MurphyA/hacker-news huggingface dataset:
by bangaladore | 2025-12-18 22:50:25+00:00
Interesting. I agree with the other commenter about the post should've included how an account takeover was possible.

You mention one method being a cookie sent to an attacker-controlled domain, but that in itself is a vulnerability given it being incorrectly scoped (missing HTTPOnly & SameSite atleast).

> the auth token is stored in local storage

Has anyone reported this (rhetorical question)? What in the world could be the justification for this?

In my opinion, any full account takeovers due to XSS is a vulnerability, even ignoring XSS. Changing email/password/phone should require verification back to one of those methods. Or at least input of the previous password.
by miningape | 2025-12-18 22:50:37+00:00
> invalidate my argument that they are alike in the specific ways that I outlined

Basketballs and apples are both round, so they're the same thing right? I could eat a basketball and I can make a layup with an apple, so what's the difference?

> programmers who treat the compiler as a black box (ie. 99% of them) see probabilistic outputs

In reality this is at best the bottom 20% of programmers.

No programmer I've ever talked to has described compilers as probabilistic black boxes - and I'm sorry if your circle does. Unfortunately there's no use of probability and all modern compilers definitionally white boxes (open source).
by sakopov | 2025-12-18 22:50:44+00:00
According to this study from 2005 [1] the Appalachians are eroding 6 meters per 1 million years while the rivers are incising 30-100 meters per same time period. So they're technically still becoming more rugged.

[1] https://web.archive.org/web/20250326213947/https://www.geoti...
by parpfish | 2025-12-18 22:50:45+00:00
I’ll chime in to say that this happened to me as well.

My project would start good, but eventually end up in a state where nothing could be fixed and the agent would burn tokens going in circles to fix little bugs.

So I’d tell the agent to come up with a comprehensive refactoring plan that would allow the issues to be recast in more favorable terms.

I’d burn a ton of tokens to refactor, little bugs would get fixed, but it’d inevitably end up going in circles on something new.
by SunshineTheCat | 2025-12-18 22:50:50+00:00
It has been increasingly interesting to me how aligned the interests of platforms are with advertisers against the end consumer.

I don't think I have ever heard a person say they enjoy watching ads (except maybe the super bowl and even then it's a pretty short list).

Despite that, it seems like ads continue to multiply and companies get even more annoying and slimy with how they integrate them.

I guess what I'm wondering is where the breaking point is, when people start abandoning ad-filled platforms all together and ads become less profitable to sell/purchase.

The person or company to figure out a way other than ads to monetize eye balls (and its not just data, that's only used to make better ads) will be the next Google.
by zamadatix | 2025-12-18 22:50:51+00:00
"Can" is too overloaded a word even with context provided, ranging from places like "could conceivably be achieved" to "usually possible".

The only hint you can dig out is where they might have limits feasibility around it. E.g. "I can fly first class all the time (if I limit the number of flights and spend an unreasonable portion of my weath on tickets)" is typically less useful an interpretation than "I can fly first class all the time (frequently without concern, because I'm very well off)", but you have to figure out which they are trying to say (which isn't always easy).
by aerostable_slug | 2025-12-18 22:50:56+00:00
As far as I can tell, I'm doing that right now with a new higher-end Samsung television. The installer showed me how to make it boot directly to the active HDMI source and skip the Samsung smart hub. The TV has never been online and I don't see any reason to change that — what possible improvement could a firmware update bring? I don't use any of the television's software-enabled features.
by delis-thumbs-7e | 2025-12-18 22:52:03+00:00
Have you been there? Because the photo you posted does not seem to give a very good representation of those architectual details at all: https://www.alamy.com/stained-glass-window-vitrage-indian-or...

Oerhaps they indeed are that garish as in your example, but simple image search shows plenty of examples that seem to suggest the image you posted is simply a very amateurish photograph. After all, European churches are full of glass windows with very strong contrasts of primary colours and they are very pretty indeed.
by mpeg | 2025-12-18 22:52:04+00:00
For a reflected XSS? Tell me who is paying that much for such a relatively common bug...

