skysight-inc/HackerNews huggingface dataset:
That's not the real downside. If it were, you'd be seeing mini-"shadow brokers" leaks every month, because the practice we're talking about here is extremely widespread: the economics of being a zero-day broker hinge on being able to sell the same exploit chain many, many times to the same country, and to get recurring revenue each such sale.

The real downsides here are probably economic and have to do with how this shifts incentives for everybody in the industry. But, at the same time, every big tech company with a desktop/mobile footprint has invested mightily on staff to counter LE/IC/foreign CNE, which is something that might not have happened otherwise, so it's all complicated.

People write as if the disclosure of a bunch of IC zero days is like some kind of movie-plot "Broken Arrow" situation, but it's really mostly news for message boards. Organizations that need to be resilient against CNE are already in a state of hypervigilance about zero-days; adversaries absolutely have them, no matter what "NSA" does.
I've been using Go for about 10 years and this the first time I've heard of "Microsoft Go"
I want an IR camera and I want to input my desired temperature. That's all.

Then I want the microwave to cycle on when the camera says everything is below temp, and cycle off as soon as any hot spot hits temp. Then wait for the hot spot(s) to dissipate before cycling back on.

Seems like a foolproof way to cook evenly without overcooking.

I kind of approximate it now by cooking something frozen on high for a couple minutes, then on 20% power for five minutes, then 10% power for another five minutes. But it would be nice to have it all automated.
GitHub's real moat is their good and responsive support (even for free users), infra (GH Actions, GHCR, etc.), and value as social network. Indeed, people use GitHub because all their peers do (network effect).

Gitea focuses on self-hosting AFAIK
Looks like vi heart took down all of her youtube videos - which is where i first learned of flexagon.
No, it didn't. There's gaslighting going on, but I'm afraid you've been gaslit by the media here. CU was not about campaign donations, despite the frenzied attempts by various factions to pretend otherwise. No donations of money to political candidates were involved in the facts of the case or in the ruling in any way whatsoever.

There was no century old precedent at stake at all. The case, and the ruling, was about the FEC attempting to use a 2002 statute to censor the release of a movie in 2008, invoking a concept ("electioneering communication") that did not exist at all prior to the 21st century.
And the M365 copilot is utter trash as well. It's the only thing we're allowed to use at work and it can barely write functional PowerShell.
I'm currently reading Modern Software Engineering by David Farley and I can say that we won't see programmers replaced unless all the concerns pointed out in this book and others has been resolved.
Ask HN: Intruder detection 101 in cloud environments – where to start?
Say you're a newly hired security architect for a global cloud environment that involves dozens of teams and services employing a variety of access patterns, protocols, etc. You observe that the org has a number of best-practices prevention mechanisms in place (e.g., decent auth-auth between services, team-based RBAC) and you conclude that it's not trivial for adversaries to gain access. However, you learn that there's no intrusion detection, so if someone did gain access, it would be difficult to identify that such access had been obtained. Where do you start?

In no particular order, here are some options that come to mind:

0. Ignore detection and focus primarily on prevention measures (better bang for the buck?)

1. Deploy a SaaS solution like CloudStrike/Falcon (and hope they don't take down your network or get compromised themselves)

2. Deploy something like Snort https://news.ycombinator.com/item?id=31534316

3. Setup/review generic monitoring of VPC flow logs for obvious anomalies

4. Focus on access log anomalies rather than network-level anomalies

5. Deploy honeypots and set up alerts for attempts to access them

6. Run a small red team experiment to measure how much noise would be necessary for someone to notice

7. Read a book to learn the fundamentals (which one...?)

8. Organize a task force without knowing which of the above options to recommend

What would you do? Where would you start?

