MurphyA/hacker-news huggingface dataset:
by martinald | 2026-01-28 03:11:24+00:00
This really is quite scary.

I suspect this year we are going to see a _lot_ more of this.

While it's good these bugs are being found and closed, the problem is two fold

1) It takes time to get the patches through distribution
2) the vast majority of projects are not well equipped to handle complex security bugs in a "reasonable" time frame.

2 is a killer. There's so much abandonware out there, either as full apps/servers or libraries. These can't ever really be patched. Previously these weren't really worth spending effort on - might have a few thousand targets of questionable value.

Now you can spin up potentially thousands of exploits against thousands of long tail services. In aggregate this is millions of targets.

And even if this case didn't exist it's going to be difficult to patch systems quickly enough. Imagine an adversary that can drip feed zero days against targets.

Not really sure how this can be solved. I guess you'd hope that the good guys can do some sort of mega patch against software quicker than bad actors.

But really as the npm debacle showed the industry is not in a good place when it comes to timely secure software delivery even without millions of potential new zero days flying around.
by CGMthrowaway | 2026-01-28 03:11:48+00:00
For most individuals it usually doesn’t matter. It might matter if you have an adversary, e.g. you are a journalist crossing borders, a researcher in a sanctioned country, or an organization trying to avoid cross‑tenant linkage

Remote attestation shifts trust from user-controlled software to manufacturer‑controlled hardware identity.

It's a gun with a serial number. The Fast and Furious scandal of the Obama years was traced and proven with this kind of thing
by wmorgan | 2026-01-28 03:11:50+00:00
Is that your theory, or is there case law that backs it up? From what I saw the bounds on 18 USC 111 are quite narrow indeed: I found a case where the defendant _fired at federal agents with his shotgun_, and the appeals court threw it out because the jury was incorrectly instructed that they could use the fact that he shot at them when considering he misled them afterwards. But actually, the jury was not allowed to do that. https://law.justia.com/cases/federal/appellate-courts/F2/199...
by tadfisher | 2026-01-28 03:12:16+00:00
Banks do this because they have made their own requirement that the mobile device is a trust root that can authenticate the user. There are better, limited-purpose devices that can do this, but they are not popular/ubiquitous like smartphones, so here we are.

The oppressive part of this scheme is that Google's integrity check only passes for _their_ keys, which form a chain of trust through the TEE/TPM, through the bootloader and finally through the system image. Crucially, the only part banks should care about should just be the TEE and some secure storage, but Google provides an easy attestation scheme only for the entire hardware/software environment and not just the secure hardware bit that already lives in your phone and can't be phished.

It would be freaking cool if someone could turn your TPM into a Yubikey and have it be useful for you and your bank without having to verify the entire system firmware, bootloader and operating system.
by kig | 2026-01-28 03:12:17+00:00
"We leverage APIs like CUDA streams to avoid blocking the GPU while the host processes requests.", so I'm guessing it would let the other GPU threads go about their lives while that one waits for the ACK from the CPU.

I once wrote a prototype async IO runtime for GLSL (https://github.com/kig/glslscript), it used a shared memory buffer and spinlocks. The GPU would write "hey do this" into the IO buffer, then go about doing other stuff until it needed the results, and spinlock to wait for the results to arrive from the CPU. I remember this being a total pain, as you need to be aware of how PCIe DMA works on some level: having your spinlock int written to doesn't mean that the rest of the memory write has finished.
Ask HN: In agent/automation incidents, what slows recovery?
by paulrekai | 2026-01-28 03:13:23+00:00
I’m trying to understand a very specific moment in agent/automation incidents.

Something has already gone wrong.
Logs exist. Dashboards exist.
But recovery still stalls.

In your experience, what actually slowed things down at that point?

Was it unclear attribution (who caused what)?
Unclear ownership (who should step in)?
Or something else entirely?

Not selling anything — trying to learn from real oncall / incident experience.
by Nursie | 2026-01-28 03:13:39+00:00
> Or, just hear me out, this is what a moral panic looks like on social media.

