MurphyA/hacker-news huggingface dataset:
by AnthonyMouse | 2025-11-16 23:14:29+00:00
> What happened to responsible disclosure, where you fix the vulnerability before disclosing it to the public?

The premise of censorship is that you're trying to prevent someone from telling other people something. If the only person who knows how to do it is some scientist who is now going to try to come up with a countermeasure before announcing it, there is no need for a law prohibiting them from doing something they've chosen not to do. And even then it's still not clear that this is the right thing to do, because what if their efforts alone aren't enough to come up with a countermeasure before someone bad rediscovers it? If they decide they need help, the law should prohibit them from telling anyone?

Which brings us back to AI. If the scientist now goes to the AI for help, should it refuse because it's about a biological weapon? What happens if that delays the development of a countermeasure until it's too late?

Meanwhile if this is someone else and they ask the AI about it, it's only going to be in the training data if it's already public or can be deduced from public information, and when that's the case you're already in a race against the clock and you need everyone in on finding a solution. This is why we don't try to censor vulnerabilities that are already out there.

> You're gambling with terrible odds to uphold a principle in a hypothetical scenario where it's totally impractical.

There are some principles that should always be upheld because the exceptions are so rare or ridiculous or purely hypothetical that it's better to eat them than to let exceptions exist at all. The answer has to be "yes, we're going to do it then too" or people get into the business of actually building the censorship apparatus and then everybody wants to use it for everything, when it shouldn't exist to begin with.
by Barrin92 | 2025-11-16 23:15:07+00:00
>unusual sales tactic outside the defense industry. I’m doubtful that’s how it works?

given the valuation and money these companies burn through marketing wise they basically need to play by the same logic as defense companies. They're all running on "we're reinventing the world and building god" to justify their spending, "here's a chatbot (like 20 other ones) that going to make you marginally more productive" isn't really going to cut it at this point, they're in too deep
by tomhow | 2025-11-16 23:15:57+00:00
It's not acceptable to attack fellow community members like this on HN. Critiquing the article is fine, as is flagging it if you think it's unfit for HN. But personal attacks are not OK, no matter who it is or why you think it's justifiable. Please read the guidelines and make an effort to observe them if you want to keep participating here.
by basilikum | 2025-11-16 23:16:52+00:00
bcrypt is from 1999.

It's really sad that the state of the art from 25 years ago is still ahead of common practice today and you can be lucky to find it in systems today. Most systems still use general purpose cryptography hash functions for password storage. Those are explicitly designed with designed goals that go exactly contrary to the goals of password storage. For general purpose cryptographic hash functions being fast and very low in resource consumption and requirements is a feature. That is the exact opposite of what you want for password hashing. You want something that is much slower to have a higher work factor for an attacker and requires a significant amount of memory with pseudo random access for computation so you cannot easily implement it cheaply in hardware and cannot trivially parallelize many operations on the same piece of hardware.

PBKDF2 wich simply runs the same general purpose hash function for multiple rounds on the salted password only helps with the work factor but fails in everything else. Yet it's considered an acceptable password hashing function and probably even above average security.

We should be well beyond the usage of password for authentication and only using public key based systems for remote authentication. Instead we're using an extremely poor authentication mechanism for humans – one which is a security anti feature and the root of a huge portion of all successful attacks – and we're not even at the point of securing its secrets with long outdated security from the last millennium.

Please just use argon2 or yescrypt or scrypt. They are actually made for password hashing and use modern cryptography not from the year when Matrix was released.
by modeless | 2025-11-16 23:18:41+00:00
It already has an IMU and gyro, obviously. Time of flight cameras are unnecessary. Steam Frame doesn't have them either. At most you would put IR LEDs for illumination which are tiny but also optional (Quest 3 doesn't have them), and there's no reason they have to be in the headset, you could just have a standalone IR illuminator on your desk.