--

(In real life, the situation is more complicated and nuanced. I'm a SWE, not an architect, and I am acting from imperfect information — my employers may indeed have intrusion detection but exactly what/how isn't visible to me. Because those tools tend to be accessible only to certain IT/InfoSec teams, I have developed a blind spot for what is considered best practices. I hope that some HN opinions can help me frame the harder problem of how to advocate for this stuff internally.)
Musk Shares Fake Video Claiming USAID Paid Hollywood Stars to Promote Zelenskyy
> The 10% of my job which is coding just isn't the difficult part.

Even so, is there any reason to believe that the other 90% won't also be automated?

As you said, the goal of these systems is to replace wages.
Yes - https://www.phoronix.com/news/Microsoft-Azure-Linux
Facts about Americans' Views of the World Health Organization
One idea maybe to submit to an industry conference and review the feedback. Usually they only require you to submit a short abstract and the turnaround time is a few days.
But who is copilot being marketed to?
what are you attempting to achieve with this idea? what kind of foothold? ideas are everywhere, they are cheap. the idea plus the execution, timing, marketing, and approach are all factors in something being successful. maybe you are thinking you need to make a startup or something to be successful.

i understand the feeling you have a little bit, but agree with the others that you don't need to despair too much about the industry, there is still a great need (and will be) for humans to understand the systems we are using and be able to get in the weeds to solve problems.

totally agree we might need less people writing/wrangling code, and it might put downward pressure on salaries... on the other hand, there might be upward pressure on salaries as developers will have a higher output and the ROI for hiring an effective developer in this environment will go up. especially when production is on fire, the AI that wrote the code that is on fire might not be the best source of how to solve it.

to me this is all basically a big unknown, without substantial reason to panic though, even if it feels overwhelming and hopeless from a certain perspective at the start of a career. currently a lot of development feels pretty sluggish to me, we fight with build tools and multiple languages and eke out these incremental improvements - if developers can work much much faster, that's great, but then we hit a limit to like... OK we need to let the product changes "settle" for a while and get user feedback about the changes, we can't actually ship 14 major product updates in a week because users will have no idea what the fuck is happening. but maybe we can do more advanced things with rapid split testing and automated success metrics to deploy pages that "self-optimize" or something, and there might be new second and third order ideas that come from this where it takes a human to manage and direct and build and solve things at that level.
If these annotations are so powerful why haven't they been adopted in all these years then? Why mention them now as an alternative to Rust? And why not try both and see what sticks?
Whataboutism. What China does doesn't invalidate any criticism the US gets. Or are you saying that actually it's perfectly fine to do this?
I am deeply humbled.
Not a major problem in my experience if you use the aistudio version of the model. Claude tends to be the most conservative in my experience. Gemini 2.0 and 4o appear similar.
Commenters may be missing that Google, Amazon, etc., as US government contractors, are required to follow the legal requirements for all such contractors. Previously contractors were required to follow rules based on a policy set by a Johnson administration EO in the 1960's. That policy has been replaced by a new EO. Online commenters might prefer to focus on recent changes as representative of corporate culture, management ideology, etc. instead of business judgment (as in the "business judgment rule" followed by the US courts), e.g., meeting the necessary legal requirements to secure/retain government contracts.

https://www.ebglaw.com/insights/publications/dei-and-affirma...
I'd imagine the biggest cost might be not hiring a decent engineering team - since then you are probably spending a boatload more on server costs and bandwidth and losing customers due to bugs and glitches
you're right, I meant $0000 and $0001 which _are_ registers. The rest 254, yeah. Zeropage is a must on C64 at least. I don't know much about other platforms.
Waymo to Begin Testing in New Orleans
Looks like this is just a limited window, with no public access, but they seem to be getting ready to expand very quickly, very soon.
Yes, the update rules please.
It's hard to to rate the quality, I just feel like it does a better job of knowing the codebase and what I am working on via whatever mechanisms they have implemented.

I also find the DX better, I only really use the right click to mark code to talk about, and then the chat. The accept/reject changes UI works better imo.

In short, I barely have to do anything to use the AI features, just feels right.

