MurphyA/hacker-news huggingface dataset:
by system2 | 2025-12-23 05:28:47+00:00
I switched to Opus permanently, but I am being cautious. It tends to go berserk and add a bunch of extras. Most of my time is spent narrowing the task to it. Sonnet was much more straightforward forward, but Opus' quality is unmatched when compared. I caught Opus messing up my CSP settings, and I had to restrict the access levels to deeper levels. Using it as an agent with full access without a plan more is suicide with Opus, but Sonnet didn't have this problem.
by skipants | 2025-12-23 05:35:31+00:00
As someone who has thought about, planned, and implemented a lot of RBAC... I would never trust the security of a system with RBAC at that level.

And to elaborate on that -- for RBAC to have properly defined roles for the right people and ensure that there's no unauthorized access to anything someone shouldn't have access to, you need to know exactly which user has which access. And I mean all of them. Full stop. I don't think I'm being hyperbolic here. Everyone's needs are so different and the risks associated to overprovisioning a role is too high.

When it's every LEO at the nation level that's way too many people -- it is pretty much impossible without dedicated people whose jobs it is to constantly audit that access. And I guarantee no institution or corporation would ever make a role for that position.

I'm not even going to lean into the trustworthiness and computer literacy of those users.

And that's just talking about auditing roles, never mind the constant bug fixes/additions/reductions to the implementation. It's a nightmare.

Funny enough, just this past week I was looking at how my company's roles are defined in admin for a thing I was working on. It's a complete mess and roles are definitely overprovisioned. The difference is it's a low-stakes admin app with only ~150 corporate employees who access it. But there was only like 8 roles!

Every time you add a different role, assign it to each different feature, and then give that role to a different user, it compounds.

I took your comment at face value but I hope to god that Flock at least as some sort of data/application partitioning that would make overprovisioning roles impossible. Was your Texas cop tracking an abortion a real example? Because that would be bad. So so bad.
by masonhensley | 2025-12-23 05:35:42+00:00
I've been in the bowels of the domestic robot/drone parts supply chain. It's ugly, almost non-existent. I wish there was more of a carrot, but the opportunity for that was frankly 5 years ago.

NDAA has been a saving grace that we have anything like https://arkelectron.com/

Frankly, they should just rip the bandaid off and apply it to robotics like robovacs/delivery bots/etc scanning homes/offices/critical infrastructure at this point.
by bee_rider | 2025-12-23 05:36:44+00:00
I don’t know anything about this (other than doing mediocre in some undergrad Verilog classes one million years ago). Wikipedia seems to call FPGAs a type of PLD. Of course, everybody has heard of FPGAs; is it right to think they’ve sort of branched off, become their own thing, and eclipsed their superset?
by mighty_moran | 2025-12-23 05:36:46+00:00
Hi, we’ve been building NØNOS, an experimental OS aimed at “clean sessions” where the system is designed to minimize persistence and keep trust explicit. The public repo right now is the kernel/boot path + early desktop/QEMU flow.

What it is: a Rust microkernel with capability-based access control and a “runs entirely in RAM / zero persistent state” model (by design).

How to try it (QEMU):

Follow the repo README to build/run, or use the docs “Running in QEMU”. The kernel repo includes expected boot output and troubleshooting notes.

What I’d love feedback on:

Whether the “zero-state” model is compelling vs. existing approaches (live OSes, VMs, immutable systems).

Threat model gaps / places where the design assumptions are shaky.

What would make this actually easy to test safely (prebuilt images, reproducible builds, hardware support priorities).

If you want deeper design context, see the whitepaper.
by why-o-why | 2025-12-23 05:36:51+00:00
Too bad the only people that will watch this are people who already understand the terror of what is happening. It might have helped a little if it had aired. My MAGA dad still watches 60 Minutes (no idea why, habit?) This might have penetrated his TDS-addled skull if it had aired. But the takeover of CBS by Trump and Ellison (and his 1980's-college-villain son) with Weiss is complete, and vile.
by leecommamichael | 2025-12-23 05:40:44+00:00
I see what you're saying, and it's true that C's design guides Odin's in a large way. A more precise way to word things may have been "inspired by" rather than "with" Wirth's design ethos. In Odin's case, I do think there's quite a lot of design area reduced in not having a GC, which is no small amount of complexity to skip.
by crystal_revenge | 2025-12-23 05:41:21+00:00
> massive application of reinforcement learning techniques

So sad that "reinforcement learning" is another term whose meaning has been completely destroyed by uneducated hype around LLMs (very similar to "agents"). 5 years ago nobody familiar with RL would consider what these companies are doing as "reinforcement learning".