Could be, could be, except moral panics are usually absent evidence, whereas here we have meta's own researchers discovering and attempting to suppress the knowledge that people become addicted -

https://www.nationalreview.com/news/meta-researchers-private...

Or evidence that "Company documents cited in the complaint described several Meta officials acknowledging the company designed its products to exploit shortcomings in youthful psychology" -

https://www.theguardian.com/technology/2023/nov/27/meta-inst...

There's also research into its mental health consequences (a single example of many pieces of research available) -

https://pubmed.ncbi.nlm.nih.gov/36219756/

And legal opinions (the references on this one are good and contain further information on the poor mental health outcomes associated with youth social media use) -

https://law.stanford.edu/2024/05/20/social-media-addiction-a...

Not to mention ongoing courtcases etc.

Dismissing this as "moral panic" seems wrong with that background of well-grounded concern.

> To quote the top replies to that thread:

Those are neither the best nor the top replies, why did you feel the need to misrepresent that?

> I'd examine why you're so willing to believe what you read on social media despite the lack of real data and evidence towards the claims you're accepting at face value.

I'd examine why you're so keen to ignore the real data and evidence in favour of your moral panic theory.
by lostmsu | 2026-01-28 03:15:17+00:00
AFAIK gpt-oss-20b on high reasoning has SWE score of just over 60. It is smaller than all comparable models. Maybe I am missing something, but it is still state of the art all the way up to 50B parameters vs all models released after.

At least https://huggingface.co/facebook/cwm team had balls comparing to it directly (sort of, see TTS).

What does this model do that gpt-oss-20b does not? AFAIU the base model it was finetuned from is not reproducible, and if I flip a single bit in gpt-oss-20b and tell you how (instruction under MIT) that would satisfy "fully open finetuning" they claim as advantage. But that "open" fine-tuned gpt-oss-20b is probably going to beat their model.

Am I missing something?
by Cargo4286 | 2026-01-28 03:18:20+00:00
Here's an ellipsoid in build123d using geometric transformation of a sphere:

from build123d import *
mat = Matrix([[2,0,0,0],[0,1.5,0,0],[0,0,0.5,0]])
ellipsoid = Sphere(100).transform_geometry(mat)

Also, FYI build123d now runs in the browser thanks to OCP.wasm. Example playground here https://jojain.github.io/build123d-sandbox/
by seer | 2026-01-28 03:18:43+00:00
Honestly, this seems very much like the jump from being an individual contributor to being an engineering manager.

The time it happened for me was rather abrupt, with no training in between, and the feeling was eerily similar.

You know _exactly_ why the best solution is, you talk to your reports, but they have minds of their own, as well as egos, and they do things … their own way.

At some point I stopped obsessing with details and was just giving guidance and direction only in the cases where it really mattered, or when asked, but let people make their own mistakes.

Now LLMs don’t really learn on their own or anything, but the feeling of “letting go of small trivial things” is sorta similar. You concentrate on the bigger picture, and if it chose to do an iterative for loop instead of using a functional approach the way you like it … well the tests still pass, don’t they.
by pizlonator | 2026-01-28 03:18:45+00:00
Impressive.

I checked the stack overflow that was marked High, and Fil-C prevents that one.

One of the out-of-bounds writes is also definitely prevented.

It's not clear if Fil-C protects you against all of the others (Fil-C won't prevent denial of service, and that's what some of these are; Fil-C also won't help you if you accidentally didn't encrypt something, which is what another one of these bugs is about).

The one about forgetting to encrypt some bytes is marked Low Severity because it's an API that they say you're unlikely to use. Seems kinda believable but also ....... terrifying? What if someone is calling the AESNI codepath directly for reasons?

Here's the data about that one:

"Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.

Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection."
by Nursie | 2026-01-28 03:18:58+00:00
Did they describe them as either wholesome or safe?

To me the difference is in the doom-scrolling, the shoving rage-bait in your face and the gaming for addictiveness.

