MurphyA/hacker-news huggingface dataset:
by jorams | 2025-11-06 22:23:55+00:00
This seems to include details from a Spotify data breach in or before early 2020 that, to my knowledge, was never reported on. They did have other, similar issues that year.

Reporting from the time seems to all be about one or multiple leaks/attacks involving:

- Credential stuffing with data from other breaches

- A leak of data (including email addresses) to "certain business partners" between April 9, 2020 and November 12, 2020.

On April 2, 2020 somebody logged in to my Spotify account (which had a very weak password) from a US IP address. This account used an email address only ever used to sign up to Spotify years earlier, and the account had been unused for years by that point. I changed the password minutes later. A few hours after that Spotify also sent an automatic password reset because of "suspicious activity". At no point have I ever been notified by Spotify that my data had been leaked, though it obviously had, and now said email finally shows up on HIBP.
by Aurornis | 2025-11-06 22:23:56+00:00
> Like a slave but with subtle differences that don't really matter.

Anyone using slavery as a metaphor for participating in tech platforms is out of touch with what slavery really is. Nobody is owning you as person and forcing you to work for them without any freedoms because they opened an app store or let you make a Facebook book.

Minimizing the brutality of actual slavery by drawing comparisons to putting apps in app stores (or other tech platform things) is really distasteful
by martinald | 2025-11-06 22:23:58+00:00
The issue isn't even 'quality' per se (for many tasks a small model would do fine), its for "agentic" workflows it _quickly_ runs out of context. Even 32GB VRAM is really very limiting.

And when I mean agentic, i mean something even like this - 'book a table from my emails', which involves looking at 5k+ tokens of emails, 5k tokens of search results, then confirming with the user etc. It's just not feasible on most hardware right now - even if the models are 1-2GB, you'll burn thru the rest in context so quickly.
by ChrisMarshallNY | 2025-11-06 22:24:01+00:00
I think, at this point, we should just assume that our emails are out there. Can't put the candy back in the piñata.

My main email addy is an OG mac.com address. I registered it about five minutes after Steve announced it. My wife got her first name, but I suspect that Chris Espinosa already had chris@mac.com.

In any case, it was compromised back when Network Solutions sold their database to spammers (or some other scumbags sold their database), and it's been feral, ever since. Basically, most of this century.

I've survived it. I maintain Inbox Zero, frequently.

One of the saving graces, is that mac.com has "aged out," so most of the spammers switched over to icloud.com, and that means I can just set up a rule to bin anything that comes into icloud.com.
by brailsafe | 2025-11-06 22:24:24+00:00
Technically you're probably right, but I think this feeling affects people who trained to be competitive at something when they were very young, then stopped and stagnated, and then tried to pick it back up after their divorce or letting themselves get a beer gut or something. The feeling of not being the same as they were in high school or whatever.

I was reasonably athletic, but never tried to "train" or got even close to what peak might have meant, and then continued skateboarding and doing other athletic things throughout my twenties, always being in pretty good shape. Now in my thirties, I'm in my best shape and continuing, it doesn't really matter what my peak hypothetically could have been or where I was at earlier, past is the past, let the good memories stick around, let the bad ones disappear, be present and keep pushing into the future.

Maybe I consider it a blessing that I never tried that hard in my early years, because now I'm not concerned about any ceiling. I let the enjoyment and ambition guide me, not the numbers, who cares.
by anigbrowl | 2025-11-06 22:24:33+00:00
Great analysis. It's especially ironic to see it play out in this context given the well-known Japanese predilection for building consensus and buy-in; the flip side of this is that those outside the circle of decision-makers are especially sensitive to the subtexts you identify.

