MurphyA/hacker-news huggingface dataset:
by codegeek | 2025-12-17 22:00:24+00:00
tl:dr: He got hacked but the damage was only restricted to one docker container runn ing Umami (that is built on top of NextJS). Thankfully, he was running the docker container as a non privileged non-root user which saved him big time considering the fact that the attack surface was limited only within the container and could not access the entire host/filesystem.

Is there ever a reason someone should run a docker container as root ?
by aucisson_masque | 2025-12-17 22:00:41+00:00
> He says he could begin to block ad blockers in Firefox and estimates that’d bring in another $150 million, but he doesn’t want to do that. It feels off-mission.

That's just miss interpretation. The way he told that was probably badly reported by the journalist and now it's getting miss understood.

Let's be honest and give this guy an honnest chance instead of witch hunting.

I really didn't like his interview and his blog post but even then, judge on the facts and not the talk !
Not as intelligent as they are thought to be
by wef | 2025-12-17 22:00:49+00:00
So having done all the "Hard" binary puzzles (and thinking myself very clever), I wanted to start on the "Very Hard" ones at https://www.binarypuzzle.com/puzzles.php?size=10&level=4&nr=1.

Very quickly getting stuck, I thought I'd try the AI's for inspiration. All four of the LLM's that I tried appeared to understand the puzzle rules but then they all hallucinated, confounded, fluffed and fumbled.

Just goes to show that they are not using logic, just repeating words that they have scraped elsewhere.

This was my prompt:

<quote> I am stuck on this binary puzzle. What is the next move?

0 1 0 1 1 0 0 1 1 0

0 1 0 - - 1 0 0 1 1

1 0 1 - - 0 1 1 0 0

- - 1 - - 0 1 0 0 1

0 1 0 0 1 1 0 1 1 0

- - 1 - 0 1 1 0 0 1

1 0 0 1 0 0 1 1 0 1

- - 0 - 1 - 0 - 1 0

- - 1 - - - 0 - 1 0

- - 1 - 0 - 1 0 0 1

</quote>

The solver at https://www.magmeister.be/binarypuzzlesolver/ showed that it was able to complete the first column as the next step - I just can't understand how!!
by Izkata | 2025-12-17 22:01:00+00:00
English to Japanese loses plurals, Japanese to English loses most honoriffics and might need to invent a subject (adding information that shouldn't be there and might be wrong). Different languages also just plain have more words than others with their own nuances, and a round trip translation wouldn't be able to tell which word to choose for the original without a additional context.

Translation is lossy. Good translation minimizes it without sounding awkward, but that doesn't mean some detail wasn't lost.
by throwaway81523 | 2025-12-17 22:01:28+00:00
> “ In the two decades since the show aired, a hundred thousand American Spirits had yellowed Bob’s fingers and turned his voice to gravel.”

13.7 per day, I guess it could be worse.

When I saw the title I wondered if Bob Rutan had any connection with Burt Rutan, the airplane guy. I guess not.

How do you get $200 an hour for a corporate Santa gig?

Article looks good. I'm just a paragraph or two in, but will probably read it.
by timmyc123 | 2025-12-17 22:01:59+00:00
You're quoting the first post of a long discussion, where the importance of protecting your data on disk was highlighted, and a proposal was made that at minimum, the default should be encrypting the backup with a user selected secret or key.

> But I want to use Apple Passwords.

You're choosing to use an app that doesn't meet your needs, when there are numerous apps out there that do meet your needs. I'm not sure how anyone is supposed to solve that for you.
by munificent | 2025-12-17 22:02:36+00:00
> if you didn't know any better, might make you think that AI is a worthless technology.

"Worthless" is ambiguous in this sentence. I think people understand that AI isn't useless in that it at least to some degree does the things it is intended to do. At the same time, it might be valueless in that a world without it is preferable to some.

Landmines are not useless, but they are valueless. Opinions differ is to what degree generative AI is like landmines in terms of externalities.
by pbalau | 2025-12-17 22:02:42+00:00
The stupid answer is that not everything that can be automated should be.

