MurphyA/hacker-news huggingface dataset:
by torginus | 2026-01-04 16:24:47+00:00
It is kind of unfortunate how people don't actually read the paper but only run with the conclusions, speculating whether this would or would not work.

Here's the paper in question:

https://arxiv.org/abs/2310.13828

My two cents is that in its current implementation the compromised images can be easily detected, and possibly even 'de-poisoned'.

The attack works by targeting an underrepresented concept (let's say 1% of images contain dogs, so 'dog' is a good concept to attack).

They poison the concept of 'dog' with the concept of 'cat' by blending (in latent space) an archetypical image of 'cat' (always the same) to every image containing a 'dog'.

This works during training, since every poisoned image of dog contains the same blended in image of a cat, so this false signal eventually builds up in the model, even if the poisoned sample count is low.

But note: this exploits the lack of data in a domain - this would not prevent the model from generating anime waifus or porn, because the training set of those is huge.

But how to detect poisoned images?

1. You take a non-poisoned labeler (these exist, because clean pre-SD datasets, and pre-poison diffusion models exist)

2. You ask your new model and the non-poisoned labeler to check your images. You find that the concept of 'dog' has been poisoned

3. You convert all your 'dog' images to latent space and take the average. Most likely all the non-poison details will average out, while the poison will accumulate.

4. You now have a 'signature' of the poison. You check each of your images in latent space against the correllation with the poison. If the correllation is high, the image is poisoned.

The poison is easily detectible for the same reason it works - it embeds a very strong signal that gets repeated across the training set.
by js8 | 2026-01-04 16:25:29+00:00
That's been my experience too. I had some nighttime pictures taken from a plane ride and I wanted Claude to identify the area on the map that corresponds to the photograph.

Claude wasn't able to do it. It always very quickly latched onto a wrong hypothesis, which didn't stand up under further scrutiny. It wasn't able to consider multiple different options/hypotheses (as human would) and try to progressively rule them out using more evidence.
by cj | 2026-01-04 16:25:30+00:00
I agree with what you’re saying.

> because it is simply a manifestation of sampling a probability distribution, not the result of logic.

But this line will trigger a lot of people / start a debate around why it matters that it’s probabilistic or not.

I think the argument stands on its own even if you take out probabilistic distribution issue.

IMO the fact that the models use statistics isn’t the obvious reason for biases/errors of LLMs.

I have to give credit where credit is due. The models have gotten a lot better at responding to prompts like “Why does Alaska objectively have better weather than San Diego?” by subtly disagreeing with the user. In the past prompts like that would result in clearly biased answers. The bias is much less overt than in past years.
Ask HN: I'd like to learn about software licensing. Any recommendations?
by scott01 | 2026-01-04 16:25:58+00:00
Hey folks,

Can you give a recommendation what to read to get acquainted with the software licensing topics? I appreciate this is a very complicated topic and I won’t become an expert, but I’d like to try to dip my toes into just for the fun of it and to satisfy some curiosity. e.g. why disclaimers in BSD-style licenses are formulated with this specific language, and why Polyform’s plain language is unenforceable (according to some comments here on HN). Tbh, having a mere appreciation of the complexity of this topic would be a fine learning outcome for me, really.

Anything you can recommend to read? Books, articles, court cases?
by jcelerier | 2026-01-04 16:26:15+00:00
Conversely, I much prefer lowest latency at the cost tearing; when I'm forced to use windows I generally disabled the compositor there too whenever i could (I certainly don't use one under Linux and that's one of my reasons for being there). I find macOS unuseable, even on brand new top-end mac studios the input lag and slow reaction of the OS to... any user input, is frightening when you're used to your computer reacting instantly.
by IncreasePosts | 2026-01-04 16:26:33+00:00
They indicted Maduro and his cronies in 2020, before anything with the boats. And the "why" might be that there is no standard that a government needs to release the information they make decisions on. In fact, it's more standard to not release it under the guide of "sources and methods". In any case, are the boats even related to Maduro or just some other thing?
by paulddraper | 2026-01-04 16:26:40+00:00
1. The title says “understanding sbin” but the content gives zero understanding of that. If someone has a historical explanation, please provide it.

