skysight-inc/HackerNews huggingface dataset:
> Imagine AI can do none of those things, but the people who control the capital believe they can.

I don't need to imagine, that's the reality we live in right now
As it currently stands, MCP is absolutely a security nightmare. Combine this with a general lack of appreciation for security culture amongst developers, and the emerging vibe coding paradigm where non-security-minded people automatically generate and fail to properly audit production-facing code, and it's a disaster waiting to happen.

Feels like we've slid back into the 90s in this regard. Great time to be a security researcher!
For what it's worth, in the siege of Sarajevo, rich people stockpiled lots of food while many were going hungry; it did not take long before they shared their supplies with their neighbours. People seem to be generous when they feel part of the same community.
Also, anything of this sort should go through the legal system first. She’s not Bin Laden, there’s no movie-plot bomb with a countdown timer, they should be expected to file charges and allow her to confront the evidence rather than abducting her with a bunch of masked officers who aren’t even in uniform.
The SEC selectively enforcing the rule does not prohibit a shareholder suit against the company. "Everything Everywhere Is Securities Fraud" after all.
A bit off topic, but is there any good recent Image to midi/XML/Sibelius stuff out there?
This is the correct answer. Pro-tip: use Django admin as a user facing interface in your prototype, then you won’t even need to write HTML templates, let alone client-side JS.
Most of the data in the article is totalmente false
Since I've worked with the official MCP SDK, I find this analogy quite accurate
Yes, with the caveat that virtual memory restrictions matter a lot more than physical memory restrictions.

Heap exploitation is difficult because 1) glibc malloc is hardened to try to defeat many common exploit strategies, and 2) ASLR means that even if you have the ability to corrupt a pointer, you might not be able to control what the pointer points to.

Regarding #1, memory constraints don't really make a difference until you're so constrained on memory that you can't run glibc anymore, so you use an allocator that is optimized for low overhead/code size rather than performance and security.

For #2: ASLR works by placing every section of the process (heap, stack, program binary, and each library) at a randomized virtual address so that attackers can't forge pointers. ASLR is much more effective on a 64-bit system than on a 32-bit system, simply because there's so much virtual address space available to choose. If memory addresses are only 32 bits, it's feasible to just brute force guess the memory address of some data you're interested in; with 64 bits, it's not. And if your system doesn't have virtual memory at all (like a microcontroller), you probably don't have any kind of ASLR.

> intentionally breaking up and segmenting memory so it's not possible to read much linearly

This is typically done at the level of individual sections (stack, heap, program binary, library binaries) but not within sections; mainly for performance, memory overhead, and cache locality reasons. The entire heap is contiguous, so if you overwrite past the end of one heap allocation you can overwrite adjacent allocations, but you can't overwrite the stack (without more work). Breaking up the heap into smaller chunks wouldn't really help that much; it just means an attacker has to manipulate the heap layout so they can be sure the allocation they're targeting ends up in the chunk they're targeting.

Exploit hardening in the heap allocator is something of a last-ditch stopgap measure: "we've already lost, but let's see if we can minimize the damage to the user/maximize the difficulty to the attacker". There's certainly much more you could do to harden the heap, but remember that any security measures implemented in glibc are applied to every program, with no way to opt out (except bringing your own libc). So glibc is designed to maximize performance and compatibility; exploit mitigations are only included when they doesn't compromise these goals.

If you don't mind giving up some performance for the sake of security, you probably would already be using a garbage-collected language instead of C. (And now that Rust is sufficiently mature for most use cases, you probably should be using that if you're in a situation where you need both performance and security).
This is neat. I left cloud infra work before everyone wanted k8s knowledge and Ive always assumed im 50% of the way there having docker and nomad experience
> Do you mean often you want multiple segments of code to all do the same thing on error? If there is only one segment then you well and truly have just moved things around.

If a segment has 6 function calls and you want the same error handling for each one, you can't get rid of the boilerplate with the current language.

> If the original error is your own

Assume the original error is not my own then.
In this regard, they have been extraordinarily fruitful for my research and studies.
That makes sense. But if that's the case I think we should call a spade a spade and differentiate "Local-first MCP" and "Remote MCP"; because what (many, most?) companies are really trying to do is integrate with the latter.

Which is where you see this sort of feedback, where a bunch of us API engineers are like; "there's already a well-trodden path for doing all of this stuff. Can we just do that and agree that it's the standard?"
Not sure about price comparisons but what I can say is that many experiences feel worse. Paying 50-60$ for 3 tacos to be delivered, going out to basically any restaurant, pricing models on almost any subscription service(Adobe good example).

It’s led me to learn to DIY as much as possible, making my own fun and experiences so to say.
This is what we used to just call "standards", but apparently we need analogies now in order to explain standards to new developers.
I tend to agree with this.

