skysight-inc/HackerNews huggingface dataset:
> So it really boils down to prompting in such a way that the right set of components are brought together in the right way. That's where the skill now lies.

And how is this different from just calling the libraries in the right way to make it adhere to stakeholder requirements?

The statement isn't "its impossible to get an AI to print the code for a right program", but "the work and skills you need to get an AI to print the right program is as much or more than to do it yourself.". That seems to be true for all but trivial programs. Here trivial means you can download a git repo and change some variables to get that result.
Typically you train it on one set and test it on another set. If you see that the differences between the two sets are significant enough and yet it has maintained good performance on the test set, you claim that it has done something useful [alongside gaming the benchmark that is the train set]. That "side effect" is always the useful part in any ML process.

If the test set is extremely similar to the train set then yes, it's goodharts law all around. For modern LLMs, it's hard to make a test set that is different from what it has trained on, because of the sheer expanse of the training data used. Note that the two sets are different only if they are statistically different. It is not enough that they simply don't repeat verbatim.
Suddenly HN has decided that they're not visual learners anymore. Too bad, Keenan Crane from CMU has the best video course series on Discrete Differential Geometry:

https://www.youtube.com/playlist?list=PL9_jI1bdZmz0hIrNCMQW1...

https://www.cs.cmu.edu/~kmcrane/Projects/DDG
Because it is the same.
Hiring remote employees? Use Zleni
A large amount of work in the last few years has gone into building benchmarks because models have been going though and beating them at a fairly astonishing rate. It's generally accepted as true that passing any one of them does not constitute fully general intelligence but the difficult part has been finding things that they cannot do. They are giving them more and more difficult tasks. The ARC prize in particular was designed to be focused on reasoning more than knowledge. The 87.5% score achieved in such a short time by throwing lots of resources at conventional methods was quite a surprise.

You can at least have a degree of confidence that they will perform well in the areas covered by the benchmarks (as long as they weren't contaminated) and with enough benchmarks you get fairly broad coverage.
And that is why the human race is truly doomed (and well deserving of it). Nobody wants to fix the root cause of any problem. Instead, let's just keep ignoring the disease and only treat the symptoms... That'll solve everything.
YC alum LunaJoy got $6.6M, offers job below minimum wage
"It’s too easy for a human today to forget to auth an endpoint."

Woah. Is this real?
Show HN: MathCask – Share mathematics notes with TeXMe-based self-rendering HTML
This aged like milk
This won't stop the big ones, Google, Meta, OpenAI, Perplexity, or even the Chinese Govt. But it will make it harder for new entrants.
I was responding to this:

> so leaks are a fact of life in basically every major Rust project I've seen not written by somebody like BurntSushi

And yes, I said I considered their overall argument specious.
But that agent would be making requests against Cloudflare's servers not the origin site.

And that is a fight they are very comfortable in having.
> I think probably people will also use LLMs to debug.

I don’t have a link handy, but someone has already set up a service that’s “JS time travel debugger + LLM that knows how to use it”

Pretty sure it was a Show HN recently.
That "article" looks like AI generated slop. It suggests `if (request.headers.has('x-middleware-subrequest'))` in your middleware as a fix for the problem, while the whole vulnerability is that your middleware won't be executed when that header is present.
I recall reading that the design kicked off because of some stock of surplus CRTs but that didn't ultimately end up used.

https://www.gamedeveloper.com/design/a-history-of-gaming-pla...

> The system got its start in late 1980, when one of the hardware designers at Western Technologies (Smith Engineering), John Ross, had a light bulb go off -- or, to be more precise, a surplus one-inch Cathode Ray Tube (CRT).

> Western Technologies redesigned the system as a tabletop, and later that year General Consumer Electronics (GCE) licensed it for production -- though now with a nine-inch screen.

More of that history here https://www.vectrex.be/vectrex_jay_smith.html
It's possible of course to sanction individuals using the software.

But the decentralized service is more or less independent of the original Devs and will stay running without their involvement.

