MurphyA/hacker-news huggingface dataset:
by jsnell | 2025-11-25 19:35:44+00:00
I don't share your optimism. Those kinds measures would be just security theater, not "a lot better".

Avoiding secrets appearing directly in the LLM's context or outputs is trivial, and once you have the workaround implemented it will work reliably. The same for trying to statically detect shell tool invocations that could read+obfuscate a secret. The only thing that would work is some kind of syscall interception, but at that point you're just reinventing the sandbox (but worse).

Your "visually inspect the contents of the URL" idea seems unlikely to help either. Then the attacker just makes one innocous-looking request to get allowlisted first.
by mixmastamyk | 2025-11-25 19:36:07+00:00
Agreed, my biggest current complaint is Firefox expanding the URL bar across the full window right when you start typing. The result is that when you go to edit a URL, it shifts left an inch or two just as you start typing, which stops me in my tracks every time while my eyes search for where the cursor went. Hate it, just like the URL bar expanding in size (vertically too) when you click it. Who thinks these things up?

Note: I never, EVER want a GUI shifting around while I use it!
by throw45678943 | 2025-11-25 19:36:08+00:00
Who knows? Maybe with the way AI is going that will be considered a lot of money compared to what people earn on this site.

As in what people generally earn on this site will crash way down and be outsourced to these models. I'm already seeing it personally from a social perspective - as a SWE most people I know (inc teachers in my circle) look at me like my days are numbered "cause of AI".
by funnybeam | 2025-11-25 19:36:37+00:00
This isn’t a bug, it is known behaviour that is inherent and fundamental to the way LLMs function.

All the AI companies are aware of this and are pressing ahead anyway - it is completely irresponsible.

If you haven’t come across it before, check out Simon Willisons “lethal trifecta” concept which neatly sums up the issue and explains why there is no way to use these things safely for many of the things that they would be most useful for
by bitwize | 2025-11-25 19:37:53+00:00
Not information from nowhere, no. But information from outside the genome. To use cats again, colorpoint cats such as Siamese are subject to a temperature-sensitive mutation in the genes which code for fur pigment, so the fur at the coolest parts of their body (face, ears, paws, tail) is the darkest. The colorpoint pattern is not coded for in DNA. It needs input from the environment in order to be expressed.

It's not really compression. It's more like, you can write a much shorter Lisp program to do the same task as a C program, but you need the entire Lisp runtime to get it that short.
by autoexec | 2025-11-25 19:38:22+00:00
Nintendo kind of tried that with "friend codes" but they were just annoying and spread online anyway, which is kind of fair since today it's not uncommon for people to be friends with people in distant places and the internet should allow us to be able to connect and play with each other no matter where we are.

The original solution to just playing with local friends was LAN parties, but private servers were great too where they were actually private/hosted entirely by the players and not just part of some corporation's online platform.
by jeffbee | 2025-11-25 19:38:26+00:00
You could just read their whitepapers and accept them at face value. What other major SaaS providers are publishing about their technical countermeasures against insider risk?

If a company publishes loads of articles about how they have technical controls for privacy and security, through encryption and compartmentalization and code review and build provenance and so forth, and all the people who work/worked at said company are always whining about how onerous those processes are, then what gives you reason to doubt it?
by eloisant | 2025-11-25 19:38:35+00:00
It's like with the justice system: if you have to choose between the risk of jailing an innocent and the risk letting a guilty person go free, you choose to let a guilty person go free. All the time.

Unless you're 100% sure that a student cheated, you don't punish them. And you don't ask them to prove they're innocent.
by rixed | 2025-11-25 19:38:43+00:00
Granted, memory is certainly more complex than basic feelings and can probably not be generated on demand by stimulating a few neurons in a single place. We are certainly far from being able to create memories by electric stimulations, but I see no reason to believe it's impossible. Therefore invoking "memory" (or any other complex though, really) does not refute "[the mind] is the sum of electrical and chemical network activity in the brain".

Anyway, I suspect in those discussions more time is spent disagreeing on the meaning of words than on the core concepts.
by agreeahmed | 2025-11-25 19:38:44+00:00
Yeah this very true.