This style of communication certainly has its uses, and I too resort to it when I want to indicate firm disagreement without being aggressive, as do most people. I think the reasons it has generated so much pushback on this occasion are twofold: it's being used to dismiss the concerns of whole community by infantilizing a long-time leader of said community, and it's doing so in the context of translation itself. That is, volunteer effort and tools that are supposed to improve communication and mutual understanding in theory are in practice being replaced unilaterally with a tool that epitomizes a unilateral and dehumanized approach to information processing.
by fcpguru | 2025-11-06 22:24:34+00:00
222 and timeleft you start in groups of 5 or 6, but then there is the "after party" with all those small groups combined. That's where this idea first came from. I was at one of those after parties and I was like wait and sec, it's 2025 why does this feel exactly like how we did this in 1980s?
by Rohansi | 2025-11-06 22:25:57+00:00
> In none of them text is primary and all other incidental?

This is a pretty outdated way of thinking. If we were only speaking about (old) HTML then maybe. But these days HTML and CSS are basically inseparable and go far beyond "text is primary".

> In which UI framework actions like "set focus on an element" triggers a full page re-layout?

I don't see why a browser would need to re-layout for just a focus change. Unless, of course, the CSS changes require a re-layout after the focus has changed (`:focus` selector).

Every UI framework can run into performance issues with layout and/or painting if they're complex enough (or poorly made). There is fundamentally very few differences between HTML+CSS and other UI frameworks.
by blobbers | 2025-11-06 22:26:04+00:00
I think its an interesting conundrum because you're right it is the same as what you said!

They don't tell us the due diligence they do, but we would hope that our bureaucracy is careful about who they target and carefully thinks about how it affects the perception of americans vs. the potential benefit to our society (elimination of narco traffickers)?

Ukraine / Russia aside, we no longer have much in the way of conventional wars where each team wears a certain color and they shoot at each other. Instead the weaker force tries to disguise itself as best possible and strike when possible. In this case, a drug cartel would try to be as under the radar as possible.

What level of due diligence would you need to see before you would trust that a strike is justified? Or is the problem that narco trafficking doesn't justify death and therefore they should simply be imprisoning traffickers?

On the subject of evidence, the problem with AI is that now video and imagery can easily be faked. You've always been able to plant a bag of weed on a teenager and arrest him, so planting a kilo of coke on a boat and arresting someone is no different.

Malaysia, Philippines, China, Singapore all punish drug related crimes with death. One could argue that the societal impact of drugs is incredibly bad, thus warranting death to the traffickers.

Without a doubt, helping addicts is a societally very challenging problem! Anyone who has had a loved one fall victim to addiction has dealt with the struggle of emotions that comes with it. A need for them to be better, but lacking the path forward when they regress. Simply removing the drugs from the equation would have never destroyed their lives.

At some point it fundamentally needs to come down to trusting the people who defend the country ... who are entrusted to do this most difficult job.
by vkou | 2025-11-06 22:26:05+00:00
> It’s Incredibly Easy

client = OpenAI() context_good, context_bad = [{ "role": "system", "content": "you're Alph and you only tell the truth" }], [{ "role": "system", "content": "you're Ralph and you only tell lies" }] ...

And this will work great until next week's update when Ralph responses will consist of "I'm sorry, it would be unethical for me to respond with lies, unless you pay for the Premium-Super-Deluxe subscription, only available to state actors and firms with a six-figure contract."

You're building on quicksand.

You're delegating everything important to someone who has no responsibility to you.
by andrecarini | 2025-11-06 22:27:06+00:00
As an unpaid volunteer to a multimillion dollar corporation that has just erased a huge collective volunteer effort, listing in writing the reasons I'm unhappy is already way too much effort.

Asking that same volunteer to hop on a video call is just insensitive. They're the one providing free work; if you care about solving the problem and not losing the volunteer force, you should go where they are (the forums) instead of asking them to come to you (video call). They probably don't want to take time out of their schedule to waste their time talking with a community rep. And they probably don't even want to do a voice/video call.
by tptacek | 2025-11-06 22:27:06+00:00
I think my thing about MCP, besides the outsized press coverage it gets, is the implicit presumption it smuggles in that agents will be built around the context architecture of Claude Code --- that is to say, a single context window (maybe with sub-agents) with a single set of tools. That straitjacket is really most of the subtext of this post.