RLHF and similar techniques are much, much closer to traditional fine-tuning than they are reinforcement learning. RL almost always, historically, assumes online training and interaction with an environment. RLHF is collecting data from user and using it to reach the LLM to be more engaging.

This fine-tuning also doesn't magically transform LLMs into something different, but it is largely responsible for their sycophantic behavior. RLHF makes LLMs more pleasing to humans (and of course can be exploited to help move the needle on benchmarks).

It's really unfortunate that people will throw away their knowledge of computing in order to maintain a belief that LLMs are something more than they are. LLMs are great, very useful, but they're not producing "nontrivial emergent phenomena". They're increasing trained a products to invoked increase engagement. I've found LLMs less useful in 2025 than in 2024. And the trend in people not opening them up under the hood and playing around with them to explore what they can do has basically made me leave the field (I used to work in AI related research).
by nutjob2 | 2025-12-23 05:41:35+00:00
The oligarchy is in full effect. This is exactly how it works, ie you scratch my back I scratch yours. Ellison kills this CBS report, he gets approval on buying WBS, or more to the point NetFlix doesn't. Same with Musk, Middle East dictators and all the others lining up for favors from Trump. Also he and his family is enriched in various ways by all the pardons he hands out.

It's nauseating, but this is where Republicans live these days. The midterms can't come soon enough.
by array_key_first | 2025-12-23 05:42:05+00:00
No, other trusted repositories are legitimately better because the maintainers built the software themselves. They don't purely rely on binaries from the original developer.

It's not perfect and bad things still make it through, but just look at your example - XZ. This never made it into Debian stable repositories and it was caught remarkably quickly. Meanwhile, we have NPM vulnerability after vulnerability.
by fuzzfactor | 2025-12-23 05:43:50+00:00
This could be related to a new user setting which was delivered recently in Chrome and Edge updates where the default is to allow websites to access your local filesystem.

Has this already been the unseen default up until recently? That would seem like quite an anti-privacy default and I could imagine that security people would not all have been in favor of it happening without any notification at least. But maybe could have been going on for a while anyway?

Seems like the article is complaining if the default in his setup tools no longer allowed local access by default (without permission) any more, and the collateral damage from that reduced attack surface caught him by surprise. With this in mind maybe notification alone may turn out to be the only resultant hardening of the system but for me things like OneNote are just plain not worth it.
by nirui | 2025-12-23 05:45:23+00:00
There are pro factors too. For example, the subscription culture pushed by those big platforms has trained user to pay to get. This is a vast improvement compare to decades ago where most user will just download, trial, expire and pirate.

> But Google have done everything they can to raise bid prices and generally enshittify Adwords, so they can grab more and more of the value in every transaction.

Now days, a software that work as claimed and reasonably priced is already rated above-than-average quality.

The real problem here, is discovery.

The old tricks such as SEO and forum signature link etc are dead. If you need user, you need to stay with your user group, listen to what they want and make them happy. Then your user will talk about it elsewhere and that could generate traffic for you.

Online ADs on targeted platforms may also help. But all and all, it's no longer free and automatic.
by kristopolous | 2025-12-23 05:46:13+00:00
In any media, people only see what they want. There's a psychological term for this, Motivated Reasoning.

https://en.wikipedia.org/wiki/Motivated_reasoning

If you want to break this you have to know the person and ask key questions afterwards. Their distortion field is held together by beliefs and principles, not empirical analysis.

For instance, for my father, the question "how is this treating people responsibly? How can we expect the behavior of those guards to be held accountable?" would pierce this ... but really you have to know how the person doing motivated reasoning thinks.
by raw_anon_1111 | 2025-12-23 05:46:16+00:00
This seems like such a simple problem to solve on the institutional level. Allow a person to have 3FA. Two phone numbers being required to log in - yours and trusted person.