Old-school forums, whether they were wholesome or not, didn't do that stuff. Hell, I used to be on Kuro5hin, which was incredibly toxic, but I have IRL friends from there and it just wasn't the same as doom-scrolling through algorithmically selected influencers while meta/tiktok shoved ads in my face.
by jeffbee | 2026-01-28 03:19:06+00:00
I don't know why you're still using OpenSSL but if you're able to switch I note that BoringSSL was not affected by any of the January 2026 OpenSSL advisories, and was also not affected by any of the advisories from 2025, and was affected by only one of the 2024 advisories. I also note that I don't see any hasty commit activity to s2n-tls that looks like a response to these advisories.

Better software is out there.
by zuoning | 2026-01-28 03:19:12+00:00
Kutt AI is a professional AI video generation platform that turns text prompts or images into cinematic videos in seconds. You can create lifelike speaking avatars, swap faces or bodies, and animate characters with action imitation, all in HD and ready to share. The platform bundles top models like Wan and Seedance, offers over 100 effects, fast rendering, and commercial-use rights, so creators and teams can produce social clips, promos, and short films without complex editing.
by cyberax | 2026-01-28 03:19:23+00:00
Just imagine the same argument, but for bloodwork. You're literally saying: "We didn't have to deal with these pesky MRIs before, so go away".

We will need some additional radiologist training, and the primary care doctors will need to learn when to escalate and/or require followup scans. But that's really about it.

MRIs are _cheap_ these days. The true cost of a scan is around $1000, including the radiologist's reading. They don't have to be reserved as a tool of the last resort.
by kevstev | 2026-01-28 03:19:53+00:00
There is actually. I used to work in grocery e-commerce. The model is pickers in a store --> a "dark store" that looks more like a home Depot with only pickers, not open to public --> warehouse like environment with various levels of automation.

This was a bit before the model of having Uber driver type delivery though. I am guessing that having the deliverers be close to the deliverees make it more economical to keep them in stores until a larger scale is reached. The dark store+ model was also predicated on a more factory floor like environment with only FTEs present. Think pallets moving about among the pickers- not too hard to work around IMHO but maybe the lawyers and insurers feel differently.

I still feel the overreaching factor is that in dense urban centers there is no cheap commercial/industrial space that is also in close proximity to customers.
by tpurves | 2026-01-28 03:20:00+00:00
Either M5 Pro chips are finally here... or March is just the next time Apple can source any DRAM or SSD chips for the existing line!

In all seriousness, I am quite concerned for what the base model and upgrade pricing is going to be for the full M5 line, given the recent AI-driven DRAM supply apocalypse.
by timschmidt | 2026-01-28 03:20:03+00:00
The badness cannot be overstated. "Hostile codebase" would be an appropriate label. Much more information available in Giovani Bechis's presentation: https://www.slideshare.net/slideshow/libressl/42162879

If someone meant to engineer a codebase to hide subtle bugs which might be remotely exploitable, leak state, behave unexpectedly at runtime, or all of the above, the code would look like this.
by lovich | 2026-01-28 03:21:23+00:00
I can read C/C++ code about as well as I can read German. Bits and pieces make sense but I definitely don’t get the subtleties.

What’s eye bleachy about this beyond regular C/C++?

For context I’m fluent in C#/javascript/ruby and generally understand structs and pointers although not confident in writing performant code with them.
by Nasrudith | 2026-01-28 03:21:42+00:00
It is important to remember that meritocracy isn't a binary, it is a spectrum. Just having exams based upon literacy and ability to understand poetry about flowers for bureaucratic positions that do paperwork is more meritocratic than just a literal aristocracy and ensures literacy, but it still isn't necessarily the most relevant ability to actual ability to perform the job. Then there is the question if office politics qualify as actual job skill or is just a derailment of merit.

Furthermore there are complications with unequal resources and means of training. Not just from some families having more money, but also from more knowledge. Children who are read to are more likely to be literate, family businesses, and all that. The unequal resources raises deeper questions about what is the origin of merit.

The real world is messy like that.
by ux266478 | 2026-01-28 03:23:51+00:00
>And Arcan is so many things at once I'm not convinced it is a good alternative to Wayland. It has good ideas, but they sort of require the whole package.

