MurphyA/hacker-news huggingface dataset:
by decafninja | 2026-01-23 19:29:09+00:00
Based on my rather limited knowledge of French politics, isn’t Macron and his coalition supremely unpopular and just one election away from losing the country to factions that have a distinctly different vision of Europe and France’s role within? Including distancing itself from any pan-European entities and presenting a friendlier face to Russia?

Seems like the current French government and many decisions they make between now and then would be lame-ducky and be taken with a grain of salt.
by volkercraig | 2026-01-23 19:29:20+00:00
Is it though? Think about being a musician 200 years ago. In 1826 you needed to essentially be nobility or nobility-adjacent just to be able to touch an instrument let alone make a living from it. 100 years later, 1926 the barrier to entry was still sky high, nobody could make and distribute recordings without extensive investment. Nowadays it's not uncommon for a 17 year old to download some free composer software, sign up for a few accounts and distribute their music to an audience of millions. It's not easy to do, sure, but there is still opportunity that never existed. If you were to take at random a 20 year old from the general population in 1826, 1923, 1943, 1953, 1973, 83, etc, would you REALLY say that any of them have a BETTER opportunity than today?
by dfajgljsldkjag | 2026-01-23 19:29:25+00:00
> According to the House Clerk’s official roll call, 160 Republicans supported [killing the mandate], joined by four Democrats, while 57 Republicans and 211 Democrats voted against it.

I usually support the Democrats because I think they want to protect our rights. It is very sad to see them vote for something that creates such a big security hole in our cars. If you build a special way for the government to stop a car then the hackers will find a way to use it too. I wish my party understood that you cannot have a safe back door that only the good guys can use.
by basetwojesus | 2026-01-23 19:29:31+00:00
I def get it, but it just seems like a fight not worth fighting anymore, at least not in the areas I work I guess. I work in my languages' type system first and rely on things like serde when some sort of conversion is necessary. If I suddenly got told to switch from JSON to XML for some upstream API it would be annoying but still firmly in the "solved problem" territory. I guess I'm saying use whatever interchange formats you have to and maintain the primacy of your internal type definitions

I'm sure there are plenty of arenas where this doesn't make as much sense but I suspect it's common
by amiga386 | 2026-01-23 19:30:07+00:00
The Scottish court system uses Royal Mail Signed For to send citations, I believe it makes two attempts to deliver, and won't consider the citation delivered unless the named addressee signs for it.

...on the other hand, if you don't respond to citations e.g. for a criminal case, they might then escalate by issuing a warrant for your arrest.

Looking at the English civil courts, I'm having trouble parsing their rules:

https://www.justice.gov.uk/courts/procedure-rules/civil/rule...

My reading is that either the court sends the summons (claim form) and comes to its own conclusion if it has been served or not, but if you choose to do it or have a process server do it, you have to submit a certificate of service to the court. If you do that, all it says they require is the method and date you sent it, no proof it got delivered!

Furthermore, rule 6.18 says that if the court posts the claim form itself, it will inform you if the form is returned to them undelivered... but will deem it "served" anyway, provided you gave them the correct address?
by nancyminusone | 2026-01-23 19:30:11+00:00
I'll always remember - when I was first learning about it, one of the interesting counter-arguments to ignoring privacy was "what if the Nazis come back, would you want them to have your data?". I suppose there's some debate these days, but hostile governments seem a lot closer than they were 10-15 years ago.

Will this make people care? Probably not, but you never know.
Show HN: Instagram: Private Posts Exposed to Unauthenticated Requests
by jatin-dot-py | 2026-01-23 19:30:11+00:00
Author here.

I released this disclosure today regarding a server-side authorization bypass I found in Instagram.

The Vulnerability:
By sending a GET request to [instagram.com/](http://instagram.com/)<private_username> with specific mobile headers, the server returned the full polaris_timeline_connection JSON object containing direct CDN links to private posts, captions, and media. No login or follower relationship was required.