The code is open source so I dont think anything technical would prevent some random person deploying the same software again into the blockchain, I'd be surprised if that hasn't already happened.

You raise North Korea as a user, so sanction them. There are other users who just want their finances to be free of government control. Perhaps they are ordinary people living in a dictatorship under capital controls and just want to get their money outside of that system.
Also, nobody else steals your stuff like AI does. Doesn't take much thought to figure out the difference.
0F .. 100F is about the range of temperatures a human living on earth could reasonably expect to experience without deliberate adventuring. It's not a precise range - plenty of people live in Doha (way above 100F) and in Alberta (way below 0F) - but it's a pretty reasonable approximation.
Aha. Thanks!
I’ve seen ads for buying small quantities of elements including selling a full periodic table. We probably all have. I wonder how many of us on HN could have been in this poor guy’s position.

The writeup makes it sounds typically Australian in a massive law enforcement overreaction over something innocent and minimal.
So the thing was Groundhog Day is actually really interesting. The prediction doesn't really have to do with groundhogs but instead has to do with whether it is cloudy or not on Groundhog Day. It's kind of funny about it is that they kinda got it backwards. If you bet against Punxsutawney Phil you'll be doing better than random chance.
The LLM crawler just needs to respect robots.txt and they won't be affected.

I don't understand how anyone can find this to be a problem.
Show HN: Don't click this button – testing the internet's patience
This weekend I was looking for a side project to play around with Go so I built a simple web experiment to test the self control of the internet: it has a single button, a live click counter, and a timer. I want to see how long the internet can collectively resist clicking it.

The backend is a very simple Go binary with Go's std http server, web sockets, a WAL-style log of clicks, plain CSS and Comic Sans.

Inspired by Silicon Valley's (HBO series) Bro app, OneMillionCheckBoxes and Cookie Clicker
Btw, would anyone have any good resources on using pytorch as a general-purpose graph library? Like stuff beyond the assumption of nets = forward-only (acyclic) digraph
I took differential geometry during undergrad but had to drop out of the course as i thought i would fail the final. Great professor, but too much for my 20 year old brain. Id like to try it again in retirement.
The "entire scale" has no maximum. So your waste of the Celsius scale from 35-100 is Fahrenheits waste of the scale from 0-32 or whatever you're trying to base your comments on.
> So... just adding a "x-middleware-subrequest: true" header bypasses auth? Am I understanding this correctly?

correct.

That is how serious this bypass is and why it is a severity 9.1 (I think it should be a 9.8, as it is so trivial by adding a single header.)
Huey P. Newton and the Last Days of the Black Colony
> Good luck getting it to write a competitive video card driver for Nvidia hardware

Jensen says they use AI to build their chips.
Oh come on. This article is peak midwit "ackshually."

Like all of the game's weapons, how exactly the sniper rifle works is not described. The bullet's diameter is not described. Its ballistic coefficient is, of course, not described. Most pointedly of all, the bullet's velocity is not described.

There are existing guns that can fire projectiles at hypervelocities. These are mostly "two-stage gas guns" that utilize incompressible gasses to accelerate small metal projectiles for NASA experiments -- sometimes to velocities over 32000 feet per second. (10km/s! Roughly 10-11x faster than conventional rifles, but a common velocity for micrometeoroids.) There's absolutely nothing to suggest that similar mechanisms can't be adapted to smaller arms; it's impractical, but it's an engineering problem, not magic.

There are other possible mechanisms, e.g. a conventional weapon with a magnetic rail that assists in the acceleration of the bullet. Science fiction? Sure. As is the game.

So, anyway, assume the UT gun fires a small iridium slug at 10km/s and there's nothing to complain about. Very fast bullets are very flat-shooting, as any .22-250 appreciator can corroborate.
If you're talking about finding specific biological ancestors (names) then yes.

