skysight-inc/HackerNews huggingface dataset:
AI published a bogus CVE for my project
I help maintain Dask, an OSS project in the Python data space. Dask helps users run arbitrary Python code on distributed clusters of computers.

Yesterday, I and several users got a CVE alert (https://www.cve.org/CVERecord?id=CVE-2024-10096) that there was an exploit allowing users with access to a Dask scheduler to run arbitrary code on that server using a backdoor with pickle.

Obviously, the creators of this CVE missed the easily accessible `client.run_on_scheduler(my_function)` API, which makes this much easier for a would-be hacker. Is this a backdoor? Maybe, but the front door is wide open inviting all to enter.

I did some research into the creator of the CVE, a project call "Protect AI" (Dask is often used in AI workloads). It looks like they acquired an AI bug bounty company, Huntr (https://protectai.com/newsroom/protect-ai-acquires-huntr), which reported the "bug" several months ago. Even though this was spam, Dask maintainers responded to the bug report saying ...

> This is the expected behavior and not a vulnerability, which is documented at https://distributed.dask.org/en/stable/limitations.html?highlight=host#security. Specifically "You should only host Dask workers within networks that you trust."

Huntr's response?

> A dask/dask maintainer has acknowledged this report

Followed by publishing the report as a CVE

This thoughtless behavior both distracts OSS users, and diminishes the seriousness of the CVE database. It's a shame seeing companies misuse public infrastructure like this. I guess they're using this to generate some internal revenue?
Show HN: I built an AI website summarizer API
> It's a miracle so many sites, and products, have held out due to sheer obstinance of their creator to push thru. It's altruistic, but like fighting the tide, eventually they get worn down.

Yes I feel the same way, but it feels so sad to me. These sites are valuable to many people! I'd imagine millions are familiar with JSFiddle but our idea of what things should cost is so warped. Then there's the fact that even if I were ok with giving JSFiddle a fraction of a dollar every time I visited it, I have no great way of doing it that's not ad-based.

I hope we can find something more reliably between enshittification and donation.
It's sickening to know how many people approve of authoritarianism and giving up the United States' leadership in the free world.
Show HN: Set goals, make progress, get paid
I've been building out a social-ish, AI-moderated productivity app for the past several months. Premise is that users set goals for themselves, post their progress, then get paid for their efforts - up to $400/year in USDC (via Base). Hoping it will inspire some small, positive change for folks who use it.
Military needs terminators that do acrobatics. That is who this is for.
That might be true, but you might not have those engineers or they might be busy with higher-priority tasks:

> It’s also ill-advised to try to solve data sync while also working on a product. These problems require patience, thoroughness, and extensive testing. They can’t be rushed. And you already have a problem on your hands you don’t know how to solve: your product. Try solving both, fail at both.

Also, you might not have that "large scale" yet.

(I get that you could also make the opposite case, that the individual requirements for your product are so special that you cannot factor out any common behavior. I'd see that as a hypothesis to be tested.)
"I am not reinventing the wheel, I am disrupting the wheel industry"
— TramSDK creator https://github.com/racenis/tram-sdk
Regarding the repetition loops, I found that adding the end of turn token to the stop param was enough. Documentation mentions detecting this.

But your point about quality stands. Separately, this model emits the docling XML format, not the JSON format, so as far as I know today that means you are using the Python flavored docling only, the JS variant does not support this yet (afaik).
Can't you make the same argument for a crawler? The user wants information, the peon (crawler) just compiles it for them.
Soft power is economic and cultural levers. Hardware is actual military power.
Does the LLM look at our click ads? If not, it’s a self destructive technology that will get itself blocked as it consumes resources in an unsustainable way
Barawave – AI-Powered Cloud ERP for Smarter Business Management
Barawave is a next-generation AI-powered Cloud ERP system designed to streamline business operations, enhance efficiency, and drive growth. With intelligent automation, real-time insights, and seamless integrations, Barawave empowers businesses to optimize workflows, manage resources, and scale effortlessly. Whether you're handling finances, sales, HR, or customer relationships, Barawave provides the tools you need—all in one powerful platform.
>Were you using Macs before Jobs came back?