We have a plan to allow you to store more of this data on the merchant's side and still benefit from the work we've done to refine our data model, and make the SDK super usable. Even if you do hit Stripe's APIs, you will need to maintain mappings of price ids to your plans, your plans to what features you grant for each, stripe customer ids to your customer ids, etc. That's the kind of grunt work and maintenance burden we'd like to eliminate.

Plus, Stripe is explicitly designed to be a write-optimized system, and discourages[0] using them as a realtime read layer. We're super early in the journey but that's the problem we want to solve: how can we give software devs the same unified money movement + value movement experience that Shopify has availed to DTC brands for nearly 20 years?

[0] https://docs.stripe.com/rate-limits
by camdenreslink | 2025-11-25 19:38:50+00:00
As a personal anecdote, I had a fairly involved application that built up a context with a lot of custom prompting and created a ~1000 word output. I could run my application over and over again to inspect the results. It was fairly reproducible.

I was having really nice results with the o4-mini model with high thinking. A little while after GPT-5 came out I revisited my application and tried to continue. The o4-mini results were unusable, while the GPT-5 results were similar to what I had before. I'm not sure what happened to the model in those ~4-5 months I set it down, but there was real degradation.
by 4ggr0 | 2025-11-25 19:39:22+00:00
huh, good point! never saw it that way. never bought a pre-built myself, but the first PC i got when i was a kid was a pre-built with Windows on it.

the argument i always used is that Windows feels like spyware, and slowly seems to turn into it. showing me ads, selling my data. don't see why i should pay for this.
by johnnyanmac | 2025-11-25 19:39:39+00:00
There's a lot wrong here, but I'll just cut to the meat here:

>the US Gov is in so much debt, drastic measures are absolutely required. Any argument to the contrary ignores the fiscal situation.

https://fiscaldata.treasury.gov/americas-finance-guide/feder...

https://i.imgur.com/cm4yvbL.png (for preservation of FY2026)

As always, 60% of government spending is in 3 categories. Anyone who is touting a ned to balance the budget and is not taking moves to hit on these 3 (Medicare, Social Security, National Defesnse) is not seriously interested in balancing the budget.

- SS is political suicide and no one is even fancying touching it (and to be fair, it's hard to touch). Just kicking it down the road until it's too late. Ideally we remove the contribution caps from this so we can keep it funded, but alas.

- Medicare is the health plan for the old people, so it's equally risky to touch that politically. Any backlash seen from making healtchare cuts this year would be 10-fold if they touch medicare

- So then there's national defense. Not as unpopular to touch, but instead we keep pouring more money into it.

So no. Playing penny slots with all this turmoil isn't helping the budget. Pretty sure the ICE funding boost alone cancelled out even the most optimistic reports of DOGE savings.
by bena | 2025-11-25 19:39:48+00:00
15 points is right around one standard deviation.

It's not nothing, but IQ is already a little squishy. No one's IQ is a single number. But the article also goes into problems with the study and other potential issues.

Basically, they're saying there is this pattern in the data as recorded, but there are multiple confounding factors and issues with collecting the data in the first place.
by bigbuppo | 2025-11-25 19:39:49+00:00
Hell is being the sys admin at a web hosting company.

You can either pay a web developer to update your fully static site once a year, or you can pay them five times a year to clean up your Wordpress install when it inevitably gets popped because that one mailback form plugin you demanded... you know the one that has never received a single non-spam submission... hasn't been updated in ten years... and also you're too cheap to pay someone to maintain your Wordpress site because "why would I do that the site is finished?"
by xnoreq | 2025-11-25 19:39:54+00:00
Though a good language would point out that what the junior (or in some cases even senior) dev is holding in their hand is in fact a gun and not a gun disguised and marketed as this nice and easy to use toy, which is especially true for Go.

