenBSD is a small, niche operating system, and it really only gets support for something if it solves a problem for someone who writes OpenBSD code. In a way, this is nice, because you never get half-assed features that kinda-sorta work sometimes, maybe. Everything either works exactly as you'd expect, or it's just not there.

I love OpenBSD, but there are some tasks it's just not suited for, and that's fine, too.
by michaelanckaert | 2025-11-24 20:55:38+00:00
Security nightmare inbound...

The example given by Anthropic of tools filling valuable context space is a result of bad design.

If you pass the tools below to your agent, you don't need "search tool" tool, you need good old fashion architecture: limit your tools based on the state of your agent, custom tool wrappers to limit MCP tools, routing to sub-agents, etc.

Ref: GitHub: 35 tools (~26K tokens) Slack: 11 tools (~21K tokens) Sentry: 5 tools (~3K tokens) Grafana: 5 tools (~3K tokens) Splunk: 2 tools (~2K tokens)
by FloorEgg | 2025-11-24 20:55:49+00:00
Most learning curves in the education system today are very bumpy and don't adapt well to the specific student. Students get stuck on big bumps or get bored and demotivated at plateaus.

AI has potential to smooth out all curves so that students can learn faster and maximize time in flow.

I've spent literally thousands of hours thinking about this (and working on it). The future of education will be as different from today as today is to 300 years ago.

Kids used to get smacked with a stick if they spelled a word wrong.
by embedding-shape | 2025-11-24 20:55:52+00:00
> Well, what really prompted this crisis is AI,

If the shortage of RAM is because of AI (so servers/data centers I presume?), wouldn't that mean the shortage should be localized to RDIMM rather than the much more common UDIMM that most gaming PCs use? But it seems to me like the pricing is going up more for UDIMM than RDIMM.
by niwtsol | 2025-11-24 20:56:18+00:00
Thank you for posting this, it really gave me an answer to the "huh, how did all that drama from last week play out." IMO rebble jumped to some conclusions and felt robbed/cheated by what Eric was doing. With Eric going above and beyond to open source everything, I really feel he is trying to live up to what the original promise of pebble was. It is cool what rebble did to keep the pebble community alive, and I get that they might feel slighted, but if you take all egos out of the equation, what Eric is doing is like the best possible outcome - we get new pebble devices. Isn't that the best possible outcome?
by caycep | 2025-11-24 20:57:28+00:00
It's a sad trend for "the rest of us" and history in general. The economic boom of the 80's thru the 2010s has been a vast democratization of computation - hardware became more powerful and affordable, and algorithms (at least broadly if not individually) became more efficient. We all had supercomputers in our pockets. This AI movement seems to move things in the opposite direction, in that us plebeians have less and less access to RAM, computing power and food and...uh...GPUs to play Cyberpunk; and are dependent on Altermanic aristocracy to dribble compute onto us at their leisure and for a hefty tithe.

I am hoping some of that Clayton Christensen disruption the tech theocracy keep preaching about comes along with some O(N) decrease in transformer/cDNN complexity that disrupts the massive server farms required for this AI boom/bubble thing.
by esrauch | 2025-11-24 20:57:34+00:00
I'm surprised by this comment; after the drama last week and after seeing this I fully have to side against Rebble.

The nature of driving a healthy open source centered ecosystem is that you don't control it under your iron fist: you make good contributions, users _and_ companies are able to use them in all new ways which comply with the licensing terms. And it seems that RePebble is going way beyond the licensing terms requirements, but bending over backwards to honor Rebble here when they aren't actually required to.

I just can't imagine what people want from RePebble if not this: they are being maximally open, making it so all of everything would be able to continue if they went out of business tomorrow, while also actively enabling people to continue using Rebble's store and paid offerings. Should they be forcing users to use Rebble's offerings (instead of making things even more open) as a reward for doing a good job bridging the dark age?
by tmnvix | 2025-11-24 20:58:26+00:00
It occurred to me the other day that young people rarely get described as 'shy' anymore. 'Anxious' is more common now.

Interestingly it was common to hear "they're shy, but they'll grow out of it". I don't think the same is ever said about anxious people (and I say this as someone who was very shy/socially anxious as a teen and 'grew out of it').