The real answer is of a more philosophical nature, if you manually had to check A, B, C... Z, then you will have a better understanding of the state of the system you work with . If something goes wrong, at least the bits you checked can be disregarded and free you to check other factors. What if your systems correctly report a faulty issue, yet your automatic checklist doesn't catch it?

Also, this manual checklist checks the operator.

You should be automating everything you can, but much care should be put into figuring out if you can actually automate a particular thing.

Automate away the process to deploy a new version of hn, what's the worst that can happen?

But don't automate the pre flight checklist, if something goes wrong while the plane is in the air, people are going to die.

I think a less verbose version of the above is that a human can detect a fault in a sensor, while a sensor can't detect it is faulty itself.
by djinnrutger | 2025-12-17 22:02:44+00:00
I have been using VSCode / CoPilot with Opus 4.5 and it has been working the best of any of the system I have tried. Very happy with it so far. I never really got good results with GPT5.1. though 5.2 seems better...but not by alot, so I will stick with Opus 4.5 for now.
by minitech | 2025-12-17 22:02:54+00:00
Seconding what others have said about preferring to read bad human writing. And I don’t want to pick on you – this is a broadly applicable message prompted by a drop in the bucket – but please don’t publish articles beyond your ability to fact check. Just write what you actually know, and when you’re making a guess or you still have open questions at the end of your investigation, be honest about that. (People make mistakes all the time anyway, but we’re in an age where confident and detailed mistakes have become especially accessible.)
by peterfirefly | 2025-12-17 22:02:58+00:00
> One question I have is why have Kelvin sign that is distinct from Latin K and other indistinguishable symbols?

To allow round-tripping.

Unicode did not win by being better than all previously existing encodings, even though it clearly was.

It won by being able to coexist with all those other encodings for years (decades) while the world gradually transitioned. That required the ability to take text in any of those older encodings and transcode it to Unicode and back again without loss (or "gain"!).
by benjismith | 2025-12-17 22:03:00+00:00
I think the biggest injury to the hiring of junior devs happened after COVID made remote-work ubiquitous. It's a lot harder for a junior dev to get real mentorship, including the ambient kind of mentorship-by-osmosis, when everyone works alone in a sad dark room in their basement, rather than in an office with their peers and mentors.

The advent of agentic coding is probably punch #2 in the one-two punch against juniors, but it's an extension of a pattern that's been unfolding for probably 5+ years now.
by d4mi3n | 2025-12-17 22:03:49+00:00
While this is true, the general security stance on this is: Docker is not a security boundary. You should not treat it like one. It will only give you _process level_ isolation. If you want something with better security guarantees, you can use a full VM (KVM/QEMU), something like gVisor[1] to limit the attack surface of a containerized process, or something like Firecracker[2] which is designed for multi-tenancy.

The core of the problem here is that process isolation doesn't save you from whole classes of attack vectors or misconfigurations that open you up to nasty surprises. Docker is great, just don't think of it as a sandbox to run untrusted code.

1. https://gvisor.dev/

2. https://firecracker-microvm.github.io/
by Workaccount2 | 2025-12-17 22:04:02+00:00
So gemini 3 flash (non thinking) is now the first model to get 50% on my "count the dog legs" image test.

Gemini 3 pro got 20%, and everyone else has gotten 0%. I saw benchmarks showing 3 flash is almost trading blows with 3 pro, so I decided to try it.

Basically it is an image showing a dog with 5 legs, an extra one photoshopped onto it's torso. Every models counts 4, and gemini 3 pro, while also counting 4, said the dog had a "large male anatomy". However it failed a follow-up saying 4 again.

3 flash counted 5 legs on the same image, however I added distinct a "tattoo" to each leg as an assist. These tattoos didn't help 3 pro or other models.

So it is the first out of all the models I have tested to count 5 legs on the "tattooed legs" image. It still counted only 4 legs on the image without the tattoos. I'll give it 1/2 credit.
by magicloop | 2025-12-17 22:04:28+00:00
Your graphs roughly marry up with my anecdotal experience. After a while, when you know when and how to utilize LLMs/agents, coding does become more productive. There is a discernible improvement in productivity at the same quality level.

Also I notice it when the LLMs are offline. It feels a bit like when the internet connect fails. You remember the old days of lower productivity.