---

Just try both, I didn't feel like Cursor suited my style much, Windsurf had me hooked instantly.
(Disclosure, CEO of Aryn (https://aryn.ai/) here)

Good post. VLM models are improving and Gemini 2.0 definitely changes the doc prep and ingestion pipeline across the board.

What we're finding as we work with enterprise customers:

1. Attribution is super important, and VLMs are there yet. Combining them with layout analysis makes for a winning combo.

2. VLMs are great at prompt-based extraction, but if you have document automation and you don't know where in tables you'll be searching or need to reproduce faithfully -- then precise table extraction is important.

3. VLMs will continue to get better, but the price points are a result of economies of scale that document parsing vendors don't get. On the flip side, document parsing vendors have deployment models that Gemini can't reach.
reminds me of the classic post: https://workplace.stackexchange.com/questions/93696/is-it-un...

OOC Do you use ChatGPT/Gemini via the chat interfaces, pasting context and design and then copying out?

Thanks!
Your for example is basically Common Lisp's `loop`

(loop for i in my-list
do (logic)
(more logic)
(yet more logic))
@atgreen - Would love to hear what key lessons / takeaways you've learned while working on this project?
George Orwell wrote this because of how words are co-opted by the media to obfuscate and dilute their meaning. A discussion can still define it and that definition can be used for the purpose of discussion.

In this case, the site has a bunch of sliders, whereby each slider indicates how far along we are on that axis of what they're calling fascism. Each of those axes can easily be one or more individual topics. At any rate, this website is at least more specific than "something not desirable" when it comes to how it defines fascism.
I like the different P(x) breakdowns, although I think there's something inconsistent in how they are used: A high value of P(correct) in Creative means "screwing up is impossible" but in Planning it means "screwing up is unacceptable."

Perhaps Planning was supposed to have a different term, like Cost(correct) ?

> Current AI models have no inner thoughts, ideas, experiences or emotions, at least not in a way I recognize them

I'm conscious of repeating myself, but one of the biggest AI illusions being cast right now involves confusion between character and author. We humans are presented a story with a clever relatable robot character, and are encouraged to impute all of those inferred fictional qualities onto the real-world algorithm.
Actually states can arrest them for any non-federal crime, punish them and incarcerate them and there is nothing Trump can do about it.
I mean, you might still be right but I'd rather suspect that they didn't consider somebody running SQLite over S3 with 100ms latency ...

Presumably, it is faster on a saner filesystem.
1% per day which is the number I found doesn't seem terrible for solar type systems.
R1 Computer Use
Hey HN,

We are working to apply the ideas of R1 to computer use. The primary struggle is creating reliable neural reward models since hard-verification rewards are not available at scale in GUI interactions.

Our team is currently deep in the weeds of collecting reasoning annotation data for GUI interfaces to train a reliable reward model.

We would love all thoughts, feedback, and collaborations!
Hey HN,

We are working to apply the ideas of R1 to computer use. The primary struggle is creating reliable neural reward models since hard-verification rewards are not available at scale in GUI interactions.

Our team is currently deep in the weeds of collecting reasoning annotation data for GUI interfaces to train a reliable reward model.

We would love all thoughts, feedback, and collaborations!
I have no idea how you came to that conclusion.

The government has vulnerabilitys in stock that they already verify function as intended. They already regularly verify these vulnerabilitys continue to function with each update cycle. They already quantify these vulnerabilitys by ease-of-discovery, impact, etc. so they can prioritize utilization. They already determine vulnerabilitys to disclose.

Assuming that the vulnerabilitys they disclose are not entirely "actively under exploit", the only difference in my proposed policy is that they do not disclose the details to the vendors so they can paper over them. Instead, they publicly announce the presence of vulnerabilitys and then keep verifying as they already do until the vulnerabilitys no longer function.

You seem to think I am arguing that the government should create a new organization to look for vulnerabilitys in all software everywhere and then act as I stated.
The upstream Go 1.24 changes and macOS support using system libraries in Microsoft's Go distribution are really significant for the large ecosystem of startups trying to sell to institutions requiring FIPS 140 certified cryptography.

