MurphyA/hacker-news huggingface dataset:
by andybak | 2025-12-17 23:06:57+00:00
I'm one of the maintainers of Open Brush (open-source continuation of Google's Tilt Brush) and a huge chunk of our community is in Japan as well as other East Asian countries. The language barrier is really frustrating as I'd love to engage with them more - respond to bug reports, feature requests etc).

(Open Brush can be used to create content for platforms such as VR Chat as well as being a way to create explorable spaces and artworks in it's own right)
by ozim | 2025-12-17 23:07:01+00:00
Second this.

Basically making sense of unstructured data is super cool. I can get 20 people to write an answer the way they feel like it and model can convert it to structured data - something I would have to spend time on, or I would have to make form with mandatory fields that annoy audience.

I am already building useful tools with the help of models. Asking tricky or trivia questions is fun and games. There are much more interesting ways to use AI.
by baby_souffle | 2025-12-17 23:07:03+00:00
I can certainly think of some organizations that fit into that bucket. I can also name organizations that are hyper controlling and micromanage every aspect of the interaction with their core products and services because they value consistency above all else.

I wonder if we'll have a situation where out of two competing organizations only one is elected to use this and the other one staunchly opposes. That will be telling.
by nodesocket | 2025-12-17 23:07:15+00:00
I also run Umami, but patched once the CVE patch was released. Also, I only expose the tracking js endpoint and /api/send via Caddy publically (though, /api/send might be enough to exploit the vul). To actually interact with Umami UI I use Twingate (similar to Tailscale) to tunnel into the VPC locally.
by marwamc | 2025-12-17 23:07:39+00:00
Another example is they would enumerate your directories and find the names of common scripts and then overwrite your script. Or to be even sneakier, they can append their malicious code to an existing script in your filesystem. Now each time you run your script, their code piggybacks.

OTH if I had written such a script for linux I'd be looking to grab the contents of $(hist) $(env) $(cat /etc/{group,passwd})... then enumerate /usr/bin/ /usr/local/bin/ and the XDG_{CACHE,CONFIG} dirs - some plaintext credentials are usually here.

The $HOME/.{aws,docker,claude,ssh}

Basically the attacker just needs to know their way around your OS. The script enumerating these directories is the 0777 script they were able to write from inside the root access container.
by tagyro | 2025-12-17 23:07:43+00:00
yes, they were (theoretically) a python developer, should have mentioned this was an ML role (your guess is right, slice just before the last char)

Just to be clear: the main problem is not that they did not know what `:-1` was - there are many weird syntax additions with every version - understandable.

IMHO the problem is that there's usually a single interviewer that decides go/no go.

We all have biases, so leaving such an important decision (like hiring an EM) to one person is, (again IMHO) ...stupid .
by Nextgrid | 2025-12-17 23:08:14+00:00
But the firewall wouldn't have saved them if they're running a public web service or need to interact with external services.

I guess you can have the appserver fully firewalled and have another bastion host acting as an HTTP proxy, both for inbound as well as outbound connections. But it's not trivial to set up especially for the outbound scenario.
by heavyset_go | 2025-12-17 23:08:45+00:00
Go over to friend's place and watch the ads they get, you'll get a good idea of what kind of health concerns or illnesses they may have.

So far, in situations where it wouldn't be rude to ask, I've been able to determine with pretty good accuracy that at least someone in the household has the advertised health concerns.

You can also get an idea of their financial situation, given what buckets advertisers put them in and what they're advertised, as well.

Similarly, advertisers know when you're at friend's location, or elsewhere, and may show ads tailored to your profile.
by QuercusMax | 2025-12-17 23:09:01+00:00
Slow, steady, progress can appear quick when the alternative is no progress at all. Or, alternatively: avoid "dead air".

I think I generally identify with what the article is saying - but I think it's more about responsiveness and predictability than pure speed. I've always been a pretty quick worker, but more importantly I've been responsive. It's better to reply back in 5 seconds with an "I don't know; you might want to talk to Susan about this instead" than to spend an hour researching on your own and give them the answer yourself. You can even say "If Susie is too busy, I can look into it myself, but it might take an hour or two".