One must keep in mind that devs manage to implement even flawed logic that is directly reflected by the code. I'd rather not give them a non-thread safe language that provides a two letter keyword to start a concurrent thread in the same address space. Insane language design.
by Jeaye | 2025-11-25 19:39:55+00:00
It looks like the key missing part which would be needed for a lexer is source information (bare minimum: byte offset and size). I don't think edn.c can be used as a lexer without that, since error reporting requires accurate source information.

As a side note, I'm curious how much AI was used in the creation of edn.c. These days, I like to get a measure of that for every library I use.
by Brizmo | 2025-11-25 19:40:26+00:00
Hi HN,

I built ProfitMate AI, a lightweight tool for freelancers, small businesses, and side hustlers to track profits, analyze trends, and generate reports in seconds.

Features:

Upload CSVs and get instant profit summaries

Export PDF / CSV reports

Smart analytics to spot trends and opportunities

Clean, intuitive UI for fast insights

I built it because I wanted a faster, smarter way to see if my projects were actually profitable without spending hours crunching numbers.

Check it out: https://profitmateai-web.web.app
by zdragnar | 2025-11-25 19:41:14+00:00
The <p> tag is red because it is inside of #alert. Anything inside of #alert has the color variable set to red.

Variables don't use specificity like CSS selectors. I prefer to create a few layers for variables; one for color names, one that maps color name variables to global semantic names (i.e. --primary-cta-color: var(--blue-50) or something), and maybe go so far as to add another that maps component-specific semantics to global specific semantics (i.e. --date-picker-hover-color: var(--primary-cta-color)).

That way, you can add something like

.theme-1 { --primary-cta-color: var(--blue-50); } .theme-2 { --primary-cta-color: var(--brown-40); }

and / or

@media (prefers-color-scheme: dark) { .theme-1 { --primary-color: var(--grey-30); } .theme-2 { --primary-color: var(--brown-10); } }

as a purely hypothetical example. Slap the class name your user wants on the body tag, and you're good to go.
by lelandbatey | 2025-11-25 19:41:43+00:00
Yes, an ISP could see that you're using a lot of traffic. But if the traffic is encrypted, they can't be sure what you're doing. Are you a personal user? Or are you a business? How would they know if it's all encrypted?

As for the volume of traffic you're sending, you need to read the terms of your ISP contract, at least a little. Your ISP could have volume limits (e.g. only 5TB of traffic per month), and if you reach those limits, they could temporarily suspend service. But if they can't see what you're doing, and you're within the technical and contractual limits of your service agreement, and you're not causing problems for them, then an ISP is not going to care what you do.
by timenotwasted | 2025-11-25 19:41:58+00:00
As a parent of identical twins watching them develop and grow is fascinating. I do wonder at times how much of it is due to going through every single life stage together but then again there are times where that bond seems to go beyond environment. There was a sobering but very interesting documentary on identical twins called Three Identical Strangers, if you are interested in this type of stuff it's a good watch.
by brunosutic | 2025-11-25 19:42:19+00:00
> The DX of Stripe is already great

This used to be the case back in 2015, but not anymore. The financial compliance is more strict now. You have to charge taxes. EU enforced SCA / 3DS in 2019. All of these are hard to implement (correctly) on their own - almost impossible together.

Source: I run (paid) Ruby on Rails library for Stripe subscriptions integrations. I also do billing audits. Here's an example audit where I pay $30, get ~$2000 https://www.youtube.com/watch?v=YuXp7V4nanU
by tmp10423288442 | 2025-11-25 19:43:05+00:00
That's true, but the context is Xi being against Western "Welfarism". I presume (although I don't know for sure) that they're not against some support for the truly disabled, but that doesn't cover able-bodied people being on welfare for long periods, even if the employment market is unfavorable. The major exception is that Chinese people have traditionally been able to retire relatively young (in their 50s or even 40s sometimes) and receive support, particularly if they work for state-owned enterprises.
by ls-a | 2025-11-25 19:43:26+00:00
I'm open to discussion. If I see compelling evidence I could change my mind. Unfortunately I don't believe there is anything called "nuclear weapons". Just nuclear energy. Anyway that's old news. The new race is AI. Soon there is going to be a major event claiming to be AI superiority that will seem like magic. If that happens, I hope you remember my comment.
by ArcHound | 2025-11-25 19:43:38+00:00
I disagree. No state "owned" by LLM changed, it only sent a request to the internet like any other.