For a variety of reasons - including "CGo is not Go" (https://dave.cheney.net/2016/01/18/cgo-is-not-go) - using boringcrypto and requiring CGO_ENABLED=1 could be a blocker. Not using system libraries meant that getting all of the software to agree on internal certificate chains was a chore. Go was in a pretty weird place.

Whether FIPS 140 is actually a good target for cryptography is another question. My understanding is that FIPS 140-1 and 140-2 cipher suites were considered by many experts to be outdated when those standards were approved, and that FIPS 140 still doesn't encompass post quantum crypto, and the algorithms chosen don't help mitigate misuse (e.g.: nonce reuse).
LibreOffice 25.2 released
How did that "fade any existing lit pixels" bit work? Do you just redraw the list N lines, fading in from black (to completely erase the oldest) to the full color of the newest?
Apple TV+ is great on Roku (have an older 4K box that still has Toslink output). Also liked the experience on a newer Apple TV box that now has buttons for scrolling (only other Apple TV box I've used is the first generation which is touchpad only and I'm not a fan of)
I dunno, a job? I don't think one other person's idea is enough.

> ideas are everywhere, they are cheap. the idea plus the execution, timing, marketing, and approach are all factors in something being successful

And water is everywhere but you need a boat to get across it. I don't think I have a boat. I don't know if I can build one. I don't know if anyone will let me on their boat. s/boat/idea generation/g.
Never called you a Nazi. Just said that the guy who gave the Nazi salute, twice, while standing behind the Seal of the President of the United States, is a Nazi.
Assuming you actually see that money. Musk and Trump are both famous for avoiding debt obligations. It may not even be legal for them to make this offer -- not that this is necessarily a limitation, but it makes an excellent excuse.
Why all these approaches have not succeeded is that to close the gap, you have to backtrack on all the effort made so far. Like choosing a shortcut and stumbling on an impassable ravine. The only way is to go back.
There are a couple parts to it.

As someone who's been in the industry a long time I think Azure and AWS are very easy to use compared to the bad old days where you would call/send an email/create a ticket and wait for somebody else to provision a machine for you, add a disk drive or something and it was like Russian Roulette in that there was a 20% chance they'd so something seriously wrong.

So far as automatability is concern I think people who are struggling are struggling because they use Chef, Puppet, Ansible, CloudFormation and other high-level tools that introduce complexity. It is dead easy to write a Java or Python program that creates a cloud instance and all the resources it needs and writes a bash init script that will configure the machine however you need it. If you try anything else you are always going to be debugging problems that were introduced by your tools.

(I know some people swear by it, and the ability to 'build your own instance' looks cool, but I had some terrible early experience with Google Cloud Computer)

So Vercel partially has an easier UI because it is a simpler product for better and for worse. Azure is "simple" for some people because you can often "lift and shift" an on-premise system in the cloud with a 1-1 mapping of concepts. You can use cloud native services at your own pace.

Now if you start out with Vercel and that's the way you think, it's even simpler, but if you had to move a legacy system there it would be a total rewrite

----

Then there's the more superficial aspect of UX which is not superficial at all. It's really a people problem. Somebody on the team has to care about it and the rest of the team has to let them do it. It can be as simple as "there's a person in charge of UX who cares" and management doesn't get in the way. However there are many people on the team with different demands. Sometimes management is in an excessive hurry or is way too niggardly but this tends to be an expensive mistake that can slow down development dramatically. Ideally management believes in the value of good UX and the folks doing the work agree.
I like this one even more

"I'm a Barbie girl" again, but in the style of 6 classical composers
https://m.youtube.com/watch?v=WRfsibwR5x4

The guy is a blast!
Oh man, I needed this so many times didn't even think of doing it like this. I tried using Selenium and all different external services. Thank you!