The Timeline & Contradiction:

- Oct 12: I reported the issue, with a video, poc script, and testing on my account [jatin.py](http://jatin.py/)
- Oct 14: Meta requested specific vulnerable accounts to test. I provided a consenting third-party account where the POC script successfully extracted 30 private URLs.
- Oct 16: The exploit stopped working on the accounts where it was previously working.
- Oct 27: Meta closed the report as "Not Applicable," stating they "could not reproduce" the issue and that "no changes were made directly in response".

The Current State:
While the exploit no longer functions on the accounts I tested, Meta officially maintains the bug never existed. They attributed the change in behavior to "infrastructure changes" or "unintended side effects".

Without a root cause analysis or acknowledgment from Meta, it is impossible to confirm if the underlying authorization failure was actually patched or if this was an accidental fix that could regress.

The repository contains the POC script poc.py , SHA256 hashes of the video evidence, and the full logs of the communication.
by hyperpape | 2026-01-23 19:30:19+00:00
My background is in philosophy, though I am a programmer, for what it is worth. I think what I'm saying is subtly different from "black and white thinking".

The final answer can be "each of these positions has merit, and I don't know which is right." It can be "I don't understand what's going on here." It can be "I've raised some questions."

The final answer is not "the final answer that ends the discussion." Rather, it is the final statement about your current position. It can be revised in the future. It does not have to be definitive.

The problem comes when the same article says two contradictory things and does not even try to reconcile them, or try to give a careful reader an accurate picture.

And I think that the sustained argument over how to read that article shows that Yegge did a bad job of writing to make a clear point, albeit a good job of creatring hype.
by jbstack | 2026-01-23 19:30:26+00:00
You only have to run through a modern Windows installer to understand how screwed you are if you install it. Last time I did this for a disposable Windows VM (a couple of years ago) I remember having to click through a whole bunch of prompts asking about all the different types of data Microsoft wanted my computer to send them. Often the available answers weren't "yes" or "no" but more like "share all data" vs "share just some data". After that I recall being forced to sign up for an outlook account just to create a local login unless I unplugged my network cable during the install. I've heard they have closed that loophole in recent installers.

I'd already long since migrated away from Windows but if I'd been harbouring any lingering doubts, that was enough to remove them.
by n_u | 2026-01-23 19:30:29+00:00
I see what you are saying, perhaps no matter the conversation before as long as it doesn't filter out some products via personalized filters (e.g. dietary restrictions) it will always give the same answers. But I do feel the value prop of these AI chatbots is that they allow personalization. And then it's tough to know if 50% of the users who would previously have googled "best running shoes" instead now ask detailed questions about running shoes given their injury history etc and that changes what answers the chatbot gives.

I feel like without knowing the full distribution, it's really tough to know how many/what variations of the query/conversation you need to sample. This seems like something where OpenAI etc. could offer their own version of this to advertisers and have much better data because they know it all.

Interesting problem though! I always love probability in the real world. Best of luck, I played around with your product and it seems cool.
by almostlikemagic | 2026-01-23 19:30:42+00:00
it's an economic problem, not a technical one, imo.

unfortunately, we no longer live in an economic environment that supports being able to run a stable business that way. if cost of living were still relatively stable/affordable/predictable? sure.

i would love to see everyone go back to this model, but sadly i don't see that happening unless the person offering it is independently wealthy/comfortable by other means.
by jampa | 2026-01-23 19:30:48+00:00
Slightly off topic, but does anyone feel that they nerfed Claude Opus?

It's screwing up even in very simple rebases. I got a bug where a value wasn't being retrieved correctly, and Claude's solution was to create an endpoint and use an HTTP GET from within the same back-end! Now it feels worse than Sonnet.

All the engineers I asked today have said the same thing. Something is not right.
by joshstrange | 2026-01-23 19:30:59+00:00
> Keep in mind that Steve has LLMs write his posts on that blog.

Ok, I can accept that, it's a choice.

> Things said there may not reflect his actual thoughts on the subject(s) at hand.

Nope, you don't get to have it both ways. LLMs are just tools, there is always a human behind them and that human is responsible for what they let the LLM do/say/post/etc.