I'm thankful I struggled with this at a time when medications were not easily available or readily prescribed.
by vilhelm_s | 2025-11-24 20:58:37+00:00
Yeah, that sounds very unlikely. The full paper dismisses the possibility:

> Another possible explanation to consider is that the current indings were caused by cross-cueing (one hemisphere informing the other hemisphere with behavioural tricks, such as touching the left hand with the right hand). We deem this explanation implausible for four reasons. First, cross-cueing is thought to only allow the transfer of one bit of information (Baynes et al., 1995). Yet, both patients could localize stimuli throughout the entire visual field irrespective of response mode (Experiments 1 and 5), and localizing a stimulus requires more than one bit of information. Second, [...]

I get the impression that the authors of the paper have some kind of woo (nonmaterialist) view of consciousness. But they also mention this possiblity, which seems more plausible to me:

> Finally, a possibility is that we observed the current results because we tested these patients well after their surgical removal of the corpus callosum (Patient DDC and Patient DDV were operated on at ages 19 and 22 years, and were tested 10–16 and 17–23 years after the operation, respectively). This would raise the interesting possibility that the original split brain phenomenon is transient, and that patients somehow develop mechanisms or even structural connections to re-integrate information across the hemispheres, particularly when operated at early adulthood.
by jmward01 | 2025-11-24 20:58:38+00:00
The Programmatic Tool Calling has been an obvious next step for a while. It is clear we are heading towards code as a language for LLMs so defining that language is very important. But I'm not convinced of tool search. Good context engineering leaves the tools you will need so adding a search if you are going to use all of them is just more overhead. What is needed is a more compact tool definition language like, I don't know, every programming language ever in how they define functions. We also need objects (which hopefully Programatic Tool Calling solves or the next version will solve). In the end I want to drop objects into context with exposed methods and it knows the type and what is callable on they type.
by sqs | 2025-11-24 20:59:09+00:00
What's super interesting is that Opus is cheaper all-in than Sonnet for many usage patterns.

Here are some early rough numbers from our own internal usage on the Amp team (avg cost $ per thread):

- Sonnet 4.5: $1.83

- Opus 4.5: $1.30 (earlier checkpoint last week was $1.55)

- Gemini 3 Pro: $1.21

Cost per token is not the right way to look at this. A bit more intelligence means mistakes (and wasted tokens) avoided.
by perihelions | 2025-11-24 20:59:15+00:00
https://news.ycombinator.com/item?id=14238786 ("Sent to Prison by a Software Program’s Secret Algorithms (nytimes.com)")

https://news.ycombinator.com/item?id=14285116 ('Justice.exe: Bias in Algorithmic sentencing (justiceexe.com)")

https://news.ycombinator.com/item?id=43649811 ("Louisiana prison board uses algorithms to determine eligility for parole (propublica.org)")

https://news.ycombinator.com/item?id=11753805 ("Machine Bias (propublica.org)")
by Wowfunhappy | 2025-11-24 20:59:16+00:00
I thought the reminder from GP was fair and I'm disappointed that it's downvoted as of this writing. One thing I've always appreciated about this community is that we can remind each other of the guidelines.

Yes it was just one word, and probably an accident—an accident I've made myself, and felt bad about afterwards—but the guideline is specific about "word or phrase", meaning single words are included. If GGP's single word doesn't apply, what does?
by jpalawaga | 2025-11-24 20:59:44+00:00
through all of this, it really feels like rebble didn't know what they want (as they say). the future collaboration with eric also sounds like they don't know what they want. they want a third party mediator for... something. Eric was already prepared to pay them per user, which seemed generous to me to begin with.

It sounds to me like Rebble (the board + community) should figure out what they want before trying to proceed, lest they further waste time and good-faith negotiating capital. like are they unhappy with the previous payment rate per user? or something else?
by sunshowers | 2025-11-24 20:59:51+00:00
As I said in the article, we avoid Tokio mutexes entirely for the exact reason that being cancelled in the middle of a critical section is bad. In Rust, there are two sources of cancellations in the middle of a critical section: async cancellations and panics. Ergo, panicking in the middle of a critical section is also bad, and mutexes ought to detect that and mark their internal state as corrupted as a result.
by FloorEgg | 2025-11-24 21:00:18+00:00
Yes, the biggest problem with authentic exercises is evaluating the students' actions and giving feedback. The problem is that authentic assessments didnt previous scale (e.g. what worked in 1:1 coaching or tutoring couldn't be done for a whole classroom). But AI can scale them.