2. “Then somebody decided
/usr/local wasn't a good place to install new packages, so let's add /opt”

Not exactly. /usr/local exists so you don’t accidentally mess up your distro/package manager by changing its files. It’s “local” to your installation. But it is still structured — /usr/local/bin, /usr/local/lib, etcetera — divided into binaries, shared libraries, manpages, etcetera.

Whereas /opt has no structure. It’s “the wild west”…application binaries, libraries, configuration, data files, etcetera with no distinction. “Universal” apps or sometimes secondary package managers.

For example /usr/local/bin is normally part of PATH, but /opt is not (unless eg homebrew adds it to your bashrc).
by Simulacra | 2026-01-04 16:26:44+00:00
I don't see this is happening, it's a tremendous death from removing a dictator who's authority was legitimate, to invading Greenland. I just don't see that and I think this is more click bait and rage bait. I don't agree with how it was done, but I'm glad to see maduro gone, but it's opened a very, very, very dangerous door.....
by jmclnx | 2026-01-04 16:27:01+00:00
Not really, back then disks were very expensive and you had no choice but to split. And disk sizes were very small.

But, I in a way int kind of makes sense.

/bin and /sbin, needed for system boot. /usr/bin and /usr/sbin for normal runtime.

's' for items regular users do not need to run, remember, UN*X is a multi-user system, not a one person system like macs, windows and in most cases Linux.
by pigpop | 2026-01-04 16:27:10+00:00
I think we are well beyond this mattering.

To my knowledge, the era of scraping online sources of training data is over. The focus has been on reinforcement learning and acquiring access to offline data for at least a year or two. Synthetic data is generated, ranked and curated to produce the new training sets for improving models. There isn't even really any point to collecting human made images anymore because the rate of production of anything novel is so low. The future of data collection looks like Midjourney's platform where they integrate tools for providing feedback on generated images as well as tools for editing and composing generated images so that they can be improved manually. This closes the loop so the platform for generating images is now part of the model training pipeline.
by pheggs | 2026-01-04 16:27:58+00:00
I tried to find something in the article that bothered me, but I don’t find it very convincing. Points like "someone can forward your email unencrypted after they decrypt it" are just... well, yeah - that can happen no matter what method you choose. It feels like GPG gets hate for reasons other than what’s actually mentioned, and I'm completely oblivious to what those reasons might be.
by ucmind | 2026-01-04 16:28:39+00:00
OP here

I built a platform to validate a hypothesis: If we lower the barrier to entry for using and productizing agents, normal users will actually like them.

Even if the agent isn’t super complete or powerful, as long as it reliably solves one small problem, that should already be meaningful.

I’m looking for agent builders to test this out with me. You can take your existing agent code, fill out a simple manifest, run a few CLI commands, and have a shareable, web-accessible agent in about 10 minutes.

Even if you don’t have an agent yet, feel free to browse and try the creative apps others have built on the site. You might unexpectedly find something useful or fun.

I also wrote a blog post explaining why I’m doing this, for anyone who wants more context.

Blog: https://charmos.io/blog/2

Try agents: https://store.charmos.io/
by Isamu | 2026-01-04 16:28:39+00:00
That’s interesting, they use the Singularity to refer to technological explosion in general rather than specifically AI becoming super intelligent. This seems to predate the AI usage.

