MurphyA/hacker-news huggingface dataset:
by ProllyInfamous | 2025-12-23 04:19:42+00:00
¿Porque no los dos?

My attendances at DEF-CON have been mostly grey-hat [0]. I don't really care about downvotes just here to spread knowledge on topics I find interesting.

Thanks for the sanity/perspective.

[0] I'm in the XX documentary, and have been on stage (as have many friends), but never as an official speaker. In a former digital life, I ran a lockpicking youtubey with millions of views.
by dragonwriter | 2025-12-23 04:20:02+00:00
> I don't think Chromebooks are good computers for kids to learn on.

I think its fine for kids to learn on. Its arguably not ideal for learning computing, but that's not most of what kids learn using a computer.

> What is the reason given for Chromebooks being used so much in US schools?

Price per unit and the fact that its bundled with software and services for centralized administration. There's nothing comparable in traditional Linux. Windows could have competed but dropped the low-end netbook as a category right around when Google started making inroads with Chromebook, and even with Windows-on-ARM neither Microsoft nor anyone using Windows seems to have really targeted the same market.

> Is it just Google having a good sales team?

I don't know how good their sales team is, I think they are the only firm that acts like they want market at all.
by zamadatix | 2025-12-23 04:21:05+00:00
> It's just a regular PC with Windows Copilot... which is a standard Windows feature anyway.

"AI PC" branded devices get "Copilot+" and additional crap that comes with that due to the NPU. Despite desktops having GPUs with up to 50x more TOPs than the requirement, they don't get all that for some reason https://www.thurrott.com/mobile/copilot-pc/323616/microsoft-...
by dragontamer | 2025-12-23 04:21:51+00:00
> but I'm not even sure it's that much more friendly than previous gov

Do you take this line back, or did you simply forget you said this? Or is there some fine detail you wish to clarify here.

Because one admin literally suing for the breakup of Google, and the next admin giving the case up with no argument is about as opposite as you can get. The facts simply do not match your assertions
by throwaway290 | 2025-12-23 04:22:09+00:00
show a country that doesn't have some dark stuff in its history?

This is not whataboutism. Trying to shift it to the past is not helping the cause. If all countries are fascist because they did something like this some time ago then the word has no useful meaning anymore.

So now in the eyes of some centrist American who has any national pride and half a brain you are making a biased argument. Then yall act surprised why they elect Trump AGAIN.

> It’s not about the past.

You literally said US has always been fascist. This is wrong if you look at the dictionary of what fascist is. Show how authoritarian, intolerant, oppressive US was under Obama for example.

It's one thing to say US could do better and another thing to say US has always been fascist while there are tons of countries that were 50x more fascist (and racist too, which is a different thing) than US, like PRC or USSR (side note it's funny how some american lefties I meet straight up admire them).
by awesome_dude | 2025-12-23 04:22:12+00:00
2. Verbose Error Messages: When Your Application Talks Too Much
Verbose error messages represent another common misconfiguration that gifts critical information to attackers. When applications encounter errors, they often generate detailed messages intended for developers. In production environments, these messages can reveal:

Technical infrastructure details: Database types, versions, server configurations
File paths and directory structures: Enabling directory traversal attacks
Programming logic: Including code snippets that expose application behavior
Sensitive credentials: Database connection strings, usernames, passwords
Software versions: Allowing attackers to identify known vulnerabilities
The impact of this vulnerability is significant. Error messages can expose not just that a system runs PHP, but that it runs a specific, unsupported version — providing attackers with a clear exploitation path.

Security researchers have documented numerous instances where verbose error messages enabled breaches:

Dating App Vulnerability (2016): Tinder’s login system displayed error messages indicating whether specific email addresses were registered, enabling brute-force attacks to identify valid accounts.
Password Manager Leak (2019): A popular password manager’s login form disclosed through error messages whether email addresses were registered with the service, facilitating targeted attacks.
Government Agency Breach (2020): A major US government agency’s website displayed error messages revealing whether specific usernames existed in the system, enabling attackers to enumerate valid accounts.