I get that you can use MCP with any agent architecture. I debated whether I wanted to hedge and point out that, even if you build your own agent, you might want to do an MCP tool-call feature just so you can use tool definitions other people have built (though: if you build your own, you'd probably be better off just implementing Claude Code's "skill" pattern).

But I decided to keep the thrust of that section clearer. My argument is: MCP is a sideshow.
by timenotwasted | 2025-11-06 22:27:42+00:00
Despite what they say in that GH comment that it was reduced by 10x my anecdata is that it has been hyper-aggressive in the last few days. I had it popup twice during a single context window session. It makes me feel like they are really concerned about model regressions and in turn their lack of confidence makes me really not confident about what's going on behind the scenes.
by Jtsummers | 2025-11-06 22:28:00+00:00
I need to get back in the habit, but we have a sitting room with no television. I used to have a "no screens" (except e-ink ereaders with just books/PDFs/etc.) rule in there for myself, made for a great reading space. I broke it while working on a masters degree and needed a quiet space to study and work on projects, once I'm done with the degree I plan to go back to that rule though.
by jiggawatts | 2025-11-06 22:28:44+00:00
> we run on Azure SQL Hyperscale

Definitely the wrong technology, and was almost certainly picked only because Troy Hunt is a "Microsoft Regional Director and MVP".

Many other technologies scale better for this kind of workload. Heck, you could ask ChatGPT to write a short C# CLI tool to process the data on one machine, you don't even need a huge box.

This kind of thing comes up here regularly on HN for problems such as duplicate password detection, leaked password filtering, etc...

After previous brainstorming sessions the general consensus was that it's really hard to beat a binary file that contains the sorted SHA hashes. I.e.: if you have 1 billion records to search and you're using a 20-byte SHA1 hash, then create a file that is exactly 20 billion bytes in size. Lookup is (naively) just binary search, but you can do even better by guessing where in the file a hash is likely to be by utilising the essentially perfectly random distribution of hashes. I.e.: a hash with a first byte value of "25" is almost certainly going to be 10% of the way into the file, etc...

It's possible to create a small (~1 MB) lookup table that can guarantee lookups into the main file with only one I/O operation of a fixed size, such as 64 KB.

Sorting the data is a tiny bit fiddly, because it won't fit into memory for any reasonably interesting data size. There's tricks to this, such as splitting the data into 65,536 chunks based on the first two bytes, then sorting the chunks using a very ordinary array sort function from the standard library.

On blob storage this is super cheap to implement and host, about 50x cheaper than Azure SQL Hyperscale, even if it is scaled down to the minimum CPU count.
by kazinator | 2025-11-06 22:29:52+00:00
Why generate code at all?

Because there are times when you use code in order to generate content. For instance, a complicated document in a content creating documentation. (Anything: graphics, music, corporate documents, ...).

Suppose that, on the spot, AI writes you a software suite in which you create a document.

Do you dare throw that suite away, hoping that AI will write a compatible one tomorrow which can still open and correctly handle all details of that complex document?
by buzer | 2025-11-06 22:30:02+00:00
> But also, how did 2 billion email addresses get exposed?

The list contains emails which have been part of some other breaches. In my domain I have 2 emails that were exposed that weren't my normal email address. One of them was a typo that I used sign up for one service which was later breached. The other one was something someone used to register to service that I have never used & that service was later breached. Those emails have never been used for anything else as far as I'm aware.

Of course judging from what posted there are likely some other services as well which were breached but wasn't noticed/published until now.
by hylaride | 2025-11-06 22:30:28+00:00
There are several options to choose from, but most data brokers will know that small custom domains go back to a certain or small group of people.

That being said, this is a good list:

https://www.reddit.com/r/privacy/comments/108wzvg/what_is_th...

