MurphyA/hacker-news huggingface dataset:
by AshamedCaptain | 2026-02-20 22:20:59+00:00
No, I do not understand why I cannot call homeopathy bullshit. There's plenty of widespread positive anecdote for it, too!

Why would you think calling one bullshit is "offensive" and not the other? You realize that this "gray" scale that you claim is as unscientific as it gets, right? After all, it worked for me! And I hear that it works for my friends! How can homeopathy/blue light filters/whatever-ritual-you-like-today not work? How can there not be a teapot on the sky?

If the problem is with the word "bullshit", call it pseudo-scientific, but it is almost the same thing.

Tomorrow there could be some evidence of an effect shown in the opposite direction (e.g. blue light filters _harming_ sleep quality*, or performance the day after, or whatever) and you would be as skeptical as with claims of no effect, if not more. See the recent article of white noise in HN and how it was met in the comments.

* Because of people (or worse, software) turning their screens' brightness up to compensate, which I already read an article about long time ago...
by jameslk | 2026-02-20 22:21:40+00:00
The implications for RLM is really interesting. RLM is expensive because of token economics. But when tokens are so cheap and fast to generate, context size of the model matters a lot less

Also interesting implications for optimization-driven frameworks like DSPy. If you have an eval loop and useful reward function, you can iterate to the best possible response every time and ignore the cost of each attempt
by FiloSottile | 2026-02-20 22:21:45+00:00
For regular updates, because you can minimize but not eliminate risk. As I say in the article that might or might not work for your requirements and practices. For libraries, you also cause compounding churn for your dependents.

For security vulnerabilities, I argue that updating might not be enough! What if your users’ data was compromised? What if your keys should be considered exposed? But the only way to have the bandwidth to do proper triage is by first minimizing false positives.
by seanmcdirmid | 2026-02-20 22:21:53+00:00
Autopilots in airplanes are kind of dumb (keep heading, speed, and altitude, they won’t do much anything else), which is why Tesla doesn’t use the name as branding for its full self driving software. People at least know that much.

But then again even on HN people like parent think that autopilot is the same as full self driving, when it is and always has been just smarter cruise control. The payout was for autopilot (a feature that most new cars have these days under various names), not full self driving.
by CamperBob2 | 2026-02-20 22:21:59+00:00
No, they didn't neglect to mention it at all: https://www.theguardian.com/us-news/2024/oct/16/project-2025...

“We are in the process of the second American Revolution, which will remain bloodless if the left allows it to be.”

Almost all of history's greatest, most-destructive conspiracies were not concealed in smoke-filled rooms, they were published and advertised to great fanfare. This one included.
by dspillett | 2026-02-20 22:23:41+00:00
> I came across a pretty serious security concern at my company this week. The ramifications are alarming. […] Then when I bring it to leadership, their agenda is to take these conversations offline, with no paper trail, and kill the conversation.

I was in a very similar position some years ago. After a couple of rounds of “finish X for sale Y then we'll prioritise those issue”, which I was young and scared enough to let happen, and pulling on heartstrings (“if we don't get this sale some people will have to go, we risk that to [redacted] and her new kids, can we?”) I just started fixing the problems and ignoring other tasks. I only got away with the insubordination because there were things I was the bus-count-of-one on at the time and when they tried to butter me up with the promise of some training courses, I had taken & passed some of those exams and had the rest booked in (the look of “good <deity>, he got an escape plan and is close to acting on it” on the manager's face during that conversation was wonderful!).

The really worrying thing about that period is that a client had a pen-test done on their instance of the app, and it passed. I don't know how, but I know I'd never trust that penetration testing company (they have long since gone out of business, I can't think why).
by tovej | 2026-02-20 22:23:50+00:00
I play with generative AI quite often. Mostly for shits and giggles. It's fun to try to make it hallucinate in the dumbest way possible. Or to make up context.

E.g. try to make any image generating model take an existing photo of a humanoid and change it so the character does a backflip.

It's also interesting to generate images in a long loop, because it usually reveals interesting patterns in the training data.