[1] https://medium.com/@instatunnel/security-misconfiguration-th...
by DannyBee | 2025-12-23 04:22:56+00:00
Galen has achieved an amazing amount over the years, both in MS research and at MS. Do you have a real reason to believe he won't achieve this or just want to character assassinate him with no evidence

(We went to the same university, ive never worked with him and actually worked at a competitor for about twenty years, but know plenty of folks who have worked with him and am fairly familiar with his work and research)
by dang | 2025-12-23 04:23:36+00:00
Whoa, I agree that the parent was a bad comment that missed everything interesting thing about the article (of which there must be at least 100, which is why I submitted it), but please don't respond to a bad comment by breaking the site guidelines yourself, and certainly not by crossing into personal attack. It only makes things worse.

(that said, I do feel like you deserve a clancy exemption in this case)

https://news.ycombinator.com/newsguidelines.html
by Dylan16807 | 2025-12-23 04:25:25+00:00
> “Reasonable” is a lynchpin bearing an awful lot of load here.

No it's not. I could imagine sentences where it would be, but not this sentence. Here, watch me replace the word:

"99% of adults are not allowing their teenager to to experiment with heroin or giving their 12 year old permission to drive their car down the freeway."

Even if most people aren't ""reasonable"", they are whatever adjective that sentence describes.
by runako | 2025-12-23 04:26:15+00:00
I don't understand EU law, but wouldn't the country where the purchase happened be the one whose laws govern the transaction? In other words, if an Italian purchases a developer account from Germany, wouldn't any disputes be handled in German court?

(Also, I would assume Apple would require a developer to have a legitimate physical business address in a country where they allow developers. I don't imagine this would be an easy transaction.)

The opposite -- Italian law governs because the developer is Italian, even if the developer makes the purchase in Germany -- seems untenable even by European standards.
by MarsIronPI | 2025-12-23 04:26:58+00:00
> With Nix, any fetcher will download the source.

OK, I see how the Debian idea differs from the Portage/Nix/etc. idea. For Portage and Nix it is enough that the build proper be offline, but the source code is fetched at the beginning of the package build. Not only do I find this sufficient, I prefer it because IMO it makes the package easier to work with (since you're only wrangling the packaging code, not upstream's).
by seanmcdirmid | 2025-12-23 04:29:22+00:00
Memory prices will rise short term and generally fall long term, even with the current supply hiccup the answer is to just build out more capacity (which will happen if there is healthy competition). I meant, I expect the other mobile chip providers to adopt unified architecture and beefy GPU cores on chip and lots of bandwidth to connect it to memory (at the max or ultra level, at least), I think AMD is already doing UM at least?
by krastanov | 2025-12-23 04:30:13+00:00
> When the amplitude has norm 1, there is only one nonzero amplitude.

Yes, that is exactly the point. The example statevector you guys are talking about can (tautologically) be written in a basis in which only one of its amplitudes is nonzero.

Let's call |ψ⟩ the initial state of the Shor algorithm, i.e. the superposition of all classical bitstrings.

|ψ⟩ = |00..00⟩ + |00..01⟩ + |00..10⟩ + .. + |11..11⟩

That state is factorizable, i.e. it is *completely* unentangled. In the X basis (a.k.a. the Hadamard basis) it can be written as

|ψ⟩ = |00..00⟩ + |00..01⟩ + |00..10⟩ + .. + |11..11⟩ = |++..++⟩

You can see that even from the preparation circuit of the Shor algorithm. It is just single-qubit Hadamard gates -- there are no entangling gates. Preparing this state is a triviality and in optical systems we have been able to prepare it for decades. Shining a wide laser pulse on a CD basically prepares exactly that state.

> Changing basis does not affect the number of basis functions.

I do not know what "number of basis functions" means. If you are referring to "non zero entries in the column-vector representation of the state in a given basis", then of course it changes. Here is a trivial example: take the x-y plane and take the unit vector along x. It has one non-zero coefficient. Now express the same vector in a basis rotated at 45deg. It has two non-zero coefficients in that basis.

---

Generally speaking, any physical argument that is valid only in a single basis is automatically a weak argument, because physics is not basis dependent. It is just that some bases make deriving results easier.

Preparing a state that is a superposition of all possible states of the "computational basis" is something we have been able to do since before people started talking seriously about quantum computers.
by evanreichard | 2025-12-23 04:30:14+00:00
Have you tried llama.vscode [0]? I use the vim equivalent, llama.vim [1] with Qwen3 Coder 30B and personally feel that it's better than Copilot. I have hot keys that allow me to quickly switch between the two and find myself always going back to local.

