MurphyA/hacker-news huggingface dataset:
by itissid | 2025-12-17 19:02:34+00:00
I gave opus an "incorrect" research task (using this slash command[1]) in my REST server to research to use SQLite + Litestream VFS can be used to create read-replicas for REST service itself. This is obviously a dangerous use of VFS[2] and a system like sqlite in general(stale reads and isolation wise speaking). Ofc it happily went ahead and used Django's DB router feature to implement `allow_relation` to return true if `obj._state.db` was a `replica` or `default` master db.

Now claude had access to this[2] link and it got the daya in the research prompt using web-searcher. But that's not the point. Any Junior worth their salt — distributed systems 101 — would know _what_ was obvious, failure to pay attention to the _right_ thing. While there are ideas on prompt optimization out there [3][4], the issue is how many tokens can it burn to think about these things and come up with optimal prompt and corrections to it is a very hard problem to solve.

[1] https://github.com/humanlayer/humanlayer/blob/main/.claude/c... [2] https://litestream.io/guides/vfs/#when-to-use-the-vfs [3] https://docs.boundaryml.com/guide/baml-advanced/prompt-optim... [4]https://github.com/gepa-ai/gepa
by bluGill | 2025-12-17 19:02:37+00:00
> potentially tow a long distance.

IF you do this even once a year you don't really have any other option. Finding a rental truck that allows you to tow is hard. The vast majority won't allow it. When you do find one it is generally in an inconvenient location and very expensive. I can justify keeping my truck (long paid for) just because just 2 trips a year need a truck and so it is cheaper overall to just own the truck (tax and insurance is low) than to rent.
by bsammon | 2025-12-17 19:02:42+00:00
The article says that Jobs owned a lamp like this in 1982.

Questions that come to mind:

Was Steve Jobs rich in 1982?

In 1982, was the cost of a "real" Tiffany lamp within the reach of someone at Jobs's 1982 wealth/income level?

What are the chances that the item Jobs owned was a knockoff or a mass-produced item?

I imagine that Steve Jobs was the kind of person who would buy a $5000 lamp even if he was only making $20,000 a year.
by schainks | 2025-12-17 19:02:46+00:00
Disagree. While documentation is often out of date, the threshold for maintaining it properly has been lowered, so your team should be doing everything it can to surface effective docs to devs and AIs looking for them. This, in turn, also lowers the barrier to writing good docs since your team's exposure to good docs increases.

If you read great books all the time, you will find yourself more skilled at identifying good versus bad writing.
by IAmBroom | 2025-12-17 19:03:22+00:00
"Queen of the Silver Dollar" was written by Shel Silverstein in desperation to pay rent, and dictated from a phonebooth* to a member of Dr. Hook and the Medicine Cabinet.

Sometimes people really are hard-bitten.

* It's kind of like a specially designed room standing on the sidewalk of a city street, where you can put your iPhone on speaker and still hear the other person talk. Only it comes with it's own iPhone that you can rent for less than a dollar with an old form of Venmo.
by woodruffw | 2025-12-17 19:03:33+00:00
"Cause" seems unsubstantiated: I think to justify "cause," we'd need strong evidence that the equivalent bug (or worse) wouldn't have happened in C.

Or another way to put it: clearly this is bad, and unsafe blocks deserve significant scrutiny. But it's unclear how this would have been made better by the code being entirely unsafe, rather than a particular source of unsafety being incorrect.
by missedthecue | 2025-12-17 19:03:43+00:00
"AI can hallucinate on any data you feed it, and it's been proven that it doesn't summarize, but rather abridges and abbreviates data."

Have you ever met a human? I think one of the biggest reasons people become bearish on AI is that their measure of whether it's good/useful is that it needs to be absolutely perfect, rather than simply superior to human effort.
by zurfer | 2025-12-17 19:03:47+00:00
It's a cool release, but if someone on the google team reads that: flash 2.5 is awesome in terms of latency and total response time without reasoning. In quick tests this model seems to be 2x slower. So for certain use cases like quick one-token classification flash 2.5 is still the better model. Please don't stop optimizing for that!
by macNchz | 2025-12-17 19:03:53+00:00
Google has great distribution to be able to just put Gemini in front of people who are already using their many other popular services. ChatGPT definitely came out of the gate with a big lead on name recognition, but I have been surprised to hear various non-techy friends talking about using Gemini recently, I think for many of them just because they have access at work through their Workspace accounts.
by nerdjon | 2025-12-17 19:04:22+00:00
The obvious solution is just to throw more LLM's at it to verify the output of the other LLM and that it is doing its job...