I think he was :)

https://en.wikipedia.org/wiki/Glider_(video_game)
"The bias to assume that computers are going to produce correct answers is extremely strong."

This. We know that computers are very good at actual computation, and we don't expect them to go completely haywire in conversations either.

Though this is beginning to change, with the observation of just how blatant some of the hallucations are, accusing random people of serious crimes etc. But the pro-computer bias is still strong.

There was an awful case of a system in the UK which accused postal officers of defraudation. The software malfunctioned, but people were indicted and punished by the courts relying on infallibility of computers, and some of the innocent victims committed suicide out of shame.
Gave Books a quick try, hardest part was probably how to send files from Linux to iOS, but thanks to ifuse it ended up being pretty easy, by (ab)using Chrome's download directory. Still haven't found a way of importing them into Books automatically, but better than nothing I suppose.

In case others are in the same situation, I ended up doing something like this:

idevicepair pair
mkdir ~/iphone
ifuse --documents com.google.chrome.ios ~/iphone
cd ~/iphone
cp /home/user/books/*.epub .
cd ~
fusermount -u ~/iphone

Then use Files app on the phone, navigate to the Chrome documents folder and click on the .epub file and after ~5 seconds or so it opens up in Books, and after that it's accessible via Books directly.
Or perhaps the fact that it didn't happen that bad earlier is that the threat model has substantially changed in the recent years?
Most every profession should be unionized including software devs. Not including cops.
can you intro me to your accountant? I've yet to find one who can keep my books clean.
aakash at wyndly.com
In many (most?) states, large trucks are taxed on this basis.
This is a list of countries that have a full diplomatic relationship with Taiwan. Other countries may have varying degrees on recognition of Taiwan

Belize

Eswatini

Guatemala

Haiti

Holy See (Vatican City)

Marshall Islands

Palau

Paraguay

Saint Kitts and Nevis

Saint Lucia

Saint Vincent and the Grenadines

Tuvalu
VP seems like just a title that corporation gives out when they run out of brownie points or something.
No, I'm saying it's justified to update the interface to reflect the state of todays interface-language.

Find the warts, optimize them, let it evolve and bring the workflows to the next level. The app is old and grown, one doesn't need to reinvent it, to make it better. And with its complex purpose, you would end up with something similar anyway.
1981 Atari VCS Catalog – By Paul Lefebvre
This spasm would have ruined my dishes: https://youtu.be/F_7IPm7f1vI?t=80
Golang Search Links to China
An inability to extrapolate the general intent of someone's statement in good faith is often an omen for a needlessly entrenched discussion.
This varies by employer.

At my employer, we have several job families that encompass "software developer"... software engineer, cloud engineer, architect, and technical fellow.

With the two engineering roles, there are levels... software engineer I, II, III, Lead, Principal. Architect starts with more seniority... architect (roughly equivalent to to Lead), principal architect. And technical fellow is "director level" - basically a terminal spot for ICs who are really good at building software but have no desire to manage people - they typically report to a VP or director - they do have lots of meetings, but they're also setting the technical direction of the company for the long haul.
>I'm not claiming that we were smarter, but by sheer coincidence, most people, even folks like me who skipped school, had very solid fundamentals.

Higher barrier of entry should statistically lead to less people making it past and that those who do make it past aren't a random sampling of the initial group making the attempt. While the selection isn't only for intelligence, specifically the subsets of intelligence related to programming, I would doubt any claims it wasn't a factor at all.
Bike paths get people to drive less, saving road maintenance money.
If America's imperialist death machines can't do superhero landings and strike cool poses in front of burning villages what are we even doing as a culture?
Most importantly, roll your own crypto!*

*https://www.schneier.com/blog/archives/2015/05/amateurs_prod...
Nah, there are people that run companies here, too. Many of them drink the cool-aide.
> why don't restaurants use actual dish washers? They have a "Commercial dish washer machine", but that's actually just a final sterilizing step, and restaurant dishes are instead washed by hand.