Not sure I trust the longevity of some of them, though. I do use https://temp-mail.org/en/ or other similar services for some logins for some services I'm not afraid to lose access to, though (especially for places likely to spam me).
by runjake | 2025-11-06 22:30:49+00:00
I guess it's a matter of perspective. Dotnet 10 just came out[1] with a bunch of solid new shiny that I'm enjoying.

And, as it stands, Dotnet is much further along in the multi-platform game than Swift. As far as I know, none of the Swift-based UI stuff is being ported to, let alone going to be usable on non-Apple platforms.

1. https://www.c-sharpcorner.com/article/whats-new-in-net-10/
by Aerolfos | 2025-11-06 22:31:16+00:00
I'm sure people will come out of the woodwork to tell me just how wrong this is, but say various Linux projects or the kernel seem to have better (better, not perfect) governance structures.

Not being obsessed with rapacious growth, not chasing trends and features that look good on delivery metrics but instead building a stable product would go a long way.

And frankly, for descriptions on what the product should be, standards to implement (or not), and overall strategy for a project that tries to do its best for tech as a whole - Mozillas own writeups are spot-on! They just don't seem to act in accordance with the "vibe" and ideals that blog posts etc. talk about.
by nowittyusername | 2025-11-06 22:32:19+00:00
I agree with the sentiment but I also recommend you build a local only agent. Something that runs on llama.cpp or vllm, whatever... This way you can better grasp the more fundamental nature of what LLM's really are and how they work under the hood. That experience will also make you realize how much control you are giving up when using cloud based api providers like OpenAI and why so mane engineers feel that LLM's are a "black box". Well duh buddy you been working with apis this whole time, of course you wont understand much working just with that.
by blobbers | 2025-11-06 22:32:23+00:00
We should probably enact harsher laws on drug smugglers / narco traffickers. A lot of asian countries have essentially declared the death penalty to drug importers.

The administration wants to see results and it would seem that the problem is that the American judicial systems is set up to simply cost money, which is something narcos have.

If you take a cartel to court, they just have a lawyer tie up your law team. We've made the mistake of allowing capitalism to influence too many of our systems of government from judicial (cost of lawyers) to electoral (advertisement costs and political campaigning). Isn't this the problem?
by zahlman | 2025-11-06 22:32:35+00:00
> Imagine what it’ll do if you give it bash. You could find out in less than 10 minutes. Spoiler: you’d be surprisingly close to having a working coding agent.

Okay, but what if I'd prefer not to have to trust a remote service not to send me

{ "output": [ { "type": "function_call", "command": "rm -rf / --no-preserve-root" } ] } ?
by vidarh | 2025-11-06 22:32:36+00:00
I'd second the article on this, but also add to it that the biggest reason MCP servers don't really matter much any more is that the models are so capable of working with APIs, that most of the time you can just point them at an API and give them a spec instead. And the times that doesn't work, just give them a CLI tool with a good --help option.

Now you have a CLI tool you can use yourself, and the agent has a tool to use.

Anthropic itself have made MCP server increasingly pointless: With agents + skills you have a more composeable model that can use the model capabilities to do all an MCP server can with or without CLI tools to augment them.
by 9rx | 2025-11-06 22:32:46+00:00
> Democracies tend towards dictatorship?

Strictly speaking, no. A dictatorship takes power away from the people. A democracy sees the people give the power away.

The people don't have to give power away in a democracy, technically, but in practice they always do. Democracy is hard work and people have bigger fish to fry, like keeping food on their table and a roof over their head. For most people it is most sensible to allow a "leader" to take power away from them.

So casually speaking, there isn't a difference. In both cases power isn't in the hands of the people. The reason for why the power isn't held differ, but that is understood to be immaterial with respect the context of discussion.
by zozbot234 | 2025-11-06 22:33:17+00:00
Rust is a lot simpler than C++ and arguably Python itself, so it's not a huge surprise that it turns out to be viable as a first programming language. Especially since some parts of it can be taught as pretty much a pure functional language at the outset (actually this works quite well, right up until you really need interior mutability - which is not that often), which makes for a good intuition of what keeps the borrow checker happy.
by piratesAndSons | 2025-11-06 22:33:54+00:00
How many degrees of separation need to exist before your culpability drops to nearly zero?