Of course, there is a lot of junk/silly ways to approach these tools but all tools are just a lever, and need judgement/skill to use them well.
by 1vuio0pswjnm7 | 2025-12-17 22:04:34+00:00
"It annoys me that big-tech marketing has made most people believe that "personalised advertising" means they get ads which are more "useful" to them."

"relevant" is another term seen in addition to "useful"

But "relevant" is relative

For example, "relevant" to what?

It's only if Big Tech has collected data about the ad target and, e.g., made some guess about their intent, that the ads could be "relevant"

Whether the ads are truly "relevant" is a question for the reader. The term "relevant" might just be marketing fluff

Either way, Big Tech will keep the data vacuum humming
by taberiand | 2025-12-17 22:04:35+00:00
Overengineering is building a bridge that will stand 1000 years when 100 will do; it's excess rigor for marginal benefit. Juicero wasn't overengineering, it was building a crappy bridge to nowhere with a bunch of gaudy bells and whistles to try and hide its uselessness and poor design, that collapsed with the first people to walk over it
by foxglacier | 2025-12-17 22:05:12+00:00
Yea, Fortran is nice to use for so-called "scientific" computing. It has high performance as well as some handy intrinsic functions like DOT_PRODUCT and TRANSPOSE but the best features to me are colon array slicing syntax like Python/Numpy and arrays being indexed from 1 which makes converting math equations into code more natural without constantly worrying about off-by-one errors.

I wouldn't call multi-dimensional arrays tensors though. That's a bit of a bastardization of the term that seemed to be introduced by ML guys.

It wasn't until I started using Fortran that I realized how similar it is to BASIC which must have been a poor-man's Fortran.
by vitaut | 2025-12-17 22:05:21+00:00
I am not sure how it compares but I did use one idea from Cassio's talk on Teju:

> A more interesting improvement comes from a talk by Cassio Neri Fast Conversion From Floating Point Numbers. In Schubfach, we look at four candidate numbers. The first two, of which at most one is in the rounding interval, correspond to a larger decimal exponent. The other two, of which at least one is in the rounding interval, correspond to the smaller exponent. Cassio’s insight is that we can directly construct a single candidate from the upper bound in the first case.
by timmyc123 | 2025-12-17 22:05:22+00:00
Unclear how this quoted comment relates to what I was replying to (which was about exporting / backing up your credentials).

But I'll respond.

> Will I always be able to use any credential manager of my choice? Any naturally also includes software that I might have written myself. And would you be in support of an ecosystem where RPs might block my implementation based on my AAGUID?

If a website were to block your custom software's AAGUID for some reason, you can change your AAGUID.

AAGUIDs in the consumer passkey ecosystem are used to name your credential manager in account settings so you remember where you saved your passkey.
Show HN: A browser game about the AI alignment problem
by NickSharp | 2025-12-17 22:06:03+00:00
Hi. I'm a game designer who cares deeply about AI safety. I saw the Future of Life Institute's Keep The Future Human contest https://keepthefuturehuman.ai/contest/ and made a browser game.

Feedback welcome.

You start the game running a small research lab, building AI. As you grow, a rival appears and the race kicks in. If you build too slow and they steal your resources. But if you build too fast without alignment, all humans lose (including you). In the late game players may want to take their foot off the pedal and slow down progress, but the world has begun to depend on the wonders you create. The challenge is to thread the needle, create great tech for humanity without ending it all.

Game mechanics draw heavily on the essay Keep The Future Human by Anthony Aguirre, I'm happy to discuss below.

Oh, and don't worry if the UI starts acting weird. As your AI gets more powerful, the game might start misbehaving...

https://TheChoiceBeforeUs.com/
by pengaru | 2025-12-17 22:06:12+00:00
from his wikipedia page:

> In 1978, at age 23, Jobs was worth over $1 million (equivalent to $4.82 > million in 2024). By age 25, his net worth grew to an estimated $250 million > (equivalent to $865 million in 2024). He was also one of the youngest "people > ever to make the Forbes list of the nation's richest people—and one of only a > handful to have done it themselves, without inherited wealth".[97] In 1982, > Jobs bought an apartment on the top two floors of The San Remo, a Manhattan > building with a politically progressive reputation. Although he never lived > there,[98] he spent years renovating it thanks to I. M. Pei.
by lkjdsklf | 2025-12-17 22:06:24+00:00
I’ve worked at a couple FAANG and questioning things is pretty much always viewed as a positive when it’s done in a productive and professional manner

What isn’t viewed positively is when you refuse to accept a decision after it’s been made and your concerns have been heard. People get pissed if you keep relitigating the same points over and over again
by watwut | 2025-12-17 22:06:48+00:00
I think that you are not listening to what they say, it is as simple as that. You want to be their friend, to dont want to take them seriously.

