MurphyA/hacker-news huggingface dataset:
by aidenn0 | 2025-12-19 20:40:16+00:00
I agree that the coordinated (particularly at a state level) restrictions[1] on books sits largely with the political Right in the US.

However, from around 2010, there has been increasingly illiberal movement from the political Left in the US, which plays out at a more local level. My "vibe" is that it's not to the degree that it is on the Right, but bigger than the numbers suggest because librarians are more likely to stock e.g. It's Perfectly Normal at a middle school than something offensive to the left.

1: I'm up for suggestions for a better term; there is a scale here between putting absurd restrictions on school librarians and banning books outright. Fortunately the latter is still relatively rare in the US, despite the mistitling on the Wikipedia page you linked.
by bigthroat | 2025-12-19 20:40:26+00:00
38 days after @hackermondev's disclosure, our automated OSINT harvester captured 121 IOCs exploiting the same attack surface:

- 101 URLs for discord.flawing.top/blog/* - 20 URLs for openopenbox301.vercel.app Evidence is queryable: curl "https://analytics.dugganusa.com/api/v1/search?q=discord.flawing.top" Free STIX feed included.
by jrflowers | 2025-12-19 20:41:12+00:00
I can’t speak to the value of the vulnerability as I lack the universal Rolodex of Every Exploit Buyer that is apparently available (nor am I interested in debating this with somebody that admitted they didn’t know anything about the vulnerability, declared it worthless anyway, and then moved the goalposts after a core assumption about it was trivially shown to be wrong. I’m fairly certain at this point these kids could recreate the end of the movie Antitrust and there’d be a thread somewhere with tptacek posting “This isn’t that big of a deal because”).

I just saw that you asked if the article about the server-side exploit was about a server-side exploit. It is. It’s right there in the post.
by Tuna-Fish | 2025-12-19 20:41:32+00:00
The fundamental problem is that your machine is running software from a thousand different projects or libraries just to provide the basic system, and most of them do not handle allocation failure gracefully. If program A allocates too much memory and overcommit is off, that doesn't necessarily mean that A gets an allocation failure. It might also mean that code in library B in background process C gets the failure, and fails in a way that puts the system in a state that's not easily recoverable, and is possibly very different every time it happens.

For cleanly surfacing errors, overcommit=2 is a bad choice. For most servers, it's much better to leave overcommit on, but make the OOM killer always target your primary service/container, using oom-score-adj, and/or memory.oom.group to take out the whole cgroup. This way, you get to cleanly combine your OOM condition handling with the general failure case and can restart everything from a known foundation, instead of trying to soldier on while possibly lacking some piece of support infrastructure that is necessary but usually invisible.
by commandlinefan | 2025-12-19 20:42:07+00:00
> They were responsive, professional, and took the findings seriously, patching the issues promptly.

The "issue" is that they're returning the entire PNR dataset to the front-end in the first place. He doesn't detail how they fixed it, but there's no reason in the world that this entire dataset should be dumped into Javascript. I got into pretty heated arguments with folks about this at Travelocity and this shit is exactly why I was so adamant.
by pizlonator | 2025-12-19 20:42:35+00:00
This is such an old debate. The real answer, as with all such things, is "it depends".

Two reasons why overcommit is a good idea:

- It lets you reserve memory and use the dirtying of that memory to be the thing that commits it. Some algorithms and data structures rely on this strongly (i.e. you would have to use a significantly different algorithm, which is demonstrably slower or more memory intensive, if you couldn't rely on overcommit).

- Many applications have no story for out-of-memory other halting. You can scream and yell at them to do better, but that won't help, because those apps that find themselves in that supposedly-bad situation ended up there for complex and well-considered reasons. My favorite: having complex OOM error handling paths is the worst kind of attack surface, since it's hard to get test coverage for it. So, it's better to just have the program killed instead, because that nixes the untested code path. For those programs, there's zero value in having the memory allocator be able to report OOM conditions other than by asserting in prod that mmap/madvise always succeed, which then means that the value of not overcommitting is much smaller.