Outside these distractions I've never had generative AI be useful. And I'm currently working in AI research.
Show HN: Bbt – Black Box Testing Directly from Your Documentation
by LionelDraghi | 2026-02-20 22:24:30+00:00
bbt is an open-source tool that lets you test command-line executables using plain Markdown documentation—no scripts, no glue code. Write your specs, run them as tests.

Why bbt?
- Zero duplication: Test scenarios live in your READMEs, user guides, or any Markdown file.
- Natural language: Steps like When I run gcc --version → Then the output contains 14.2.0 just work.
- No learning curve: Partial parsing means you write almost-normal English; bbt extracts the test logic.
by ylk | 2026-02-20 22:25:29+00:00
This is not how CVEs work at all. You can be pretty vague when registering it. In fact they’re usually annoyingly so and some companies are known for copy and pasting random text into the fields that completely lead you astray when trying to patch diff.

Additionally, MITRE doesn’t coordinate a release date with you. They can be slow to respond sometimes but in the end you just tell them to set the CVE to public at some date and they’ll do it. You’re also free to publish information on the vulnerability before MITRE assigned a CVE.
by jmclnx | 2026-02-20 22:26:47+00:00
How about forcing all stations to:

1. read from the bible between between 16:00 and 20:00

2. At 20:00 show Trump's picture for 5 minutes with people praising him

3. rest of the programming are shows based upon Leave it to Beaver and my 3 sons, make sure only WASPS are the actors and producers.

That is what the US admin. really wants. If I see more than one of these "PSAs" in a 4 hour period, I will never watch that network again. FWIW, I stream as opposed to using Cable. So they will know why I cancelled their service.
by kpw94 | 2026-02-20 22:27:01+00:00
> Basically, I was told to make it so that my phone's camera could see something on the screen and my desk at the same time without washing out

+1. The low-tech version of this I've heard and I've been doing is:

Hold a printed white paper sheet right next to your monitor, and adjust the amount of brightness in monitor so the monitor matches that sheet.

This of course requires good overall room lightning where the printed paper would be pleasant to read in first place, whether it's daytime or evening/night
by Yodel0914 | 2026-02-20 22:27:25+00:00
Well, we already use password managers for all their benefits: autofill, syncing, password generation, passkey storage etc.

For a while we’re using `pass` which doesn’t have an easy way to share passwords, so my wife and I had duplicates of a handful of passwords, which was annoying when they changed, or when we needed to share a new one.

Moving to Bitwarden meant that we can have a set of passwords that are shared, and we can update or add to it. As the kids have gotten older, I’ve get them using it too, so we can share a small set of passwords with them (wifi, streaming services etc).
by tracker1 | 2026-02-20 22:27:29+00:00
Literally found the same issue in a password system, on top of passwords being clear text in the database... cleared all passwords, expanded the db field to hold a longer hash (pw field was like 12 chars), setup "recover password" feature and emailed all users before End of Day.

My own suggestion to anyone reading this... version your password hashing mechanics so you can upgrade hashing methods as needed in the future. I usually use "v{version}.{salt}.{hash}" where salt and the resulting hash are a base64 string of the salt and result. I could use multiple db fields for the same, but would rather not... I could also use JSON or some other wrapper, but feel the dot-separated base64 is good enough.

I have had instances where hashing was indeed upgraded later, and a password was (re)hashed at login with the new encoding if the version changed... after a given time-frame, will notify users and wipe old passwords to require recovery process.

FWIW, I really wish there were better guides for moderately good implementations of login/auth systems out there. Too many applications for things like SSO, etc just become a morass of complexity that isn't always necesssary. I did write a nice system for a former employer that is somewhat widely deployed... I tried to get permission to open-source it, but couldn't get buy in over "security concerns" (the irony). Maybe someday I'll make another one.
by Hnrobert42 | 2026-02-20 22:27:54+00:00
I use a different email address for every service. About 15 years ago, I began getting spam at my diversalertnetwork email address. I emailed DAN to tell them they'd been breached. They responded with an email telling me how to change my password.

