MurphyA/hacker-news huggingface dataset:
by Muromec | 2026-01-19 23:27:22+00:00
Because the door being open makes it possible for opportunistic thieves and even kids to steal something. If the police knocks on it, it's actually better to open it. Otherwise they will still get in, but you will also not have door after that.

With phone interception, I can't imagine any other actor being sophisticated enough to bother with setting up the stringray thingy. Maybe something very targeted to get somebody very special (having a hot wallet with 20 bitcoins and going around the city with it comes to mind), but I would still expect the simplier methods there too.

Add: Even with the normal HTTP traffic, mitming was way more common and more practically exploitable back in the day, just by setting up a rogue wifi AP and fishing for passowrds. I'm not sure it was ever a thing with stringrays when non-government actors did something with them.
by jrochkind1 | 2026-01-19 23:27:26+00:00
> I assume some tests at least broke that meant they needed to be "fixed up"

OP said:

"However, we did not have any tests asserting the behavior remains consistent due to the ambiguous language in the RFC."

One could guess it's something like -- back when we wrote the tests, years ago, whoever did it missed that this was required, not helped by the fact that the spec proceeded RFC 2119 standardizing the all-caps "MUST" "SHOULD" etc language, which would have helped us translsate specs to tests more completely.
by asdff | 2026-01-19 23:27:27+00:00
If we consider other fields such as biology, behaviors of interest are specified but I'm not sure a formal language is currently being used per say. Data are evaluated on dimensional terms that could be either quantitative or qualitative. meta analysis of some sort might be used to reduce dimensionality to some degree but that usually happens owing to lack of power for higher resolution models.

One big advantage of this future random walk paradigm is you would not be bound by the real world constraints of sample collection of biological data. datasets could be made arbitrarily large and cost to do so will follow an inverse relationship with compute gains.
by herczegzsolt | 2026-01-19 23:27:37+00:00
It probably wouldn't trigger, because of the 2nd criteria:

> The alert is not triggered immediately: it takes 8 hours during the day, 30 mins at night, and ...

But the warning system is by no means perfect. My family is split 50-50 between iOS and Androd ecosystems, and that's already enough to throw things off and get false positives semi-regularly.

Also, don't even ask the curriers how many alerts they get. Including airtags in valuable shipments is the de-facto standard nowdays.
by potato3732842 | 2026-01-19 23:28:06+00:00
It was mostly a joke, since these sorts of groups have always, like going back 40+yr, been magnets for law enforcement who always seem to push them to do illegal things.

Second, the incident I'm referencing is well documented. You should look it up. It's basically the "feds radicalize then arrest muslim man, pat themselves on back for catching terrorist" playbook but for white people.
by rayiner | 2026-01-19 23:28:15+00:00
> What America got, by being the heavyweight in NATO, was the greatest economy the world has ever seen. America got rich by selling Europe a nuclear umbrella

But this just isn’t true! The U.S. overtook the UK in per capita GDP in 1880, near the peak of the British Empire: https://unchartedterritories.tomaspueyo.com/p/us-gdp-per-cap...

If you look at GDP growth rate, the US has consistently averaged 1.7% GDP per capita growth over the past 200 years. The mass industrialization during the war itself spike growth and helped recovery from the Great Depression, but America didn’t grow dramatically faster during the NATO era than it did before that.
by Dylan16807 | 2026-01-19 23:28:16+00:00
> You say "the vast majority

I put an "if" on vast majority. I put confidence on "very common".

> The original claim upthread was that the law is rarely applied justly. You've now moderated that

> Disagreed that this means the system is unjust more often than just, which was the original claim.

Well again, if you tell me which specific comment you mean then I'll address that specific comment.

> But that's not the same as "the system is fundamentally unjust" or "plea bargains routinely coerce false confessions." Those are the claims that sparked this entire thread, and you've now acknowledged you don't have evidence for them.

You are the only person that has used the word 'fundamentally'. And yes the plea bargain thing needs evidence but should not be rejected for lack of citations.
by torstenvl | 2026-01-19 23:28:19+00:00
> One such implementation that broke is the getaddrinfo function in glibc, which is commonly used on Linux for DNS resolution.