I would have that setup for my parents so that if they ever called me for the 2nd code, I could ask questions about why they need it.

While I’m not too worried about my 83 year old mom, she is more tech savvy than most and has been using computers since 1986, I do worry about my dad if my mom passes first. He’s a lot more gullible.
by gaigalas | 2025-12-23 05:47:10+00:00
The thing about Mes is that it does riscv64 too. I don't know the current state of the support, but there is something there.

There are still many pieces of riscv64 missing in the whole thing (an equivalent to Fiwix being the most challenging right now), and realistically only x86 is currently viable. I think riscv64 is the next in line though.
by ordinaryradical | 2025-12-23 05:48:48+00:00
Corruption is not merely something someone in power enacts in their choices; it is a rot that eats out the society from the inside.

As individuals realize that nakedly appeasing the autocrat wins favor, they voluntarily corrupt themselves and others in hopes of advantage.

More and more of the society enters the grip of this force and weakens until the truly valuable things—its resources, minds, institutions—are annihilated, stolen, and displaced by a hierarchy of criminals or warlords. This is how nations sink. It’s the story of many in Africa, South America, Russia—and now it is our own.
by fgonzag | 2025-12-23 05:49:39+00:00
Apple's M5 Max will probably be able to run it decently (as it will fix the biggest issue with the current lineup, prompt processing, in addition to a bandwidth bump).

That should easily run an 8 bit (~360GB) quant of the model. It's probably going to be the first actually portable machine that can run it. Strix Halo does not come with enough memory (or bandwidth) to run it (would need almost 180GB for weights + context even at 4 bits), and they don't have any laptops available with the top end (max 395+) chips, only mini PCs and a tablet.

Right now you only get the performance you want out of a multi GPU setup.
by Raviteja_ | 2025-12-23 05:50:36+00:00
Hi HN! I built this after 3 months researching image-based attacks.

The problem: Apps that accept user images typically just strip EXIF metadata.
But this misses:
- Steganographic payloads (data hidden in pixel LSBs)
- Polyglot files (valid as both image AND executable)
- Image bombs (1x50000px files that exhaust memory)

My approach: Content Disarm & Reconstruction (CDR)
- Decode image to raw pixel buffer
- Completely discard the original container
- Rebuild a sterile PNG from scratch

Stack: Rust core → WebAssembly sandbox → Cloudflare Workers edge

Free tier: 100 requests/month on RapidAPI

Happy to answer questions about the architecture, threat model, or implementation!
by PebblesHD | 2025-12-23 05:50:45+00:00
This reads like more overworked salaried employees mentally justifying spending their own time on work. Once you start setting the expectation that you’ll spend your own time doing work that couldn’t be finished during the week, that’s what your employer is going to expect. And may also expect of your colleagues. I’m sure they’ll appreciate that…

Personally, I log off at 5pm friday and don’t think about anything work related until after at least one coffee somewhere in the vicinity of 9am the next monday.
by hetspookjee | 2025-12-23 05:50:48+00:00
I have the feeling that particular energy output does not so much, really. For example this plant in the image is about 700x400m and when multiplied with the suns peak output you already get a potential energy of 280MW. And this site almost triples that. The sun shines practically everywhere, though.

Humans produce about 20TW globally at this time (ChatGPT), while the sun adds about 174000TW of energy to the earth.

I guess you could argue that our waste heat does something, but I think the greenhouse gases that trap this enormous energy more effectively have a far bigger effect.
by altairprime | 2025-12-23 05:51:42+00:00
“Over half of U.S. adults surveyed said that it’s very inappropriate, somewhat appropriate, or were uncertain whether it’s appropriate for their child to set boundaries for their interactions” is a reasonable-sounding statement, too; it’s plausible, applies to children of all ages (below or beyond age 25!), and is demonstrably an aspect of culture represented by media and other ephemera.

