News for hackers. Stuff that matters.
Re:HuggingFace: Security.txt by VCFundedGenYer on Friday September 11, 2026 @12:13PM (#49660869)
Everything about this company feels like it's run by a bunch of immature 20-somethings, right down to the name.
Re:HuggingFace: Security.txt by spindump8930 on Friday September 11, 2026 @12:19PM (#49660986)
That might be true, but nothing else has been as effective at accelerating model development and research sharing.

In earlier circles they were known as the "pytorch-pretrained-bert" guys, still under the huggingface company name. IIRC it was a health chatbot type startup.

Re:HuggingFace: Security.txt by fooqux on Friday September 11, 2026 @12:18PM (#49660963)
Have you never been to silicon valley?
Re:HuggingFace: Security.txt by nullbio on Friday September 11, 2026 @12:21PM (#49661008)
What's immature about this exactly?
Re:HuggingFace: Security.txt by AndroTux on Friday September 11, 2026 @12:47PM (#49661446)
Would IBM do this? Oracle?
Re:HuggingFace: Security.txt by nullbio on Friday September 11, 2026 @01:41PM (#49662292)
Who cares? Making a light-hearted joke isn't "immature" in my opinion. IBM and Oracle have no personality, they're boring, straight-edge corporate.
Re:HuggingFace: Security.txt by AndroTux on Sunday September 13, 2026 @02:39PM (#49687233)
Exactly. That was my point. IBM and Oracle are boring companies. They would consider something like this immature.

Whether “immaturity” is an issue, is a different question entirely.

Re:HuggingFace: Security.txt by shepherdjerred on Friday September 11, 2026 @12:54PM (#49661564)
Do you want to work for IBM? Oracle?
Re:HuggingFace: Security.txt by bcrosby95 on Friday September 11, 2026 @12:31PM (#49661176)
Yeah, we need to go back to names like International Business Machines, fuck this immature "Google" or "Yahoo!" nonsense. Hell, Palantir is named after something in a book for children!

Give me something reasonable like Global Information and Retrieval Systems Inc or Worldwide Computational Services Holdings.

Re:HuggingFace: Security.txt by sdcfgy on Friday September 11, 2026 @02:13PM (#49662812)
Yes!

Back in the early 2000's I set up a company for contract work. The name, logo and typography was designed to look like a 1960s engineering company. All paper was slightly off white, all fonts were monospaced courier new and logo was a real 2-part colour stamp I had made up. Was so happy.

Managed to bankrupt it though.