Are there server apps where the value of gracefully handling out of memory errors outweighs the perf benefits of overcommit and the attack surface mitigation of halting on OOM? Yeah! But I bet that not all server apps fall into that bucket
by PKop | 2025-12-19 20:43:23+00:00
Maybe just try having confidence in yourself. Trust your instincts. I'm not going to impugn my own abilities based on some purported flaw in an abstract amorphous blog called "humanity", whatever that is. A lot of individuals of distinction have many characteristics better than the average, why wouldn't I trust myself more than other people?

Pattern recognition is a many millions of years evolved ability best exemplified in the "human" species by the way, so I basically disagree with your whole premise anyways.
by observationist | 2025-12-19 20:43:26+00:00
How much difference was made by the Chinese competitors being able to use whatever IP they wanted, and Roomba being constrained by law and licensing, and not being able to enforce their own IP? What were the consequences of having to engage with China for manufacturing, effectively giving them the capability to clone any R&D on the fly, without having to figure things out themselves?

How much did regulation and taxation and red tape play into Roomba's inability to compete?

What sort of VC deals were they shackled by, in order to siphon off the data and abuse it for third party marketing, and other forms of enshittification?

There's a lot that American companies have been held back by. Some of it is actually good, consumer protective and well crafted, but it won't work if you allow other players in the same market to ignore the regulations and restrictions without consequences. Other policy is just stupid and self destructive, and other policies border on malignant, deliberately giving foreign companies significant advantages, directly and indirectly, without any other purpose.

American companies are way too easily forced into a race to the bottom dynamic, resulting in failure and huge wastes of money and effort.
by pm215 | 2025-12-19 20:43:30+00:00
Because the point of forbidding overcommit is to ensure that the only time you can discover you're out of memory is when you make a syscall that tries (explicitly or implicitly) to allocate more memory. If you don't account the COW pages to both the parent and the child process, you have a situation where you can discover the out of memory condition when the process tries to dirty the RAM and there's no page available to do that with...
by mothballed | 2025-12-19 20:43:44+00:00
Honestly most dictatorships are less effective at crushing the freedom and spirit of the populace as democracies are. If you go someplace like Myanmar or DRC, the response to the whims of a dictator are something like "you and what army." Most of their populace doesn't even listen to what the dictator says, nor pay taxes or any of the like. Democracy scams the populace into thinking the government is actually 'them' which disarms them into subservience.

Occasionally you do find a dictatorship that can run with an iron fist and actually subject the majority of the population. A couple of divergent examples are UAE/Dubai -- which ranks higher in economic freedom than the US. On the other hand you have places like DPRK which are just an absolute shithole all around.

Depending on where you're at democracy definitely functions worse, than say a kritarchy (ex: Somalia, which was more prosperous and peaceful and better respect for individual rights under decentralized 'xeer' law than under any democratic government.)
by santoriv | 2025-12-19 20:44:15+00:00
It is really good at grep and will make multiple grep calls in parallel.

And when I open it in the parent directory of a bunch of repos in our codebase, it can very quickly trace data flow through a bunch of different services. It will tell me all the files the data goes through.

It's context window is "only" 200k tokens. When it gets near 200k, it compresses the conversation and starts a new conversation..... which mostly works but sometimes it has a bit of amnesia if you have a really long running conversation on something.
by aquariusDue | 2025-12-19 20:44:33+00:00
I always believed stuff like Proton and Tutanota to pander to individuals who cared about privacy but who fell ultimately to their shiny marketing campaigns.

Anyway most people would be better served when disavowing any notion that email is secure or that VPN services operated by companies (as opposed to ones you control) are good for anything other than bypassing region locks.
by nabla9 | 2025-12-19 20:44:40+00:00
You saw name "Noam Chomsky" and that started a process in your mind that generated the standard spiel about Syntactic Structures.