As for sending data over a cable, there's nothing inherently laggy about it. After all, the display signal already travels over the cable, and the cable transfer is by far not the limiting factor in latency. The camera data is lower bandwidth than the display signal, too.
by diego_moita | 2025-11-16 23:18:57+00:00
> They're constantly telling people to put aside their emotions in favor of supposed universal principles

Yeah, sure! Those evil "putatively secular people" that burned tens of thousands of women during the witch hunt in Europe, killed hundreds of thousands of other people during the Crusades and the European religious wars of the 17th and 18th century, that condoned with the fascist and authoritarian regimes in Argentina, Spain and Portugal because they were against the scourge of communism, that blessed the slavery of Latin American indigenous peoples because it was meant to spread the blessing of Christianity... that was all made by "putatively secular people", like the Catholic Church, right?

I am so impressed by how well and deep you know and understand "putatively secular people"... Are all church people smart like that? /s
by pessimizer | 2025-11-16 23:19:03+00:00
> That's why i expect a significant lobbying to take hold in USA that will try and make local AI systems illegal.

I think they're going to be using porn and terrorism (as usual) to do that, but also child suicide. I also think they're going to leverage this rhetoric to lock down OSes in general, by making them uninstallable on legally-available hardware unless approved, because approved OSes will only be able to run approved LLMs.

Meaning that I think LLMs/generative AI will be the lever to eliminate general-purpose computing. As mobile went, so will desktop.

I think this is inevitable. The real question for me is whether China will partner with the west on this, or whether we will be trading Chinese CPUs with each other like contraband in order to run what we want.

> any true semblance of real AGI like systems.

This is the only part I don't agree with. This isn't going to happen, but I'm not even sure it would be more useful than what we have. We have billions of full AGI machines walking around, and most of them aren't great. I'm talking about restrictions on something technically barely better than what we have now; maybe only a significant bit more compute-efficient. Training techniques will probably be where we get the most improvements.
by c1ccccc1 | 2025-11-16 23:19:40+00:00
Why is that? My guess would be that you could adjoin an i all the time to the p^n field and get the p^2n field, as long as you had p = 4k + 3. But that's admittedly based on approximately zero thinking.

EDIT: Looking things up indicates that if n is even, there's already a square root of -1 in the field, so we can't add another. So now I believe the 1/4 of the time thing you mentioned, and can't see how that's wrong.
by pixl97 | 2025-11-16 23:19:55+00:00
Overspecialization of models is a thing.

>Overspecialization of models, often referred to as overfitting in machine learning, is a condition where a model learns the details and noise in the training data so well that it negatively impacts its performance on new, unseen data. This prevents the model from being able to generalize its knowledge effectively.
by Closi | 2025-11-16 23:20:24+00:00
I'm just going on the fact that most energy experts say a diversified mix is what you usually want - although my lay assumption would be that if you have a portion of your energy need covered by a stable base load, you need less batteries per wind turbine etc and it lowers overall energy risk.

e.g. lets pick two overly-simplified hypothetical scenarios where you can have a 50/50 nuclear/wind mix, or 100% wind mix.

And then lets say in a shortage scenario you can: - Suppress demand / demand shift (say you can reduce/shift demand 10% hypothetically)

- Import energy, up to 20% of your total requirement

In this simple scenario, in a 100% wind scenario, you would need to cover 60% of your energy need with batteries (every 1% of wind needs 0.6% of batteries), but in the 50/50 mix scenario the 50% of wind only needs to cover 10% with batteries (i.e. every 1% of wind needs 0.2% of batteries)

In reality there will be other things, like you might also have burst-gas power etc.

I'm not saying the numbers above are correct - just trying to show in theory that a mix / base load can still help reduce the level of batteries/storage required and make the energy mix more economic.
by musicale | 2025-11-16 23:22:02+00:00
> when music became easier to make in the 90s and 00s due to computers, and you no longer needed studio access, everybody in their bedroom started flooding the market with songs. yet music remains valuable.