We have seen the hell that comes from playing the "They said that but they don't mean it" or "It's just a joke" (re: Trump), I'm not a fan of whitewashing with LLMs.

This is not an anti or pro Gas Town comment, just a comment on giving people a pass because they used an LLM.
by lorenzleutgeb | 2026-01-23 19:31:33+00:00
> I keep thinking about people putting secrets up in github.

You gave me an idea. For Radicle, we implemented a `git-remote-helper` (Git recognizes `rad://`-URIs and then wakes up the helper to handle the rest). This helper could well look at the blobs being pushed and detect secrets. Then error out and request a retry with `--force` if the user is sure.

To implement something like this, we'd not want to reinvent the wheel, so we'd want to consume some description of patterns that we should look for. And obviously we're not going to ask GitHub or some web server.

So, is there such library? In a format that is simple-ish to implement filtering for but also catches a good amount of secrets?
by paulhebert | 2026-01-23 19:31:49+00:00
I tried using Claude Code this week because I have a free account from my work.

However when I try to log in via CLI it takes me to a webpage with an “Authorize” button. Clicking the button does nothing. An error is logged to the console but nothing displays in the UI.

We reached out to support who have not helped.

Not a great first impression
by UncleEntity | 2026-01-23 19:31:59+00:00
Been working on the design of an optimizer for my APL VM and asked Claude how this would fit in (as we don't have Dyalog extensions):

The pattern is:

f⌿ X ∘.g Y

Where f is an associative reduction and g is a comparison. iBurg could recognize this tree shape and apply rewrites based on operator properties:
┌─────────┬───────────────────────────────────┐
│ Pattern │ Optimization │
├─────────┼───────────────────────────────────┤
│ +⌿X∘.≤Y │ Binary search count (if X sorted) │
├─────────┼───────────────────────────────────┤
│ +⌿X∘.=Y │ Histogram / count matches │
├─────────┼───────────────────────────────────┤
│ ∨⌿X∘.=Y │ Membership (hash lookup) │
├─────────┼───────────────────────────────────┤
│ ∧⌿X∘.<Y │ All-less-than (single comparison) │
└─────────┴───────────────────────────────────┘
The generic rules would be:
1. Shape rule: f⌿X∘.gY avoids materializing n×m matrix if f and g have algebraic properties that allow streaming/early-exit
2. Sortedness rule: If X is sorted and g is monotonic (≤, <, ≥, >), use binary search
3. Associativity rule: If f is associative (+, ∨, ∧, ⌈, ⌊), can process in chunks or parallel

The cost model decides when O(n log m) binary search beats O(n×m) outer product -typically when both n and m exceed some threshold.

iBurg is the Bottom-Up Rewrite System (BURS) based optimizer to operate over the continuation graphs the parser spits out, not sure where the 'i' part came from though...
by program_whiz | 2026-01-23 19:32:13+00:00
Perhaps this is a helpful model, rather than worrying about the "billions spent" and whether its inference vs training.

How much would it cost you to deploy a model that you and maybe a few coworkers could effectively use? $400k probably to buy all the hardware required to host a top-tier model that could do a few hundred tokens per second for 10 concurrent users? That's $40k per person. Ammortize the hardware over 5 years, thats $8k per person per year (roughly), with no training costs (that's just you buying hardware and running it yourself). So that means, you need ~$800 per user monthly just to cover hardware to run the model (this is with no staffing costs, internet, taxes, electricity, hosting, housing, etc).

So just food for thought, but $200 claude code is probably still losing money even just on inference.

Since they are in the software realm, they are probably shooting for a 90% profit margin. Using the above example, it would be ($800 + R&D + opex) x 10. My guess is assuming no more training (which probably can never be profitable at current rates), they need $20k per month per user, which is why that number was floated by OpenAI previously.
by celsoazevedo | 2026-01-23 19:32:23+00:00
> A good critique for example is OVH lost a lot of customer data due to a fire. Where was the redundancy? That would make me think twice before switching to OVH.