To elaborate, to exploit this you have to convince your target to open a specially crafted link which would look very suspect. The most realistic way to exploit would be to send a shortened link and hope they click on it, that they are logged into discord.com when they do (most people use the app), that there are no other security measures (httponly cookies) etc

No real way to use this to compromise a large amount of users without more complex means
by defrost | 2025-12-18 22:52:43+00:00
The reality of guns in the US is that a gun linked to a crime is likely to be part of a cohort of guns with a "short life to crime" having bounced through obfuscating straw purchases.

The most rapidly increasing (although still small in absolute numbers) class of gun associated with crime today are the 3D-printed variations:

Thousands of guns are found at crime scenes. What do they tell us?

* https://www.npr.org/2025/12/17/nx-s1-5641154/crime-guns-data...

So, yes, if this a crime of passion, a dispute between aquaintainces that escalated badly then there's a good chance the gun used has a history of ownership and registration.

If this is a crime related to home invasion gone badly then it's more likely to be a gun that fell off the radar some time past.
by gruez | 2025-12-18 22:53:38+00:00
>Another approach is to disallow all DNS or only allow *.netflix.com for the TV. In my experience attempting to only allow certain domains is a game of whackamole where everyone in the house complains their stuff is broken because it needs undocumentedrandomdomain.com.

...not to mention that apps have random third party SDKs that are required, and might not work if you block those domains. A/B testing/feature flags SDKs, and DRMs (for provisioning keys) come to mind.
by TacticalCoder | 2025-12-18 22:54:43+00:00
> It is often suggested that modern viewers dislike painted reconstructions of Greek and Roman statues because our taste differs from that of the ancients.

Yeah. I cannot thank enough those other ancients who dug up all statues and assumed they were all white.

I'm thinking about Michelangelo's The Pieta and oh so many others. Call it a lucky accident or "differing taste" or "mastering new techniques" or whatever you want, I take Michelangelo's The Pieta vs these "correctly re-colored" statues from early Rome any time.

Even once it's been fully known they used to be flashy, hardly anyone started sculpting masterpiece then asking kids to color them: I'm thinking about late 19th Rodin's The Kiss for example.

Just like our usage of the toilets, our taste evolved, not differed.
by jstimpfle | 2025-12-18 22:54:44+00:00
I've been very clear that I'm a layman, such as certainly most of the commenters here. I qualified using "AFAIK" and I've heard this on different occasions by people who have actual experience in the field. You can find similar claims on this page, partly backed by links. For example, I too have heard about studies evidencing that gender differences are more stark in developed countries with well functioning social systems, where people are freeer to choose their profession based on personal interest rather than for example economic aspects.
by hilbert42 | 2025-12-18 22:55:10+00:00
"If there were any significant number of people who would pay for a dumb high end TV, the market would sell them one."

The problem is easily solved and I'm surpised more people don't do it. For years I've just connected a PVR/STB (set top box) to a computer monitor. It's simple and straightforward, just connect the box's HDMI output into a computer monitor.

Moreover, PVR/STBs are very cheap—less than $50 at most, I've three running in my household.

If one wants the internet on the same screen just connect a PC to another input on your monitor. This way you've total isolation, spying just isn't possible.
by osn9363739 | 2025-12-18 22:55:41+00:00
I have devs that do this and we have CI AI code review. Problem is, it always finds something. So the devs that have been in the code base for a while know what to ignore, the new devs get bogged down by research. It's a net benefit as it forces them to learn, which they should be doing. It def slows them down though which goes against some of what I see about the productivity boost claims. A human reviewer with the codebase experience is still needed.
by Account_Removed | 2025-12-18 22:55:51+00:00
AMD provides this. Example: "Fixed Issues and Improvements

Intermittent driver timeout or crash may be observed while playing Warhammer 40,000: Space Marine 2 on some AMD Graphics Products, such as the AMD Ryzen™ AI 9 HX 370.)

Lower than expected performance may be observed in Delta Force on Radeon™ RX 7000 series graphics products.