Chomsky Hierarchy is his more fundamental work that joins computer science and linguistics. It was published in IRE Transactions on Information Theory. Chomsky, Noam (1956). "Three models for the description of language" https://chomsky.info/wp-content/uploads/195609-.pdf

Type-3 grammar ≡ finite-state automaton

Type-2 grammar ≡ Non-deterministic pushdown automaton

Type-1 grammar ≡ Linear-bounded non-deterministic Turing machine

Type-0 grammar ≡ Turing machine

ps. Chomsky was already aware of Finite State Automata and Turing Machines and understood that they match Type-3 and Type-0. Pushdown Automata was invented later, and connection between Type-1 grammar and Linear Bounded Automata was made few years later.
by sunshine-o | 2025-12-19 20:44:44+00:00
Yes I believe what was revealed about 10-15 years ago about the "mass surveillance" conducted by the US and what is happening in Europe are totally different things.

The US conducts mass surveillance at a planetary scale, as an "Empire". It was implemented secretly by its 3 letter agencies with the help of various actors.

Europe is doing it in the open with laws and regulations and only targets the people in its territories. One simple reason they would have to do this way is they simply have no equivalent in capabilities to the NSA, CIA, etc. or big tech.
by xnx | 2025-12-19 20:44:50+00:00
This formatting is more intuitive to me.

L1 cache reference 2,000,000,000 ops/sec L2 cache reference 333,333,333 ops/sec Branch mispredict 200,000,000 ops/sec Mutex lock/unlock (uncontended) 66,666,667 ops/sec Main memory reference 20,000,000 ops/sec Compress 1K bytes with Snappy 1,000,000 ops/sec Read 4KB from SSD 50,000 ops/sec Round trip within same datacenter 20,000 ops/sec Read 1MB sequentially from memory 15,625 ops/sec Read 1MB over 100 Gbps network 10,000 ops/sec Read 1MB from SSD 1,000 ops/sec Disk seek 200 ops/sec Read 1MB sequentially from disk 100 ops/sec Send packet CA->Netherlands->CA 7 ops/sec
by jackb4040 | 2025-12-19 20:47:10+00:00
I searched their site for any information on "how" they can claim it's safe for kids. This is what I could find: https://stickerbox.com/blogs/all/ai-for-kids-a-parent-s-guid...

> No internet open browsing or open chat features. > AI toys shouldn’t need to go online or talk to strangers to work. Offline AI keeps playtime private and focused on creativity.

> No recording or long-term data storage. > If it’s recording, it should be clear and temporary. Kids deserve creative freedom without hidden mics or mystery data trails.

> No eavesdropping or “always-on” listening > Devices designed for kids should never listen all the time. AI should wake up only when it’s invited to.

> Clear parental visibility and control. > Parents should easily see what the toy does, no confusing settings, no buried permissions.

> Built-in content filters and guardrails. > AI should automatically block or reword inappropriate prompts and make sure results stay age-appropriate and kind."

Obviously the thing users here know, and "kid-safe" product after product has proven, is that safety filters for LLMs are generally fake. Perhaps they can exist some day, but a breakthrough like that isn't gonna come from an application-layer startup like this. Trillion dollar companies have been trying and failing for years.

All the other guardrails are fine but basically pointless if your model has any social media data in its dataset.
by basch | 2025-12-19 20:47:34+00:00
Maybe I'm not explaining it well.

The template would more define the output, and I imagine it more recursively.

Say we are building a piece of journalism. First pass, do these things, second pass build more coherent topic sentences, third pass build an introduction.

Right now, the way that models write from top to bottom, the introduction paragraph seems to inform the body, and then the body is just a stretched out version of the intro. Whereas how it should work is the body is written and then condensed into topic sentences and introductions.

I find myself having to baby models, "we are going to do this, lets do the first one. ok now lets do the second one, ok now the third one. you forgot the instructions, lets revise with the parameters you were given initially. now lets put it all together."

I'm babbling, I just think these interfaces need a better way to define "lets write paragraph 4 first, followed by blah blah" to better structure the order in which they tackle tasks.
by manquer | 2025-12-19 20:47:43+00:00
It’s always faster and easier to copy than create(AI or not). There is lot of thought and effort in doing it first, which the second team(to an extent) can skip.

Much respect to what have you have achieved in a short time with graphite.