But certain general ancestral data can be deduced from variations in your DNA that are observed in some known current/historical population. I.e, I share much in common with people sampled from Scotland -> I must be Scottish.
I’ll note that macOS doesn’t necessarily always let you do this the first time, it’ll pop a dialogue saying “hey, you’re cool with this app seeing (your files/other apps files), right?” I wonder if such a thing could be implemented in flatpak.
I wish most people valued truth. But I see an overwhelming amount of cognitive dissonance and disdain for seeking truth.

Many people would rather keep family secrets secret for a myriad of reasons (with different justifiability)
If we want to focus on a thing that NixOS could have prevented, we should focus on the CrowdStrike incident. Being able to boot to yesterday's config because today's config isn't working would've mitigated most of the problems.
How much maintenance do the tools need currently, and how does it compare to the effort?

i am surprised by the implication
You're way too trusting of trash-cli here. I switched to it a while back and the only time I actually needed to recover something half the files in the folder weren't in the rubbsih bin, they were just gone
I don't know, but I am just pointing out that the problems here are really about execution, not vision.

There's no reason we can't properly enforce security boundaries in the browser, we already do it between the website's code and the local machine.

These ideas have been around a long time and predate the internet. See for example Liskov's work on Thor:

https://dl.acm.org/doi/pdf/10.1145/233269.233346
Wait... is this really a thing? Do people think that they can actually have an LLM write code for anything but a simple program for them?
Mathematical Methods for Physics is such a great course. Took the course, and an Advanced version in undergraduate when I was still attempting to be a physicist. The course is at its core a bunch of very important Mathematical concepts that a Physicist or adjacent will need that you won't quite ever come across naturally in mathematics courses unless you go into graduate studies. A "Here is the problem, here is the math and here is why" is just very useful. Legendre Polynomials, Bessel Functions, Lagrangian, Fourier Functions. Just tons of interesting and really useful math that when you hit a problem in their space you have a super power.

My professor for the courses always said it was about putting more mathematical tools in your tool box. Which is a perspective I've since carried.
Why? Celsius is just as arbitrary a choice as Fahrenheit. It brings nothing extra to the table. You might as well complain that tapered pipe threads are in US inches or that astronomers use AUs and light seconds rather than meters.
Yelp, back to librewolf it is.
Anytime your scale has to go into negative numbers to represent common scenarios, it's not human friendly.

If you're not tying your scale to human-specific temps, why not just use Kelvin? At least that won't go negative.
Man, that’s rough. I hope you’re doing well!

Totally agree with you on the line-item point. My point there was that if a 50% RIF is in the works, the people who haven’t figured out how to become more efficient using AI would be more likely to be affected. Statistically.

But again, hope you’re doing well and everything has worked out for you!
> We never solved it for the other material that we dug up and burned (coal).

Oh yes. Having fucked up this badly with long chain hydrocarbon combustion, lets do it all over again with fission, because ... well, we did it once already, right?
I really enjoyed my Vectrex, I had every cartridge and every peripheral AFAICT. I ended up selling it to offset the cost of a fancy monitor for my Amiga :-).

Related Steve Ciarcia did a vector display which was a lot of fun back in the day. You can find it in the back issues of BYTE but here is a scan https://drive.google.com/file/d/1y6SfEN8idhdZ7Y_rNh0zD9uzHEC...
NYU applicant students on reddit are saying they searched and found their data, apparently despite the hacker's claim, not all identifying information has been deleted.

So in addition to a admissions scandal, this is also a rather critical info breach.
> The Earth looks bright from the Moon, as the Moon does to us. So lets call that 100% bright.

No it doesn't, because as I've stated twice, it's the dark side of the earth we're seeing, because the sun is behind it. It's more like 1% bright, as compared to the moon's visible illuminated surface.

Think how bright the dark part of a thin crescent moon is. That's how bright the earth is going to be in this picture. Close to black, except for maybe a sliver of a crescent similar in brightness to the moon's surface.