Communicate, communicate, communicate.
by dexwiz | 2025-12-17 23:09:13+00:00
I used to share a similar sentiment about speed, especially after having burned out hard around 30. But after recovering, I think I may have overcorrected. Momentum is very powerful, and it's hard to gain momentum at low speed.

Speed is important but going fast doesn't mean going as fast as possible. It's about going fast sustainably. Work speed isn't binary. You can be fast without being the fastest.
by vel0city | 2025-12-17 23:09:23+00:00
But if the law says "this person can only be fired for cause", and the President is supposed to faithfully execute the law, shouldn't he only be able to fire the person for cause? Or what, the President can just choose parts of the laws he doesn't like anymore while operating the executive branch and yet still be found to faithfully be executing the law?

All the laws give limitations on what the executive is allowed to do. So this idea that its limiting the abilities of the executive and that's not allowable seems meaningless to me, that's what the laws are for. The laws are there to define how the executive is to act. The executive is then supposed to faithfully do those actions.

If the President has total control over the executive branch, why can't he just go tell the people in the executive branch to go do illegal things all the time? Is he just no longer bound to the law at all? If Congress says the executive needs to make a food stamp program, should he not be required to actually make one? If the Congress says dumping hazardous waste should be limited, should he not be required to actually regulate dumping? Wouldn't he fail at faithfully executing the laws?
by radicality | 2025-12-17 23:09:55+00:00
How do I get Gemini to be more proactive in finding/double-checking itself against new world information and doing searches?

For that reason I still find chatgpt way better for me, many things I ask it first goes off to do online research and has up to date information - which is surprising as you would expect Google to be way better at this. For example, was asking Gemini 3 Pro recently about how to do something with a “RTX 6000 Blackwell 96GB” card, and it told me this card doesn’t exist and that I probably meant the rtx 6000 ada… Or just today I asked about something on macOS 26.2, and it told me to be cautious as it’s a beta release (it’s not). Whereas with chatgpt I trust the final output more since it very often goes to find live sources and info.
by gruez | 2025-12-17 23:10:16+00:00
>You may be thinking about this article about how Target knew that a woman was pregnant before her family knew: https://news.ycombinator.com/item?id=3598558

"before her family knew" is a pretty low bar to clear, especially if the daughter was actively trying to hide the pregnancy (eg. by wearing baggy clothing). Moreover if we're taking the example of this specific story, where the women presumably knew she was pregnant (as opposed to the more sensational story of "Target figured out a women was pregnant before she even knew!!1!" that also makes the rounds), it's not hard to imagine how Target might be in a better position to infer her pregnancy without being galaxy brained or creepy. Take the examples given in the article:

>Take a fictional Target shopper named Jenny Ward, who is 23, lives in Atlanta and in March bought cocoa-butter lotion, a purse large enough to double as a diaper bag, zinc and magnesium supplements and a bright blue rug.
by svat | 2025-12-17 23:10:21+00:00
I assumed the books were somewhat fictional (i.e. they were Gladwell-style) because if he meant to make a claim seriously he'd have published in a medical journal instead of a popular/literary book. But since writing the comment above, I've learned that over the years many people actually believed that all details in the books were literally true (you can search for e.g. [Sacks prime] to see many people who took the story seriously and analyzed them), which does put things in a different light.
by 1vuio0pswjnm7 | 2025-12-17 23:10:31+00:00
I use a text-only browser as an offline HTML reader

I make HTTP requests with a TCP client

There are no "false positives"

I only request the resources that I want, e.g., the HTML from the primary domain, JSON from the API domain, etc.

I also use custom filters written in C to extract the information I want from the retreived HTML or JSON and transform it into SQL or "pretty print"

There is nothing to "block" because I'm not using software that automatically tries to request resources I do not want from domains I never indicated I wanted to contact
by awesome_dude | 2025-12-17 23:10:34+00:00
My Entire career

"Why the f*ck are you asking, you should know this"

or

"Why the f*ck can you not look that up"

edit: There's an entire chapter of the internet with "LMGTFY" responses because people ask questions.

or

"Isn't it f*cking obvious"

or

"Do I have to f*cking spell it out for you"

There's a strong chance that I am autistic, which means, yes, I need people to be (more) explicit.