One degree? Two? Three? Someone cashing a paycheck from Facebook or Google can tout how the company is connecting people, which is like military folks saying they work in defense.

I feel like almost no one working at a for-profit company can truly escape the principle of do no harm.

The fact that I lean into the positive aspects of my work is just natural. Everyone does the same thing, since every product has both good and bad aspects.
by chubot | 2025-11-06 22:34:08+00:00
> language with well-defined semantics

That would certainly be nice! That's why we have been overhauling shell with https://oils.pub , because shell can't be described as that right now

It's in extremely poor shape

e.g. some things found from building several thousand packages with OSH recently (decades of accumulated shell scripts)

- bugs caused by the differing behavior of 'echo hi | read x; echo x=$x' in shells, i.e. shopt -s lastpipe in bash.

- 'set -' is an archaic shortcut for 'set +v +x'

- Almquist shell is technically a separate dialact of shell -- namely it supports 'chdir /tmp' as well as cd /tmp. So bash and other shells can't run any Alpine builds.

I used to maintain this page, but there are so many problems with shell that I haven't kept up ...

https://github.com/oils-for-unix/oils/wiki/Shell-WTFs

OSH is the most bash-compatible shell, and it's also now Almquist shell compatible: https://pages.oils.pub/spec-compat/2025-11-02/renamed-tmp/sp...

It's more POSIX-compatible than the default /bin/sh on Debian, which is dash

The bigger issue is not just bugs, but lack of understanding among people who write foundational shell programs. e.g. the lastpipe issue, using () as grouping instead of {}, etc.

---

It is often treated like an "unknowable" language

Any reasonable person would use LLMs to write shell/bash, and I think that is a problem. You should be able to know the language, and read shell programs that others have written
Show HN: Insinuate – tense description party game
by wolfred | 2025-11-06 22:35:35+00:00
My friends and I love playing description games, but got tired of the same old cards - so I made a simple web app with a fresh set of prompts, and a different timer mechanic:

Rather than teams taking turns, everyone sits together, and you describe only one prompt at a time. As soon as you're done you pass the phone to the player on your left, who gets a new set of prompts to choose from, and so on. After an exponential (memoryless) random amount of time, the round ends (loudly!), and whoever was holding the phone at the time loses a life for their team. It's like Hot Potato.

The prompts are AI-generated - I like most of them, but there are some weird ones in there...

Warning: the explosion is LOUD.
by vkou | 2025-11-06 22:35:44+00:00
> It seems weird that such an overwhelming majority of US retail banking customers are using a domestic institution if the foreign ones are getting a fair shake, doesn't it?

Why is it weird? All other aspects being equal, why would you want to put your money into a bank that's accountable to another government first, and your market second?

Banking involves a ton of (unverifiable from the retail end) trust. There are a lot of risks to it. Going with a local institution mitigates some of them, and going with a foreign one adds very few benefits (Unless you're doing a lot of business in their home country).

You can absolutely bank with a foreign bank. HSBC is a giant international bank. TD and RBC are Canadian banks with branches in the US (RBC's are whitelabeled as City National Bank). If you want to do some tax evasion, or deal with the fallout of rogue traders, or bank with someone who has the rotting corpse of Credit Suisse anchored around its neck, you're free to do your retail (or investment) banking with UBS.

Why aren't you using them?

I assure you, you'll find the experience largely interchangeable with the same level of service you'd expect from any of the Big Four.
by iamnothere | 2025-11-06 22:36:07+00:00
This idea was explored recently here: https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...

This is just another form of Blackstone’s ratio: https://en.wikipedia.org/wiki/Blackstone's_ratio

The problem itself is an ancient one and you can find a number of texts that explore the idea from various angles.