> Most DNS clients don’t have this issue.

The most widespread implementation on the most widespread server operating system has the issue. I'm skeptical of what the author means by "Most DNS clients."

Also, what is the point of deploying to test if you aren't going to test against extremely common scenarios (like getaddrinfo)?

> To prevent any future incidents or confusion, we have written a proposal in the form of an Internet-Draft to be discussed at the IETF. If consensus is reached...

Pretty sure both Hyrum's Law and Postel's Law have reached the point of consensus.

Being conservative in what you emit means following the spec's most conservative interpretation, even if you think the way it's worded gives you some wiggle room. And the fact that your previous implementation did it that way for a decade means people have come to rely on it.
Ask HN: How would you design for this scale today?
by phs318u | 2026-01-19 23:29:15+00:00
20 years ago I worked at a utility (electricity distribution). The government introduced a mandate to switch everyone from "basic" meters (4 data points per year, read quarterly by a human looking at a dial), to "remotely read interval meters" (48 data points per day, streamed periodocally over the day). The company had around a million meters and our data was going intake was going to jump by roughly 3.5 orders of magnitude. Key requirements: store 15 months of meter data hot/active, bill customers on time-of-use tariffs, estimate/substitute missing data (previous period lookup or guess), and (key requirement) send the meter data to the regulator and market participants within 24 hours of receipt.

The solution I came up with back in 2005 was a sharded Oracle 10g database, storing 1 read per row (controversial!) and the biggie - using Oracle Advanced Queuing to run worker jobs that could scale independently (no. of processes per queue) with a design that was basically a queue per business action (e.g. send data, aggregate consumption etc) and worker processes designed to do 1 thing - read a message off the queue (1 msg = 1 unit of work), and do its thing (if successful, write messages to other queues for downstream activity).

This all ran on a single piece of Sun hardware running Solaris, with the worker processes being either C++ applets or PL/SQL stored procs. Processed 48 million rows per-day, stored about 18 billion rows in the active table. Ran for about 10 years before being decommissioned for COTS solution.

My question is: how would such a solution be architected today? What design, what technologies etc. I am interested for my own learning (I've been working away from the pointy end of an IDE for quite some time).

Addendum: probably the only thing I wished we had done was use Oracle RAC. Instead we opted for an active-passive topology (annoyingly wasteful of an 50% of our compute).

Feel free to ask clarifying questions.
by echelon | 2026-01-19 23:29:34+00:00
If I want to get in touch with a company, I go through Google. It's not the brand's choice, it's not my choice. The brand has to pay for that. I, ultimately, also have to pay for that.

This is NOT okay. Google is using monopoly power to do this. They have inserted themselves as parasitic middle men. No different than a cymothoa exigua eating away at the tongue.

This is not advertising. It's a road bump. It's getting throttled by the mafia. It's a protection racket on people's hard-earned brands. A tax on cognition and communication.

Google is a villain here. They are not offering value or service or anything useful. They're extracting.

They're the Harvey Weinstein of the internet here -- nobody wants to do business with the guy, but he's there and he's asking you to do what he wants. You can go along, and do the thing, or you can say no and completely lose your customer.

The customer that already knows you by name. You made it this far. Now there's this gross middle man asking you to give up.

So you let Harvey Weinstein slip his hands in. Cost of doing business.

That's what Google is in this story.

This isn't advertising. It's the R-word, being perpetrated because of a lack of the other R word: healthy market regulation.

90 percent of all humans on the planet are being fleeced by this. Every time you put something into the URL bar, Google gets a piece of the action.

What I'm saying is, when these are brand names, this is theft. Highway robbery. Monopolistic pillaging.

Google needs a slap down.
by biglyburrito | 2026-01-19 23:29:39+00:00
"Before we proceed into a detailed discussion of net worth by age, we should note one glaring discrepancy in the numbers: the difference between mean and median.