AI has done a hell of a good job making it easier for me to search for subtexts that I typically miss. And I receive less of the negative feedback when I have something to ask that does help.
by Nextgrid | 2025-12-17 23:10:50+00:00
Container escapes exist. Now the question is whether the attacker has exploited it or not, and what the risk is.

Are you holding millions of dollars in crypto/sensitive data? Better assume the machine and data is compromised and plan accordingly.

Is this your toy server for some low-value things where nothing bad can happen besides a bit of embarrassment even if you do get hit by a container escape zero-day? You're probably fine.

This attack is just a large-scale automated attack designed to mine cryptocurrency; it's unlikely any human ever actually logged into your server. So cleaning up the container is most likely fine.
by dangus | 2025-12-17 23:11:23+00:00
This article feels judgmental, off-putting, and condescending to me.

It is especially so because it chooses real examples to put down.

Why is the author’s philosophy the arbiter of what we are allowed to enjoy? Why is basic shallow pleasure in life looked down upon?

It even feels condescending to people who have actual serious needs like hunger and disease who may turn to some of these “vices” for an escape. Meanwhile, thick desires are available for those privileged with free time, energy, and money.

By the end of the article I almost felt like the author was trying to evangelize a religion to me, in a really icky way.
by xp84 | 2025-12-17 23:11:40+00:00
> the genie, used well, accelerates learning.

Ehh... 'used well' is doing some very heavy lifting there. And the incentive structure at 90% of companies does not optimize for 'using it well.'

The incentive is to ship quickly, meaning aim the AI-gun at the codebase for a few hours and grind out a "technically working" solution, with zero large-scale architecture thought and zero built-up knowledge of how the different parts of the application are intended to work together (because there was no "intention"). There will be tests, but they may not be sensible and may be very brittle.

Anyway, deploying a bunch of fresh grads armed not with good mentorship but with the ability to generate thousands of LOC a day is a recipe for accelerating the collapse I usually see in startup codebases about 6-8 years old. This is the point where the list of exceptions to every supposed pattern is longer than the list of things that follow the patterns, and where each bug, when properly pursued, leads to a long chain of past bad decisions, each of which would take days of effort to properly unwind (and that unwinding will also have a branching effect on other things). Also, coincidentally, this is the point where an AI agent is the most useless, because they really don't expect all the bizarre quirks in the codebase.

Am I saying AI is useless? No, it's great for prototyping and getting to PMF, and great in the hands of someone who can read its output with a critical eye, but I wouldn't combine it with inexperienced users who haven't had the opportunity to learn from all the many mistakes I've made over the years.
by nguyensonatx | 2025-12-17 23:11:43+00:00
That’s fair, and I actually agree with a lot of this. I don’t think everything should be automated, especially the parts where thinking and intent matter.

The “20+ hours” is mostly coming from the mechanical stuff: re-entering the same work history, dates, education, addresses, citizenship questions, etc. over and over across different ATSs. Not the cover letter, not the custom questions.

Ideally, the goal would be to reduce fatigue so people can put more effort into the thoughtful parts, not less.
by prmph | 2025-12-17 23:12:05+00:00
It seems they have listened to users and allow pinned tabs to navigate to any url.

Initially this is how pinning worked, and along the way they changed it so that if you navigated to a different domain from the one you pinned, it opened in a new (unpinned) tab, which was jarring.

Now it seems they have reverted that change. So they seem to vacillate on the implementation.
by andrewl-hn | 2025-12-17 23:12:08+00:00
Perhaps, their own hiring pipeline is suffering, too. With most companies out there cutting internships and hiring of people with no experience "because AI will replace them" for the past 2-3 years we probably having a large dip in number of prospective candidates with 2-3 years of experience today.