\s (mostly because you know this will be the "Solution" that many will just run with despite the very real issue of how "persuadable" these systems are)...

The real answer is that even that will fail and there will have to be a feedback loop with a human that will likely in many cases lead to more churn trying to fix the work the AI did vs if the human just did it in the first place.

Instead of focusing on the places that using an AI tool can truly cut down on time spent like searching for something (which can still fail but at least the risk when a failure is far lower vs producing output).
by Aurornis | 2025-12-17 19:04:22+00:00
I worry about the same effect. Debunking style conversations produce the opposite effect in viewers who instinctively take the side of anyone who appears to be trying to help and reactively take the opposite position of anyone who appears to be attacking.

So many will watch this video and come away siding with Dr. Amen, feeling like they're doing the right thing to disregard the mean man on the other side who is questioning everything.

The alternative medicine and pseudoscience communities thrive on "but what if it works" or "they're just trying to help" attitudes, which snake oil sellers capitalize on.
by dlor | 2025-12-17 19:04:58+00:00
Hey!

I work at Chainguard. We don't guarantee zero active exploits, but we do have a contractual SLA we offer around CVE scan results (those aren't quite the same thing unfortunately).

We do issue an advisory feed in a few versions that scanners integrate with. The traditional format we used (which is what most scanners supported at the time) didn't have a way to include pending information so we couldn't include it there.

The basic flow was: scanner finds CVE and alerts, we issue statement showing when and where we fixed it, the scanner understands that and doesn't show it in versions after that.

so there wasn't really a spot to put "this is present", that was the scanner's job. Not all scanners work that way though, and some just rely on our feed and don't do their own homework so it's hit or miss.

We do have another feed now that uses the newer OSV format, in that feed we have all the info around when we detect it, when we patch it, etc.

All this info is available publicly and shown in our console, many of them you can see here: https://github.com/wolfi-dev/advisories

You can take this example: https://github.com/wolfi-dev/advisories/blob/main/amass.advi... and see the timestamps for when we detected CVEs, in what version, and how long it took us to patch.
by jmsgwd | 2025-12-17 19:04:58+00:00
> passkeys in Safari requires iCloud Keychain

This is not true - browsers including Safari support passkeys managed by third-party password managers.

I'm using 1Password with browser extensions for Safari and Chrome on macOS and iOS and it works seamlessly with my passkeys, which are not stored in iCloud Keychain.

> you're always locked in to one passkey vendor or another.

This will change: https://1password.com/blog/fido-alliance-import-export-passk...
by buellerbueller | 2025-12-17 19:05:11+00:00
>Racism is discrimination according to race, not innocently making fun of our differences, as here.

This is racial discrimination.

In fact, racism is the assignment of a non-defining attribute to an entire "race". This is true for even potentially a positive attribute, for example it is still racist to say: "black people are good at basketball" or the trope of the "latin lover" or "asians are good at math"

"Racism is the belief that groups of humans possess different behavioral traits corresponding to inherited attributes and can be divided based on the superiority of one race or ethnicity over another. It may also mean prejudice, discrimination, or antagonism directed against other people because they are of a different ethnic background." [1]

[1] https://en.wikipedia.org/wiki/Racism#:~:text=Racism%20is%20t...
by everdrive | 2025-12-17 19:05:12+00:00
That's very true. I bought a quad-cab midsize truck and it feels like the ultimate compromise:

- Not amazing at hauling people

- Only OK payload

- Not the best gas mileage

- Too expensive (but still cheaper than other midsize trucks -- $36k)

With how much everything costs this truck really _had_ to be a compromise. It had to be able to do everything. I'd have much rather had an old crappy truck and then a normal family car, but those seem to have all been priced out.
by inerte | 2025-12-17 19:05:26+00:00
I update a spreadsheet with all my accounts and money and their values so I know my net worth and its changes, and oh boy every month getting these numbers is such a chore.