EDIT: In other words, the LLM didn't change any state it has access to.

To stretch this further - clicking on search results changes the internal state of Google. Would you consider this ability of LLM to be state-changing? Where would you draw the line?
by bilekas | 2025-11-25 19:43:57+00:00
We really are only seeing the beginning of the creativity attackers have for this absolutely unmanageable surface area.

I ma hearing again and again by collegues that our jobs are gone, and some are definitely going to go, thankfully I'm in a position to not be too concerned with that aspect but seeing all of this agentic AI and automated deployment and trust that seems to be building in these generative models from a birds eye view is terrifying.

Let alone the potential attack vector of GPU firmware itself given the exponential usage they're seeing. If I was a state well funded actor, I would be going there. Nobody seems to consider it though and so I have to sit back down at parties and be quiet.
by milch | 2025-11-25 19:43:57+00:00
I use Kagi at home and Google at work, and IME Kagi results are much better compared to Google. It's easy enough to jump to Google by adding !g, but I never find myself actually using that... I do however end up doing the reverse, where I'll not find the result I'm looking for on my work computer and then quickly repeat the search on Kagi on my phone. I used to use DuckDuckGo on my personal devices before, and while it was mostly fine, I did have to jump to Google more frequently. In the end sometimes the results were better on DDG and sometimes on Google. I haven't really found any situation where Google results were better than Kagi (I do tend to prefer Google Images results, but I only very rarely use image search, maybe once a month).

There was also an instance recently where I was helping out a coworker get set up with something. I had done it earlier in the day, so I told him something like "type in $SEARCH_TERM, then go to the first page and copy the commands from there". He put it into Google, couldn't find the right result, tried a few variations, still couldn't find it. I pulled Kagi up on my phone, searched the same term, and slacked him the page while he was still looking around on Google.
by darth_avocado | 2025-11-25 19:44:00+00:00
> For how much power they have over team organization and processes, software middle management has nearly no accountability for outcomes.

Can we also address the fact that “software spend” is distributed disproportionately to management at all levels and people who actually write the software are nickel and dimed. You’d save billions in spend and boost productivity massively if the management is bare bones and is held accountable like the rest of the folks.
by zdragnar | 2025-11-25 19:44:07+00:00
In OP's example, the <p> would be colored blue, because the * selector directly targets it, taking priority over the inherited value from the #alert parent element if the CSS had been normal assignment:

#alert { color: red } * { color: blue }

Variables behave slightly differently, in that they don't follow specificity rules. The definition of the variable / property behaves like a scope, and affects everything within it, hence the <p> being colored red instead of blue.
by lazyasciiart | 2025-11-25 19:44:56+00:00
For one project I got so far as to include in the project proposal some outcomes that showed whether or not it was a success: quote from the PM “if it doesn’t do that then we should not have bothered building this”. They objected to even including something so obviously required in the plan.

Waste of my bloody time. Project completed, taking twice as many devs for twice as long, great success, PM promoted. Doesn’t do that basic thing that was the entire point of it. Nobody has ever cared.

Edit to explain why I care: there was a very nice third party utility/helper for our users. We built our own version because “only we can do amazing direct integration with the actual service, which will make it far more useful”. Now we have to support our worse in-house tool, but we never did any amazing direct integration and I guarantee we never will.
by alecco | 2025-11-25 19:45:26+00:00
I keep reading this online and I find it to be nonsense. Over a thousand years earlier the Romans developed all the conquered lands. They built massive infrastructure projects: roads, ports, aqueducts, buildings. And brought sanitation and education. Ghengis Khan only brought peace and trade networks, something Rome also brought with them.

Next up, how Carthaginians were actually the good guys and child sacrifice was not that bad.
by habinero | 2025-11-25 19:45:28+00:00
Obviously men are people and therefore can vary, but a lot of them rely on women to be their sole source of emotional connection. Women tend to have more and closer friends and just aren't as lonely or desperate.