>"Singularity is a time in the future. It'll occur when the rate of change of technology is very great--so great that the effort to keep up with the change will overwhelm us. People will face a whole new set of problems that we can't even imagine." A look of great tranquility smoothed the ridges around his eyes. "On the other hand, all our normal, day to day problems fade away. For example, you'll be immortal."
by bob1029 | 2026-01-04 16:29:22+00:00
Tool vendor choice is one of the most important factors in whether or not things will work next year or decade. Using vendors who take stewardship over their ecosystem is at the heart of it all. The solutions to project rot are actually quite obvious if we will allow for them to be. Being required to vendor-in a vast majority of your dependencies is the biggest hallmark of a neglected ecosystem.
by omoikane | 2026-01-04 16:29:59+00:00
For some reason, the box drawing characters aligns properly for me in Chrome but not in Firefox, as seen in the right edge of the blue box. The misalignment is more pronounced in the SDF circle demo:

https://play.ertdfgcvb.xyz/#/src/sdf/circle

I wonder if it's just me (different browser locale, maybe?)
by kayo_20211030 | 2026-01-04 16:30:29+00:00
A libertarian's authoritarian wet-dream. The post assumes that producers and consumers are disjoint i.e. one is either a consumer, or one is a producer. There's no acknowledgement that it's possible to produce in one context and consume in another, or that last year one produced and this year one consumed. It reeks of a religious argument - the saved and the damned. Even the admission that consumers (freeloaders?) will always exist and need to be treated with dignity smells of an annoying paternalism.
by esparanto | 2026-01-04 16:30:30+00:00
When I hear people complaining about this sort of thing, I want to say, “Just go and invent your own, then.”

But then you get things like Esperanto. Esperanto takes about 1/4 of the time to learn compared to other languages. It’s taught in China and used as primary language in some settings. But, aside from a large number of people learning some Esperanto from Duolingo several years ago, it’s just another language now to have to learn.
by jvns | 2026-01-04 16:30:44+00:00
From the other side, I’ve fairly often written blog posts that I don’t put much effort into and have no intention of reaching the front page of HN, only to see 12 hours later that somebody submitted it and it’s on the front page.

I realize this sounds like a humblebrag but it is not a positive thing for me to have every single thing I write submitted to HN whether it’s relevant to a broad audience or not.
by kianN | 2026-01-04 16:30:54+00:00
I don’t love these “X is Bayesian” analogies because they tend to ignore the most critical part of Bayesian modeling: sampling with detailed with detailed balance.

This article goes into the implicit prior/posterior updating during LLM inference; you can even go a step further and directly implement hierarchical relationships between layers with H-Nets. However, even under an explicit Bayesian framework, there’s a stark difference in robustness between these H-Nets and the equivalent Bayesian model with the only variable being the parameter estimation process. [1]

[1] https://blog.sturdystatistics.com/posts/hnet_part_II/
by ufmace | 2026-01-04 16:31:29+00:00
I don't get the "individual" vs "grouped" element thing at all. I guess you could interpret everything as a list, where null is actually empty list, but it seems like that would be a ton of boilerplate and architecture astronomy, not a universally better way of programming. I don't see any decent explanation of what "grouped-element" programming is and why it's universally better and more advanced.

If that was really true, you should be able to point to a subset of code developed with this supposedly better mindset and demonstrate that it's actually better in terms of some objective measure like speed, memory efficiency, features, security vulnerabilities, etc. I don't see anything like that though. What are the odds that it really is a better way of programming versus a theory some guy made up? If you're familiar with the "no silver bullets" thing, a ton of things have been promoted by various people in the industry as a universal solution to general problems of software quality at various times, but vanishingly few of them have ever made a real difference.

It seems to me that advances in memory management have been one of the few advancements promoted over the decades to make programming genuinely better and more reliable. Witness the dominance of garbage-collected languages for virtually everything that could possibly be done with them, and the advantages of moving things that can't use GC to languages with more solid non-GC memory management like Rust, which are becoming more clear. I think that's the best element we can lean on for software quality, not this grouped-element stuff.
by ptx | 2026-01-04 16:31:48+00:00
Maybe this one [1] from 1987? It says:

> There are many race conditions that must be dealt with in input and window management because of the asynchronous nature of event handling. [...] However, not all race conditions have acceptable solutions within the current X design. For a general solution it must be possible for the manager to synchronize operations explicitly with event processing in the server. For example, a manager might specify that, at the press of a button, event processing in the server should cease until an explicit acknowledgment is received from the manager.