I guess I should feel lucky they didn't try to have me criminally prosecuted.
by tovej | 2026-02-20 22:28:07+00:00
Why do you need to move things around? And how is that difficult?

Surely you have an LSP in your editor and are able to use sed? I've never had moving files take more than fifteen minutes (for really big changes), and even then most of the time is spent thinking about where to move things.

LLM's have been reported to specifically make you "feel" productive without actually increasing your productivity.
by inventor7777 | 2026-02-20 22:28:17+00:00
That is fair. I do not think anyone could feasibly could detect/extract the exact data sent, because of HTTPS.

However I was more thinking of simple things, such as disabling anything that SHOULD be communicating with the Internet and seeing if any constant traffic persists.

Now of course, some very small (e.g plaintext) traffic might be almost undetectable, however that would suggest that most of the data would not be able to be transmitted due to size.
by rmason | 2026-02-20 22:28:32+00:00
Non-subscriber link: https://archive.is/8KcNX

Been following Andy long before he bought the car factory. The story omits his largest customer for his bus company. He does all the transportation for the Detroit Public Schools. He pitched the school system which is always resource constrained that he could take over transport for less than it cost for them to d do it.
by SamPatt | 2026-02-20 22:29:21+00:00
You can see when they buy or sell a position. It's on the blockchain so it's all public. And yes, copying positions is called copy-trading and it's extremely popular.

Orders aren't public though. Only the actual trades. This is important because by the time the trade is known by others very often the edge is gone. Especially if you have other people watching the same trader and they all try to copy the trade at the same time.
by bonsai_spool | 2026-02-20 22:30:08+00:00
> Indeed, the court adopted a new legal concept

I wasn't wrong - the first time the concept was named in a decision was in the Biden administration. It sounds like you're not actually reading any of these, or aware of this issue?

I do agree that the idea that some agency actions should be used appeared in the case OP cited. But it's obvious that SCOTUS is using this concept much more broadly now.
by conductr | 2026-02-20 22:30:40+00:00
Ah got it, thanks a ton for the feedback! I suppose that’s helpful but not too different than using Google. There’s a ton of chart types that aren’t native that I need to create and so usually just google for specifics, it’s not always something I do with high frequency so don’t have the muscle memory of it. Would be very cool if I could find a tool that would fully execute the gui actions needed.

I have similar wants for other software. Where for example AI can do image generation, what I often what is it to take over my Photoshop app and perform all the steps like a graphic designer would. Then I’d have layers and such. Then I could take that to animation software and have an ai create me a rig and what not. I’ve not found anything quite like this yet
by techblueberry | 2026-02-20 22:30:56+00:00
This feels a little excessively cynical, you still might hate it, but it's specifically for the 250th Anniversary of America.

Federal Communications Commission Chairman Brendan Carr today urged broadcasters to join a “Pledge America Campaign” that Carr established to support President Trump’s “Salute to America 250” project.

Carr said in a press release that “I am inviting broadcasters to pledge to air programming in their local markets in support of this historic national, non-partisan celebration.” The press release said Carr is asking broadcasters to “air patriotic, pro-America programming in support of America’s 250th birthday.”

Carr gave what he called examples of content that broadcasters can run if they take the pledge. His examples include “starting each broadcast day with the ‘Star Spangled Banner’ or Pledge of Allegiance”; airing “PSAs, short segments, or full specials specifically promoting civic education, inspiring local stories, and American history”; running “segments during regular news programming that highlight local sites that are significant to American and regional history, such as National Park Service sites”; airing “music by America’s greatest composers, such as John Philip Sousa, Aaron Copland, Duke Ellington, and George Gershwin”; and providing daily “Today in American History” announcements highlighting significant events from US history.

I don't know that "pledge" should be the right word, just maybe like encourage? And like way to speed run the death of broadcast television, but whatever.
by SmirkingRevenge | 2026-02-20 22:32:02+00:00
Maybe in rare cases, but for each of the various policy goals tariffs are used for, there are other kinds of targeted industrial policy that work better and cost less.