The average 50-something is worth about $1.4 million, according to Empower. But that’s a mathematical average, and the super-rich drive the number way up.

The “median” 50-something – imagine the middle number in a long list of numbers – is worth a more modest $192,964."

So yeah, just a wee bit sensationalism in that headline.
by drillsteps5 | 2026-01-19 23:29:55+00:00
You got me there, I don't have one. I'm senior in my career but haven't been able to build a network that I can rely on when I'm looking for my next role, so I'm in the same boat with all of you guys and gals.

I do maintain though that cold reach out is more often harmful due to the barrier of HR/recruiting built to prevent this from happening, and you trying to go around that will likely cause trouble.

Also, when you reach out to the employees for "the referral", what does this even mean? If the person knows you, worked with you, or went to college with you, then they can refer you, but if they haven't even met you and don't even know if you're real, what are you asking them to do? "Hey boss I got this email from this guy he says he's a good fit for this role we have open, do you wanna hire him?", is that it?

DO research the company. DO research the role, the team, the manager, the environment, the toolsets, the issues they're facing. Do NOT flood people's inboxes asking for "referrals" whatever that means.
by qwertox | 2026-01-19 23:29:58+00:00
Oh wow! https://www.foto-webcam.eu/webcam/ederplan/2026/01/20/0000

And up at the top right, left to "Latest" you can skip the time back and forth at 10 minute intervals. And then jump back like 10 images, what a beauty.

You can even see Starlink satellites https://www.foto-webcam.eu/webcam/ederplan/2026/01/19/1820
by biophysboy | 2026-01-19 23:30:05+00:00
Why isn't there a job search website that forces you to adopt this targeted bet strategy? The game theory of job-hunting incentivizes both submitters and receivers to adopt inefficient practices. Why not limit applications to one per day to signal genuine interest? Then you can demonstrate skill at an in-person interview, or at your local legally-bound interview center? (my very boring sci-fi prediction)
by netsharc | 2026-01-19 23:30:31+00:00
> Bottom line:

> Yes — it is overwhelmingly likely (and effectively certain) that Obama knew he was overseeing active wars and new military escalations before he went to collect the Nobel Peace Prize.

So your "assistant" supports my reply, he was fully aware of that and acknowledged this. And in the speech you didn't read, he went into how war came as naturally as the first man, and how some wars are necessary and "just".

Indeed Ukraine is at the moment shooting back at Russian conscripts...

And since we're allowing AI responses look at the answer of my second question: https://gemini.google.com/share/57839224db00

But I'm sure you would've been a better at politicking than Obama's team!
by coppsilgold | 2026-01-19 23:30:46+00:00
Many WiFi chips can be put into monitor mode (process all the data packets it can detect over the air) and inject packets for transmissions themselves. This pathway is typically unoptimized and would offer poor bandwidth but it is enough for text and audio.

You would need root to do this, and implement your own protocol on top of it with forward error correcting codes.
by potato3732842 | 2026-01-19 23:30:50+00:00
>they'd just take a bit longer to have identified the members of the insurrection

They'd have had to enjoin more parties, probably to include state agencies. Any party can push back, stall or blow the whistle if they feel something wrong and risky to them is happening. Which is exactly the opposite of what the feds want. They want to act unilaterally, on anything and everything.
by BLKNSLVR | 2026-01-19 23:30:54+00:00
I like how, the way you've described it, it sounds as if, with the effort they go to to make ads as difficult to identify as possible, they're trying to hide their shame.

It's tacit admission that people need to be 'tricked' into thinking that the advertising is actually an organic result. It's manipulative. It's an admission of the fact that advertising actively gets in the way of the service they're (incidentally) providing that 'the people' actually find useful.