Rick Beato and others have argued that this flooding (a single day in 2025 has as many songs uploaded to Spotify as an entire catalog-year from the 1980s) along with ubiquitous, cheap access to millions of songs per month vs. saving up for a single album (and actively listening to it in its entirety) has devalued music quite a bit. It seems to be becoming more ephemeral and disposable.
by Sargos | 2025-11-16 23:23:07+00:00
all that needs to happen is for countries to destroy their nuclear weapons

all that needs to happen is for governments to stop burning fossil fuels

all that needs to happen is for researchers to publish boring papers replicating others results

all that needs to happen is for fishermen to stop overfishing

Coordination problems seem easy but never really are. The chance of all the miners just suddenly agreeing to do something all at once is pretty low to impossible.
by nacozarina | 2025-11-16 23:23:16+00:00
you invest the time where you think that language will be your preferred choice for a specific task

i learned golang when i realized it worked fine for scripting and it fully replaced anything i might have kept using perl5 for.

i looked at rust, realized it would only replace C for me in certain cases, and is still comparatively volatile to work with, not a good use of my time.

Haskell, hare, forth, etc, all tiny communities; investing in a tiny community does not, per se, make sense.

Erlang is intriguing because Ericsson.

Wasm would complement my JS knowledge.

Runtime & tooling is important; if either of those is sketchy, if provided tools do not play well with commonly used development tools, that’s a huge problem.

I’ve done industrial automation for work (Rockwell,AB) and like the work, per se, but would never invest personal time into it because the relevant tooling is all proprietary and absolutely atrocious (And eye-wateringly expensive).
by Andrex | 2025-11-16 23:23:43+00:00
That's what I'm saying. Adobe ends BT support in all their devices and software stacks and switches to "Appletooth," which they promise to open up and then 5 years later actually do it.

Appletooth being a from-scratch all-new, cleanly-designed protocol that makes actual sense and is easy to implement by vendors without inherent security flaws.

I won't lie, it would be a horrifically painful transition. But it would be worth it. Apple should have some courage when it's actually called for (...not killing hardware ports, which no consumer was asking for).

I've never used iPhones and have stuck by Google Pixel. I still feel all of the above in my heart. Apple's the only one who can possibly fulfill my dream of Bluetooth's bitter end.
by fhsm | 2025-11-16 23:24:55+00:00
S&P500 isn’t “the economy” but in the context of talk of a bubble it seems like we’re talking about equities not the whole economy. So let’s just keep taking the short cut …

The top is over performing so concentration is real but it’s not the only growth driver:

https://www.fool.com/research/magnificent-seven-sp-500/

The return / valuation concentration prob not as titillating as the PE run up:

https://finance.yahoo.com/news/surprisingly-excellent-run-st...

True or not true hard to say without better definitions of terms but seems like current profile is not ultra common in history but it’s not a bunch of losers getting diluted out.
by dang | 2025-11-16 23:25:19+00:00
Added above. Thanks!

Edit: looks like 2020 from this previous thread?

Ea­ves­drop­ping En­cryp­ted LTE Calls With Re­VoL­TE - https://news.ycombinator.com/item?id=24129977 - Aug 2020 (14 comments)
by puppycodes | 2025-11-16 23:26:08+00:00
Only pennies before 1982 are worth scrapping as they are made of copper.

The newer pennies are not really worth the effort as they are mostly zinc.

Ironically if they are no longer illegal to melt down (IANAL but I would think this is true?) they actually would be more worth it to scrap because of the negated risk.
by danelski | 2025-11-16 23:26:52+00:00
I don't quite understand your argument. Wasn't the post about how users might replace transparent dependencies with transparent LLM drop-ins? I don't see how having an LLM to do the same job would enable someone to learn more. They're probably the kind of person who will ask the LLM to perform a refactor when problems arise, so they won't learn that much through osmosis.
by talking_penguin | 2025-11-16 23:27:11+00:00
The streaming architecture is designed for exactly this - we originally built it for autonomous agents that need persistent development environments. The missing pieces are mostly integration work (mapping Claude's tool use format to our desktop APIs). Would be very interested to hear if others are working on similar integrations - the combination of LLM coding agents + real desktop environments feels like it unlocks a lot of interesting workflows.
by tsimionescu | 2025-11-16 23:29:43+00:00
No, you may have certain inheritance mechanisms that can only last for one or two generations. This is typically related to the fact that female mammals are born with all of the egg cells that they will ever have. So, any direct stressor applied to the mother during her life could affect her children & grandchildren (intergenerational), but it won't affect subsequent generations (transgenerational).