A lot of B2B SaaS is about tones of integrations to poorly designed and documented enterprise apps or security theatre, compliance, fine grained permissions, a11y, i18n, air gapped deployments or useless features to keep largest customers happy and so on and on.

Graphite (as yet) does not any of these problems - GitHub, Slack and Linear are easy as integrations go, and there is limited features for enterprises in graphite.

Enterprise SaaS is hard to do just for different type of complexity
by ActorNightly | 2025-12-19 20:47:45+00:00
Germany has a big alt-rising in the form of AFD, and consequently, they do track social media heavily. There is also a non-insignificant fundamentalist Muslim population.

For things like troll posts or just general hate speech, most of the time the police visit your house and ask you questions and give you a stern warning. And remember, police in EU isn't like police in US - when you get visited by police in EU, you aren't afraid that you are going to get shot up or thrown on the ground and tazed if you did nothing wrong. In extreme cases where you are calling for things like beheading, yea they def arrest for that.

Source: close friend that lives in Germanty works for a company that does business with German government. I don't know first hand but he is pretty aware of the policics in EU and I have no reason to believe he would be exaggerating.

On anther note, Germany policing is quite progressive actually. For example, if you run, you don't get a charge for evading/eluding - its actually legal to run from police because "desire for freedom is a human right".
by pm215 | 2025-12-19 20:48:02+00:00
I believe (per the stuff at the bottom of https://www.kernel.org/doc/Documentation/vm/overcommit-accou... ) that the kernel does the accounting of how much memory the new child process needs and will fail the fork() if there isn't enough. All the COW pages should be in the "shared anonymous" category so get counted once per user (i.e. once for the parent process, once for the child), ensuring that the COW copy can't fail if the fork succeeded.
by PaulHoule | 2025-12-19 20:48:13+00:00
You can definitely write parsers and lexers knowing just enough to be dangerous.

I remember being in the PHP culture where people wrote regex-based hacks instead of the character-at-a-time or token-at-a-time state machines or state machine + a stack kind of things which would be too slow in a language like that.

The less you know the faster you get in trouble when things get tough.
by toast0 | 2025-12-19 20:48:14+00:00
> Using overcommit=2 necessarily wastes RAM (renders a larger portion of it unusable).

The RAM is not unusable, it will be used. Some portion of ram may be unallocatable, but that doesn't mean it's wasted.

There's a tradeoff. With overcommit disabled, you will get allocation failure rather than OOM killer. But you'll likely get allocation failures at memory pressure below that needed to trigger the OOM killer. And if you're running a wide variety of software, you'll run into problems because overcommit is the mainstream default for Linux, so many things are only widely tested with it enabled.
by nkrisc | 2025-12-19 20:48:47+00:00
> Stickerbox is our attempt to make modern AI kid-safe, playful, and tangible. We’d love to hear what you think!

How is it made to be "kid-safe"?

> Our model includes strict safety filters that block inappropriate content before it ever appears, ensuring that every creation stays fun, imaginative, and age-appropriate.

How do you filter the output of a generative AI like this?
by laurencerowe | 2025-12-19 20:49:53+00:00
Disabling overcommit on V8 servers like Deno will be incredibly inefficient. Your process might only need ~100MB of memory or so but V8's cppgc caged heap requires a 64GB allocation in order to get a 32GB aligned area in which to contain its pointers. This is a security measure to prevent any possibility of out of cage access.
by didibus | 2025-12-19 20:49:54+00:00
I understood OP's saying more as "appetite for doing".

Ignoring the practical reality that you need resources, capacity, good planning, and so on to actually do something. I understood OP as saying the mindset in China is that they want to do it all. They are willing to invest even in things that would have poor ROI, if they can come into an industry and undercut by taking a smaller margin they will.

If so, that is a difference in attitude. In the west, we are only interested in returns that beat our alternatives. Capital is divested based on maximizing return on investment. This is why we even allowed many industries in the first place to move to China and we exited those segments domestically.
by fabian2k | 2025-12-19 20:50:06+00:00
I don't really know enough about the specifics here. But my main points isn't about checksums, but more something like WAL in Postgres. For an embedded KV store this is probably not the solution, but my understanding is that there are data structures like LSM that would result in similar robustness. But I don't actually understand this topic well enough.