Unfortunately this is just a much longer way of saying 'you're the product'.
by hollowturtle | 2026-01-19 23:31:00+00:00
First of all natural selection doesn't happen per se, nor is controlled by some inherent mechanism, it's the by product of many factors external and internal. So the comparison is just wrong. Human engineering is an interative process not a selection. And if we want to call it selection, even though it is a stretch, we're controlling it, we the master of puppets, natural selection is anything but a controlled process. We don't select a more resistant wing, we engineer the wing with a high bending tolerance, again it's an iterative process
by azakai | 2026-01-19 23:31:15+00:00
> For example what, exactly, is a "high-utility response to harmful queries?" It's gibberish. It sounds like it means something, but it doesn't actually mean anything. (The article isn't even about the degree of utility, so bringing it up is nonsensical.)

Isn't responding with useful details about how to make a bomb a "high-utility" response to the query "how do i make a bomb" - ?
by _carbyau_ | 2026-01-19 23:31:47+00:00
My take away: apparently Cyberpunk Hackers of the dystopian future cruising through the virtual world will use GPT-5.2-or-greater as their "attack program" to break the "ICE" (Intrusion Countermeasures Electronics, not the currently politically charged term...).

I still doubt they will hook up their brains though.
by walterfreedom | 2026-01-19 23:33:17+00:00
Hey, I wrote here about my FelWorld mod series, where I wished to turn RimWorld into an RPG game a few months ago (https://news.ycombinator.com/item?id=45921896#45921995). I couldn't release the FelQuest Module, that would be responsible with generating quests and world content overall yet, but as a start I could create my FelPawns mod, which makes you the main character, and allow you to talk to other pawns (LLM, RAG, Tool call setup). I wished to share it here too, as some people commented on the other thread before ^^
by dfajgljsldkjag | 2026-01-19 23:33:35+00:00
I was under the impression that once you have a vulnerability with code execution, writing the actual payload to exploit it is the easy part. With tools like pentools and etc is fairly straightforward.

The interesting part is still finding new potential RCE vulnerabilities, and generally if you can demonstrate the vulnerability even without demonstrating an E2E pwn red teams and white hats will still get credit.
by Aurornis | 2026-01-19 23:33:51+00:00
> I'm sure the governments can ultimately control things

In the US there is free speech protecting the ability of people to say what they want.

Public TV has limitations on broadcast of certain material like pornography, obviously, but the government can’t come in and “control” the opinions of journalists and newscasters.

The current US admin has tried to put pressure on broadcasters it disagrees with and it’s definitely not a good thing.

You really do not want to encourage governments to “control” what topics cannot be discussed or what speech is regulated. Sooner or later the government will use that against someone you agree with for their own power.
by IanCal | 2026-01-19 23:34:20+00:00
A few points:

1. I think you have mixed up assistance and expertise. They talk about not needing a human in the loop for verification and to continue search but not about initial starts. Those are quite different. One well specified task can be attempted many times, and the skill sets are overlapping but not identical.

2. The article is about where they may get to rather than just what they are capable of now.

3. There’s no conflict between the idea that 10 parallel agents of the top models can mostly have one that successfully exploits a vulnerability - gated on an actual test that the exploit works - with feedback and iteration BUT random models pointed at arbitrary code without a good spec and without the ability to run code, and just run once, will generate lower quality results.
by execveat | 2026-01-19 23:34:43+00:00
Defenders have threat modeling on their side. With access to source code and design docs, configs, infra, actual requirements and ability to redesign / choose the architecture and dependencies for the job, etc - there's a lot that actually gives defending side an advantage.

I'm quite optimistic about AI ultimately making systems more secure and well protected, shifting the overall balance towards the defenders.
by slg | 2026-01-19 23:34:55+00:00
>and then prioritize for outrage and emotionalism

This isn’t inherent to social networks though. It is a choice by the biggest social media companies to make society worse in order to increase profits. Just give us a chronological feed of the people/topics we proactively choose to follow and much of this harm would go away. Social media and the world were better places before algorithmic feeds took over everything.
by Muromec | 2026-01-19 23:35:12+00:00
What is the point of stringrays anyway? It's a thing that exists, so I believe it does something, but I can't figure out what exactly.