Since it's been a few days, sometimes I am logged out of either bank/traders and also the password manager.

So it's open the bank site, click on login/password, password manager browser extension asks to login. Type password manager password. It asks for 2FA. Unlock phone with face. Find app, open app, unlock app with face. Approve password manager login. Click on bank login/password again. I am in! No, bank wants to 2FA with mobile. Unlock phone with face. Open bank mobile app, unlock with face. Get code or approve login. Back to computer, type code or click approve.

Repeat that 12 times for all the accounts, and by the end of it I have neck pain with all the "pick up phone to face unlock" motions.

I am a bit paranoid so I turn on 2FA and passkeys and whatnot, but all of this makes me want to use `123password` everywhere and never change it.
by bigstrat2003 | 2025-12-17 19:05:34+00:00
> If rust is so inflexible that it requires the use of unsafe to solve problems...

Thankfully, it doesn't. There are very few situations which require unsafe code, though a kernel is going to run into a lot of those by virtue of what it does. But the vast majority of the time, you can write Rust programs without ever once reaching for unsafe.
by timpera | 2025-12-17 19:05:51+00:00
Does Gemini Enterprise have more features?

Just tried once again with the exact same prompt: GPT-5.1-Thinking took 12m46s and Gemini 3.0 Pro took about 20 seconds. The latter obviously has a dramatically worse answer as a result.

(Also, the thinking trace is not in the correct language, and doesn't seem to show which sources have been read at which steps- there is only a "Sources" tab at the end of the answer.)
by ipython | 2025-12-17 19:06:08+00:00
wow... honestly, reading the Twitter feed for Zuhair ("CEO" of DoubleSpeed) makes me sick. https://x.com/rareZuhair and https://www.zuhair.io/.

If you want more photos of his phone farm... it's all on his twitter page: https://x.com/rareZuhair/status/1961160231322517997

"Accelerating the dead Internet"? Why are we, as a community, encouraging the acceleration of enshitification of our common spaces? So weird to me...
by dijit | 2025-12-17 19:06:20+00:00
Those guys were writing a lot of unsafe rust and bumped into UB.

I sound like an apologist, but the Rust team stated that “memory safety is preserved as long as Rusts invariants are”. Feels really clear, people keep missing this point for some reason, almost as if its a gotcha that unsafe rust behaves in the same memory unsafe way as C/C++: when thats exactly the point.

Your verification surface is smaller and has a boundary.
by danenania | 2025-12-17 19:06:28+00:00
Thanks for the comment.

- On precision vs. noise: yeah, this is a core challenge. Quick answer is the scanner tries to be conservative and lean towards not flagging borderline issues. There's a custom guidance field in the config that lets users adjust sensitivity and severity based on domain/preferences.

- CI times: on a medium-sized PR (say 10k lines) in a fairly large codebase (say a few hundred K lines), it will generally run in 5-15 minutes, and run in parallel with other CI actions. In our case, we have other actions that already take this long, so it doesn't increase total CI time at all.

- Vulnerability types: the post goes into this a bit, but I would look at scanning and red teaming as working together for defense in depth. RAG and tool misuse vulnerabilities are definitely things the scanner can catch. Red teaming is better for vulnerabilities that might not be visible in the code and/or require complex setup state or back and forth to successfully attack.
by mixmastamyk | 2025-12-17 19:06:47+00:00
No—they did not cut costs enough to build a sufficient endowment. Again, income of several billion dollars.

That is plenty for an endowment to build a browser+ in perpetuity... like an order of magnitude in excess. Ladybird/servo are successfully building on perhaps 1% of that?

I'm sure they have some money in the bank and it gets interest, but obviously not enough or handled well enough to avoid the temptation to start an advertising project due to their unsustainable spending rate.

You keep trying to make it sound like they "did everything they could." No, they did not by a long shot.
by malux85 | 2025-12-17 19:06:49+00:00
This is the problem with this, in simple cases like “you add N employees” then you can vaguely approximate it, like they do in the article.