Not the ones I've seen, dishwashers are pretty common. Are you seriously saying that the dishes are handwashed in the Restaurants you know?
You do :)

My post was about while and if and you repeatingly bring up for. The for statement is another statement.
Its a thing: https://www.nature.com/articles/s41377-024-01590-3
Never mind this year's event - it's going to be multiple years before they have something of the quality they 'demoed' last year. They rushed some great concept videos and then thought they could actually build them in less than a year. And sold $1k+ devices based on it. I'd honestly say this is a bigger disaster than Apple Maps. At least in that case they were forced into doing something really big really quick (because Google was crippling the iOS Maps app). In this case Apple didn't need to do any AI. Absolutely nothing they have shipped is useful or innovative. It's one of the rare times they've followed the market instead of waiting to do it right. At the minute, it's not any better than the co-pilot rubbish MS have shoved into Windows.

Edit: I wonder if this will force them back to live events? Live demos are at least more believable and might win them back some trust.
Honestly, I've found Youtube Music great for discovery. There's a lot of metal bands that are small enough that you can't find their album preorders on Amazon that I found only by following the musical recommendations down the rabbit hole. In my city smaller bands from Europe don't tend to get a lot of playtime on the radio.
I've released AWS MCP Server (v1.0.4), an open-source project that lets AI assistants like Claude, Cursor, Windsurf (and other MCP Clients) execute AWS CLI commands through natural language.

Key features:
- Execute AWS CLI commands via AI assistants
- Support for Linux commands and pipes
- Execute commands in isolated Docker container (with AMD64/ARM64 support)
I truly enjoy the Primeagen. I've watched him since he started on Twitch. I don't ever really see him pushing any particular agendas at all. Mostly he's either trying new things, or working on projects. That's pretty much been his jam since day one. He has opinions, sometimes they're counter to the typical dev takes. Theo is much more likely to have a commonly shared opinion. That's not necessarily a bad thing if you're into NextJS (I'm not). I just don't feel like either of those guys are trying to get me to buy stuff.
Why You Should Not Trust JSON Decoding
The place we commonly refer to as China is not the Republic of China, but the People's Republic of China.

That is like saying that Republic of Congo and the Democratic Republic of Congo are the same country because they both end in Congo.
"Semi"?
It’s up to us in the US to stop it. No one else well. Don’t give into despair! We have power; we just need to use it.

At a bare minimum, call your congress people at least once a week. It does make a difference.

Here are some links that may give you some ideas:

https://thewhitepages.net/p/thirty-lonely-but-beautiful-acti...

https://chopwoodcarrywaterdailyactions.substack.com/

https://handsoff2025.com/?SQF_SOURCE=indivisible
Yeah, I personally remember "10.6.0 utterly fucking sucks" (though it got better) — hard to remember the details, which is probably in my personal best interest, but I remember fairly vividly shouting that to friends over beers somewhere.

And I also remember 10.7 actually being better and where I thought Mac OS X (and its macOS rebrand) peaked, for interactive/workstation use.

However I ran a 10.6.x virtual machine (that yes, ran Mac OS X 10.6.8 Update Combo v1.1[1] for the last decade of its service life) until 2021 for a bunch of long-timeline server functions, so I guess Snow Leopard was pretty good overall, in the end...

[1]: https://support.apple.com/en-us/106449
I still don't see why you would need a humanoid robot for those tasks. Folding laundry could be done by a single robotic arm, and dishes are done by a dishwasher.
The Terms and Privacy Policy links at the bottom don't go anywhere.
> Once again sour grapes. Abandoning the idea of your system compiler working for C++ is wild.

why? most operating systems (Windows, macOS, Android, iOS etc) don't even have a system compiler, it's a separate app that you install (and for which you can thankfully install multiple versions in parallel, unlike the stupid linux idea that every app should only ever have one version installed at any given time).
I love that you made it so simple to use!