No, MCP's have NOT Won (Yet) https://newsletter.victordibia.com/p/no-mcps-have-not-won-ye...
I usually think about it in the other direction: every time an accident occurs, a human learns something novel (even if it be a newfound appreciation of their own mortality) that can't be directly transmitted to other humans. Our ability to take collective driving wisdom and dump it into the mind of every learner's-permit-holder is woefully inadequate.

In contrast, every time a flaw is discovered in a self-driving algorithm, the whole fleet of vehicles is one over-the-air update away from getting safer.
"Anyone can build a bridge that doesn't fall down. Only engineers build bridges that only barely don't fall down."
>Now you're admitting people do switch when something else is much better. And they do so easily. Which was my point.

I'm saying people don't bother trying potentially better options and that they don't easily leave what they are used to. What part of that statement implies they would never leave for a much better product? I'm genuinely baffled.

>But experts in these things do

Yeah.. experts in...search engines? Lol. Those guys aren't making videos for marginally better products and even if they are, it doesn't necessarily mean anything.

If it was as simple as better model > gets all the users then Anthropic Usage wouldn't still be dwarfed by GPT.

Network Effects are not the only thing that creates stickiness for customers.
Mid-tier engineers are the most dangerous type of engineer as they've learned enough to make decent abstractions and they tend to run with that over-engineering everything they touch.

IMO it is better said that Go is designed as being a good language for Senior and Junior developers, where mid-tiers will probably hate it.
I think banks requiring you to buy hardware you don't actually own (a blessed android phone) to run software you can't control (this banking app) so you can access money you worked to make is absolutely ridiculous and dystopian. Why do you allow a bank to do this to you?

I sincerely hope there is some alternative option in your country. In mine, I can still perform banking activity by going to a physical branch, by calling in, or by using the website with a physical 2FA token (i.e. not my phone). The bank keeps trying to get me to switch over to their app but I will continue to protest this until it's no longer possible to not use an app at which point I will likely switch banks.
It's not about shit posting. It's about genuinely interesting contrarian viewpoints. Even if someone isn't afraid of posting it, the problem is that it gets censored by the community and no conversation can happen.
No. My recollection is a lot of people urging them to get generics right and into 1.0 and the Go guys saying, “don’t worry, we can add generics later”.
I want to see the list! :-)
Typically pro-Palestinian student activists in the US go to lengths to not support Hamas and generally have multiple statements to that end.

To date, to the best of my searching, the DHS claims have not been backed up.

In a statement to the Guardian, a DHS spokesperson said on Wednesday that Ozturk was “granted the privilege to be in this country on a visa” and, without supplying any proof, accused her of supporting Hamas, the Islamist group that controls Gaza and led the attack on southern Israel on 7 October 2023, prompting a massive military response from Israel.

~ https://www.theguardian.com/us-news/2025/mar/26/ice-agents-d...
Yeah "They terminated him for lack of transparency and honesty", which is ridiculous since the opposite was the case. (He was being transparent and honest towards his employer that he is being investigated.)
Perhaps the article needs to be read as if prefixed with:

"I was asked to write the following explanation for the public, to put on our website, and talked to the programmers. I have idea what they were saying. I took some notes, which likewise mean nothing to me, but here goes ..."
rubbish? yeah rubbish.

no one can tell the difference between a $200 handbag and a $2000 handbag, outside of people in the industry.
> What Killed Innovation?

regulations and taxes
A former Facebook policy employee on the Careless People book
Japan has a LOT of make-work jobs for the elderly.
So is the MCP server acting like a middleman between the llm and the application you want to control?

Like, could I give the MCP server the ability to say exec Unix code on my machine and then tell the LLM "here's the MCP server, this function can execute Unix code and get back the response".

Then I can tell the LLM, "create an application using the MCP server that will listen to a GitHub webhook and git pull when the webhook hits and have it running" then the LLM would generate the commands necessary to do that and run them through the MCP server which just executed the Unix code. And viola?

I've gotten an llm to create files and run system commands for me.

Is that the most barebones application?
Some of my hobby projects really feel like invention but others feel like discovery. Myself I was a hobby programmer, than I got a PhD in physics, then I became a professional programmer. There were things I found nervewracking about the culture of science that led me to leave but looking back retrospectively I could have taken better advantage of the opportunities I was given.
SPDX Maven Plugin
I think this is actually the best way to zero an array in place. The other option is using foo.splice(0,foo.length)

foo = []; Will reassign the reference but other pointers can still have the array.

foo.length=1 will remove all elements but the first.
> He was just lucky to be lifted by this Tech Bubble.

Almost all of Google's revenue has made from decade old products lmfao. He just kept growing them despite many years of people calling Google dead.
> and likely an upcoming huge stock market crash.

Most likely US can survive bullying one ex-ally at a time.
If you're a European it probably shouldn't surprise you that much. Even if you don't share these feelings, many of your fellow Europeans do.