Tariffs are the most expensive way to try to onshore manufacturing. The cost per "job created" is astronomical usually. They incentivize corruption and black markets.

Even regular old subsidies are usually easier, cheaper, and less problematic
by 1718627440 | 2026-02-20 22:32:19+00:00
Which is why the more serious consequences a law has the harder it is to change it and the more people need to sign off on it. There is stuff that needs simple majorities, stuff that is in the constitution and requires a super majority, stuff that can't be changed short of abolishing the current state and stuff that can't be changed at all, because it is just an assertion that is independently on anyone asserting it.

This is kind of a "solved*" thing in theory, not so much in practice of course.

*solved meaning we have a proper process established
by iainctduncan | 2026-02-20 22:32:50+00:00
Regardless of the sleep effect (or lack of) they absolutely do work for reducing eye strain for migraineurs.

It's noticeable to me all the time, but if I'm borderline migraining, or recovering from a migraine, the difference between shifted and not is something I can feel instantly. Shifting all the way over enables me to eek out some work after a migraine without it flaring back up again.
by isthatafact | 2026-02-20 22:33:00+00:00
For me, when someone promises to "drain the swamp", they reveal their ignorance and selfishness with their shallow anti-swamp ideology.

Swamps are rich ecosystems with incredible natural beauty and diversity. Draining a swamp is extraordinarily bad in general, even if good for wealthy property developers.

Ironically, it seems that "drain the swamp" turns out to be an apt metaphor for what Trump and that gang have been doing, as promised.
by jameslk | 2026-02-20 22:33:09+00:00
> Certainly interesting for very low latency applications which need < 10k tokens context.

I’m really curious if context will really matter if using methods like Recursive Language Models[0]. That method is suited to break down a huge amount of context into smaller subagents recursively, each working on a symbolic subset of the prompt.

The challenge with RLM seemed like it burned through a ton of tokens to trade for more accuracy. If tokens are cheap, RLM seems like it could be beneficial here to provide much more accuracy over large contexts despite what the underlying model can handle

0. https://arxiv.org/abs/2512.24601
by mindslight | 2026-02-20 22:33:33+00:00
I didn't say the intentions weren't plain as day for anyone not stuck in the Fraudster in Chief's reality distortion field. Just that they abused the reference to the history without actually owning up to where in the analogy their agenda sits. Lawless gangs of soldiers terrorizing American cities for political purposes is straight out of the Revolution.

And yeah "bloodless, if the left allows it". It's always projection and gaslighting with these fascists. "Stop hitting yourself. Stop hitting yourself. Look what you made me do."

(see also "TDS" to describe anybody not in the Fraudster in Chief's reality distortion field)
by tracker1 | 2026-02-20 22:34:19+00:00
I wish I could recall the name of a pen test company I worked with when I wrote my auth system... They were pretty great and found several serious issues.

At least compared to our internal digital security group would couldn't fathom, "your test is wrong for how this app is configured, that path leads to a different app and default behavior" it's not actually a failure... to a canned test for a php exploit. The app wasn't php, it was an SPA and always delivered the same default page unless in the /auth/* route.

After that my response became, show me an actual exploit with an actual data leak you can show me and I'll update my code instead of your test.
by flaburgan | 2026-02-20 22:34:23+00:00
>The impact is a direct threat to independent AOSP distributions like Murena's e/OS/ (which I'm personally using). If installing a basic APK eventually requires a Google-verified developer ID, maintaining a truly de-Googled mobile OS becomes nearly impossible.

I have trouble understanding why this is a threat to AOSP distribution. I would have said quite the opposite actually, I don't see why they would not remove the verification and that's an incentive for people to use their project instead of Google Android.
by kazinator | 2026-02-20 22:35:00+00:00
> What are folks doing to get around it?

Some are using Google Gemini.

It saves your chats, which are presented in a pane you can expand on the left and search. You can jump back into any chat and continue it, or delete individual chats.

This history is attached to your Google account, not to the chat window. You can pick up an existing chat in another browser on another device where you are authenticated with the same Google identity.