The position itself is, of course, completely unreasonable — boundaries are never inappropriate to consider (and to contrast with the parent’s boundaries about immediate versus deferred conversations in unsafe circumstances, the child’s age and cognitive ability to assess risk, and so on), no matter how uncomfortable it is to teach a child about boundaries by honoring one they’ve presented one! — but that intolerance is presented in such a reasonable guise, with a tone of majority support to quash any brief qualms, that it causes many to overlook its true nature.

See also “pleasant”, as in “Pleasantville”.
by PunchyHamster | 2025-12-23 05:51:50+00:00
> It did not make anything really hard suddenly become easy.

It did. Onboarding people onto embedded programmer.

You just ran it, wrote few lines and you had working blinky. Write some more and you have useful toy. You could even technically make products with it but going from this to C++ was easier coz you already know what you could do, just needed to go thru pain of switching the toolchain once you're already invested.

Compare that to "you need to setup compiler, toolchain, SDK, figure out how to program the resulting binary, map the registers to your devboard pins etc."
by robocat | 2025-12-23 05:52:49+00:00
For a low precision environment to avoid sudden jumps I used SetSystemTimeAdjustment on Windows (now SetSystemTimeAdjustmentPrecise) to smoothly steer the system clock to match the GPS supplied time signal.

On Linux I think the adjtimex() system call does the equivalent https://manpages.ubuntu.com/manpages/trusty/man2/adjtimex.2....

It smears out time differences which is great for some situations and less ideal for others.
by throw-12-16 | 2025-12-23 05:52:53+00:00
I was responsible for dev-ops, ci, workstation security at my previous position.

Containerize all of your dev environments and lock dependency files to only resolve to a specific version of a dependency that is known safe.

Never do global installs directly, ideally don't even install node outside of a container.

Lag dependency updates by a couple weeks, and enable automated security scans like dependabot on GH. Do not allow automated updates, and verify every dependency prior to updating.

If you work on anything remotely sensitive, especially crypto adjacent, expect to be a target and use a dedicated workstation that you wipe regularly.

Sounds tedious, but thats the job.

Alternatively you could find a job outside the JS ecosystem, you'll likely get a pay bump too.
by gucci-on-fleek | 2025-12-23 05:53:19+00:00
Why? I'm a pretty dedicated Linux user, but I'd argue that Windows NT is a far better technical architecture than GNU/Linux, it's just the Win32 and shell stuff that sucks. But in this hypothetical transition, Win32 and the shell would be one of the only things that Microsoft keeps, which seems like the worst of both worlds to me.

If we're talking hypotheticals, I'd much rather Microsoft open source the NT kernel and low-level subsystems (like ntdll.dll). Open sourcing all of Windows would be even better, but that seems nearly impossible to me.
by pseudalopex | 2025-12-23 05:55:01+00:00
> $150 million in 2023, $160 million in 2024. But before the 2008 deal, only ~$20 million.

Someone who read this comment but not the article could assume this was because demand increased unexpectedly. But someone interviewed for the article said the company increased rates and required payment where it was not required before.
by cryptonector | 2025-12-23 05:55:45+00:00
What siblings say. What you want is `git rebase`, especially with the `--onto` and `--interactive` options. You might also want something like bisect-rebase.sh[0], though there are several other things like it now.

[0] https://gist.github.com/nicowilliams/ea2fa2b445c2db50d2ee650...
by VivaTechnics | 2025-12-23 05:55:58+00:00
Python won because simplicity scales. Like English—26 letters, minimal grammar—it became the default. Python mirrors that trajectory.

It is trivially learnable, absurdly flexible, and unmatched in ecosystem leverage. No simpler language delivers comparable reach.

Python may not be so suitable for systems, real-time, or performance-critical work—that’s Rust, C, and C++.

Nevertheless, every serious engineer must know Python, just as they must know shell/bash scripting. Non-negotiable.
by checker659 | 2025-12-23 05:56:02+00:00
> software developers generally aren't very good at doing things in parallel

If only hardware people would stop stereotyping. Also, do you guys not use use formal tools (BMC etc) now? Who do you think wrote those tools? Heck all the EDA stuff was designed by software people.

I just can't with the gatekeeping.