[0] https://github.com/ggml-org/llama.vscode

[1] https://github.com/ggml-org/llama.vim
by exmadscientist | 2025-12-23 04:30:25+00:00
Hey, that was my problem from last week. And, yes, I agree with you -- it was best solved another way.

But please don't complain when I give concrete examples of things I'd like to do but couldn't. (And please do recognize that there was a lot more context to the mess than just "I need an OR gate", but no one cares about the real gory details.)
by zdragnar | 2025-12-23 04:30:49+00:00
It isn't just copilot that these laptops come with; manufacturers are already putting their own AI chat apps as well.

For example, the LG gram I recently got came with just such an app named Chat, though the "ai button" on the keyboard (really just right alt or control, I forget which) defaults to copilot.

If there's any tension at all, it's just who gets to be the default app for the "ai button" on the keyboard that I assume almost nobody actually uses.
by satisfice | 2025-12-23 04:32:08+00:00
You may be missing the point. The author’s feeling about the plan he was sent were predicated on an assumption that he thought was safe— that his co-worker had written the document that he claimed to have “put together.”

If you order a meal at a restaurant and later discover that the chicken you ate was recycled from another diner’s table (waste not want not!) you would likely be outraged. It doesn’t matter if it tasted good.

As soon as you tell me you used AI to produce something, you force me review it carefully, unless your reputation for excellent review of your own is well established. Which it probably isn’t— because you are the kind of guy who uses AI to do his work.
by minikomi | 2025-12-23 04:32:54+00:00
An example of why a basic understanding is helpful:

A common sentiment on HN is that LLMs generate too many comments in code.

For good reason -- comment sparsity improves code quality, due to the way causal transformers and positional encoding work. The model has learned that real, in-distribution code carries meaning in structure, naming, and control flow, not dense commentary. Fewer comments keep next-token prediction closer to the statistical shape of the code it was trained on.

Comments aren’t a free scratchpad. They inject natural-language tokens into the context window, compete for attention, and bias generation toward explanation rather than implementation, increasing drift over longer spans.

The solution to comment spam isn’t post-processing. It’s keeping generation in-distribution. Less commentary forces intent into the code itself, producing outputs that better match how code is written in the wild, and forcing the model into more realistic context avenues.
by scapbi | 2025-12-23 04:34:02+00:00
Thank you, @tomhow. The quick response and the welcoming attitude from the moderators are something I personally appreciate a lot.

As I mentioned before, HN is a technology community. I hope that one day I can share only technical topics here, so we can focus the discussion on technical matters. I hope we can stand together as engineers, doing our part and taking responsibility, even if that does not fully address the root causes.
by shimman | 2025-12-23 04:34:37+00:00
Matrix lore is quite cool, if you haven't seen the Animatrix check it out. The Second Renaissance is great world building!

https://www.youtube.com/watch?v=sU8RunvBRZ8 (first part)

To answer your Q tho, this was in one of the sequels I believe, basically the first iterations of the matrix were like "Eden" but humans couldn't adapt to it so they redesigned and iterated it into what you see in the movie. The idea being that if humans weren't busy they'd realize they were enslaved so they had to make a system to keep humans occupied and stimulated enough to be useful.
by johncolanduoni | 2025-12-23 04:36:25+00:00
I don't have an issue with `unsafe` - Java has the mythical unsafe object, C# has it's own unsafe keyword, Python has ffi, etc. The title of that blog post - that there is no memory safety without thread safety - is not quite true and it acknowledges how Java, C#, and Go have strong memory safety while not forbidding races. Even the "break the language" framing seems like special pleading; I'd argue that Java permitting reading back a sheared long (64-bit) integer due to a data race does not break the language the same way writing to a totally unintended memory area or smashing the stack does, and that this distinction is useful. Java data races that cause actual exploitable vulnerabilities are very, very rare.
by corimaith | 2025-12-23 04:36:43+00:00
>Of course the point is to clamp down on figures Beijing doesn't like

Tldr, its just full throated authoritarianism where I define local figures I don't like as "NSC" despite being no real threat to China while actual foreign intelligence just handshakes out of sight. What did I say about effectiveness?