It seems like AI will destroy education but it's only breaking the old education system, it will also enable a new and much better one. One where students make more and faster progress developing more relevant and valuable skills.

Education system uses multiple choice quizzes and tests because their grading can be automated.

But when evaluation of any exercise can be automated with AI, such that students can practice any skill with iterative feedback at the pace of their own development, so much human potential will be unlocked.
by docjay | 2025-11-24 21:00:57+00:00
That all depends on what you consider to be reasonably running it. Huge RAM isn’t required to run them, that just makes them faster. I imagine technically all you'd need is a few hundred megabytes for the framework and housekeeping, but you’d have to wait for the some/most/all of the model to be read off the disk for each token it processes.

None of the closed providers talk about size, but for a reference point of the scale: Kimi K2 Thinking can spar in the big leagues with GPT-5 and such…if you compare benchmarks that use words and phrasing with very little in common with how people actually interact with them…and at FP16 you’ll need 2.9TB of memory @ 256,000 context. It seems it was recently retrained it at INT4 (not just quantized apparently) and now:

“ The smallest deployment unit for Kimi-K2-Thinking INT4 weights with 256k seqlen on mainstream H200 platform is a cluster with 8 GPUs with Tensor Parallel (TP). (https://huggingface.co/moonshotai/Kimi-K2-Thinking) “

-or-

“ 62× RTX 4090 (24GB) or 16× H100 (80GB) or 13× M3 Max (128GB) “

So ~1.1TB. Of course it can be quantized down to as dumb as you can stand, even within ~250GB (https://docs.unsloth.ai/models/kimi-k2-thinking-how-to-run-l...).

But again, that’s for speed. You can run them more-or-less straight off the disk, but (~1TB / SSD_read_speed + computation_time_per_chunk_in_RAM) = a few minutes per ~word or punctuation.
by thatcks | 2025-11-24 21:02:36+00:00
The computers that moved from OpenBSD to Ubuntu were our local resolving DNS servers. These don't use PF and we also wanted to switch from our previous OpenBSD setup to Bind, where we were already running Bind on Ubuntu for our DNS master servers. The gory details were written up here: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/UsingBindN...

We may at some point switch our remaining OpenBSD DHCP server to Ubuntu (instead of to FreeBSD); like our DNS resolvers, it doesn't use PF, and we already operate a couple of Ubuntu DHCP servers. In general Ubuntu is our default choice for a Unix OS because we already run a lot of Ubuntu servers. But we have lots of PF firewall rules and no interest in trying to convert them to Linux firewall rules, so anything significant involving them is a natural environment for FreeBSD.

(I'm the author of the linked-to article.)
by pedalpete | 2025-11-24 21:03:32+00:00
I believe that training a system to understand the electrical signals that define a movement is significantly different from a system that understands thought.

I work in neurotech, I don't believe that the electrical signals of the brain define thought or memory.

When humans understood hydro-dynamics, we applied that understanding to the body and thought we had it all figured out. The heart pumped blood, which brought nutients to the organs, etc etc.

When humans discovered electricity, we slapped ourselves on the forehead and exclaimed "of course!! it's electric" and we have now applied that understanding on top of our previous understanding.

But we still don't know what consciousness or thought is, and the idea that it is a bunch of electrical impulses is not quite proven.

There are electrical firing of neurons, absolutely, but do they directly define thought?

I'm happy to say we don't know, and that "mind-reading" devices are yet un-proven.

A few start-ups are doing things like showing people images while reading brain activity and then trying to understand what areas of the brain "light-up" on certain images, but I think this path will prove to be fruitless in understanding thought and how the mind works.
by ghjnut | 2025-11-24 21:03:33+00:00
I had issues too that they sent a tech support out for while warning me "If they find it's your fault, you will be assessed a charge". The tech came out, climbed my local pole and then went down the street and climbed another one. He said it was a busted port and he moved me to a new one, and put in a service request to upgrade as it was out of ports.

CenturyLink sends me a bill for maintenance. After tons of back and forth I got to the point where I said "So can you state for the record since I'm recording this phone call, that I the customer should have climbed the telephone pole to remedy the issue".

After that he finally decides to get in touch with the fiber contractor they use who emphasized it was no fault of my own and they cleared the charge.
by rco8786 | 2025-11-24 21:03:39+00:00
> Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables.

Even a properly containerized app will still have these things, because you need things like environment variables (that contain passwords, api keys, etc) for your app to function.