Checksumming detects corruption after it happened. A database like Postgres will simply notice it was not cleanly shut down and put the DB into a consistent state by replaying the write ahead log on startup. So that is kind of my default expectation for any DB that handles data that isn't ephemeral or easily regenerated.

But I also likely have the wrong mental model of what Garage does with the metadata, as I wouldn't have expected that to be ever limited by Sqlite.
by vablings | 2025-12-19 20:50:06+00:00
I think it's hard to say. Grok is pretty good and also fairly free with good usage limits.

Every single AI company in my opinion is committing fairly grave misdeeds with the ruthless scraping of the internet and lack of oversight.

Not to mention the shady backdoor deals going on with big tech and the current administration.

Grok is also pretty bad with its whole gas turbines in one state and datacenter in another and some possible environmental issues

It's more of a pick your poison at this point
by 201984 | 2025-12-19 20:50:10+00:00
> What's not helping the situation is the fact that the kernel has no good page allocation API that differentiates between reserving and committing memory.

mmap with PROT_NONE is such a reservation and doesn't count towards the commit limit. A later mmap with MAP_FIXED and PROT_READ | PROT_WRITE can commit parts of the reserved region, and mmap calls with PROT_NONE and MAP_FIXED will decommit.
by barfoure | 2025-12-19 20:50:31+00:00
Some of this can be reduced to a trivial form, which is to say practiced in reality on a reasonable scale, by getting your hands on a microcontroller. Not RTOS or Linux or any of that, but just a microcontroller without an OS, and learning it and learning its internal fetching architecture and getting comfortable with timings, and seeing how the latency numbers go up when you introduce external memory such as SD Cards and the like. Knowing to read the assembly printout and see how the instruction cycles add up in the pipeline is also good, because at least you know what is happening. It will then make it much easier to apply the same careful mentality to this which is ultimately what this whole optimization game is about - optimizing where time is spent with what data. Otherwise, someone telling you so-and-so takes nanoseconds or microseconds will be alien to you because you wouldn’t normally be exposed to an environment where you regularly count in clock cycles. So consider this a learning opportunity.
by ch4s3 | 2025-12-19 20:51:02+00:00
Well the vote was a sham with no secret ballots and separate voting tents for yes and no votes. Armed members of Tudeh were at almost every poling station, there were wide spread reports of members of Mossadegh's party voting multiple times, and the vote count came out to 99.99% "yes'. On top of being illegal it was obviously fraudulent. It is at times called a coup by Mossadegh.
by f30e3dfed1c9 | 2025-12-19 20:51:14+00:00
Replying to my own comment because I'm wrong. I thought that Times came first and Times New Roman later, but according to this article from the New York Public Library, the typeface was designed only once (by Stanley Morison).

The metal punches were then created jointly by Linotype and Monotype, which each sold these under different names (and registered trademarks), Times by Linotype and Times New Roman by Monotype.
Ask HN: What is your dangerous idea?
by kaycebasques | 2025-12-19 20:52:36+00:00
Resurrecting The Edge Annual Question from 2006 [1]. Here's the original prompt:

> The history of science is replete with discoveries that were considered socially, morally, or emotionally dangerous in their time; the Copernican and Darwinian revolutions are the most obvious. What is your dangerous idea? An idea you think about (not necessarily one you originated) that is dangerous not because it is assumed to be false, but because it might be true?

[1] https://www.edge.org/annual-question/what-is-your-dangerous-idea
by sanbor | 2025-12-19 20:52:58+00:00
I have a different point of view. This was a test to see if the AI could perform a specific task. Asking AI to draw a pelican riding a bike is another test. I find the experiment interesting because it proves that currently LLMs are not able to perform a simple task reliably for a long period of time.

If the journalist was not asking the right questions, or was too obvious the article was PR it’s another thing (I haven’t read WSJ’s piece, only the original post by Anthropic)