(Btw, this frustration isn't just pointed at you. I find this sentiment being parroted allover /r/FPGA on reddit and elsewhere. It's damn frustrating to say the least. Also, the worst thing is all the hardware folks only know C so they think all programming is imperative. VDHL is Ada for crying out loud.)
by hunterpayne | 2025-12-23 05:56:48+00:00
"entirely capable of keeping them with power even if the grid goes down for an indefinite period."

You do know that batteries have a capacity right? And powerplants have something called a capacity factor. That means for a given amount of capacity, you generate on average a certain amount of power. For nuclear that factor is .9. For renewables its .1. So 1 watt of nuclear provides the same power as 9 watts of renewables. That's why when you say that renewables have 1/3 the capacity cost, it really means its 3x more expensive than nuclear. That means higher bills for people, which is what we mean when we say utilization cost. That's the real cost that people pay and actually counts. And all this is before we talk about siting issues with renewables. Fun fact, most PV is sites (located) somewhere with an albino factor of less than .25. But since you connected a battery terminal to a PV panel, you must know what that means. Seriously, you are just spreading misinformation that transfers cost from the rich to the poor, such a hero you are.
by throw-12-16 | 2025-12-23 05:57:50+00:00
Yes, and even more so now that we are vibe coding codebases with piles of random deps that nobody even bothers to look at.

You can mitigate it by fully containerizing your dev env, locking your deps, enabling security scans, and manually updating your deps on a lagging schedule.

Never use npm global deps, pretty much the worst thing you can do in this situation.
by gucci-on-fleek | 2025-12-23 05:58:05+00:00
ConTeXt has been using beta versions Lua 5.5 for a few years now, so you can look through its source [0] or try running it [1] if you're curious what a large codebase written in Lua 5.5 looks like.

[0]: https://codeberg.org/contextgarden/context

[1]: https://wiki.contextgarden.net/Introduction/Installation
by cxr | 2025-12-23 05:58:16+00:00
> If I had specified this repo's git url with a specific version number or sha directly in my package.json[…] that's not really an end-run around version control at that point

Yes it is. Git doesn't operate based on package.json.

You're still trying to devise a scheme where, instead of Git tracking the source code of what you're building and deploying and/or turning into a release, you're excluding parts of that content from Git's purview. That's doing an end-run around the VCS.
by Retric | 2025-12-23 05:58:28+00:00
I don’t think nuclear waste is a huge deal, but it does increase fuel costs in a very meaningful way. The classic uranium is cheap therefore nuclear’s fuel is cheap is a tiny fraction of the story. Refueling generally means weeks of downtime, you can’t safely operate at extreme temperatures for maximum efficiency, you need enrichment, and fuel rods, and even with multiple trips through the reactor core a significant amount of fuel isn’t burned or economically useful, and when your done you also need processes do deal with highly radioactive material + the costs of dry casks, and then transport them offsite and then down into some tunnels.

Add all that stuff up and fuel is a major expense. Granted that downtime depends on the design, and is also used to do other maintenance tasks but without refueling you’d end up with different tradeoffs.
by cryptonector | 2025-12-23 05:59:41+00:00
This is a misunderstanding of what Git does. Git is a Merkle hash tree, content-addressed, immutable/append-only filesystem, with commits as objects that bind a filesystem root by its hash. The diffs that make up a commit are not really its contents -- they are computed as needed. Now most of the time it's best to think of Git as a patch quilting porcelain, but it's really more than that, and while you can get very far with the patch quilting porcelain model, at some point you need to understand that it goes deeper.
by galaxyeye | 2025-12-23 05:59:55+00:00
Yes. Browser4 supports concurrent multi-agent execution. At the moment, we support the following scenarios:

A single agent operating on multiple pages (tabs) within the same browser context

Multiple agents operating in parallel across multiple browser contexts, where each context has an isolated profile

Are you specifically looking for multiple agents concurrently operating on the same browser context? If so, could you describe the concrete use case?
by pseudo0 | 2025-12-23 05:59:56+00:00
This is a petty political slapfight, basically the definition of an off-topic submission. If you want to hear about it, turn on CNN.

> Off-Topic: Most stories about politics, or crime, or sports, or celebrities, unless they're evidence of some interesting new phenomenon. Videos of pratfalls or disasters, or cute animal pictures. If they'd cover it on TV news, it's probably off-topic.