They can go through the area, catch a whole bag of IMSIs and then.... what? What capability does it enable? Knowing when a certain person of interest shows up in a certain locality? Can't they get it from the phone company without a warrant anyways, just by asking nicely? If it's not targeted, what the data is even used for theoretically?
by mparlane | 2026-01-19 23:35:20+00:00
Yes, sadly they are legitimate emails so its hard to block them. The problem seems to be on zendesk side where they are accepting any email as the source of the ticket and simply replying to that email with the contents of the ticket.

Apparently they are well aware of this problem since at least last year:

https://support.zendesk.com/hc/en-us/articles/9833274501786-...
by thorum | 2026-01-19 23:35:27+00:00
Developed by Jordan Hubbard of NVIDIA (and FreeBSD).

My understanding/experience is that LLM performance in a language scales with how well the language is represented in the training data.

From that assumption, we might expect LLMs to actually do better with an existing language for which more training code is available, even if that language is more complex and seems like it should be “harder” to understand.
by frzen | 2026-01-19 23:35:38+00:00
I had the most intensely coloured lights visible in the west of Ireland. I've seen them a few times before but never like this. Phones were capturing them in video not just long exposures.

Not sure what the best service is to be alerted ahead of time. Apparently it'll be strong here again at 6am according to some of the apps some random people were waving around.
by black3r | 2026-01-19 23:36:21+00:00
> 4. Ends up in test environment for, what, a month.. nothing using getaddrinfo from glibc is being used to test this environment or anyone noticed that it was broken

"Testing environment" sounds to me like a real network real user devices are used with (like the network used inside CloudFlare offices). That's what I would do if I was developing a DNS server anyway, other than unit tests (which obviously wouldn't catch this unless they were explicitly written for this case) and maybe integration/end-to-end tests, which might be running in Alpine Linux containers and as such using musl. If that's indeed the case, I can easily imagine how noone noticed anything was broken. First look at this line:

> Most DNS clients don’t have this issue. For example, systemd-resolved first parses the records into an ordered set:

Now think about what real end user devices are using: Windows/macOS/iOS obviously aren't using glibc and Android also has its own C library even though it's Linux-based, and they all probably fall under the "Most DNS clients don't have this issue.".

That leaves GNU/Linux, where we could reasonably expect most software to use glibc for resolving queries, so presumably anyone using Linux on their laptop would catch this right? Except most distributions started using systemd-resolved (most notable exception is Debian, but not many people use that on desktops/laptops), which is a locally-cached recursive DNS server, and as such acts as a middleman between glibc software and the network configured DNS server, so it would resolve 1.1.1.1 queries correctly, and then return the results from its cache ordered by its own ordering algorithm.
by HarHarVeryFunny | 2026-01-19 23:37:10+00:00
That "nest of objects point to each other" makes no sense ... RAII is just a technique where you choose to tie resource management to the lifetime of an object (i.e. acquire in constructor, release in destructor).

If an exception gets thrown, causing your RAII object scope to be exited, then no problem - the object destructor gets called and the resource gets released (this is the entire point of RAII - to make resource allocation and deallocation automatic and bullet-proof).

If you are creating spaghetti-like cross-referencing data structures, then that is either poor design or something you are doing deliberately because you need it. In either case, it has nothing to do with RAII, and RAII will work as normal and release resources when the managing object is destroyed (e.g. by going out of scope).

RAII could obviously be used to allocate/free a resource (e.g. temp buffer) from a free list, but is not really relevant to arena allocation unless you are talking about managing the allocation/release of the entire arena. The whole point of an arena allocator is the exact opposite of RAII - you are deliberately disconnecting individual item allocation from release so that you instead do a more efficient bulk (entire arena) release.
by hollowturtle | 2026-01-19 23:37:22+00:00
I said "being it open source or by innovating" eg Google innovated and killed many, also contributed a lot to open source. Android is a Linux success, ChromeOS too. Now Google stinks and it is not innovating anymore, except for when other companies, like OpenAI, come for their lunch. Google was caught off guard but eventually catching up. Sooner or later, big tech gets eaten by next big tech. I agree if we stop innovating that would never happen, like Open Office is the worst example you could have picked