Historically, these candidates have been the hiring sweet spot: less risky than brand new engineers, still small enough experience to efficiently mold them into your bespoke tools and processes and turn them into long-term employees, and still very cheap.
by 9rx | 2025-12-17 23:12:24+00:00
Has there been any successful app stores since the mobile app stores, which made developers fortunes selling fart apps, thus making it highly appealing for others to try and chase the same?

Every one I can think of since gets a bit of initial interest hoping to relive the mobile app store days, but interest wanes quickly when they realize that nobody wants to buy fart apps anymore. That ship sailed a long time ago.

And ChatGPT apps are in a worse position as it doesn't even have a direct monetization strategy. It suggests that maybe you can send users to your website to buy products, but they admit that they don't really know what monetization should look like...
by lanfeust6 | 2025-12-17 23:12:26+00:00
I think this is in part projection of insecurity by low/middle classes, because rec sports are definitely a social status signal for upper classes. It's also "socially acceptable" to waste hours of time watching TV instead of hustling. Another data point as a counter is the popularity of video games. The only people saying they should just be for kids are aging boomers (in general)

I do agree though that there is a stronger social pressure to be enterprising. For young Americans I think the obsession is social media or youtube
by Neywiny | 2025-12-17 23:12:38+00:00
Cost plus I'm not sure on. Maybe if your work was in small enough chunks. But if, did example, just generating one response is too expensive, there's no plus, it's just somebody paid $ for some bits in GPU memory and that's likely not useful to anyone.

Yes exactly. Your second paragraph hits the nail on the head. And I'm sure you agree that the AI companies aren't going to take on more risk for free.
by numpad0 | 2025-12-17 23:12:42+00:00
It's a bit perplexing, but 1st gen VTubers were all 3D. They evolved through natural selection into current 2D forms, only slowly growing back supplemental 3D forms.

My guess as to why is that full 3D must have been extraneous cognitive load to viewers - xkcd wouldn't have been as popular as it is now if it had been drawn somehow by Rembrandt himself. It owes its success to Randall Munroe's minimalist art style. That kinds of things.
by freehorse | 2025-12-17 23:13:06+00:00
> How many of those investors do you think are among us here pushing it

Probably a bunch are users here, but

1. the amount of money (~2.5m) gathered in a 2-year period from 93 people seem peanuts in VC terms, if we are talking about YC itself rather than random users

2. their whole approach and strategy seems to aim towards a sustainable, long term development rather than quick profit (so far)

3. there does not seem to be any obvious link between them and YC itself in general

4. even if some of the 93 people are "pushing it" here, quite a few other users do the same without being investors (I have done/do it), and the former would probably do it without being investors anyway. There are bigger problems than some random people who invested in some company write once in a while supporting comments in some forum online.

I guess "forum run by its investors" can be interpreted as either the users of the forum are investors or the admins/owners are, so I tried to address both.

I think it is more like that users here are more prone to like kagi and want to pay for search (they spend more time online on a computer, they have jobs where web search is important to them etc), so you have people saying how great kagi is, but their experience does not necessarily extend to the general population as much because most people do not care as much about these things to think they are worth paying. Rather than most of them being actually kagi investors and trying to get people subscribe to kagi for their investment to grow. People can also just be satisfied with a product/service and talk about it.
by sarreph | 2025-12-17 23:13:24+00:00
We think that in commercial buying there will still be a place for “discovery”, where B2B visitors gain from being able to independently digest public facing materials themselves. And that this will mean the adoption of agentic browsing is slower than people think.

However, we did already start experimenting with the agentic browsers like Atlas and Strawberry — I built a PoC for the former. But this is still very much experimental!

Edit:

Just wanted to add that your question is a prescient one and it is something we get asked a lot by investors, VCs etc, but hardly ever by people who run businesses with websites, or the people who visit them / do commercial buying.
by avaer | 2025-12-17 23:13:34+00:00
If someone is socializing in VRChat it would follow they are able to be social. So a bit of a non sequitur.

Would it be more accurate to say you have a categorical disdain for the way they are socializing? Why do you think that is (other than the obvious stuff, which seems to be more an anonymous internet thing than anything particular to VRChat)?