I lost a VPS in that fire, but I was up and running a few hours later with a new VPS at a different OVH location.

Not to deflect blame away from OVH and their large screw up, but we should never rely only on the redundancy of the hosting provider. Even on AWS, I wouldn't trust them to not lose my data if one of their datacenters burns down.

At the time I was making regular backups to two different providers with servers somewhere else. When I noticed that it was serious, I ordered a new VPS and restored everything. If OVH itself went down, I could have used Scaleway, Hetzner, Contabo, etc.
by kemayo | 2026-01-23 19:32:30+00:00
Here's a representative news article about it (WaPo because they were first in the search results): https://www.washingtonpost.com/immigration/2026/01/22/ice-me... (paywall-avoiding: https://archive.is/bsdv9)

They've come up with a memo saying that non-judicial warrants can let them break in. This has historically been very much not allowed.

Edit: As a quick explanation, this is more or less a separation-of-powers thing. The rule has been that for the executive to enter someone's home they need a warrant from a judge, a member of the judicial branch. They now say that an "administrative warrant" is enough, issued by an immigration judge -- but immigration judges are just executive branch employees, so this is saying that the executive can decide on its own when it wants to break into your house.
by happymellon | 2026-01-23 19:32:51+00:00
> and I unticked the launch apps on restart.

I do untick it. It's a bug that happens with every restart.

I'll have a go with setting the defaults, I'm wondering if there was a file it writes out open applications to (to trigger on restart) that has somehow become corrupted and therefore doesn't get cleared.

Do you know where MacOS stores the list to reopen?
by citizenpaul | 2026-01-23 19:32:57+00:00
This actually is a good summary of my theory of AI. The best use case for AI is replacing management. Thats the real reason AI is floundering right now with making money. The people in charge would literally need to admit that they are basically no longer needed and act accordingly.

This of course will never happens so instead those in power will continue to try to shoehorn AI into making slaves which is what they want, but not the ideal usage for AI.
Show HN: A tiny JavaScript library for content origin metadata (no truth claims)
by dheerazmakes | 2026-01-23 19:33:00+00:00
This is a small, client-side JavaScript library that surfaces content origin metadata already present in HTML (author, source, date, type).

It does not verify truth, authenticity, or trustworthiness.
It only displays declared origin information in a consistent, accessible way.

The goal is to make origin more visible without making claims about correctness.

Features:
- Zero configuration by default
- Client-side only (no network calls)
- Keyboard-accessible overlay
- Optional visual “verified” styling (purely cosmetic)
- Designed to be ignorable unless needed

This started as an experiment in restraint: adding transparency without authority.

Demo: https://originjs.netlify.app/
Code: https://github.com/dheeraz101/OriginJS

Feedback welcome, especially on UX, wording, and failure modes.
by boringg | 2026-01-23 19:33:12+00:00
Oh is this whats been happening? I've been trying to ask question on a fairly long context window and history -- but it fails. No response it kind of acknowledges it received the input but then reprints the last output and then that whole dialogue is essentially dead ... same issue? Happened multiple times - quite frustrating.

Just a pro sub - not max.

Most of the time it gives me a heads up that I'm at 90% but a lot of the times it just failed, no warning, and I assumed it was I hit max.
by diego_moita | 2026-01-23 19:33:22+00:00
This isn't even about Microsoft or BitLocker. This is about the U.S.A.: anyone who thrusts the rule of law in the U.S. is a fool.

Yes, the American government retrieves these keys "legally". But so what? The American courts won't protect foreigners, even if they are heads of state or dictators. The American government routinely frees criminals (the ones that donate to Republicans) and persecutes lawful citizens (the ones that cause trouble to Republicans). The "rule of law" in the U.S. is a farce.

And this is not just about the U.S. Under the "five eyes" agreement, the governments of Canada, UK, Autralia and New Zealand could also grab your secrets.

Never trust the United States. We live in dangerous times. Ignore it at your own risk.
by Wojtkie | 2026-01-23 19:34:20+00:00
It doesn't help that it seems like society has been trending to reward individuals with a lack of shame. Fortune favors the bold, that is.

