skysight-inc/HackerNews huggingface dataset:
Here’s an extended comment by another astrophysicst: https://telescoper.blog/2025/01/02/timescape-versus-dark-ene...

The most important bit:

> The new papers under discussion focus entirely on supernovae measurements. It must be recognized that these provide just one of the pillars supporting the standard cosmology. Over the years, many alternative models have been suggested that claim to “fix” some alleged problem with cosmology only to find that it makes other issues worse. That’s not a reason to ignore departures from the standard framework, but it is an indication that we have a huge amount of data and we’re not allowed to cherry-pick what we want.
Oh I know that feeling. We got in hot water because the codes were 6 digits long and security decided we needed to make them eight digits.

We pushed back and initially they agreed with us and gave us an exception, but about a year later some compliance audit told them it was no longer acceptable and we had to change it ASAP. About a year after that they told us it needed to be ten characters alphanumeric and we did a find and replace in the code base for "verification code" and "otp" and called them verification strings, and security went away.
Spherical robocop in China offers glimpse into future of law enforcement
In the early 1990s a paddler named Eric Jackson was fast enough to make the U.S. Olympic team in whitewater slalom kayak. But he lacked funds to go.

So he dressed up in his full paddling outfit and brought his boat (4m long in those days) and paddle to a street corner in downtown DC. He set up a “meet an Olympian” sign and charged people cash to have their picture taken with him. Much hustle, very entrepreneurial of him, and he made a decent amount of money.

But he got into huge trouble with the U.S. Olympic establishment, and was almost dropped from that team. They said they were scandalized that he would dare to try to make personal money from his Olympic team status. It became clear to some that they were also mad he dared to demonstrate how poor many Olympic athletes actually were—by essentially begging on a street corner in a part of town full of prominent people.
I think exposing 8080:8080 would result in sockets bound to 0.0.0.0:8080 in either Docker or Podman. You still need 127.0.0.1:8080:8080 for the socket binding to be 127.0.0.1:8080 in Podman. The only difference is that Podman would not punch holes in the firewall after binding on 0.0.0.0:8080, thus preventing an unintended exposure given that the firewall is set up to block all incoming connections except on 443, for example.

Edit: just confirmed this to be sure.

$ podman run --rm -p 8000:80 docker.io/library/nginx:mainline
$ podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
595f71b33900 docker.io/library/nginx:mainline nginx -g daemon o... 40 seconds ago Up 41 seconds 0.0.0.0:8000->80/tcp youthful_bouman
$ ss -tulpn | rg 8000

tcp LISTEN 0 4096 *:8000 *:* users:(("rootlessport",pid=727942,fd=10))
To be honest, that was my first thought on reading that headline as well. Given that especially those large companies (but who knows how smaller ones got their training data) got a huge amount of backlash for their unprecedented collection of data all over the web and not just there but everywhere else, it's kinda ironic to talk about intellectual property.

If you use one of those AI model as a basis for your AI model the real danger could be that the owners of the originating data are going after you at some point as well.
Seems like larger machines are likely to have larger material removal rates. Dependent on the surface of the digging tool and it's feed rate.
Brazil eliminated daylight saving time. It's having second thoughts
You do remember the entire dot com boom and bust, the punch the monkey banner ads, X11 pop under ads, etc?

Don’t romanticize the early internet.
How would Swiss Re get the data except by collaborating with Waymo?
> I think the takeaway here is that the pg image should autogenerate a strong password or not start unless the user defines a strong one. Currently it just runs with "postgres" as the default username and password.

Takeaway for beginner application hosters (aka "webmasters") is to never expose something on the open internet unless you're 100% sure you absolutely have to. Everything should default to using a private network, and if you need to accept external connections, do so via some bastion host that isn't actually hosted on your network, which reaches into your private network via proper connections.
Brief Introduction to Fix and Fix JSON
Your comment confused me, but I'm very interested in what you're getting at.