That's a bit of a double edged sword, it's the exact reason why I don't think Wayland is a good alternative to X. Wayland's minimalist attitude towards responsibility is good for one thing, and that's implementing new compositors from scratch. The bare bones compositor will be a long way from usable, but it will be technically complete. The question is, does it matter to me that there are 30 different compositors? Each in various states with their own eclectic featureset with no guarantees given, a la USB-C? Not really. In effect, it did present me with the conundrum of choosing between a half-baked compositor (dwl) or a desktop experience I have literally zero interest in (Gnome/KDE) which left me with a sour taste in the mouth.

Moving beyond that, a real problem with Wayland's architectural minimalism is that a display server does more than simply abstract a single API. It provides a lot of rather complex features, from accessibility to input handling. Not every compositor is capable of handling that kind of complexity, especially if it's to work well. What we will find going forward are two possible futures:

1. The future resembles the present status quo of fragmentation, made worse by time. The compositor archipelago is here to stay, and deploying software in this environment has become excessively annoying. There are 10 different competing libraries for any given category of basic infrastructure, and each library in each category has their own ideas and idiosyncrasies that have to be worked around. Most of them are buggy and incomplete.

2. Smaller compositors effectively die off, and we are left with a single monolithic compositor, back to the modular Window Manager/Desktop Environment. This monster implements the defacto Extended Wayland protocol, where all of the different parts don't quite match each other very well because that's the cost gained from not having vertical integration of complicated components. There's no cohesive rhyme or reason to the design of anything. Thus, the exercise in minimalism has wrought an uglier and more complicated beast than Xorg itself.

I think it's clear Wayland is going to continue to sweep the Linux desktop given its massive corporate backing. But I'm not really compelled to run a bare Wayland compositor under any circumstances, because my Arcan server already works perfectly fine as a Wayland compositor. It works as any number of Wayland compositors running whatever extensions they implement. In effect, no matter which future we end up in, by using Arcan I'm in a much better position than someone running a normal compositor. This fact alone makes me favor Arcan, even before we get into its unique merits.
by jeffbee | 2026-01-28 03:26:52+00:00
For one thing, "C/C++" is not a thing. If you see C-like C++, that is C.

Part of OpenSSL's incomprehensibility is that it is not C++ and therefore lacks automatic memory management. Because it doesn't have built-in allocation and initialization, it is filled with BLAH_grunk_new and QVQ_hurrr_init. "new" and "init" semantics vary between modules because it's all ad hoc. Sometimes callees deallocate their arguments.

The only reason is needs module prefixes like BLAH and QVQ and DERP is that again it is not C++ and lacks namespaces. To readers, this is just visual noise. Sometimes a function has the same name with a different module, and compatible function signature, so it's possible to accidentally call the wrong one.
by codyb | 2026-01-28 03:27:05+00:00
I feel like if you're really spending a ton of time on off by one errors after twenty years in the field you haven't actually grown much and have probably just spent a ton of time in a single space.

Otherwise you'd be senior staff to principle range and doing architecture, mentorship, coordinating cross team work, interviewing, evaluating technical decisions, etc.

I got to code this week a bit and it's been a tremendous joy! I see many peers at similar and lower levels (and higher) who have more years and less technical experience and still write lots of code and I suspect that is more what you're talking about. In that case, it's not so much that you've peaked, it's that there's not much to learn and you're doing a bunch of the same shit over and over and that's of course tiring.

I think it also means that everything you interact with outside your space does feel much harder because of the infrequency with which you have interacted with it.

If you've spent your whole career working the whole stack from interfaces to infrastructure then there's really not going to be much that hits you as unfamiliar after a point. Most frameworks recycle the same concepts and abstractions, same thing with programming languages, algorithms, data management etc.

But if you've spent most of your career in one space cranking tickets, those unknown corners are going to be as numerous as the day you started and be much more taxing.
by Nursie | 2026-01-28 03:27:16+00:00
Where exactly the line is between 'withdrawal' and anxiety caused by a sudden, non-voluntary change in habits, I'm not sure, but I'd say that the one looks very like a symptom of the other.