> people tend to shutdown when they hear trigger words like fascism

Also, it is objectively not true they shutdown. There is nothing shutdown about current conservatives and republicans. They are loudly and actively working on their project. They are not shy afraid to talk ... instead people like you are unwilling to listen to what they are saying again and again.

Either that or pretending to not listen and focusing on trying to make their opposition shut up.

> productive conversation, it's better to use less loaded language.

Do you want productive conversation or you simply want the rest of us help them and pretend they are actually not fascists? Productive conversation and middle ground between democracy and fascism is authoritarian dictatorship and a lot of victims.
by K0nserv | 2025-12-17 22:07:02+00:00
Everything is solely the responsibility of the programmer. The strength of Rust as a language is that it helps the programmer check themselves before they wreck themselves. The critique of C would be that it provides far too little support to the programmer, although it was reasonable at the time it was was invented.

Unsafe is the one escape hatch where Rust is more like C, but pragmatically it's an important escape hatch.
by Ukv | 2025-12-17 22:07:17+00:00
> [...] Finally, most important of all, did you have fun? The answer to all of these questions is "no".

Exploring the possibilities and limitations of a new technology is fun.

Obviously this is just a quick experiment lacking a whole lot you'd expect from a regular game, but there's also a lot to be curious about and different directions it could be taken in. With a harness could it generate a background, sprites, and collision mask so the player/NPCs can walk around in real-time? Could you limit commands from the player to reasonable actions ("I attempt to kick down the door") without the full god-mode world control? Or alternatively, could you allow a player to act as god of the world dictating changes, with NPCs or other players living within it (like as a tool for DnD)?

> why not just play an actual Legend of Zelda game? They exist. They are good.

One of their posts under "Latest" at the bottom is "Things I appreciate about Ocarina of Time", so presumably they have. Playing a game doesn't mean you can't also play around with experiments like this.
by timmyc123 | 2025-12-17 22:07:48+00:00
I used the technical name for the capability, but you've likely run into it before.

If there is no passkey on the local device, a QR code will appear which you can scan with your phone or tablet, and use the passkey for the account from that device. It just kind of happens, typically without the user having to do anything special.

I will say though, corporate devices can be a bit of a wildcard as they are usually configured and locked down for a specific purpose. But the cross-device flow is generally not blocked by organizations.
by Forgeties79 | 2025-12-17 22:08:15+00:00
> The idea of “independent agencies” staffed by neutral civil servants arises directly from this skepticism of democracy and voters

It arises from the need for certain aspects of our country to not be explicitly partisan or subject to fickle leadership. Same reason people call for independent committees to draw congressional maps.

This country is not and never has been a “true” democracy. Being inherently skeptical of the democratic process is foundational to our country.
by waffletower | 2025-12-17 22:08:27+00:00
Humans can fail at some of these qualifications, often without guile: - being consistent and knowing their limitations - people do not universally demonstrate effective understanding and mental modeling.

I don't believe the "consciousness" qualification is at all appropriate, as I would argue that it is a projection of the human machine's experience onto an entirely different machine with a substantially different existential topology -- relationship to time and sensorium. I don't think artificial general intelligence is a binary label which is applied if a machine rigidly simulates human agency, memory, and sensing.
by shaftway | 2025-12-17 22:08:47+00:00
Not OP, but it's probably about inheritance rules. If you inherit a property then you inherit its tax basis. In fact, if I remember correctly, you inherit the tax basis, but the capital gains basis resets. You effectively inherit a property that has a low property tax, but face zero capital gains if you turn around and sell it.