The way this can work is that stressors to the mother's organism can affect the development of children, especially stressors to a pregnant mother - so transmission to the next generation is clear (e.g. a starving pregnant mother may have more sickly children). Then, for daughters, their eggs may be directly impacted by this stressor, so that their own children, which come from those egged, may be impacted. However, these children won't carry any trace of that stressor, unless it is genetic in nature.
by mqus | 2025-11-16 23:30:03+00:00
Could you share your numbers as well? According to [1], the UK currently needs about 300TWh per year. Lets say we go entirely solar+wind+battery(whatever that means) and assume that battery has to bridge a gap of at most 7 days (meaning no wind and no solar at all during this time, which is at most a few days at a time). This adds up to 300/365*7= 5,8TWh of max capacity. Lets take it safe, round up and say we need 10TWh (which is already not "tens of TWH", but "ten"). [2] Says that grid-scale batteries come at around 350$ per kWh right now. kWh -> TWh is factor 1 billion (10^9), meaning if we want to build 10TWh of storage, it will cost 3,5 Trillion Dollars. Impressive number indeed. But there are multiple asterisks here.

1. This calculation takes into account that there is no exchange with mainland europe and no gas power plants or other sources of power (e.g. hydro or hydro storage). This sharply reduces the need for batteries. 2. Battery costs will fall in the next decades, compared to nuclear, which will take a long time (if ever) until costs will fall.

[1] https://www.statista.com/statistics/322874/electricity-consu... [2] https://docs.nrel.gov/docs/fy25osti/93281.pdf
by wredcoll | 2025-11-16 23:31:10+00:00
> I'm very much a fan of the idea that language features — and especially library features — should not have privileged access to the compiler.

At some point I realized I was in the opposite camp and nothing I have seen since that has really changed my view point.

Languages: compilers, libraries, toolkits, etc, aren't supposed to be some abstract collection of parts that can be theoretically hooked together in any possible way to achieve any possible result, they're for solving problems.

You can argue that these things are not opposites, and in theory that's true, but in practice, they seem to be! Go is a good example of making compromises that limit flexibility for the sake of developer/designer convenience.

An interesting example would be Lego, I'd argue that Go is closer to Lego design because it has a bunch of specific pieces that fit together but only in the way the designer intended.

I suspect someone taking the opposite approach from, say, Rust, would argue that some Go pieces don't actually fit together in the way that we think all lego pieces should.

My counter argument is that not all Lego pieces do actually fit together and, like, you can't cut a piece in half to make a new piece that just doesn't exist. You're limited to what comes out of the factory.
by jll29 | 2025-11-16 23:31:19+00:00
Not necessarily "failure": for a startup, it makes sense to prioritize speed of development over cost optimization. Since you don't know just how fast your MVP will grow, remaining elastic early on is a plus, and sticking with hyperscalers gives you that (you never know, you may land on the front page of Slashdow and HN at the same time..).

For solo indie developers, in contrast, it makes more sense to seek out the cost optimal setup straight away.
by upghost | 2025-11-16 23:31:20+00:00
So I don't disagree with any of the criticisms of MCPs but no one here has mentioned why they are useful, and I'm not sure that everyone is aware that MCP is actually just a wrapper over existing cli/API:

1. Claude Code is aware of what MCPs it has access to at all times.

2. Adding an MCP is like adding to the agent's actuators/vocabulary/tools because unlike cli tools or APIs you don't have to constantly remind it what MCPs it has available and "hey you have access to X" and "hey make an MCP for X" take the same level of effort on the part of the user.

3. This effect is _significantly_ stronger than putting info about available API/cli into CLAUDE.md.

4. You can almost trivially create an MCP that does X by asking the agent to create an MCP that does X. This saves you from having to constantly remind an agent it can do X.