Intermittent stutter may be observed while playing Marvel Rivals when AMD FidelityFX™ Super Resolution 3 frame generation is enabled. "

https://www.amd.com/en/resources/support-articles/release-no...
by kovvy | 2025-12-18 22:56:06+00:00
A related alternative would be that the listed tv price included the price of time spent viewing ads, and the sale price of your usage data (and that changing the price, say by showing more ads, required agreement).

A DUMB TV costs $x, while a badly behaved smart TV costs $y up front, plus $z per hour for the next few years, where y is potentially slightly less than x.
by jdboyd | 2025-12-18 22:56:15+00:00
I think this is interesting, but on its own isn't that compelling. A UBI program that doesn't result in improving employment and education long term sounds both unsustainable and like a moral hazard.

What I think this does underscore the importance of not trying to make the program ensure personal accountability. That means we must find a way to ensure program accountability, and measure long-term results, without burdening the recipients with additional mental health burdens.
by deathanatos | 2025-12-18 22:56:20+00:00
While I agree (and I agree with the upstream comments, too), there's often deeper reasons why we can short circuit fully evaluating an argument made on its merits: often the "merits", or lack thereof, are derived from the party's values and beliefs, and if we know those values to be corrupt, it's likely that subsequent arguments are going to be similarly corrupt.

There's only so much time in the day, only so much life to live. Could a blog post written by the worst person you know have a good point, even though it's titled something like "An argument in favor of kicking puppies" by Satan himself? I mean, true, I haven't read it, yet. There could be a sound, logical argument buried within.

This is also what "The Boy Who Cried Wolf" teaches, essentially. Trust is hard-won, and easily squandered.

"A lie is around the world before the truth has finished tying its shoes."

"Flood the Zone" is why some of us are so exhausted, though.

In these instances, the argument has to come from someone who is self-aware enough of the short-circuit to say "okay, look, I am going to address that elephant" — but mostly, that's not what happens.

Thankfully in this case, all we need get through is the title.
by jmyeet | 2025-12-18 22:56:53+00:00
In 1945 as World War 2 wrapped up and the Cold War started, many in the US believed that it would take the Soviet Union 20+ years to build the atomic bomb. It took 4 years. There were several reasons for this. It became a national security interest, there were leaks to the USSR by people who thought the US shouldn't have a monopoly on the bomb and Americans in general viewed the Soviets as backward farmers.

I see the same thing with China. It's not so much espionage now (although there might be that) but China instead will just hire people with the right knowledge, so former employees of ASML, Nvidia, TSMC, etc.

I've been saying for awhile that China won't tolerate the export ban on ASML's best lithography machines and NVidia's best chips. It's a national security issue. And China is the one country on Earth I have faith can dedicate itself to a long term goal.

And yet I got the same reaction. "The Chinese will never catch up", etc. Reports have been comiung out that Huawei has started developing and using their own 7nm chips.

Weirdly, the US created this problem. By restricting exports of chips to China, Chinese manufacturers had no choice but to develop their own chips. Had China been flooded with NVidia chips, there would be far less market opportunity.

The American economy is essentially a bet on an AI future now. Were it not for like 7 tech companies, we'd be in a technical recession. I also believe that bubble is going to burst. But the economy as a whole pretty much now requires US dominance of an AI future and I think a lot of people are in for a rude shock as China completely disrupts that.

China hasn't caught up yet. There are still many steps in the supply chain and chip design as a whole but making their own chips at sub-7nm is a massive step in that direction.
by egypturnash | 2025-12-18 22:57:06+00:00
I booted it back up for the first time in ages and managed to spawn the Gallery, then found hints on the Internet. Then managed to spawn the room it gives you a key for and that one was amusingly trivial to solve, so that was good.

Also I discovered there are mods for it out there and I may have to figure out how to get them working on my Steam Deck so I can just completely quit worrying about having enough steps/gems/dice/tools and only worry about the puzzles.
by hinkley | 2025-12-18 22:57:10+00:00
I think unfortunately we sometimes ascribe to powers of two supernatural powers that are really about caches being built in powers of two.