[1] https://web.mit.edu/6.033/2006/wwwdocs/papers/protected/xwin...
by criticalfault | 2026-01-04 16:32:00+00:00
> Standards bureaucracies like the Linux Foundation (which consumed the Free Standards Group in its' ever-growing accretion disk years ago) happily document and add to this sort of complexity without ever trying to understand why it was there in the first place.

this is the reason in my opinion and experience

as a lead dev in a rather complicated environment I tended to solve the problem many times where some identifier was used. short deadlines and no specification made us solve the problem quickly, so some shortcuts and quick actions were done. this identifier gets asked about later and super overcomplicated explanations given as a reason by people that don't know the history.

...and the history is often like 'they mounted stuff to /usr because they got a third drive'. and now, people even in this thread keep giving explanations like it's something more.
by stacktrust | 2026-01-04 16:32:08+00:00
> Osteoarthritis occurs when a joint is stressed by aging, injury or obesity. The chondrocytes begin to release pro-inflammatory molecules and to break down collagen, which is the primary structural protein of cartilage. When collagen is lost, the cartilage thins and softens; the accompanying inflammation causes the joint swelling and pain that are hallmarks of the disease.

Collagen synthesis in the human body can be aided by hydrolyzed collagen, Vitamin C, zinc and copper.
by sjsdaiuasgdia | 2026-01-04 16:32:13+00:00
"We don't need to worry about the guy making serious noises about an unconstitutional 3rd term because he might die in office" is a position that does not do anything about the problems that have allowed Trump to happen. Could even say it leaves fertile ground for the next populist authoritarian who comes along.

We must challenge the unitary executive theory. America is not intended to be a dictatorship or monarchy. It's not OK for Trump / those in his orbit to make comments about a 3rd term, it is a problem, it is something we need to take seriously.
by Imustaskforhelp | 2026-01-04 16:32:21+00:00
gobo's a neat idea. I for one really like that its package management can have multiple packages without conflicts etc.

I think the only other I can think of like this is probably nix or spark and nix really wants to learn a new language so it has some friction but nix is a neat idea too

I think not many people know this but how tinycore packages work are really fascinating as well and its possible I think to have this as well by just downloading the .tcz and manually running it since it actually mounts the code to a squashfs mount loop, I am not familiar with the tech but removing applications and adding them can be just about as easy as deleting and adding files when one thinks about it.

Does anybody know some more reference pointers to a more smooth/easy way of not having to deal with dependency management etc.

I think that mise for programming languages is also another good one. Appimages/zapps are nice too for what they are worth. Flatpak's a little too focused on gui section for my liking though. Its great that we have flatpak but I dont think its just the right primitive for cli applications that much
by digdugdirk | 2026-01-04 16:32:22+00:00
Having been on the customer side of your scenario (in the manufacturing sector), this hits deep. It's that feeling of being on a phone tree, and needing to jump through hoops to find the person who can actually help you. But you're in person. And they probably fired the person who has the experience you're looking for, because experience isn't able to be quantified in a column on a spreadsheet.
by some_furry | 2026-01-04 16:32:31+00:00
One of the projects I alluded to in that post makes a technological solution to what you want easy to build, but the harder problem to solve is societal (i.e., getting it adopted).

https://github.com/fedi-e2ee/public-key-directory-specificat...

My current project aims to bring Key Transparency to the Fediverse for building E2EE on ActivityPub so you can have DMs that are private even against instance moderators.

One of the things I added to this design was the idea of "Auxiliary Data" which would be included in the transparency log. Each AuxData has a type identifier (e.g. "ssh-v2", "age-v1", "minisign-v0", but on the client-side, you can have friendly aliases like just "ssh" or "age"). The type identifier tells the server (and other clients) which "extension" to use to validate that the data is valid. (This is to minimize the risk of abuse.)