I've started building a similar app before, except with more of a focus on the timestamps than the text (prioritizing time tracking over note taking). I ended up switching gears to different side projects and never came back to this one.

That being said, a feature I'd begun to implement that you could consider adding is what I called Context Tags. It looks like in Notetime tags are applied to notes to provide better organization. Context tags in contrast would be applied to timestamped lines within the note. When moving to the next line, the new one would default to having the same context tags.

That's it! That's the whole feature. This let's a user tag the first line in a category, such as "work" or "project A", then gain that categorization for any subsequent lines (until the user specified a new category).
Parquet Pruning in DataFusion: Read Only What Matters
> Permanent deletions use a "recycle" symbol

So does Windows.

> while download cover and input options share a downward chevron icon

This may be version-specific to be fair; I checked 7.8 and the latest, 8.0.1, and the two icons are differentiated in both. In Preferences, "Metadata download" is a cloud with a downward arrow, whereas "Input options" is a downward chevron.

> Titles are shown underneath main toolbar actions, but not in the statusbar or modal windows, for example.

Mine definitely does for all of those. Are you sure you don't have something configured differently, or perhaps there are differences in OS default behavior (I'm on MacOS)?

> Stuff like "Edit metadata > Merge book records > Merge only formats in first selected book - delete others" feels extremely intuitive for you?

Yes. "Book records" definitely sounds like metadata to me, so that's where I would look for it. The "Edit metadata" menu has 7 options on my build. Of those, only "Merge book records" expands, and it expands into 3 options, including the one you mentioned.

There may also be age differences at play here, specifically with respect to what GUI era your formative computing years were in. I got into computers in as a kid in the 90s (DOS, then Windows 3.1, 95, then a mix of Linux distros and successive versions of Windows). Calibre to me looks and feels like a slightly fancier version of programs I grew up with. Nero Burning ROM [0], foobar2000 [1], and of course, WinRAR [2]. Microsoft Office design peaked with 2000, IMO. 2003 was technically fine, just that it adopted XP's visual styling, which I found appalling.

In contrast to dense UIs, we have modern web apps. If I want to change the appearance, is that under Profile, or Preferences? How do I get to either one? Do I click on the vaguely person-shaped icon, the hamburger icon, or do I have to go Home first?

[0]: https://en.wikipedia.org/wiki/Nero_Burning_ROM

[1]: https://en.wikipedia.org/wiki/Foobar2000

[2]: https://en.wikipedia.org/wiki/WinRAR
Previous:

https://news.ycombinator.com/item?id=43356439 (no comments)
AI results typically blow away Google results in both quality and definitely speed.

For example, when searching for product information, Google results in top 50 to 100 listed items titled “the 10 best …“ full of vapid articles that provide little to no insight beyond what is provided in a manufacturers product sheet. Many times I have to add “Reddit” to my search to try and find real opinions about a product or give up and go to Youtube review videos from trusted sources.

For technical searches like programming questions, AI is basically immediately nailing most basic questions while Google results require scanning numerous somewhat related results from technical discussion forums, many of which are outdated.
Now, sqluv command supports http/https protocol.
What surprises me with all of the robots is that the engineers had the freedom to create the best machine for all purposes, yet they keep creating a "humanoid" with 1 body, head, 2 arms and 2 legs. Is our human body form really the best for all tasks?
> anything that could be seen as remotely critical of the US administration is being hushed

The US stops sharing air quality data from embassies worldwide (apnews.com)
639 points 448 comments

https://news.ycombinator.com/item?id=43274821

> I'm the Canadian who was detained by ICE for two weeks (theguardian.com)
931 points 834 comments

https://news.ycombinator.com/item?id=43410548

The A.I. Monarchy (substack.com)
213 points 268 comments

(This one is about Peter Thiel and Curtis Yarvin and their relationship with the Trump administration.)

https://news.ycombinator.com/item?id=43229245

GSA Eliminates 18F (nextgov.com)
529 points 482 comments
https://news.ycombinator.com/item?id=43221549