But for anything that’s not this trivial example, the person who knows the value most accurately is … the customer! Who is also the person who is paying the bill, so there’s strong financial incentive for them not to reveal this info to you.

I don’t think this will work …
by seanmcdirmid | 2025-12-17 19:06:53+00:00
1965: learning how to punch your own punch cards is part of the learning process

1995: struggling with docs and learning how and where to find the answers part of the learning process

2005: struggling with stackoverflow and learning how to find answers to questions that others have asked before quickly is part of the learning process

2015: using search to find answers is part of the learning process

2025: using AI to get answers is part of the learning process

...
by lynndotpy | 2025-12-17 19:07:03+00:00
Yes. When writing unsafe, you have to assume you can never trust anything coming from safe rust. But you are also provided far fewer rakes to step on when writing unsafe, and you (ideally) are writing far fewer lines of unsafe code in a Rust project than you would for equivalent C.

Rust is written in Rust, and we still want to be able to e.g. call C code from Rust. (It used to be the case that external C code was not always marked unsafe, but this was fixed recently).
by Noaidi | 2025-12-17 19:07:14+00:00
My god, horrific. Does not everyone know everything online is a psyop now? I will tel you, they don't. No one studies things, no one takes the time. AI, social media, it all has to be protested, boycotted.

Now it seems war is coming from the US it could not be more true that at this moment.
by Aurornis | 2025-12-17 19:07:33+00:00
I recall similar arguments being made against search engines: People who had built up a library of internal knowledge about where and how to find things didn't like that it had become so easy to search for resources.

The arguments were similar, too: What will you do if Google goes down? What if Google gives the wrong answer? What if you become dependent on Google? Yet I'm willing to bet that everyone reading this uses search engines as a tool to find what they need quickly on a daily basis.
by bluGill | 2025-12-17 19:08:30+00:00
> Your use case sounds like it would be perfect for renting a vehicle, especially since it would save you from storing and insuring it an extra 300 days per year.

Have you ever looked at the real costs of renting. More rentals won't let you tow. They won't let you go off road (no burning man!), even if allowed they will charge you for the damages typical of going off road. Any just when you think you have navigated all that you get there to pick up the car you reserved and they are sold out.

I'm not saying renting cannot work, but it isn't nearly as clear cut as people keep saying.
by postflopclarity | 2025-12-17 19:08:37+00:00
why is that crazy? legislative supremacy is an extremely common pillar of many theories of democracy. the executive has only the powers enumerated in the Constitution and explicitly granted by Congress. if Congress wants to set up an agency independent of POTUS, that "should" (scare quotes because who knows what this activist SCOTUS will do) be well within its constitutional purview
by ajross | 2025-12-17 19:09:00+00:00
Again though, does that NHTSA report include "hit a garbage can" accidents or not? My strong suspicion is not[1], because they aren't required to be reported to anyone. So comparing it to an autonomy trial (which clearly is under such a requirement) isn't very informative. And putting it in the headline is straight up misleading.

[1] Source: I've hit a garbage can and told no one. Until this moment.
by WorldMaker | 2025-12-17 19:09:03+00:00
V2V (vehicle to vehicle) charging is a standard option supported by CCS and NACS. So far implementations are limited, with most of the current focus on V2H (vehicle to home) or maybe V2G (vehicle to grid). The Ford F-150 Lightning supports V2H but not V2V today. (Interestingly, the Tesla Cybertruck does support V2V.)
by drysine | 2025-12-17 19:09:13+00:00
I don't think you should laugh. Not even a tiny grin is appropriate.

Come and see.[0] Watch desperate mother whose son was grabbed on the street and "busified"[1]. She later died in the ER after the stroke she suffered.

Just found some random telegram channel for you which apparently collects the videos of Ukrainian forced mobilization[2]. The channel's admins sarcastically call them "volunteers" which I find despicable, but just watch the videos. Some of the videos have logos of popular Ukrainian telegram channels, you can find them there.

[0] https://t.me/ASupersharij/42745

[1] https://en.wikipedia.org/wiki/Busification

[2] https://t.me/busification
by jfindper | 2025-12-17 19:09:22+00:00
Genuinely, it's nice that Mozilla's user base is so passionate! There's three multi-hundred-comment submissions in the top 50 posts of HN in just the last 24 hours.