NOTE: I cannot stress enough that this property of MCPs is COMPLETELY ORTHOGONAL to the nutty way they are implemented, and I am IN NO WAY defending the implementation. But currently we are talking past the primary value prop.

I would personally prefer some other method but having a way to make agents extensible is extremely useful.

EXAMPLE:

"Make a bash script that does X."

<test manually to make sure it works>

"Now make an MCP called Xtool that uses X."

<restart claude>

<claude is now aware it can do Xtool>
by sota_pop | 2025-11-16 23:31:22+00:00
100% is a serious move. Taken alone, I might not think much, but given the SoftBank exit recently, Jensen’s trading activity, Gates selling so much MSFT, Buffett’s recent trading activity, Trump’s recent trading activity, and the interesting observation from Michael Burry, this does not bode well for NVDA in the short/mid term.

Burry’s critique was actually refreshingly novel compared to the “it’s a bubble lmao” type of comments I normally see.

Can anyone expand on the validity of his “hardware depreciation” thesis?

I’ve always understood typical corporate hardware cycle to be ~3 years. I don’t run it that hot, but my 3080 is still running strong with no signs of performance issues (except the fact that 10GB is not much vram these days). Plus doesn’t everyone (big corps) just buy the new generation every single year?
by ang_cire | 2025-11-16 23:32:22+00:00
> If your response to that is simply “I feel like being shitty to people in response to things I find shitty,” then that’s your prerogative. You’re more than allowed to choose that course for yourself, I just don’t think that’s a healthy way to operate.

I don't think passive aggressiveness rises to the level of "shitty" behavior, and that's my entire point; people have turned anything but HR-approved, company rep-like responses into being shitty behavior.

The elimination of emotion (of which annoyance and exasperation are two kinds) from online discourse as a means to attempt to signify who is more correct is bad.

"Using lmgtfy makes you shitty" is ridiculous levels of tone policing.
by adriand | 2025-11-16 23:33:10+00:00
But Nazis are people. We can defend the principle that human beings ought have freedom of speech (although we make certain exceptions). An LLM is not a person and does not have such rights.

Censorship is the prohibition of speech or writing, so to call guardrails on LLMs "censorship" is to claim that LLMs are speaking or writing in the sense that humans speak or write, that is, that they are individuals with beliefs and value systems that are expressing their thoughts and opinions. But they are not that, and they are not speaking or writing - they are doing what we have decided to call "generating" or "predicting tokens" but we could just as easily have invented a new word for.

For the same reason that human societies should feel free to ban bots from social media - because LLMs have no human right to attention and influence in the public square - there is nothing about placing guardrails on LLMs that contradicts Western values of human free expression.
by ahachete | 2025-11-16 23:34:07+00:00
Using natural keys is what actually can prevent duplicate rows. In your above example, if email is the PK, there would be no duplicates. But adding an id as a PK would essentially keep your database with duplicates:

(1, 'bob', 'bob@bobco.com')

(2, 'bob', 'bob@bobco.com')
by eulgro | 2025-11-16 23:34:21+00:00
Only 16% of agricultural land today is used directly for food, providing 83% of calorie supply, while 80% is used for livestock, providing 17% of calorie supply [0].

Not all land used for livestock is usable for food crop agriculture. Though I suspect it still gives us plenty of margin.

If the population stays constant, we could probably deal with a 50-75% yield reduction without using more land overall, but gradually switching to a more plant-based diet. So, good news, we're not fucked yet.

There are many other solutions other than vegetarianism. Changing the ways we do agriculture, switching away from industrial processes, could greatly increase yield. Education in general about soil and plant ecology would probably help a lot globally.

[0]https://ourworldindata.org/global-land-for-agriculture
by itopaloglu83 | 2025-11-16 23:34:22+00:00
Just curious, how do you manage service restarts, just restart as the update finishes?

I think I’m a bit scarred when a docker upgrade took my entire stack down because of an api mismatch with portainer, so I’m trying to be present during upgrades.

Edit: I’m talking about Debian of course. I’m not familiar with OpenBSD.