>brought national terrorism to basically 0, how many school shootings have the very useful security checks in US

National Terrorism is 0 in Hong Kong and Asia in general. Let's not pretend that anybody actually believes those prevent attacks as they are political grifting, or it speaks more to unique CCP policies that they have a terrorism problem that other East Asians don't have.

>Revealed preference has a mainland bias.

You mean taking advantage of currency rates for cheaper lunch? That's not really "getting shit done" as it is a "big problem" for China as part of wider systemic involution.

>PRC hands off with HK.

So you agree then it's just full blown authoritarianism with no real benefit.
Show HN: A smile filter that adds a natural-looking smile
by minimk | 2025-12-23 04:36:59+00:00
Hi HN — I made a small browser tool that adds a subtle, natural-looking smile to portrait photos.

Why: I often needed a quick “smile version” for profile pics and headshots without manually retouching.

How it works: upload a photo → choose a smile style/strength → generate → download.

Limits: best results with a clear, front-facing face; strong side angles or heavy occlusion can look off.

I’d love feedback on realism (teeth/cheeks/eyes), and any failure cases you notice.
by minimk | 2025-12-23 04:38:39+00:00
Hi all — maker here.
A few details that may help when testing:

Best input: clear, front-facing portrait, good lighting, minimal occlusion.

Failure cases I’m working on: strong side angles, hands/objects covering the mouth, heavy facial hair, motion blur.

If you notice anything uncanny (teeth, lip edges, cheek folds, eye area), please mention the photo type and what looks off.

Happy to answer questions and share what I’m doing to improve realism.
by xp84 | 2025-12-23 04:39:16+00:00
In my own university days, I was once walking into the apartment building when some maintenance men called me over. (This building was part student housing and part normal families). They pointed me to a TV set in an apartment. Apparently a family had abandoned it. It was a big 27” or so set with some weird geometry problems, no visible brand, and menus exclusively in Chinese. Thankfully we had an elevator! I was pretty stoked despite the weird pincushion effects (maybe side effect of being imported from at least 100° of longitude away??) because our apartment’s only TV was a 13” which looked funny in a comically big living room.
by reaperducer | 2025-12-23 04:39:19+00:00
But I’m stuck getting several email notifications a day from them.

I have a cellular hotspot with a phone number apparently recycled from someone who still has it tied to a fintech account (Venmo, or something similar). Every time this person makes a purchase, my hotspot screen lights up with an inbound text message notification.

This person makes dozens of purchases each day, but unlike my previous hotspots, this one does not have a web interface that allows me to log in and see the purchase confirmations. All I get to see is "Purchase made for $xx.xx at" on the tiny screen several dozen times a day.
by kelseyfrog | 2025-12-23 04:39:32+00:00
I give up.

Just work seven days a week, 12 hour days, and on call every moment. Die 20 years early from stress, anxiety, and depression. Burn out and end up in the hospital. Be meat for the grinder.

Meanwhile, I'm going to shut my laptop closed at 5pm, never installed Slack on my phone, and if someone needs me, they can show up to my house and ring the bell if it's that important. Good luck.
by locknitpicker | 2025-12-23 04:39:57+00:00
> What can go wrong? Yikes..

The post is clearly aimed at self-promotion. The guy is basically referring to mundane things like using transpilers to generate Rust from C. Those have been around for a few years now, such as C2Rust[1]. At best, this sort of project is looking for corporate backing to politically handle this sort of migration.

At this point this sort of stunt is hardly technical, and instead it's something between a publicity stunt and managing technical debt.

[1] https://c2rust.com/
by jacknews | 2025-12-23 04:41:27+00:00
This sounds like the future to me.

For example, you tell the AI you're looking to buy an apartment, show some options.

It'll spin up an interactive map with layers of prices, amenities, etc.

Ask it to warp the map projection to show walk-times to metro stations, and it's do that.

Ask it to add some sliders for price range, walk-distance, 'social class', etc.

Ask to book viewings and it'll spin up a calendar, and web form (if it needs more information from you), and then send emails or fill agency booking forms with that data.