As this project matures, it will be increasingly easy to do this:

// @var pkdClient -- A thin client-side library that queries the Public Key Directory
// @var age -- An implementation of age
async function forwardSecureEncrypt(file, identity) {
const agePKs = await pkdClient.FetchAuxData(identity, "age");
if (agePKs.length === 0) {
throw new Error("No age public keys found");
}
return age.Encrypt(file, agePKs[0]);
}

And then you can send the encrypted file in an email without a meaningful subject line and you'll have met your stated requirements.

(The degree of "forward secure" here depends on how often your recipient adds a new age key and revokes their old one. Revocation is also published through the transparency log.)

However, email encryption is such a mess that most people don't quite appreciate, so I'm blogging about that right now. :)

Also, Filippo just created a transparency-based keyserver for age, fwiw: https://words.filippo.io/keyserver-tlog/
by glhaynes | 2026-01-04 16:32:31+00:00
On a similar note: just the other day I was thinking about how the Unixy systems I used 20+ years ago used to nudge/push you toward creating several actual partitions during installation. Maybe /, /usr, swap… maybe one or two more? IIRC, I think some of the BSDs, at least, maybe still do? Always seemed weird and suboptimal to me for most installations, but I remember being told by graybeards at the time that it was the Right Way.
by somenameforme | 2026-01-04 16:32:40+00:00
I'm not impugning your moral standing in the least. I'm saying that the moral argument you were concocting wasn't reasonable because you were implicitly expecting a great power to abide a standard which no great power ever would.

I am basing my arguments entire on realpolitik - great powers can be expected to act in their own self interest. It's consistently reliable and helps explain (and predict) things that are otherwise incomprehensible if you try listening to anybody's rhetoric. Countries do not act morally.

When a relatively weak and strategically important country tries to align itself against a giant on its doorstep, that's never going to lead to happy things for that country in the longrun. One of the countries that may be next on the chopping block for the US is Cuba, which I think makes our likely motivation behind this whole thing somewhat more clear.
by gbnwl | 2026-01-04 16:32:45+00:00
I literally linked my source. It's less than 7 minutes long. It's not that refineries are idle, it's that we have to import the heavy crude to keep them producing. Heavy crude went from 12% of imports to 70% as of 2025. The most relevant graphs, if you really can't stomach 7 minutes of video, are shown from 3:30 - 4:30ish in the video. And again, record production levels of shale oil is producing LIGHT crude. The information you're seeking has already been provided to you.
by IgorPartola | 2026-01-04 16:33:32+00:00
Also /bin vs /sbin believe is that the latter is meant for statically linked binaries such that if your system is corrupted these at least will keep working.

Practically in this century if I was starting a new OS I would set it up like so:

/bin for all system binaries. Any binary from a package installed by the OS package manager lived here.

/lib same but for shared libraries

/var for variable data. This is where you would put things like your Postgres data files.

/tmp for temporary files.

/home as usual.

/dev as usual.

/boot as usual

/etc as usual

/usr would be what /usr/local is on most systems. So /usr/bin is binaries not installed by the OS package manager. /usr/etc is where you put config files for packages not installed by the package manager and so on.

Get rid of /usr/local and /sbin.

/media replaces /mnt entirely (or vice versa).

Ditch /opt and /srv

Add /sub for subsystems: container overlays should live here. This would allow the root user (or a docker group, etc.) to view the container file system, chroot into it, or run a container on it.

Then again, nobody gave me a PDP-11 to decide so my vote doesn’t count :)
by moooo99 | 2026-01-04 16:33:34+00:00
> I think the important part is leaving your phone and other devices home.

The annoying part is that this becomes increasingly difficult to impossible. For example, I can't use public transport without my phone anymore, because my ticket is bound to my phone and the provider does not issue paper tickets or smartcards anymore.

Less severe but equally frustrating, many restaurants choose to use QR codes for menus rather than printing them onto a sheet of paper or writing them to the wall.

I love leaving my phone behind, primarily because I am in the "we're entertaining ourselves to death" crowd considering I essentially grew up with mobile phones already. But our environment is increasingly build on the assumption that we carry a smartphone with us at any given time.