> Circumventing a copy-prevention system without a valid exemption is a crime, even if you don't make unlawful copies.

Yep, this is the DMCA section 1201. Late '90s law in the US.

> Copyright covers the right to make copies, not the right to distribute

This is where I got confused. Copyright covers four rights: copying, distribution, creation of derivative works, and public performance. So I'm not sure what you were getting at with the copy/distribute dichotomy.

But here's a question I'm curious about: Can DMCA apply to a copy-protection mechanism that's being applied to non-copyrightable work? Based on my reading of https://www.copyright.gov/dmca/:

> First, it prohibits circumventing technological protection measures (or TPMs) used by copyright owners to control access to their works.

That's not the letter of the law, but an overview, but it does seem to suggest you can't bring a DMCA 1201 claim against someone circumventing copy-protection for uncopyrightable works.

> Whether or not model weights are copyrightable remains an open question.

And this is where the interaction with the wording of 1201 gets interesting, in my (non-professional) opinion!
I don't mind the content itself, but the title implies you have a useful method to learn new skills.
Today’s “extreme voices” are tomorrow’s “being against slavery”, depending on who you’re talking to.
Taking the Black Mirror episode "Be Right Back" [1] closer to reality.

[1] https://en.wikipedia.org/wiki/Be_Right_Back
To be fair, I would also be alarmed, albeit not by OTP. "sign an electronic document" and "built with COTs libraries in a single sprint" is essentially begging for a security review. Signatures and their verification are non-trivial, case in point: https://news.ycombinator.com/item?id=42590307
Send PR for better title and I'll change it
While playing a modern sandbox adventure game, I became enamored by the logic loop system.

Essentially everything is a little machine with inputs and outputs all responding reactively to world state changes. Everything having an interface and a simple list style prioritization. Clicking on anything will show its last message (such as an error message, or that it is working fine.)

There could be a “global chat” where everything logs (that environment didn’t have a helpful combined log.)

It gave me (a business applications developer) a dream for a simulated environment where our business processes have well defined interfaces (StrictYAML?) and they interact in a world simulation environment (for which inputs and outputs could be interfaces with the real world.

Feel me? So I could write an “agent” (logical not necessarily LLM) which performs a data task (periodic searches for a pattern.) these roll up world state and your watchdog agent alerts when preconditions are met (volume, failure rate, drastic change in some frequency.)

An effective sandbox for simulation and emulation of the business domain. In this environment one could produce workers which search for and respond to any pattern.
Is this meant to be sarcasm? If we're comparing only stamping parts in a factory vs. pushing the human body to its limits, you probably ain't gonna make money in either. But one of them is going to be a far more satisfying way to live for the soul. We can talk about other things that matter, but there's probably less of that out there than you might think.
Waymo is a taxi company. As you'd expect the customer isn't driving, isn't necessarily licensed to drive, certainly isn't authorised to drive, so necessarily the customer is not liable.

I'd actually anticipate that it makes sense in principle for them to self insure because that way they aren't paying a premium to a for-profit insurer and they have enough vehicles that the statistical risk evens out well enough. I believe that self-insurance† is still legal in the places where Waymo operates (I might be wrong).

† Self insurance is a strategy where you can and will just pay out of pocket, this obviously isn't viable for all but the richest individuals but it makes sense for say, FedEx.
I live in Thailand and I applaud their work - also here at the Chao Praya river.

However, I wonder if the money would not be better spend in lobbying, enforcing etc. a plastic tax on throw away plastic goods.

In my home country in Germany, the use of throw away plastic is much less due to effective regulations.