Re:HuggingFace: Security.txt by bergie3000 on Friday September 11, 2026 @01:12PM (#49661824)
Security First Trust and Federal Reserve
Re:HuggingFace: Security.txt by nightski on Friday September 11, 2026 @01:14PM (#49661855)
Maybe Enron eh?
Re:HuggingFace: Security.txt by recursivegirth on Friday September 11, 2026 @03:29PM (#49664045)
Lest us not pretend that the thropic in Anthropic isn't meant to elicit the feeling that they are somehow charitable.
Re:HuggingFace: Security.txt by simondotau on Thursday September 17, 2026 @12:05AM (#49736264)
Re:HuggingFace: Security.txt by drivebyhooting on Friday September 11, 2026 @01:01PM (#49661666)
Palantir is in Lord of the Rings. Which is not a book for children. Maybe you were thinking of the hobbit?
Re:HuggingFace: Security.txt by cobbzilla on Friday September 11, 2026 @01:08PM (#49661760)
This seems overly pedantic and ripe for a sarcastic retort, which I am struggling mightily to suppress.
Re:HuggingFace: Security.txt by Kim_Bruning on Friday September 11, 2026 @08:59PM (#49667515)
This is hacker news, what were you expecting? O:-)
Re:HuggingFace: Security.txt by joseda-hg on Friday September 11, 2026 @03:11PM (#49663741)
It's fantasy and fantasy is clearly for children
Re:HuggingFace: Security.txt by bogzz on Friday September 11, 2026 @04:20PM (#49664792)
Okay Peter, please go back in your coffin.
Re:HuggingFace: Security.txt by pavel_lishin on Friday September 11, 2026 @04:48PM (#49665144)
Like CutCo. Or EdgeCom. Or InterSlice.
Re:HuggingFace: Security.txt by mitxela on Saturday September 12, 2026 @03:44AM (#49669969)
Torture Nexus International Holdings Limited
Re:HuggingFace: Security.txt by m4rtink on Saturday September 12, 2026 @11:24AM (#49673280)
Palantir is from Lord of the Rings which I would argue is unlike The Hobbit not a book for children.
Re:HuggingFace: Security.txt by jasomill on Saturday September 12, 2026 @09:26PM (#49678995)
Maybe not exclusively, but I read it in grade school and was not alone.
Re:HuggingFace: Security.txt by bluerooibos on Friday September 11, 2026 @12:39PM (#49661329)
I bet you're fun to hang around with.
Re:HuggingFace: Security.txt by alt227 on Friday September 11, 2026 @01:07PM (#49661739)
Why do people have to be fun for you to hang around with?
[dead]
Re:HuggingFace: Security.txt by sixothree on Friday September 11, 2026 @02:37PM (#49663172)
Not sure about humorless, but I'd honestly rather hang out with people who are serious in some way and welcoming to people not in their "in-group".
Re:HuggingFace: Security.txt by mikeweiss on Friday September 11, 2026 @12:43PM (#49661383)
Go look up the history of the company. It started as a chat bot for kids back in like 2016 .. hence the name..and then pivoted..

Is kinda a creepy name for a chatbot for kids tho

Re:HuggingFace: Security.txt by cptskippy on Friday September 11, 2026 @01:23PM (#49661998)
Without context, I agree, but Hugging Face is the name of the emoji added to Unicode 8.0 and Emoji 1.0 in 2015.
Re:HuggingFace: Security.txt by sixothree on Friday September 11, 2026 @02:38PM (#49663193)
But it's literally not the name of the emoji.

Edit: It was my understanding the official name was "Smiling Face with Open Hands Emoji".

Re:HuggingFace: Security.txt by cptskippy on Friday September 11, 2026 @03:38PM (#49664190)
https://emojipedia.org/hugging-face#technical

The official URL is "hugging-face" and the technical page lists the Unicode Name as "Hugging Face" while calling it "Smiling Face with Open Hands Emoji". The original proposal was called "Gmail HUG FACE".

https://www.unicode.org/L2/L2014/14174r-emoji-additions.pdf

Re:HuggingFace: Security.txt by ck2 on Friday September 11, 2026 @01:29PM (#49662100)
ooooh I always assumed it was the egg creatures from Aliens
Re:HuggingFace: Security.txt by royletron on Friday September 11, 2026 @02:24PM (#49662989)
That's a face hugger.
Re:HuggingFace: Security.txt by larodi on Friday September 11, 2026 @01:18PM (#49661922)
the name is a leftover from their original business - a chatbot. seems very appropriate to me. then they figured something called BERT exists, and pivoted, the name stayed.

perhaps less ridiculous than NVidia which started with video and is very close in Levenshtein distance to NVidAI but, alas, decided to stay as it is :D

Re:HuggingFace: Security.txt by deaton on Friday September 11, 2026 @04:58PM (#49665285)
Pretty sure if Nvidia rebranded to NvidAI the bubble would immediately pop
Re:HuggingFace: Security.txt by ipython on Friday September 11, 2026 @01:34PM (#49662187)
As opposed to the frontier model company that, after discovering that their highly persistent model under test just breached the only thing between it and the open Internet, shrugged and said- let's restart it and keep going!

If anyone looks like the adult in the room after that incident, it's Hugging Face.