All highly personalized, created for the moment, and potentially disposable.
by libraryofbabel | 2025-12-23 04:41:53+00:00
I suppose I actually agree with you, and I would give the same advice to junior engineers too. I've spent my career going further down the stack than I really needed to for my job and it has paid off: everything from assembly language to database internals to details of unix syscalls to distributed consensus algorithms to how garbage collection works inside CPython. It's only useful occasionally, but when it is useful, it's for the most difficult performance problems or nasty bugs that other engineers have had trouble solving. If you're the best technical troubleshooter at your company, people do notice. And going deeper helps with system design too: distributed systems have all kinds of subtleties.

I mostly do it because it's interesting and I don't like mysteries, and that's why I'm relearning transformers, but I hope knowing LLM internals will be useful one day too.
Show HN: Efpix – A flood protocol with E2EE and metadata protection
by shinymonitor | 2025-12-23 04:44:29+00:00
I wrote a protocol and C implementation for communication in "zero-infrastructure" and high-adversity environments.

EFPIX (Encrypted Flood Protocol for Information eXchange) is a topology-agnostic flood-type relay protocol that also achieves end-to-end encryption, plausible deniability for users, untraceability of messages, spam resistance and other optional features. It is designed for environments where you cannot trust the network topology or network participants. Unlike Tor or I2P, it doesn't rely on stable circuits or central directories.

Use cases:
- Space, research, military, or other remote networks where the existence and maintenance of a server is not feasible
- Disaster zones where network infrastructure was lost
- Authoritarian Regimes for whistleblowing, journalism and activism where communication is surveilled and censored
- Broadcasts like emergency rescue calls, disaster warnings, and news distribution

I have written a whitepaper (use case + motivation, encoding + decoding algorithm, optional enchancements, threat analysis, comparison with other protocols, etc.). I am looking for feedback.

AMA.

Whitepaper: https://arxiv.org/abs/2509.08248
Implementation: https://github.com/shinymonitor/libefpix
Blog: https://shinymonitor.github.io/projects.html
by array_key_first | 2025-12-23 04:46:00+00:00
A lot of this stuff happens at a level above the legal system - no amount of juries will save you. Thats one of the troubles with putting off essential shit to the private sector. The private sector is almost the wild west. We have EULAs and terms of service, so basically nothing.

My credit example is actually giving the opponents too much credit here. The bureaus are kinda government. Even that is better!
by sumedh | 2025-12-23 04:46:12+00:00
When I click on Subscribe on any of the plan, nothing happens. I see this error on Dev Tools.

page-3f0b51d55efc183b.js:1 Uncaught TypeError: Cannot read properties of undefined (reading 'toString')
at page-3f0b51d55efc183b.js:1:16525
at Object.onClick (page-3f0b51d55efc183b.js:1:17354)
at 4677-95d3b905dc8dee28.js:1:24494
at i8 (aa09bbc3-6ec66205233465ec.js:1:135367)
at aa09bbc3-6ec66205233465ec.js:1:141453
at nz (aa09bbc3-6ec66205233465ec.js:1:19201)
at sn (aa09bbc3-6ec66205233465ec.js:1:136600)
at cc (aa09bbc3-6ec66205233465ec.js:1:163602)
at ci (aa09bbc3-6ec66205233465ec.js:1:163424)

A bit weird for an AI coding model company not to have seamless buying experience
by mcpeepants | 2025-12-23 04:46:55+00:00
This works:

$ZAI_ANTHROPIC_BASE_URL=xxx
$ZAI_ANTHROPIC_AUTH_TOKEN=xxx

alias "claude-zai"="ANTHROPIC_BASE_URL=$ZAI_ANTHROPIC_BASE_URL ANTHROPIC_AUTH_TOKEN=$ZAI_ANTHROPIC_AUTH_TOKEN claude"

Then you can run `claude`, hit your limit, exit the session and `claude-zai -c` to continue (with context reset, of course).
by gfody | 2025-12-23 04:47:26+00:00
"structured query language" is actually a backronym, SEQUEL is indeed a programming language and the only mainstream 4GL. consider the output of the compiler (query planner) is a program with specific behavior, just that your sql code is not the only source - the other inputs are the schema and its constraints and statistics. it's an elegant way to factor the sourcecode for a program, I wonder if Raymond Boyce didn't die young what kind of amazing technology we might have today.