I just wish some of the conversation wasn't so hyperbolic. For anyone not as passionate who may have been on the fence about Firefox before reading all of the blogs, news articles, comments, tweets, etc., they sure as hell aren't going to make the switch now. Ironically, the death knell for Firefox might not be from the new CEO, but from the users convincing everyone to stay on Chrome.
by wooben | 2025-12-17 19:09:35+00:00
Very cool. I remember liking trains.fyi when it went around HN a while back, keep up the good work and thank you for sharing such cool projects!

My antiquated (2016 xeon quad-core) PC chugged for a while running this in Firefox (snap) on Ubuntu, and it eventually crashed while I was angling the map close to the ground. CPU cranked up to 80% on each core.

A few questions: - While angling around, it was easy to go under the map, could you set a boundary so the camera cannot go below the horizon? - Would you be able to add the ability to enter an address, so I can get a view that would be comparable to what I'd see if I stood in that same place outside? Maybe you could even add an AR element similar to the SkyMap app on Android.
by woodruffw | 2025-12-17 19:10:00+00:00
Except that it didn't fail to be the solution: the bug is localized to an explicit escape hatch in Rust's safety rules, rather than being a latent property of the system.

(I think the underlying philosophical disagreement here is this: I think software is always going to have bugs, and that Rust can't - and doesn't promise - to perfectly eliminate them. Instead, what Rust does promise - and deliver on - is that the entire class of memory safety bugs can be eliminated by construction in safe Rust, and localized when present to errors in unsafe Rust. Insofar as that's the promise, Rust has delivered here.)
by Neywiny | 2025-12-17 19:10:23+00:00
Just remember that often acquisitions don't result in the benefits of the startup with the resources of the incumbent but rather they shut it down, or change its practices, or find other ways to get rid of it. A lot of buyouts are to remove competition, not to be better.

People keep talking about how it was such a mistake to not buy YouTube or Netflix or whatever, but they only became as successful as they did because they weren't what their competition was. That's how it works.
by anon-3988 | 2025-12-17 19:10:39+00:00
> Classic Motte and Bailey. Rust is often said "if it compiles it runs".

That claims is overly broad, but its a huge, huge part of it. There's no amount of computer science or verification that can prevent a human from writing the wrong software or specification (let plus_a_b = a - b or why did you give me an orange when I wanted an apple). Unsafe Rust is so markedly different than safe default Rust. This is akin to claiming that C is buggy or broken because people write broken inline ASM. If C can't deal with broken inline ASM, then why bother with C?
by Terr_ | 2025-12-17 19:10:40+00:00
This reminds me of some past political debates around same-sex marriage, where I encountered some folks claiming government-involvement wasn't really necessary because Free Contract could take care of everything. (This was some years back before the US Libertarian party imploded.)

It was rather frustrating to watch: "You're a huge fan of X but don't know how X works?"

For example, two people can't make a contract between them that gives one the right to visit the other in a hospital, nor the right to make medical-care/power-of-attorney decisions. You also can't contract-away the guardianship (or ownership) of children, etc.
by jmsgwd | 2025-12-17 19:10:51+00:00
> Because by default, they do, and you have to explicitly install software to let it be moved

Apple's native passkey implementation doesn't require doesn't require you to install extra software, and the passkeys sync by default. I thought Google's and Microsoft's were similar - but I haven't tried them.

> And even if you do, it’s discouraged

Really? Where is it discouraged? I thought synced passkeys are intended as the solution for consumers.

> the spec is allowed to deny you access

Yeah but I thought that's for enterprise use cases, not consumer. E.g. employers that want to enforce device type restrictions on their employees.
by anchochilis | 2025-12-17 19:10:52+00:00
Yes, totally agreed in theory, and it sounds like y'all built a great solution for your use case. But it takes substantial effort and discipline to do something like that at scale.

At some point, you develop complex interdependencies with other systems. You need sophisticated caching for optimum build performance. Techniques like GitOps are unsustainable at a certain number of engineers/commits per hour.