Works in chromium as well.
My rough calcs estimate you would need about 400mg of salt per ml of water to get a 7°C boiling point increase, but the max solubility of salt in 100°C water is 384mg/ml, so you might just get there with a supersaturated solution.

Can sous-vide machines hold 100°C in oil?
hey at least people aren't eating them anymore...

https://www.chefsresource.com/why-did-victorians-eat-mummies...
Yikes.

It's valid to assume "it will never happen" for 128 bits or more (if the hash function isn't broken) since chance of a random collision is astronomically small, but a collision in 64 bits is within realm of possibility (50% chance of hitting a dupe among 2^32 items).
Honestly, the fact that you're commenting on Hacker News already marks you as somebody who is curious and engaged with your field.

Personally I don't think having unique ideas is as important as being able to execute on projects in a self-directed way.
Very nice, I didn't know this. I used pyppeteer and selenium for this previously which seemed excessive.
Is this used anywhere outside of Azure?
But this isn't just cloud infra / platform like AWS etc right, but also various SaaS products. e.g. Office 365, gsuite, github etc. Are there even equivalent (enough) versions of all those that are not only hosted but owned by EU companies?
> While the Court didn’t explicitly equate money with speech

The court did the exact opposite, and repudiated the attempt by the FEC to equate money with speech.

The FEC were effectively arguing that "speech is money" and that their authority to regulate campaign donations allowed them to censor the direct expression of political opinions by organizations that weren't associated with candidates in any way, under the theory that the expenditure of resources in a way that might influence voters' opinions is equivalent to directly donating the monetary value of those resources to whichever candidates might benefit from shifts in opinion.

Prior to the FEC's attempted enforcement of the 2002 BCRA, this wasn't even an issue at question -- the right of individuals and organizations alike to express their own opinions with their own resources was never in doubt.
On Roku (actual box not integrated) Peacock has been good quality. Definitely hits 1080P with a decent bitrate. I suspect the software teams only have the bandwidth to focus on a few of the more popular devices (so probably Roku and Apple TV boxes) and others suffer
Its very well known that if somebody says something extreme, such as radical views, they tend to assume other people who dont oppose them, agree with them. The only possibility is to take your stance and give contra.

Also it‘s a difference to be against immigration versus the open salutation and worshipping of a mass murderer millions of europeans and americans have died for to stop.

For me it’s disgusting that this tabu is now broken and everybody still tries to loudly ignore it!
Does X Cause Y
Machines and dumbbells initially when I injured my arm (it was a repetitive use thing and not a trauma), and then after a long break and trying to let it heal, I switched to barbell for most things, along with a pressing machine (because I don't have somebody to spot me for bench press) and a pulldown machine.
> you could also just salt the water?

Hmm, so to get a 12.5ºF dT with water and NaCl we need about 6.7 mol salt per kg water [1]. That's almost 400 g/kg, more than 10x the salinity of seawater.

Pressure-vessel kitchen it is.

[1] https://en.wikipedia.org/wiki/Boiling-point_elevation#Ebulli... i = 2, Kb = 0.93°F kg/mol

[a] That 6.7 ml/kg is technically a molality, something I only point out because it's a silly-sounding word
I've been wrestling with these same challenges while building RA.Aid—trying to make tools that speak LLM. We have good tool integrations, but a lot of the tools were originally designed for human consumption. The LLMs seem to have their own idea of how they want to do something, which is what makes prompt optimization such an important factor.
I worked on a project about 4-5 years ago that required operating in a FIPS 140-2 environment and this was a huge problem, happy to see there's multiple different investments into doing this right. Same with OpenSSL offering an easy-to-snag FIPS-certified implementation.

We had to buy what felt like bootleg Canonical OpenSSL binaries, and Go looked like building some speculative forks that clearly had not been designed to be released.
The unlawfulness is the part that is newsworthy and incredibly frightening. That's the part that matters.

If the executive can unilaterally decide to allocate funds to wherever it wants while ignoring Congress, then Congress is no a coequal branch and our constitutional order is dead.