If we're willing to admit gambling to the list of things that can be addictive, then I'm not sure why other dopamine-related compulsive activities shouldn't be treated the same. Restlessness is well known as a gambling withdrawal symptom.
by olafalo | 2026-01-28 03:27:18+00:00
Thanks, this rings true to me. The struggle is an investment, and it pays off in good judgement and taste. The same goes for individual codebases too. When I see some weird bug and can immediately guess what’s going wrong and why, that’s my time spent in that codebase paying off. I guess LLM-ing a feature is the inverse, incurring some kind of cognitive debt.
by overfeed | 2026-01-28 03:27:21+00:00
> Eventually it was easier just to quit fighting it and let it do things the way it wanted.

I wouldn't have believed it a few tears ago if you told me the industry would one day, in lockstep, decide that shipping more tech-debt is awesome. If the unstated bet doesn't pay off, that is, AI development will outpace the rate it generates cruft, then there will be hell to pay.
by 3eb7988a1663 | 2026-01-28 03:28:02+00:00
Ancient crops were also pathetic to a modern eye. Before thousands of years of selective breeding, corn had six or seven kernels on a cob. Doubtful that it would be possible to survive on a field of wild cultivars without at least a few generations pushing towards more productive specimens.

https://evolution.earthathome.org/grasses/andropogoneae/maiz...
by rramadass | 2026-01-28 03:28:33+00:00
Epictetus' Handbook and the Tablet of Cebes: Guides to Stoic Living by Keith Seddon; has the first detailed modern commentary on The Enchiridion in over 1500 years. The book is positioned for both the general reader and academics with background notes, detailed commentary and explanations.

Every student of Stoic Philosophy should read this - https://www.routledge.com/Epictetus-Handbook--and-the-Tablet...
by SamBam | 2026-01-28 03:29:24+00:00
I have a big old analog radio-controlled clock in my classroom, and it's always about 4 minutes fast, which would drive me nuts except most of my students can't read analog time so they're never confused by it.

Regardless, I'm excited to try this out next time I'm in the classroom. I'm a little confused by time zones, however. My clock has no controls on the back whatsoever (at least that I can find, I haven't opened it up), so I assume it doesn't know what time zone I'm in.

So do I need to set the time zone on the station emulator? There's an "offset" setting, but it says it's only for correcting "minor errors."
by defrost | 2026-01-28 03:30:01+00:00
> once in the situation, a reasonable person could have feared for their lives.

Sure, all things being equal, a person on the Clapham omnibus, yada, yada.

However, specifically in this situation it is very frequently not "median people" in the mix, it is LEO-phillic wannabe (or ex) soldier types that are often exchanging encrypted chat messages about "owning the libs", "goddamn <insert ethic slur>'s" and exchange grooming notes on provoking "officer-induced jeopardy" .. how to escalate a situation into what passes for "justified homicide" or least a chance to put the boot in.

Those countries that investigate and prosecute shootings by LEO's often find such things at the root of wrongful deaths.
by gnabgib | 2026-01-28 03:30:02+00:00
Related:

NTSB Preliminary Report – UPS Boeing MD-11F Crash [pdf] (216 points, 2 months ago, 228 comments) https://news.ycombinator.com/item?id=45995834

UPS grounds its fleet of MD-11's, sources say (19 points, 3 months ago, 4 comments) https://news.ycombinator.com/item?id=45854311

UPS plane crashes near Louisville airport (421 points, 3 months ago, 451 comments) https://news.ycombinator.com/item?id=45816963
by kjs3 | 2026-01-28 03:31:58+00:00
That's a very fair point, but on my system telnet is 211144 bytes. How big is a javascript runtime + browser + browser sandbox. I have no idea, but I'd be really surprised if it was less than 3 orders of magnitude bigger, and not at all surprised if it was 4 orders of magnitude bigger. There's just more places for things to go wrong.

And, telnet isn't installed by default on many systems. So...YMMV.
by strange_quark | 2026-01-28 03:33:24+00:00
Yeah, all of this. Plus companies have avoided hiring and training juniors for 3 or 4 years now (which is more related to interest rates than AI). Plus existing seniors who deskill themselves by outsourcing their brain to AI. Seniors who know actually what they're doing are going to be in greater demand.

That is assuming that LLMs plateau in capability, if they haven't already, which I think is highly likely.