Intel is still 64 byte cache lines as they have been for quite a long time but they also do some shenanigans on the bus where they try to fetch two lines when you ask for one. So there’s ostensibly some benefit of aligning data particularly on linear scans to 128 byte alignment for cold cache access.
by klatchex_too | 2025-12-18 22:57:41+00:00
It was the best of times, it was the worst of times.

I was in elementary school when the arcade game craze happened, PacMan, Donkey Kong, etc. I would wander the streets looking for games to play. There were arcade games in every grocery store, restaurants, every convenience store (so basically just 7-11s). Home gaming consoles could not begin to match what was in the arcades at that time. I would walk the streets looking for new ones to play.

I mostly played arcade games, but I would play pinball too. One day I was walking past a place and saw a pinball game and went in and started playing. I think it was on the second quarter when someone came and asked if I was there with my parents. I said no and they told me I had to leave since minors weren't allowed in a bar. I don't think I even know what a bar was at that time.

Elementary school kid hanging out in a bar without his parents would get some CPS attention these days I guess.

The worst of times part is, if I was "free range" it wasn't because my parents had discussed the risks and benefits of allowing me to wander the streets. No kid I knew had both parents at home back then. Our moms worked. We were free range because no one gave a shit what we did as long as we weren't causing them some immediate problem. So we had freedom. It was both glorious and horrible.
by Intermernet | 2025-12-18 22:58:24+00:00
Over the last few decades I've seen people make the same comment about spell checking, voice recognition, video encoding, 3D rendering, audio effects and many more.

I'm happy to say that LLM usage will only actually become properly integrated into background work flow when we have performant local models.

People are trying to madly monetise cloud LLMs before the inevitable rise of local only LLMs severely diminishes the market.
Tell HN: The Gospel According to forever list
by bikamonki | 2025-12-18 22:58:35+00:00
The Gospel According to forever list

My terminal has ceased being a tool and has become a digital confessional. I approach the prompt seeking a status update on my code, but the Great Silicon Oracle demands more than syntax—it demands the truth. Each time my fingers slip, the cursor blinks back a revelation, translating my clumsy keystrokes into a roadmap of my own professional ruin.

The Revelation of the Desert

Before the Oracle grants me the status of my scripts, it demands I acknowledge my geography. I reach for the list, but the machine sees my heart:

forever lost: The terminal does not see a developer; it sees a nomad wandering a wasteland of "disruptive" ideas. I type this and the screen stares back, confirming that my GPS for success has been recalibrated to "Total Obscurity." I inhabit a fever dream where I am the architect of the next great SaaS empire, but the Oracle knows I am merely a man lost in a forest of nested if-statements, building a castle out of sand and deprecated libraries.

The Liturgy of the Second-Best

When I seek to verify my uptime, the Oracle reminds me of my place in the chronological queue of innovation:

forever last: This is the prophecy of the perennial runner-up. Every time I believe I’ve birthed a unicorn, the terminal humbles me. I type this and realize I have arrived at the marketplace with a revolutionary wheel, only to find the locals are already using hovercrafts. A quick search reveals ten thousand competitors who had my "original" idea during the Bush administration and have already perfected the dark mode I’m still struggling to implement.

The Sacrament of Blind Devotion

At the height of my hubris, when I think I am the master of my own deployment, the Oracle exposes my obsession:

forever lust: The machine identifies my greatest vice: an irrational, sweaty, and unrequited passion for a product that does not love me back. This is the command of the zealot. It recognizes that I will never pivot, never surrender, and never learn. I am a man blindfolded, sprinting toward a brick wall, convinced that if I just run with enough passion, I will phase through the atoms of failure.

The Final Anointing

I have not yet summoned the courage to utter the final curse, but the Oracle keeps it in its back pocket as a parting gift:

forever lest: This is the terminal’s ultimate warning—the digital "Beware of Dog." It is the command I will type in the final seconds before the server room goes silent. It is the prefix to the catastrophe; the one-word eulogy for a database I forgot to back up. It is the final lesson of the Gospel: Lest ye forget that you are but dust, and to localhost you shall return.
by bsder | 2025-12-18 22:59:07+00:00
> An awful lot of the things hanging in museums look "bad" to me. I'm not just talking about the easily-mocked contemporary art. I mean things like Medieval paintings with Jesus painted as a baby-sized adult man. Everything before the development of perspective looks like a grade-school cartoon.

