HackerNews Digest

Semgrep evaluated several LLMs on an IDOR (Insecure Direct Object Reference) benchmark using a uniform prompt and dataset, varying only the model and its surrounding harness. Their custom multimodal pipeline (which discovers endpoints and directs the model) achieved the highest F1 scores: GPT‑5.5 at 61 % and Claude Opus 4.8 at 53 %. Among open‑weight models run with a simple Pydantic harness, Zhipu AI’s GLM‑5.2 attained 39 % F1, surpassing Claude Code (32 %) while costing roughly $0.17 per true positive. GLM‑5.2 is a Mixture‑of‑Experts model with ~750 B parameters (≈40 B active per token), 1 M‑token context, and MIT‑licensed weights, making it runnable on‑premises. Other open‑weight models (MiniMax M3, Kimi K2.7 Code) lagged at 23 % and 22 % F1. The study concludes that harness design contributes more to performance than model choice, but a high‑performing, low‑cost open‑weight model like GLM‑5.2 can be a viable alternative to expensive closed‑source LLMs for security‑focused code analysis.

- Multiple U.S. states, European nations, and Australia have enacted “age‑verification” rules, framed as child‑protection measures. - The author argues these rules function as identity‑attribution mechanisms, linking online accounts to real‑world identifiers (e.g., SSN, government ID). - Law‑enforcement investigations typically require (1) the incident description and (2) the offender’s identity; current methods rely on OSINT, subpoenas for IP or contact data, and manual effort, which do not scale. - By mandating verified personal data for online platforms, governments can automatically retrieve a speaker’s physical identity, regardless of criminal suspicion. - The text warns that once a critical mass of users is verified, automated tracking could trigger legal or police actions for dissenting speech, likening it to prior ISP‑issued “love letters” from copyright enforcement. - The author advises avoiding age verification, preserving anonymity, and, if verification is unavoidable, using privacy‑focused services and cryptocurrency (Monero) for payment.

The open‑source ATS (interviewstreet/hiring‑agent) parses a PDF resume, calls an LLM six times to extract basics, work history, education, skills, projects, awards, adds GitHub repo data, then scores the candidate out of 100 (35 pts open‑source, 30 pts projects, 25 pts work experience, 10 pts technical skills, up to 20 pts bonuses). * Using the default gemma3‑4b model (temp 0.1) on the same résumé produced scores from 66 to 99; technical‑skill marks were stable (≈8/10), while project and open‑source points varied widely. * Lowering temperature to 0 did not eliminate variance; GitHub issue reports show similar fluctuations. * Switching to Gemini‑3.1‑flash‑lite yielded a narrower range (45–65) but still a ≈28 % failure rate for a 60‑point cutoff. * Experience points were always 25/25 regardless of seniority because the prompt provides no rubric or anchors. The author concludes that LLM‑based judgment of experience or project quality is inherently noisy, making the tool’s heavy weighting on open‑source and projects unreliable for fair candidate screening. A correction notes that scoring is position‑agnostic despite a “Software Intern” label in a template.

The page provides a continuously updated dataset of historic and current memory and storage prices, focused on DRAM, NAND flash, and HBM. Prices are expressed as the lowest nominal USD $/GB (or $/TBps for HBM) from retail listings, not contract or inflation‑adjusted rates. Visualizations include: - Overall $/GB over time for each memory type (log scale). - DRAM price broken down by generation (Pre‑DDR, DDR‑1 through DDR5). - Quarterly AI‑accelerator cost for Nvidia, AMD, Google (TPU), and Amazon (Trainium), stacked by component (HBM, logic die, packaging/CoWoS, auxiliary). - HBM price by generation (HBM2e → HBM3 → HBM3e → projected HBM4, Q3 2026) using analyst estimates (TrendForce/SemiAnalysis). Methodology: DRAM data extend McCallum’s dataset with Keepa Amazon prices; NAND uses Keepa’s cheapest consumer NVMe listings from 2016 onward; HBM values are modeled cost‑share estimates, not market transactions. Caveats note that listed prices often reflect end‑of‑life clearance, may lag contract pricing, and that outlier listings are filtered. Updates occur monthly for DRAM/NAND and quarterly for HBM; full CSV with sources is downloadable. Compiled by David Shim (Stanford DAM).

None

No content was provided to summarize.

The author experienced right‑shoulder pain and, after an orthopedist’s exam, received an MRI indicating a Grade III (>50 % width) partial‑thickness tear of the subscapularis tendon. The clinic performed shockwave therapy (contrary to recent guidelines for non‑calcific rotator‑cuff tendinopathy) and injected Traumeel, a homeopathic product without a therapeutic indication, raising confidence concerns. Seeking a second opinion, the author uploaded the 266 MB DICOM set to Opus 4.8 (via Claude Code) and instructed it to analyze the images. Opus first generated a report stating the tendon was intact, conflicting with the clinician’s finding. An arbitration step, comparing the human report and a prior ChatGPT‑generated discussion, produced a third report concluding “mild insertional tendinosis; no discrete partial‑ or full‑thickness tear identified,” with moderate‑to‑high confidence. The divergent AI and physician assessments left the author uncertain about treatment, highlighting current limits of AI in medical imaging interpretation and the need for cautious reliance on such tools.

The paper addresses the challenge of distilling knowledge from proprietary, black‑box large language models (LLMs) such as GPT‑4 into smaller, more deployable models. Traditional knowledge distillation relies on access to teacher model internals, which is unavailable for closed‑source LLMs. To overcome this, the authors propose **Proxy‑KD**, a framework that introduces an intermediate proxy model that interacts with the black‑box teacher to generate high‑quality outputs and representations usable for training the student model. Experiments demonstrate that Proxy‑KD improves the performance of distilled student models compared to standard black‑box distillation and even outperforms conventional white‑box KD methods that have full access to teacher internals. The results suggest that using a proxy can effectively bridge the gap between inaccessible teacher models and efficient student training, offering a practical route for leveraging advanced LLM capabilities in resource‑constrained settings.

The article discusses challenges of Arabic typography, emphasizing that Arabic script is inherently cursive and relies on contextual ligatures to render correctly. Early font engines lacked proper ligature handling, producing disjointed glyphs that broke the visual flow of words such as “hello, world, this is Arabic text.” A critical example is the basmala—“bismillāh al‑raḥmān al‑raḥīm”—which appears at the start of every Qur’an surah except the ninth. Rendering the basmala as separate letters yields an unacceptable jumble, so Unicode introduced a dedicated code point (U+FDFD ARABIC LIGATURE BISMILLAH AR‑RAHMAN AR‑RAHEEM) that maps to a single, correctly shaped glyph. The article notes platform inconsistencies: the glyph appears long and narrow in Firefox on desktop but differently on Android. It also breaks down the four component words, explains the assimilation of the definite article “al‑” before /r/, and cites typographic critiques of the Android design, particularly the fused letter connections.

The provided text consists solely of the title “Zanagrams – free daily word puzzle.” This indicates that the subject matter is a word‑based puzzle called Zanagrams, offered without charge on a daily basis. No additional description, rules, platform details, or contextual information is included, so the core point is simply the identification of Zanagrams as a free, everyday word‑puzzle service.