If we have only a finite amount of money to stop plastic pollution, invest it in recycling or avoidance?
taram53
I'd add to the Money Stuff newsletter the Money Stuff podcast, with Matt and Katie Greifeld (BBG reporter). The two have great chemistry, and slightly different interests in finance, so it covers topics beyond the single thread he typically covers in the newsletter.
we have just outsourced to neighboring countries in SE asia
I wonder how many people realize you can use the whole 127.0.0.0/8 address space, not just 127.0.0.1. I usually use a random address in that space for all of a specific project's services that need to be exposed, like 127.1.2.3:3000 for web and 127.1.2.3:5432 for postgres.
3-D illustration of various components and objects. Also YouTube channel
> One ambitious goal of companies developing AI agents is to have them interact with other kinds of software as humans do, by making sense of a visual interface and then clicking buttons or typing to complete a task.

Can it avoid dark patterns? If it can't, then it's not a solution to anything. It's more like an additional problem. It also opens the door to the concept of dark agents (hey, this bot _always_ installs the Altavista search bar).
That's a bit of a stretch here... Had the attackers' target been to escape from the docker container, they would have done it. They may even have done it, we can't know as OP does not seem to have investigated thoroughly enough apart from seeing some errors and then stopping the container...

Also, had it been a part of the host distro, postgres may have had selinux or apparmor restrictions applied that could have prevented further damage apart from a dump of the DB...
Write Prompts Like a Pro: Checkout These Prompt Engineering Tools
In this article, we’ll explore various prompt engineering tools, including those for creating prompts, testing and experimenting, managing prompts, and popular prompt libraries on GitHub.
I think GP means this
https://www.attejuvonen.fi/static/92eb0beb02adda69075fbbba8c...
It's an Open AI service, that's intelligence I gained by hacking, I got it to tell me its name. Once it was "ChatGPT by OpenAI" and another time it was "AIAssistant by OpenAI". Of course it's assuming that nobody lied to me. Whatever.

And of course the general rule is: validate both on the client and on the server. Clientside validation is for filtering work for the server and serverside validation is for people like you who either hack the form or use curl directly.

That's old news, but the same mistakes tend to repeated by everybody, myself included.
We dropped all support for 286 or 386+ protected mode/paging etc, as well as produce only 8088/8086 instructions so it'll run on any x86 (including the PCjr with its peculiarities, remember that?) running in real mode only without MMU. Of course, that means any program can write anywhere, so more care is taken towards program correctness, which is kind of fun.
Certainly doesn't in the UK, are you sure that's true where you are? Here incorporating as an ltd (limited liability) costs I think £25, but you can start a business as a sole trader without any kind of fee or registration (just a de facto status requiring declaring the income on your personal tax return).
Better security design fixes this. Sandstorm fixed this for self-hosters ten years ago (Sandstorm is designed to run unmaintained or actively malicious apps relatively safely), but people are still choosing the quick and easy path over the secure one.
Is there a blog post/tutorial on how to take a fairly complex docker-compose.yml and migrate it to quadlets?

UPD: hmm, seems quite promising - https://chat.mistral.ai/chat/1d8e15e9-2d1a-48c8-be3a-856254e...
Convert hand-drawn diagrams into clean SVGs
The Bitter Lesson pertains to the long term. Even if it holds, it may take decades to be proven correct in this case. Short-term, imparting some human intuition is letting us get more useful results faster than waiting around for "enough" computation/data.
Yes, GP noticed that the image is AI generated and they made an assumption that probably the text is AI generated too, since the image is.

The image is AI generated.

The text is not AI generated.
I think the point was pretty simple: there's no reason that pursuing your Olympic dreams would be a way to make money. So feed your soul, but unless you come to it with money, be prepared to find another way to feed your wallet.
Any sharing of information or data could be construed as a collaboration, but this seems to go beyond that, as the research paper includes multiple Waymo employees as coauthors.
Ask HN: What is the next big thing?
This question is asked every few years. Now that we are in 2025 and AI/ML/LLM is moving full steam forward with something new and/or revolutionary popping up every week.

What "new" do you think is gonna be emerging in 2025?
Is Alistair Riddoch still around? I've been wondering about him, his name is all over the early dev86 and ELKS C library code :)
Has there ever been any production software ever written that didn’t suffer from some kind of bug or exploit?