But the biggest issue with Tesla (I own one and bought one back in 2018 because it was the best EV available) is that the company has so badly failed to execute. They failed to update their products at a useful pace, they failed to develop a really good US-based battery supply chain, and they massively invested in China -- a decision that does not look excellent in retrospect. This is before you get to the Cybertruck and the weird political stuff.
Must be a place with a pretty bad education system if people can't answer 6 * 7 off the top of their head.
Excel can import and parse JSON, it's under the "Get Data" header. It doesn't have a direct GUI way to export to JSON, but it takes just a few lines in Office Scripts. You can even use embedded TypeScript to call JSON.stringify.
Writing a program is voyage of discovery.
Yeah, they teamed up with the Mormons mapping out the entire human family tree and have been able to predict every possible child DNA sequence in order to eventually create Paul Atreides.

(as for your question, I have no idea)
This sort of rhetoric always rubbed me the wrong way, but it falls completely flat on its face now, given that there isn't a single state in the US where the margin of victory was anywhere close to being within the Green vote. The idea that a single-issue voter on something like Palestine is an implicit Trump supporter because of the issues you care the most about is just asinine. Heck, I suspect many of them are the ones most likely to be protesting. I understand that you are obviously going to view the world through your own politics, but I do feel obligated to mention that other people do, in fact, exist, even outside of elections, with all the depth that entails, and cannot realistically be understood with dualism.
> it's easily the most widely supported data format in existence in terms of tools and language support.

Even better, the majority of the time I write/read CSV these days I don't need to use a library or tools at all. It'd be overkill. CSV libraries are best saved for when you're dealing with random CSV files (especially from multiple sources) since the library will handle the minor differences/issues that can pop up in the wild.
This looks super cool and I can see myself using this!

Although the name is a bit unfortunate.
We're all going to have to live in ze pod and eat ze boogs when it comes to software platforms and ecosystems because aside from perhaps cloud deployments at scale, there just isn't an incentive to support open source from an ecosystem standpoint.

Give you an example: Recently the Open Source Initiative held board elections. Three of the candidates were disqualified. Two were disqualified for refusing to use proprietary software with Stallman-like stubbornness after explicitly being told that use of proprietary software was non-negotiable for board participation. Lunduke tried to weave it into his neo-Nazi narrative of cultural bolsheviks infesting open source, but the reality is the proprietary software in question is DocuSign -- and there is no alternative in the open source world that does what DocuSign does.

So if the steward organization of open source cannot function without proprietary software, what hope do the rest of us have? Especially with online services using remote attestation and refusing to function unless you're using a known, approved stack from boot to UI layer. May as well buy a Mac and an iPhone and be done with it. Save you lots of hassle and you'll look less like a dweeb.
A lawsuit costs money, and doesn't un-sell the data.
JSONL as a replacement for CSV, you shouldn't be using CSV as format for long term storage or querying, it has so many downsides and nearly zero upsides.

JSONL when compressed with zstd, most of "expensive if large" disappears as well.

Generating and consuming JSONL can easily be in the GB/s range.
I never left cloud infra, though I never came across a scale that required k8s anything close to that scale would just go on serverless functions anyway. However, I will agree with you that I've always assumed that I'm too 50% of the way there with docker and misc experience.
The Website Hacker News Is Afraid to Discuss
Where do the attributions come from, Papias? He claimed Mark wrote down Peter's teachings in the wrong order, and that Matthew's gospel was written in Hebrew. But the Matthew we have is in Greek, copies from Mark and shares other Greek material with Luke (Q source).
I don't know whether to laugh at the joke or be triggered that USB takes three turns to insert.
The only reasonable alternative for now, Apple. Only thing worse about their devices than the competition is the price. One day they’ll turn as evil as Google, but hopefully other viable options will exist by then.
At the same time, ZIRP completely distorted the market and gave us multi-billion dollar companies that never had a workable business models, but filled offices all over the world with useless employees. I really enjoyed having a chief happiness officer, but I don't think the company needed it.
> Sometimes I wonder about flying to the EU to reactivate my phone there if that's possible but knowing Apple there'll be some terrifying kafkaesque twist

IIRC you needed to be like in the region like every 30 days, else it updates to your current location (but don't quote me on it, I might be really misremembering the company/product)
How you lawyer is going to prove the data is not deleted?

And what damages are you going to claim in court.

Lawyers are not cheap, no lawyer will work on a case less that even $1k. My only hope is donating to privacy fighting organizations like EFF that file class actions.
In the end it was a dumb comment by one of the Go devs which got jumped on by all the Go haters. Contrary to the popular meme, Go's not just for mid-tier programmers - it never was (and to be fair to Rob Pike, they've twisted what he said). But sure, it makes it easier for programmers at all levels to get started, and to get real work done. That includes advanced people as well as the inexperienced.