A lot of dudes are pretty awful to women in general, and dating apps are full of that sort. Add in the risks of meeting strange men, and it's not hard to see why a lot of women go "eh" and hang out with friends instead.
by jorl17 | 2025-11-25 19:45:33+00:00
I've tried Orion a couple of times. I even used it as my default browser for ~3 months about two years ago. Most recently, I tried to use it again about 2 months ago, but it still had loads of bugs and, most of all, was painfully slow.

The truth is, Orion being based off of WebKit comes with the obvious limitation that....it's based off of WebKit! So much slower than chrome or firefox, and plagued with decisions that are just not to my taste. For example, just the way it behaves when I hit the back button (or, rather, when I swipe back) feels incredibly sluggish. Loading is often terrible, with constant repaints of the screen as well. A bunch of websites don't work properly either.

The only true reason why I wanted Orion to work was because I wanted a browser that would be good for my battery life and "optimized for the mac". But, since then, I've realized I don't really use the battery that much (or that I don't notice it being a problem), and that, whatever "optimized for the mac" means, it definitely isn't speed.

After Arc went around and poo-pooed on its users, I migrated to Zen (I did try Orion again, like I mentioned). Zen is also filled with bugs, but at least I don't want to throw my computer out the window because of it being slow.
by hedora | 2025-11-25 19:46:08+00:00
This would be trivial to implement well. Give the parents a console where they can paste in usernames. Most classes already have parents whatsapp groups or similar, so it’s easy enough to broadcast the usernames, or create a shared google doc.

Console access could also be required to create new accounts. The article says it is currently trivial for kids to just create an adult account and bypass all the parental controls.
by worldsavior | 2025-11-25 19:46:43+00:00
If the all class plays Fortnite and that is the only way they get socialized, his parents should consider moving him to another school. Many kids don't play this kind of stuff and actually prefer hanging out.

This kind of approach is also invalid. So what everyone plays Fortnite? There are many places to get socialized with other kids. The kid likes basketball? Sign him up to a basketball team; he likes to play music? Sign him to some band; etc. Kids shouldn't surrender to peer pressure.

I agree schools are also a problem, but not the main problem.
by stego-tech | 2025-11-25 19:46:50+00:00
> Over and over again, we have seen leaders in Baszucki's position choose growth over guardrails. Safety features come out years after the need for them is identified, if at all. Internal critics are sidelined, laid off, or managed out. And when journalists ask, politely but insistently, why so many of their users are suffering, executives laugh and tell us that we're the crazy ones.

Definitely the larger vibe in tech at the moment. Safety is overwhelmingly not a priority, anywhere, to any leader, no matter how loudly specific proponents scream that "ahkshually, it is."

Thing is, I taste the Kool-Aid each company offers. From tiny businesses to a household name SV enterprise, I give each the benefit of the doubt that this time, they're doing things right. This time, they're taking safety seriously. This time, they care about their employees. I really, truly, sincerely tried giving them all the benefit of the doubt that they see things I don't.

After this past forced career change, I finally gave up that exercise in futility. Actions speak infinitely louder than words, and taking stock of the actions of these people reveal their true intentions every time: as much money as possible for them, fuck everyone else.
by agreeahmed | 2025-11-25 19:47:35+00:00
> Oh, also, you are gateway, not a processor.

Technically right now we are a value-added payment acceptance reseller. Eventually we'd like to become a payfac. And maybe with the new regulations that came out in Georgia, a chartered merchant acquiring bank. But that's down the road.

You're totally right about standardizing the devex across processors. We want to go as "close to the metal" as we realistically could as soon as we could. That's why we very deliberately built our own billing engine from scratch. We could have gotten to market faster by just mapping onto Stripe Billing, but we would have foregone valuable experience mapping processor lifecycle events to our data model. For a while that's going to be much of the work on our plate, standardizing how we map their lifecycle to ours.

We took the past year basically studying the prior art and developing / testing a data model that we feel is well on its way to describing the general case. I was frankly surprised how long it took to really hammer out the primitives.