Think of a lot of the inflammatory content on social media, how people have made whole careers and fortunes over outrage, and they have no shame over it.

It really does begin to look like having a good sense of shame isn't rewarded in the same way.
by belval | 2026-01-23 19:34:31+00:00
Internally maybe, but Trump has a way to trigger large political movements within countries.

Canada was supposed to have a large (historically large) conservative government 3 months before the latest elections, but with Trump in the white house people suddenly want to move away from the right, it's a very interesting effect.

https://www.nytimes.com/2025/05/04/world/canada/global-elect...

It's not impossible that we will see something similar happen across Europe.
by iamnothere | 2026-01-23 19:34:35+00:00
Also, federal highways are partially a national security issue, and are designed for quickly moving military equipment across otherwise isolated areas. Guidelines for federal interstates are specified jointly with the DoD to ensure that military transport can fit under bridges, and that bridges can support their weight. Industry is the other most important user, while individual consumers/families are the least considered users.

Everyone always assumes that individual choices and consumer behavior drives this stuff, and then they wonder why nothing changes even though we all started using reusable tote bags and LED bulbs. Stop blaming the consumer!

(The DoD is the largest institutional polluter in the world, by the way.)
by ragall | 2026-01-23 19:35:14+00:00
That was true a few years ago, but not any more. Covid made a lot of US-based companies sack local developers and actually open offices in Europe. I have friends in Italy who, between 2022 and 2023, moved from local companies to US companies opening offices in Rome and Milano, and got a salary bump from ~30-35k to 80-90k plus bonus and RSUs. Same thing happening all over Europe.
by ungovernableCat | 2026-01-23 19:35:16+00:00
European leaders fundamentally have no issue with Americans dominating tech and were happy to have their entire digital infrastructures rely on US companies. If the Trump admin could give them some sort of nod behind the scenes that all of this is just a big show and they're not actually going to break NATO or invade or w/e insane shit they're saying I guarantee you a sizeable amount would just say hey no worries then let's keep the status quo going.

But that's not what's happening. It's a clear and obvious security risk to their sovereignty. If the government can't guarantee that to its citizens then what even is its purpose? The Trump admin has already tried to use American tech dominance as leverage.

Ask yourself this question, what if there was a foreign tech competitor that managed to scale up to be basically a better cheaper AWS. Would the US government ever allow it to encroach its market to the point that AWS or Azure did in Europe? Look at what happened to tiktok if you want to see what approach they'd likely take.

So how exactly would you envision an objective and neutral provider in a world of geopolitical competition?
by dgrunwald | 2026-01-23 19:35:32+00:00
> make sure not to sign into your Microsoft account or link it to Windows again

That's not so easy. Microsoft tries really hard to get you to use a Microsoft account. For example, logging into MS Teams will automatically link your local account with the Microsoft account, thus starting the automatic upload of all kinds of stuff unrelated to MS Teams.

In the past I also had Edge importing Firefox data (including stored passwords) without me agreeing to do so, and then uploading those into the Cloud.

Nowadays you just need to assume that all data on Windows computers is available to Microsoft; even if you temporarily find a way to keep your data out of their hands, an update will certainly change that.
by eterm | 2026-01-23 19:35:36+00:00
That is a well recognised part of the LLM cycle.

A model or new model version X is released, everyone is really impressed.

3 months later, "Did they nerf X?"

It's been this way since the original chatGPT release.

The answer is typically no, it's just your expectations have risen. What was previously mind-blowing improvement is now expected, and any mis-steps feel amplified.
by kstrauser | 2026-01-23 19:35:37+00:00
I am so glad people are finally noticing and complaining about this. It's the same reason I won't use Spark or Superhuman. Those are neat services, but I can't abide storing the creds to perhaps the most security-sensitive service I use to a cloud provider. If they get hacked, then the attacker can access my email account, send phishing emails to my contacts, read and respond to password reset requests they make to other online services, etc. It would be disastrous.

No, I'll keep my credentials stored and used locally, thanks.