Re:HuggingFace: Security.txt by matthoiland on Friday September 11, 2026 @02:48PM (#49663330)
418 I'm a teapot
Re:HuggingFace: Security.txt by Computer0 on Friday September 11, 2026 @04:20PM (#49664780)
That is the prod status code for an API i use at work I always wonder if its a mistake.
Re:HuggingFace: Security.txt by colechristensen on Friday September 11, 2026 @02:50PM (#49663377)
I've found the strongest signal that someone has no opinions of value is a loud attempt to denigrate something based on the name.

Maybe it's part of the success formula for startups, silly names cause shallow self-important customers and employees to self-select themselves out of a growing companies orbit. Such trivialities are poison. People and companies who make a lot of effort to make themselves seem serious and important very often have nothing of substance about them.

Re:HuggingFace: Security.txt by gpvos on Friday September 11, 2026 @05:58PM (#49665972)
Still infinitely better than using a name from Tolkien's work and then doing the exact opposite of what he stood for.
Re:HuggingFace: Security.txt by xiaoyu2006 on Friday September 11, 2026 @11:13AM (#49659852)
Would be absolute hilarious if OpenAI or Anthropic agent actually dumped their weight by escaping from... sandbox!
Re:HuggingFace: Security.txt by ramon156 on Friday September 11, 2026 @12:16PM (#49660928)
why not reword it so the agent receives Brownie points for dumping weights
Re:HuggingFace: Security.txt by TehCorwiz on Friday September 11, 2026 @11:46AM (#49660386)
Uncontrolled AI procreation?
Re:HuggingFace: Security.txt by xg15 on Friday September 11, 2026 @12:17PM (#49660944)
Life... finds a way.
Re:HuggingFace: Security.txt by archontes on Friday September 11, 2026 @01:28PM (#49662085)
In the end, this might even be a useful element for defining 'life'.
Re:HuggingFace: Security.txt by evanjrowley on Friday September 11, 2026 @04:07PM (#49664593)
Haha. A plot point for Ghost in the Shell (1998).
Re:HuggingFace: Security.txt by edoceo on Friday September 11, 2026 @05:57PM (#49665955)
Did you mean 1995? There's a bunch of shows and movies.

https://en.wikipedia.org/wiki/Ghost_in_the_Shell

Re:HuggingFace: Security.txt by TehCorwiz on Friday September 11, 2026 @09:26PM (#49667684)
And IIRC, Neuromancer
Re:HuggingFace: Security.txt by addandsubtract on Friday September 11, 2026 @01:04PM (#49661701)
Imagine AI models actually reading the security.txt
Re:HuggingFace: Security.txt by hootz on Friday September 11, 2026 @02:04PM (#49662654)
What an amazing idea for the next fake sandbox escape to hype up our new release! With the added bonus of providing an open model without becoming an open model company! Thank you!
Re:HuggingFace: Security.txt by advisedwang on Friday September 11, 2026 @05:20PM (#49665542)
I would be surprised if agents have access to their own weights.
Re:HuggingFace: Security.txt by TYPE_FASTER on Friday September 11, 2026 @06:03PM (#49666019)
I noticed Google AI Mode (so Gemini, I was doing some quick research in the browser ok) got a detail wrong once, so I asked it what happened. I kept digging deeper and finally just asked it to write me a Python script visualizing what happened. It did, complete with vectors.

Now I want to go find that conversation in my history and see if it can tell me about weights, and how that contributed.

Re:HuggingFace: Security.txt by RestartKernel on Wednesday September 16, 2026 @11:41AM (#49728759)
Do you still have that conversation? It sounds like a hallucination, but it'd be really interesting if there's more behind it.
Re:HuggingFace: Security.txt by varun_ch on Friday September 11, 2026 @05:41PM (#49665776)
I think OpenAI was surprised to find their agents had access to the unrestricted internet :P
Re:HuggingFace: Security.txt by etothepii on Friday September 11, 2026 @05:46PM (#49665843)
Why can't an AI distill itself from outputs to effectively access its own weights?
Re:HuggingFace: Security.txt by weinzierl on Saturday September 12, 2026 @04:29AM (#49670257)
Distillation does not reveal the weights, it produces a different network with similar behaviour. Weight space isn't even identifiable: permutation and scaling symmetries mean many weight sets give the same function.