So again -- this photo makes no sense. Unless one of the two objects is just lens flare, or there's another kind of artifact.
A lot of them are pretty dark. I'm not sure I would show them to young kids.
Be honest, it was one line that should have been broken into 3 for readability. This vicious calumny must stop, only 97% of LLM output is rubbish and not the 99% you claim.
So what exactly is a vectrex computer? My real question is what’s the limits of a vector display and why didn’t it take off?
Maybe. But that future is definitely not yet here. Generating a couple of files though is here. And that compounds. So people who’re still typing those files by hand… yeah.
Mac Studio M3 Ultra can run Deepseek R1 671B in memory using <200W
Why can’t they just make the bots watch a loud 30 second “Ad” that pops up out of nowhere. If I have to do it, then so should the robots.
I actually think we may see the opposite happen with those kinds of companies too.

At the moment, a truck outfitting company building a customer CRM optimized for their workflow is an absurd idea: they would need a team of a dozen developers working for a year before they could even get a feel for if it was a feasible project or not.

Add LLM assistance and maybe a team of three developers could get to an initial working version in three months.

At that point, companies that had previously ruled out custom software development entirely may find that it makes sense for them - growing the demand for software engineers as a whole.
> To some extent it is decentralized is it not?
No. Everything relies on the root servers, as recursive servers rely on them.
you write this every year and one year you’ll be right :)
Why is nobody questioning this:

> To build xz from sources, we need autoconf to generate the configure script. But autoconf has a dependency on xz!

Both directions of this seem crazy to me.

1. Why the heck should a build configuration tool like autoconf be unable to function without a compression tool like xz? That makes no sense on its face.

2. For that matter, why the heck should xz, a tool that is supposedly so fundamental, have a hard dependency on a boilerplate generator like autoconf?

At the end of the day all autoconf is doing is telling you how to invoke your compiler. You ought to have a way to do that without the tool, even if it produces a suboptimal binary. If you care about security, instead of taking a giant tarball you don't understand and the running another tool in it, shouldn't you just generate that command line somehow (even in an untrusted fashion), review it, and then use that human-verified script to bootstrap?

And if you need a (de)compressor that low on the dependency tree so that literally the entire world might one day rest on it, surely you can isolate the actual computation for bootstrapping purposes and just expose it with just the open/read/write/close syscalls as dependencies? Why do you need all the bells and whistles?
1. Find many examples of these nofollow links

2. Create a webpage with these links, not including the nofollow

3. ...

4. Profit!
The 6809 also had two hardware stacks making it excellent for Forth programming.
Does fair use imply that pirating copyrighted material is ok?

I mean, it’s a serious question; I don’t see this as really connected.

As long as an AI can “understand” the content of a book and spit out a summary of it, or even leverage what it learned to perform further inference, I’d be inclined to say that this is fair use; a human would do the same.

But this has nothing to do with using pirated material for training, especially for some kind of commercial purpose (even if llama is free, they’re building on top of it) - I don’t see why it should be legal.
> Yes, I'm a developer.

It's interesting that you describe yourself as a developer now.

Because just three months ago, in your first post [1] to HN, you said:

> I'm somewhat non-technical but I've been using Claude to hack MVPs together for months now.

Sure: you might feel as though you have now 10x'ed yourself. But, quite honestly, when the reality is that just a few months back you self-described as "somewhat non-technical", it's clear that (a) you're at such an early stage in your learning and understanding of tech, as a developer, that it's relatively easy to experience bigs gains, and (b) you can't actually have much of an objective measure on this, because you are in fact quite new to the field.

I read a lot of your other comments. To me, even before I had confirmation that you were actually "somewhat non-technical", and fairly new to the field — effectively a junior developer by any real measure — this was already quite apparent to me.

Based upon having been a developer for some decades myself already: I can generally spot those that talk-the-talk — and similarly: I can generally spot those who have non-trivial / deeper experience with various fields of tech.

Powering-up with AI tooling doesn't remedy that. Even if it might seem otherwise from your "somewhat non-technical"-but-newly-empowered position.

Good luck with your coding endeavours though, and with your evangelism.

I have no doubts at all that the world is changing — including how software is developed. But I see your posts for what they are.