I think the ultimate goal of making a programming language is to cause the least friction for a programmer trying to get real work done, and in my experience Go's great from that point of view. Language bells and whistles may be exciting, but often don't pay their way in terms of real world productivity, IMHO.
I'm not arguing against that here.

But returning profit to the shareholders is the primary goal of a corporation.
Couple that with Upton Sinclair's quote: "It is difficult to get a man to understand something when his salary depends upon his not understanding it", and I think you get to the heart of the problem.
I would still feel zero job security in such a position, and would be looking for work which is not only intellectually and creatively rewarding, but considerably more difficult to automate. Often this means becoming product-oriented or getting into leadership positions.
I lived in Australia for five years and this is exactly the reason I left. Everyone is a stickler, NIMBYs own the cities and the police are always out to get you. Australians have an undeserved reputation for being "laid back" but they are absolutely the opposite. Any chance for a new rule or regulation is embraced by the population.
Generally the way this works is that when you write atomic algorithms, you are doing 2 things. The first is telling the compiler what it's allowed to optimize, and the 2nd is controlling the processor. What this means is that the code that relies on TSO (which is pretty close to the C++ memory model), you add a bunch of information to the code that prevents the compiler from doing some optimizations, and then when the compiler is generating native code, on X86 it will turn into regular loads/stores, but on arm it will have additional fence instructions.
I understand that. My point was that the original comment was grossly overstating the supposed 'dominance' of WhatsApp.
Not only get rich, but do so in the least productive, most destructive way imaginable.
I think this highlights how unconstitutional this administration is being. When the news first broke, nobody knew and it made sense not to put a guess in a headline.

Now they’ve responded with some very strong accusations which could be included because they’re actually saying something in public about it:

> DHS and (Immigration and Customs Enforcement) investigations found Ozturk engaged in activities in support of Hamas, a foreign terrorist organization that relishes the killing of Americans. A visa is a privilege, not a right. Glorifying and supporting terrorists who kill Americans is grounds for visa issuance to be terminated. This is commonsense security.

Of course, none of this is warranted - there’s no active threat and they could have followed the legal process but based on how quickly they moved her to Louisiana I suspect they’re hoping to blow off the court orders long enough to get her out of the country.
You could say the same thing about almost any protocol, e.g. HTTP, which runs on arbitrary streams of bytes over TCP; and the headers, methods and status codes are just illusions on top of that.
Chinese spending on renewable energy dwarfs its rivals, with over $800 billion — or 4.5% of its GDP — invested last year, according to BloombergNEF.

That is a mind boggling level of commitment.
As a matter of standard practice I use [forks] and [spoons] in otherwise typical yes/no spaces. When results are tallied I simply retcon my yes/no proxy assignments towards whatever result was my target outcome. Publishable outcomes every time. P hacking is a pain and really, why bother when I know the results are… aspirational… regardless?
1) Those Alex Horton and Missy Ryan do owe an apology to Signal project. Their publication was incorrect and caused misinformation regarding one of the most secure platforms on Earth.

2) As for Gov officials - I understand they used Signal on 1) Government issued devices, without a doubt running NSA built OS; 2) preinstalled Signal App, without a doubt audited by NSA line by line; 3) tactical OP information which has very close expiry date.

3) That "journalist", IMO, is guilty of high treason. They must have immediately notified the group about their presence and they must have not publish any of the secrets they accidentally got privy to. And even more, from professional POV, the actions of journalist were deeply non-ethical. I dare say, un-American and definitely not something that any US Citizen can be expected to do.

4) The "deep state" is furious because they can't leak Signal chat messages. IMO, it's a good choice. They (Administration) just need to carefully audit the groups and distribution lists. That was a very bad call.

I personally will _continue_ using Signal, even with more confidence now.
Oh, sweet so Mr Balls has done time and paid his debt for his crimes then?
Disparaging the boot is a bootable offense.
I assume they mean nuclear war.
It is really closer to the latter (Linux Foundation = the megacorporations LUG), but Linus seems to treat it as the former - in a good way.
Not a regular cab. There are specialty companies that you can find on sites like Viator.
Did you forget that my first message, which you replied to, was specifically about Europe?

So you replied about the UK specifically. I catered to that, and then reconnected it back to Europe as a whole, which I was originally discussing.

If someone here is derailing the conversation, it isn't me. Especially now that we're discussing the meta and not even the original subject.
Judging by past experience, culture gap is more of a problem.
Or worse, decades in the future when historians look back, they might determine that collapse started before 2025 (perhaps 9/11, 2008 financial collapse, covid, the re-emergence of populist fascism, AI, microplastics, climate change ... take your pick).

Which means we might be living in collapse now, we just don't know it yet. "The Long Emergency" as James Howard Kunstler put it.