All of these threads were posted to the front page in the last month. None of them were flagged, none of them were removed, and similar threads have been getting posted since November of last year. You do not have to look far to find comments and threads critical of the Trump administration on this website. Note that all of these threads were just the ones I happened to see in the last month; if you browse New, posts about the Trump administration (and more specifically Elon Musk) make up somewhere around 10% of all submitted threads. I actually went and checked as I was writing this, and 3 out of 30 threads were related to DOGE or Elon Musk; so exactly 10%.
NixOS, GNOME 47, Firefox, Ctrl+Shift+E opens devtools, Super+E does nothing. I have a flatpak app called "Smile" for entering emojis which always starts up very slowly - faster to open some webchat client and copy from its emoji picker...
I use it just for coding.

For general inference I use 4.5

I think OpenAI (and likely others) are on the right to track to acknowledge that different model tunings are best for different uses, and they interned to add a discriminator that can direct prompts to the best tuned model/change model tuning in real time.
Can confirm. I currently work for an SMB (~150 employees) as a manager. Our VP doesn't write any code but the directors and managers are still IC's on projects.

Right now I really like being an IC in addition to being manager cause I still have that coding itch to scratch, but I just know one day I will eventually graduate to role where I don't write any code. Long term it is the direction I want to go in but it's going to be bittersweet when I finally get to a role with no coding.
It’s good advice to its own citizens and even business travelers have a right to worry.

Many years ago, I asked my wife why’d she give up her green card (or chance for a dual).

She didn’t want to deal with the hassle or a non-zero chance of getting rejected for renewal and getting deported. Her perspective was based on the ease or difficulty based on who was in power at the time.

I thought she was paranoid, but she was right and I was so very wrong.

If you’re not a citizen (and even if you are, but of the wrong “type”), things are looking worrisome.
GP was talking about modelling your problem. A hashmap is seldom a good model for a given problem. Typically they're "just" an implementation detail.

For example, in some cases it can be useful to consider triangles in a 3D model as cyclic graphs of vertices. The edges of the triangle correspond to the edges in the graph.

However I can't think of any case where it's useful to think of a triangle as a hashmap.
I'm trying to think of a non-tacky/doxxing(if you care) way you could drop your band here so those interested could have a listen.
You have some good points, but this store also has an outsized role in the community and a large shock will drastically affect the community. Take a patient who has an infected wound. I guess you would say the prevailing approach was to putter around, let the patient develop gangrene and slowly die. I wouldn't entirely disagree, although I would tone down the severity. What DOGE is doing as reform is way too extreme to me, amputating the patient excessively and without proper care. Ironically, I was calling out "middle grounders" in my sibling reply, but I will say here that surely a middle way is most appropriate. But then DOGE as it currently stands wouldn't exist, and I don't see this administration taking such a route. This is all within expectations when we discuss broken systems. It is easy to take the extreme of standing by the system no matter what. And it is easy to take the extreme of burning it down. Culture and counterculture. The rule and the revolution. These are comfortable, if not likeable. But we should always seek a golden mean. Now whether one administration or the other is better suited for that is an entirely different discussion.
It's fine to explain why it is the way it is, but at the end of the day that's still just an engineering problem you need to try and solve. Sometimes Apple made mis-steps in that size/heat scenario but they've done it a hell of a lot better than anyone else for a long time. Sometimes you need demanding product types to force you to put serious effort into an engineering challenge you don't deem worthwhile.
Failing up is surprisingly common
Really? Software is currently why I prefer Apple products. I prefer iOS to Android and I prefer macOS to Windows.

There is always room for improvement, but I never got the feeling they need to drastically change things or start fresh. They just need to squash some of the big bugs IMO.
> a bunch of untrained and unorganized civilians with only rifles significantly hold back the russian advance on their own

I didn't say anything like that, though many were untrained and with only rifles. I said that in urban environment it is still soldier on foot is deciding factor, and in Ukraine freshly enlisted territorial defense units dug into the ground and stopped invasion.

> More like 70 million+ loyalists

70M is a civil war setting, but we are discussing setting of dictator + loyalists military vs population.