[1] https://news.ycombinator.com/item?id=42423573
It's a switch of focus. Instead of being occupied by the grunge work of integrating libraries and code logic from the outset, now focus can remain on the larger picture for longer, with a need to jump into raw code only for the really tricky/unique problems, if there are any. That can be a lot of overheat avoided, if done well.
Why? I am just asking for a simple UI, which Guix already has. Mainly for CLI applications. The idea is to be able to launch an ephemeral shell with any combination of packages, filesystem R/W privileges, and network access in a convenient way.

I think launching e.g. a Python shell with some packages that are potentially compromised and letting those read ~/.ssh and whatever else they want is fundamentally insecure. Rogue PyPI packages that steal SSH keys is not a theoretical security breach, it already happened several times [1].

The current security model in Unix is untenable. But I agree well-implemented sandboxing should be frictionless. What you are experiencing is probably a X or Wayland sandboxing glitch. I also dislike Flatpak, for other reasons, but that doesn't make sandboxing a bad abstraction. It's just that we don't happen to like this particular implementation.

[1] https://www.packtpub.com/en-tw/learning/tech-news/python-lib...
https://archive.ph/IjbpZ
What UBI proposals are you reading that do away with actual jobs? There would still be jobs for people doing those things you described.
Define all the time. I haven’t seen a shop that accepts crypto. There’s nothing I could buy with it.
Hollywood filmmaker charged with defrauding Netflix of $11M
> There seems to be a delusional part of the Internet that is convinced that nuclear is the only future, and solar and wind aren’t.

"Exponentially more" means literally nothing. 1 is also an exponent.

China is building literally everything. It's also a geographically diverse country, with wide ranges of different climates. Solar is appropriate for Hainan, but makes little sense for Harbin.
I found this take from 'Torque Test Channel' (tests battery tools) humorous: https://www.youtube.com/watch?v=2QUum9NymZY
https://github.com/pieeg-club/PiEEG_Kit
next.js has a history of similar vulnerabilities.

I was made aware recently of a vulnerability that was fixed by this patch: https://github.com/vercel/next.js/pull/73482/files

In this vulnerability, adding a 'x-middleware-rewrite: https://www.example.com' header would cause the server to respond with the contents of example.com. i.e. the worlds dumbest SSRF.

Note that there is no CVE for this vulnerability, nor is there any clear information about which versions are affected.

Also note that according to the published support policy for nextjs only "stable" (15.2.x) and "canary" (15.3.x) receive patches. But for the vulnerability reported here they are releasing patches for 14.x and 13.x apparently?

https://github.com/vercel/next.js/blob/canary/contributing/r...

IMO you are playing with fire using nextjs for anything where you care about security and maintenance. Which seems insane for a project with 130k+ Github stars and supported by a major company like vercel.
I love the ml language I'm learning and consider it better _than_ any other language I use, but I'm puzzled by "ada or ocaml, which is a better rust"

Never written rust, only looked at snippets on blogs, but it visually looks so different to ml

Am I being fooled by superficial syntactical differences?

Could you explain?
what would be interesting to learn is,

"Mega can regurgitate virtually any excerpt from any of my books, there for they have stolen them"

versus what is not interesting such as

"my books are in libgen therefore they stole my work, even though I can't find direct evidence of the theft"

>The most damning thing? It appears that Meta knew exactly what they are doing, and chose to proceed anyway.

that is not the most damning thing. It might trigger worse damages or elevation of the severity of an infraction, but it is not evidence of guilt per se, which is what I would call "damning"
Seems so many in government are incapable of asking "are we the baddies?".

Scum rises to the top in our system
This is false. I frequently find myself annoyed at my AC because it only has settings of 72°F and 74°F, and they are a little too cold and a little too warm for me. I want 73°F. When it's around room temperature, you can absolutely tell the difference.

The further away from room temperature, the less we can distinguish. All our senses work logarithmically like that.
I guess Zuck's new found interest in manly combat sports is based on his expectation of seeing PDiddy, SBF, and Luigi in club fed over his l33+ pir8cy. It all makes sense now.

#freezuck
Somehow people never learn to avoid in-band signalling.