I'm genuinely curious because I see this attitude a lot and I don't understand it.
by tyre | 2025-12-17 23:13:50+00:00
What I really want from Anthropic, Gemini, and ChatGPT is for users to be able to log in with them, using their tokens. Then you can have open/free apps that don’t require the developer to track usage or burn through tons of tokens to demonstrate value.

Most users aren’t going to manage API keys, know that that even means, or accept the friction.
by neilv | 2025-12-17 23:13:58+00:00
> “Number one, my experience is that many of the most junior folks are actually the most experienced with the AI tools. So they're actually most able to get the most out of them.”

Would that experience be from cheating on their homework? Are you sure that's the skill you want to prioritize?

> “Number two, they're usually the least expensive because they're right out of college, and they generally make less. So if you're thinking about cost optimization, they're not the only people you would want to optimize around.”

Hahaha. Sounds like a threat. Additional context for this is that Amazon has a history of stack ranking and per-manager culling quotas, and not as much a reputation for caring about employees like Google did.

> “Three, at some point, that whole thing explodes on itself. If you have no talent pipeline that you're building and no junior people that you're mentoring and bringing up through the company, we often find that that's where we get some of the best ideas.”

I thought the tech industry had given up on training and investing in juniors for long-term, since (the thinking goes) most of them will job-hop in 18 months, no matter how well you nurture. Instead, most companies are hiring for the near-term productivity they can get, very transactionally.

Does AWS have good long-term retention of software engineers?
by nightpool | 2025-12-17 23:15:50+00:00
The author already had basically full Clickhouse querying abilities, and Clickhouse lets you run arbitrary SQL on postgres, the fact that the author used a read-only command to execute it wasn't the author bypassing a security boundary (anyone with access to the Clickhouse DB also had access to the Postgres DB), it was just a gadget that made the SSRF more convenient. They could have escalated it into a different internal HTTP API instead.
by bitpush | 2025-12-17 23:16:02+00:00
You might not remember, but Snapchat was once supposed to take on Facebook. The founder was so cocky that they declined being bought by Facebook because they thought they could be bigger.

I never said Snapchat is dead. It still lives on, but it is a shell of the past. They had no moat, and the competitors caught up (Instagram, Whatsapp and even LinkedIn copied Snapchat with stories .. and rest is history)
by arjie | 2025-12-17 23:16:14+00:00
Unsurprising. They have adopted these personas into the mainstream more than anyone else. Many of these personas also have visual characteristics typical of anime/manga. Anyway, I found it interesting that it's so mainstream that they have a minister in their government who claims to be attracted only to these fictional characters: https://x.com/onoda_kimi/status/1600805415909933056

>「早く結婚を」「子供を産め」 20代の頃から有権者に言われ続けてきたけど40になってもまだこの言葉をぶつけられる事にため息出ますわ。何歳になったら言われずに済むようになるのか。

> 3次元では国と結婚してるし、そもそもプライベートは２次専だって言ってるでしょ！！何度でも言うぞ２次専なの！！

Translated by ChatGPT to be

> “‘Hurry up and get married,’ ‘Have children’— I’ve been told these things by voters ever since my twenties, and even now that I’m 40, I still get these words thrown at me. It just makes me sigh. At what age will people finally stop saying this to me?

> In the 3D world, I’m married to the state, and besides, I’ve said that my private life is strictly 2D-only, right!! I’ll say it as many times as it takes—I’m 2D-only!!”
by bitwizeshift | 2025-12-17 23:16:23+00:00
Aside from what some other users have said, logging is fundamentally an observable side-effect of your library. It’s now a behavior that can become load-bearing — and putting it in library code forces this exposed behavior on the consumer.

As a developer, this gets frustrating. I want to present a clean and coherent output to my callers, and poorly-authored libraries ruin that — especially if they offer no mechanism to disable it.

It’s also just _sloppy_ in many cases. Well-designed library code often shouldn’t even need to log in the first place because it should clearly articulate each units side-effects; the composition of which should become clear to understand. Sadly, “design” has become a lost art in modern software development.