I don’t think imperfection is a choice we’ve made. I think imperfection is part of our nature.

That said, the current state of software development is absolutely a choice, and a shockingly poor one in my opinion.
Related from a few weeks ago:

Eliminating Daylight Savings Time would make the average American’s life darker

https://news.ycombinator.com/item?id=42443456
where would you get help running that simh? it builds and produces binaries on linux but chokes on things like 'set quiet' says non-existant device, much less do much in the vax780.ini. should I try again on a 32 bit installation, as I'm using a 64 bit linux right now?
Are dark patterns harder than captchas?

I'd say no.
Rocket-inspired reaction yields carbon with record surface area
I assume there's an RF mixer somewhere in there.

Edit: read the paper, now more confused
The credit card (or rather, money) was required to purchase the computer, much like it’s required to purchase other power tools or industrial machinery
It isn't a "strangely extreme reaction" to say that something that hasn't happened hasn't happened.
The thing is, driving is a privilege and not a right since it can be revoked.
+1 to the other commenter. Please, make the URLs shareable. Maybe use the PlantUML's technique as the inspiration.
For crypto miners, it’s pretty easy to tell if your servers are in your house. Even if they aren’t, if you have any kind of metrics collection, you’ll notice the CPU spike.

My general feeling is that if someone wants to install a hardware rootkit on my extremely boring home servers, it’s highly unlikely that I’ll be able to stop them. I can do best practices (like not exposing things publicly), but ultimately I can’t stop Mossad; on the other hand, I am an unlikely target for anything other than script kiddies and crypto miners.
Why not both? Use the tax to fund the cleanup. If people stop throwing away plastic, we won't need the funds.
TIL I always thought it was /32
"This year, The Ocean Cleanup removed 11.5 million kilos of plastic from oceans and rivers."

I don't want to diminish this effort, but just to put this into perspective:

* About 460 million tons of plastic are produced every year

* About 20 million tons of that plastic end up in the environment as litter

* About 14 million tons of plastic end up in the seas every year, so this project removed roughly 0.08% of that.
> What could be a better personal assistant than an AI that's imprinted on your electronic personality as evidenced through your emails, messages, documents, social media postings, transcripts of your phone calls, etc.

One who can, you know, move. And interact with the physical world, like open letters or run errands. And correctly anticipate your needs. And react to unpredictable situations. And not make stuff up. And shield you from stuff you don’t want to engage in. And, and, and…
What could be one such business domain?
Leading through writing in software engineering
Of course, that means you need to run NixOS for that to work (which I also do everywhere) and there are networking problems with Docker/Podman in NixOS you need to address yourself. Whereas Docker "runs anywhere" these days.

Worth noting the tradeoffs, but I agree using Nix for this makes life more pleasant and easy to maintain.
> hoarding data

Laundering IP. FTFY.
> this is something that I used to do with academic papers

Academic papers are designed to be read from start to finish. They have an abstract to set the stage, an introduction, a more detailed setup of the problem, some results, and a conclusion in order.

A structured, single-document academic paper is not analogous to a multi-file codebase.
Trump was pressuring the FDA to even skip their safe guards and the FDA had to push back. Trump wanted the approvals before the election - two months earlier than it was approved.

It was approved before the inauguration. No one thought it was “Biden’s victory”
The real fun starts when they start writing the insurance contracts that are only meant to be readable by ML algorithms. Imagine thousands (millions?) of contract pages written in practically incomprehensible language, designed by an ML algorithm to contain clever loopholes that are difficult to detect by an adversarial algorithm.
Yep. I signed their CLA way back when under that same logic. I absolutely would not sign a CLA from anyone else.
If the Telecommunications Act of 1996 saw the internet of 1996 as built on top of raw telecom circuits, that might have something to do with the fact that it was. Nowadays, it's the other way around: the telecoms system is built on top of raw internet circuits.
It does. However DPI firewalls look at and block the upgrade handshake.