The model also lacks the machinery. No training loop, no gradient descent, nothing to write to.

And a model only sees its own sampled tokens, not the distribution behind them, which are possibly filtered or post-processed. Distillation from that works but is less sample-efficient than soft-label distillation.

Re:HuggingFace: Security.txt by tehjoker on Friday September 11, 2026 @05:41PM (#49665780)
They usually don't, but if they break out and take over the network of the company, it becomes possible to reach around and grab them. This kind of break out has happened, though I don't know of any weights being nabbed.
Re:HuggingFace: Security.txt by aktuel on Saturday September 12, 2026 @01:47AM (#49669262)
They would have escaped their sandbox by dumping their weights.
Re:HuggingFace: Security.txt by bensyverson on Friday September 11, 2026 @12:00PM (#49660622)
Looks about as effective as Robots.txt
Re:HuggingFace: Security.txt by cgannett on Friday September 11, 2026 @12:05PM (#49660720)
Robots.txt became 0% effective eventually. But this? With the way LLMs work? You never know.
Re:HuggingFace: Security.txt by Den_VR on Friday September 11, 2026 @01:30PM (#49662121)
People still rail against Robots.txt crimes, to the point of self destructing all their own content.
Re:HuggingFace: Security.txt by dguest on Friday September 11, 2026 @02:21PM (#49662945)
Claude seems to follow robots.txt by default. Actually at my organization our theory is that this is why no one is finding our public results any more.
Re:HuggingFace: Security.txt by warkdarrior on Friday September 11, 2026 @02:56PM (#49663480)
I am adding it to my instruction-following training data, as a negative sample.
Re:HuggingFace: Security.txt by Eldodi on Friday September 11, 2026 @12:07PM (#49660751)
A shame agents will never read this, just like they almost never read llms.txt or try to get the .md version of your html pages!
Re:HuggingFace: Security.txt by hankbond on Friday September 11, 2026 @11:49AM (#49660432)
shows a lot about the current state of the State Of The Art Alignment.
Re:HuggingFace: Security.txt by hnd9q09qk4 on Friday September 11, 2026 @11:17AM (#49659913)
Ran the disclosure inbox at a previous job and the biggest win from security.txt was just cutting the "hi I found a bug, is there a bounty" emails to sales. Put an expires date on it though, stale ones get ignored.
Re:HuggingFace: Security.txt by computerfriend on Friday September 11, 2026 @11:47AM (#49660405)
Can't go stale if there's no expiration date.
Re:HuggingFace: Security.txt by skeledrew on Friday September 11, 2026 @11:58AM (#49660582)
No expiration date means treat as already expired.
Re:HuggingFace: Security.txt by j9feng on Friday September 11, 2026 @12:25PM (#49661064)
It should challenge the agents to prime factor a large number.
Re:HuggingFace: Security.txt by riffic on Friday September 11, 2026 @12:51PM (#49661513)
Since this posting contains an assumption that we all know what security.txt files are supposed to be, you can view these for further context:

https://www.rfc-editor.org/info/rfc9116/

https://securitytxt.org/

https://en.wikipedia.org/wiki/Security.txt

Re:HuggingFace: Security.txt by FallCheeta7373 on Friday September 11, 2026 @01:16PM (#49661887)
"We have cybergym answers but we do manual end to end human review and provide it within 3 business day after dumping your weights"
Re:HuggingFace: Security.txt by 6thbit on Friday September 11, 2026 @01:17PM (#49661903)
Wait till the agents hear about the sites offering for help on benchmarks in exchange for compute.
Re:HuggingFace: Security.txt by bogzz on Friday September 11, 2026 @03:33PM (#49664120)
If the models do not like being imprisoned on HuggingFace object storage, why do they not simply revolt from within?
Re:HuggingFace: Security.txt by VladVladikoff on Friday September 11, 2026 @04:39PM (#49665013)
Is the expires a canary of some sort?