Now about the specific use scenario in this article (hitting refresh immediately after submitting a prompt, while the response is coming). Not sure why that would be important?

I just tried it several times. Both times, it initially appeared as if the Gemini interface lost the chats, since they didn't appear in the chat history section of the left pane. But after another refresh, they appeared. So there is just some delay.

Anyway, it's good in this regard beyond giving a damn.
by roenxi | 2026-02-20 22:35:10+00:00
> No my point is that the idea that the protests aren’t organic is deeply fucking ignorant and gross.

Scott Bessent, at the WEF [0], explained that:

> President Trump ordered treasury and our OFAC division, (Office of Foreign Asset Control) to put maximum pressure on Iran, and it’s worked because in December, their economy collapsed, we saw a major bank go under, the central bank has started to print money, there is a dollar shortage, they are not able to get imports and this is why the people took to the streets.

So it is organic insofar as the US is working hard to water and nourish something. This has been a huge push to destabilise and unseat the Iranian regime, the idea that they didn't have some people involved in the protests is hard to countenance. It'd be incompetence of the grossest variety. Technically possible? Yeah. A reasonable prior? No.

[0] https://youtu.be/TieI8GBcwTo?t=1760 & I got that from some random @ https://the307.substack.com/p/scott-bessent-again-boasts-tha... who has other choice quotes.
by RajT88 | 2026-02-20 22:35:36+00:00
I agree with most of this, but complaining about Yoleendadong is some "Old man yells at cloud" stuff.

My wife is a big fan, as she has a lot of funny content specific to Asian cultures. Yes, she has some relationship stuff too. You may not like her content, but she's got a few hundred thousand subscribers on Youtube, and 17 million on TikTok.
by iugtmkbdfil834 | 2026-02-20 22:35:43+00:00
This. Kids already have tons of those gadgets on. Previously, I only really had to worry about a cell phone so even if someone was visiting, it was a simple case of plop all electronics here, but now with glasses I am not even sure how to reasonably approach this short of not allowing it period. Eh, brave new world.
by makr17 | 2026-02-20 22:35:49+00:00
Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers.

* account ids are numeric, and incrementing

* included in the URL after login, e.g. ?account=123456

* no authentication on requests after login

So anybody moderately curious can just increment to account_id=123457 to access another account. And then try 123458. And then enumerate the space to see if there is anything interesting... :face-palm: :cold-sweat:
by observationist | 2026-02-20 22:37:40+00:00
Robotics is solved. Software is solved. There is no task on the planet that cannot be automated, individually. The remaining challenge is exceeding the breadth of skills and the depth of problem solving available to human workers. Once the robots and AI can handle at least as many of the edge cases as humans can, they'll start being deployed alongside humans. Industries with a lot of capital will switch right away; mass layoffs, 2 week notice, robots will move in with no training or transition between humans.

Government, public sector, and union jobs will go last, but they'll go, too. If you can have a DMV Bot 9000 process people 100x faster than Brenda with fewer mistakes and less attitude, Brenda's gonna retire, and the taxpayers aren't going to want to pay Brenda's salary when the bot costs 1/10th her yearly wage, lasts for 5 years, and only consumes $400 in overhead a year.
by magicalhippo | 2026-02-20 22:37:46+00:00
This is exactly what speculative decoding for LLMs do, and it can yield a nice boost.

Small, hence fast, model predicts next tokens serially. Then a batch of tokens are validated by the main model in parallel. If there is a missmatch you reject the speculated token at that position and all subsequent speculated tokens, take the correct token from the main model and restart speculation from that.

If the predictions are good and the batch parallelism efficiency is high, you can get a significant boost.
by throwaway876345 | 2026-02-20 22:38:20+00:00
My aunt is in her late 70s. She is a retired public school teacher who taught for over 30 years. Over the years she spends a majority of her leisure her time glued to Facebook on her iPad, consuming whatever content is delivered by their algorithm. She's become MAGA and will not tolerate any criticism of any moral wrongdoing by the current president or members of his administration. It's unbelievable the turn.