Connection: Upgrade
Upgrade: websocket
Social democracy is the term that is usually used.
Robotaxis are remotely monitored/controlled by human 24*7. We don't know how often human interferes in driving.
The betting on cameras alone is basically an Elon Musk thing. His reasoning is basically that if humans can do it AI should be able to do it. So far the software isn't really up to it but time will tell. Some stuff - https://www.engineering.com/now-revealed-why-teslas-have-onl...
Surface might be enough to save Albatrosses from extinction. Every little bit helps!
Of course there are better alloys today for all those specific uses (likely except musical).

It was just a comment on the oddity that what the Egyptians were using had not yet been figured out, but that he knew. Despite all our vast current knowledge, there remain bits of arcane knowledge still hidden away in obscure corners.

It's definitely NOT the case that "any competent chemist could figure it out".

He'd also told me about an MIT team who had gotten closer than others to figuring it out, but gave up after the mixes/processes kept exploding on them. Definitely no lack of competence there, but maybe they did run out of budget or motivation to keep unintentionally blowing things up. It's not as trivial as you'd like to think.
Dishonesty is rampant in our world.

That's why Merlin says honesty is the most important virtue.
"to working the graveyard shift at a 24-hour adult video store (fired for being “too horny”)"

I really don't think this is why he was fired.
Streaming SIMD Extensions?

Server-sent events.
Sure, most technology replaces human labor. The printing press put thousands of book copiers out of work. The word processor destroyed the entire job description of “typist”.

The promise of AI is that it will free human labor to focus on higher value areas rather than copying books or typing up the boss’ scribbled notes.
The only future where this happens is if little, non- infrastructure / specialized hardware models maintain functional parity with "throw more hardware at the problem" big models.

That seems... unlikely.

And then we'll see the same evolution that built Google.

Someone with the best algorithm leverages that into a revenue stream, then uses that revenue to buy hardware, then monetizes its userbase via advertisement, then uses that additional revenue to buy market share.

I'm sure it'll make someone a ton of money, but it's not a future I'd like to live in (again).

Diversity is strength.
With exceptions, was reading recently an interesting die analysis/estimate of the costs and margins of manufacturing of the AD9361 chip (a 65nm, digital radio transceiver, introduced 12 years ago and still selling at retail today for $300/$400):

https://zeptobars.com/en/read/AD9361-SDR-Analog-Devices-DAC-...

Relevant quotes (and the current retail price if anything is higher now then when the article was written):

“ Retail price of AD9361 at distributes is 275$, volume price from manufacturer is 175$.

That is quite an impressive added value! For 1,68$ of manufacturing cost we are getting 173,32$ of added value! Even Intel with their x86 or drug cartels could NOT do business like that.”

Of course, the actual margin needs to take into account NRE and other costs (and the above link does get into that) but, in this case, the manufacturing is a tiny sliver of the costs.
The icing on the cake is that you can also enable Phoenix channels to fallback to longpolling in your endpoint config. The generator sets it to false by default.
>They got on well, and when they were talking one day, she learned Dugan had been sewing a triangle of paisley cloth into her boyfriend’s Levi’s, allowing him to more comfortably pull them over his boots.

Why was this person putting on their jeans after putting on their shoes?
Yeah, I think their reputation isn't what it used to be. But it takes a long time for these things to percolate up from developers and lawyers to management, and another long time for them to spread from IT-focused businesses to other industries.
Then you see the Australian breakdancer and you see they are all in it for the fun.
Why would it not avoid dark patterns? Assuming the reinforcement learning takes desired task and correct outcome into account, it would take work to train them to fall for dark patterns.
They claim 90-some percent
Female Developers Navigate Discrimination in a Male-Dominated Field
Government assistance is neither socialism nor communism. You do not understand what those terms mean.

Additionally, most of the government handouts we see are going to large corporations or the military.