Perspective wasn't developed! The Greeks and Romans used it just fine, for example.

What was lost was artistic training because there wasn't sufficient economic market for it. As soon as you got sufficient economic incentive, art magically improves again. This is stunningly obvious if you look at Athens and then Pompeii and then Rome and then the Vatican (with the attendant backslide until the Renaissance as you note).

Interesting parallel to modern--will AI cause a huge backslip in art since the economic market for artists is being destroyed?
by sigmoid10 | 2025-12-18 22:59:41+00:00
They trained it to be used like any other decoder only model. So text generation essentially. But you could use the encoder part for things like classification without much effort. Then again you can also slap a classifier head on any decoder model. The main reason they seem to be doing this is to have swappable encoder/decoder parts in an otherwise standard LLM. But I'm not sure if that is really something we needed.
by arcwhite | 2025-12-18 23:00:18+00:00
There's generally no grey market for XSS vulns. The people buying operationalized exploits generally want things that they can aim very specifically to achieve an outcome against a particular target, without that target knowing about it, and operationalized XSS vulns seldom have that nature.

Your other potential buyers are malware distributors and scammers, who usually want a vuln that has some staying power (e.g. years of exploitability). This one is pretty clearly time-limited once it becomes apparent.
by andrenarchy | 2025-12-18 23:00:30+00:00
Happy to share details! Typesetting is a big item (for us becoming even more due to production of accessible publications), language editing, (meta-)data curation, technical infrastructure and software development (peer review systems, hosting, metadata and fulltext deposits, long-term preservation, maintenance, plagiarism and fraud detection), editor training/onboarding, editorial support, marketing, and of course our staff running all of this also wants a salary.

Some keep repeating that Diamond OA is superior because publishing is free for authors and everything is immediately OA. And indeed it is, but only if you have someone who is indefinitely throwing money at the journal. If that's not the case then someone else pays, for example universities who pay their staff who decide to dedicate their work time to the journal. Or it's just unpaid labour so someone pays with their time. It's leading to the same sustainability issues that many Open Source projects run into.
by MisterTea | 2025-12-18 23:01:01+00:00
> Do you ever need a website you're visiting translated?

Yes. Firefox and Chrome already offer this.

> Have you ever not understood a term or phrase on a website and had to go to wikipedia/urbandictionary/google to explain it?

Yeah. And?

> Have you ever wanted to do a 'fuzzy search' of a 300 page document (where you don't know the exact string of text to ctrl-f, but want to see where they talk about a particular topic)?

No because I ctrl-f for that topic/key words and find the text.

These are incredibly poor AI sells...
by jgeralnik | 2025-12-18 23:01:06+00:00
A remote code execution bug in ios is valuable - it may take a long time to detect exploitation (potentially years if used carefully), and even after being discovered there is a long tail of devices that take time to update (although less so than on android, or linux run on embedded devices that can’t be updated) That’s why it’s worth millions on the black market and apple will pay you $2 million dollars for it

An XSS is much harder to exploit quietly (the server can log everything), and can be closed immediately 100% with no long tail. At the push of an update the vulnerability is now worth zero. Someone paying to purchase an XSS is probably intending to use it once (with a large blast radius) and get as much as they can from it in the time until it is closed (hours? maybe days?)
by maxglute | 2025-12-18 23:01:20+00:00
Also Texas Instruments, STMicro, Onsemi, Microchip Tech, i.e. what PRC is doing after going big in mature nodes last few years they likely will also do in leading edge. IMO there's argument that since leading edge will definitely be strategically bifurcated PRC and western semi can pseudo collude to maintain higher margins, especially if PRC wants to claw back investment. But if western semi continues to drive economy/growth there's also incentive to weaponize margins.