All of this is subject to limits and rules and stuff. I think prop 19 made it so that you have to use it for your primary residence for the first year. And I think there's a cap on the difference between property value and tax basis of ~$1m.
by jakelsaunders94 | 2025-12-17 22:08:47+00:00
Thanks for the encouragement! I find it difficult to write articles beyond simply stating a series of facts.

I tried handwriting https://blog.jakesaunders.dev/schemaless-search-in-postgres/ bit I thought it came off as rambling.

Maybe I'll have a go at redrafting this tomorrow in non LLM-ese.
by anigbrowl | 2025-12-17 22:08:53+00:00
That would be true in a normal economy where supply and demand dominated. See an empty storefront/building, hustle up a few bucks and turn it into an art studio or entertainment space or whatever. But if you start using a building you have to pay rent, and if you pay rent that goes on the books, and if it goes on the books then the mortgage on the property gets reevaluated and the then the merry-go-round comes to a screeching halt, because most commercial property is mortgaged up to the eyeballs.
by Topfi | 2025-12-17 22:08:53+00:00
By existing as part of Google results, AI Search makes them the least reliable search engine of all. Just to show an example I have searched for organically today with Kagi that I tried with Google for a quick real world test, looking for the exact 0-100kph times of the Honda Pan European ST1100, I got a result of 12-13 seconds, which isn't even in the correct stratosphere (roughly around 4sec), nor anywhere in the linked sources the model claims to rely on: https://share.google/aimode/Ui8yap74zlHzmBL5W

No matter the model, AI Overview/Results in Google are just hallucinated nonsense, only providing roughly equivalent information to what is in the linked sources as a coincidence, rather than due to actually relying on them.

Whether DuckDuckGo, Kagi, Ecosia or anything else, they are all objectively and verifiably better search engines than Google as of today.

This isn't new either, nor has it gotten better. AI Overview has been and continues to be a mess that makes it very clear to me anyone claiming Google is still the "best" search engine results wise is lying to themselves. Anyone saying Google search in 2025 is good or even usable is objectively and verifiably wrong and claiming DDG or Kagi offer less usable results is equally unfounded.

Either fix your models finally so they adhere to and properly quote sources like your competitors somehow manage or, preferably, stop forcing this into search.
by skybrian | 2025-12-17 22:09:10+00:00
I like "ghosts" as a simple metaphor for what you chat with when you chat with AI. Usually we chat with Casper the Friendly Ghost, but there are a lot of other ghosts that can be conjured up.

Some people are obsessed with chatting with ghosts. It seems like a rational adult couldn't be seriously harmed by chatting with a ghost, but there are news reports showing that some people get possessed.

It's a better metaphor than parrots, anyway.

more:

https://karpathy.bearblog.dev/animals-vs-ghosts/
by jrflowers | 2025-12-17 22:09:20+00:00
> It synthesizes a more comprehensive report, using more sources, more varied sources, more data, and broader insights than a human analyst can produce in 1-2 days of research and writing.

> Note that I'm not saying 20 minutes of deep research beats 9 months of investigative journalism with private interviews with primary sources or anything like that.

I like the idea that AI is objectively better at doing analysis if you simply assume that it takes a person nine months to make a phone call
by harmmonica | 2025-12-17 22:09:25+00:00
Yeah, I feel like the yimby's are going to take another run at repealing it for investment properties (5+ units of multifamily and all of commercially-zoned property) and it stands a much greater chance of passing the next time because of how close it was last time. The messaging will be much sharper.

Re your NNN comment, would you mind sharing a source for that? My gut says it's not accurate, but happy to be proven wrong. If you meant total square footage of leased space, that would make more sense, but having a hard time believing most leases are NNN (and since your point was about businesses going under what I think matters is the number of leases because (a bit over-simplified) 1 lease = 1 business regardless of the square footage leased by the business.

The ironic thing about this whole topic of businesses going under is that there's no rent control, for the most part, for businesses and yet Prop 13 acts as rent control (i.e., carried cost control) for landlords. If the landlords only charged the market rent that was achievable at the time they bought the property with a nominal capped annual increase that'd be pretty good for operating businesses, just not for the landlord's real estate business.

P.s. I personally benefit from Prop 13 and would be happy to have its market-distorting bullshit eliminated!