Lightnews — Scholar-powered news

Simon Willison @simonwillison.net · 2h

That feature confused me SO much when I first learned about it! simonwillison.net/2021/Aug/3/s...

Simon Willison @simonwillison.net · 7h

... it's possible she's talking about an incident from before that change went live I guess

1 18

Simon Willison @simonwillison.net · 7h

"I caught a former friend from Columbia—a girl who comes from media royalty—liking negative tweets about me."

How does that work? Twitter likes have been private for about a year new

2 45

Simon Willison @simonwillison.net · 9h

Any model that trains are my collection of illustrations of pelicans riding bicycles is going to generate some very strange images in the future! simonwillison.net/tags/pelican...

Simon Willison on pelican-riding-a-bicycle

68 posts tagged ‘pelican-riding-a-bicycle’. My benchmark for LLMs: "Generate an SVG of a pelican riding a bicycle". "User might be a kid playing with words" according to Qwen3-4B-Thinking.

simonwillison.net

2

Simon Willison @simonwillison.net · 11h

You need to turn on the feature: simonwillison.net/2025/Sep/9/c...

2 1

Simon Willison @simonwillison.net · 11h

My notes (and a pelican) for the new Claude Haiku 4.5 model, released by Anthropic this morning simonwillison.net/2025/Oct/15/...

Introducing Claude Haiku 4.5

Anthropic released Claude Haiku 4.5 today, the cheapest member of the Claude 4.5 family that started with Sonnet 4.5 a couple of weeks ago. It's priced at $1/million input tokens …

simonwillison.net

4 7 52

Simon Willison @simonwillison.net · 17h

I have no idea, they only sent me one!

Simon Willison @simonwillison.net · 18h

Forging doesn't matter, because CSRF is about protection from confuse deputy attacks where a real user's real browser is tricked into performing actions on their behalf

The fact that someone with curl can send any headers they like doesn't affect that, they still need to get an authentication token

3

Simon Willison @simonwillison.net · 1d

caniuse.com/mdn-http_hea... looks pretty safe

headers HTTP header: Origin | Can I use... Support tables for HTML5, CSS3, etc

caniuse.com

1 2

Simon Willison @simonwillison.net · 1d

Can we set it up so users of old browsers don't get to login to the application at all? That might be better than letting them use it in an unsafe way

I don't know how many old browsers there are that don't at least support the Origin header though

2 2

Simon Willison @simonwillison.net · 1d

FineWeb-Edu is derived from Common Crawl, which many people consider an unethical source of training data as that's copyright material scraped from the web

arxiv.org/abs/2406.17557

The FineWeb Datasets: Decanting the Web for the Finest Text Data at Scale

The performance of a large language model (LLM) depends heavily on the quality and size of its pretraining dataset. However, the pretraining datasets for state-of-the-art open LLMs like Llama 3 and Mi...

arxiv.org

1 4

Simon Willison @simonwillison.net · 1d

Does widespread browser implementation of the Sec-Fetch-Site HTTP header mean we can protect against CSRF attacks without needing those hidden form tokens? It looks like the answer may be a cautious "yes"! simonwillison.net/2025/Oct/15/...

A modern approach to preventing CSRF in Go

Alex Edwards writes about the new http.CrossOriginProtection middleware that was added to the Go standard library in version 1.25 in August and asks: Have we finally reached the point where …

simonwillison.net

6 9 40

Simon Willison @simonwillison.net · 1d

I misquoted the llama.cpp performance numbers in my original post, here's the updated section which now distinguishes between token read speed and token generation speed

llama.cpp creator Georgi Gerganov just published extensive benchmark results from running llama.cpp on a Spark. He’s getting ~3,600 tokens/second to read the prompt and ~59 tokens/second to generate a response with the MXFP4 version of GPT-OSS 20B and ~817 tokens/second to read and ~18 tokens/second to generate for GLM-4.5-Air-GGUF.

6

Simon Willison @simonwillison.net · 1d

Here's the updated text: "He’s getting ~3,600 tokens/second to read the prompt and ~59 tokens/second to generate a response with the MXFP4 version of GPT-OSS 20B and ~817 tokens/second to read and ~18 tokens/second to generate for GLM-4.5-Air-GGUF"

2 5

Simon Willison @simonwillison.net · 1d

I need to correct that! Those are token reading but not token generation numbers

1 2

Simon Willison @simonwillison.net · 1d

bsky.app/profile/simo...

Simon Willison @simonwillison.net · 1d

WHOA I was trying to piece together why the design felt weirdly familiar www.indiewire.com/awards/indus...

‘Devs’: Rob Hardy’s Cinematography Brought the Mysterious Research Lab to Life

The secret research facility in Alex Garland's sci-fi series was an incredible collaboration of cinematography and production design.

www.indiewire.com

3 1 16

Simon Willison @simonwillison.net · 1d

WHOA I was trying to piece together why the design felt weirdly familiar www.indiewire.com/awards/indus...

‘Devs’: Rob Hardy’s Cinematography Brought the Mysterious Research Lab to Life

The secret research facility in Alex Garland's sci-fi series was an incredible collaboration of cinematography and production design.

www.indiewire.com

11

Simon Willison @simonwillison.net · 1d

NVIDIA sent me preview hardware of their new DGX Spark 128GB ARM64 4TB "AI supercomputer" - it's a very neat little device, here are my notes so far
simonwillison.net/2025/Oct/14/...

NVIDIA DGX Spark: great hardware, early days for the ecosystem

NVIDIA sent me a preview unit of their new DGX Spark desktop “AI supercomputer”. I’ve never had hardware to review before! You can consider this my first ever sponsored post …

simonwillison.net

7 13 120

Simon Willison @simonwillison.net · 1d

Terrible!

2

Simon Willison @simonwillison.net · 1d

Anyone who started their web development career in the last ten years has come up in an era where you frequently learn React as your first exposure to building websites

Try surveying people on how they would implement a search feature using an HTML <form> with no JavaScript

1 2 10

Simon Willison @simonwillison.net · 1d

"I’m genuinely interested in the reasons why people would reject a simple declarative solution in favour of the complexity of doing everything with a big JavaScript framework."

For a lot of people I really do think it's because they don't know how to build web frontends without JavaScript

1 2

Simon Willison @simonwillison.net · 2d

I quite like "Vibing" from Mitchell Hashimoto mitchellh.com/writing/non-...

Vibing a Non-Trivial Ghostty Feature

mitchellh.com

10

Simon Willison @simonwillison.net · 2d

nanochat by Andrej Karpathy is neat - 8,000 lines of code (mostly Python, a tiny bit of Rust) that can train an LLM on $100 of rented cloud compute which can then be served with a web chat UI on a much smaller machine simonwillison.net/2025/Oct/13/...

nanochat

Really interesting new project from Andrej Karpathy, described at length in this discussion post. It provides a full ChatGPT-style LLM, including training, inference and a web Ui, that can be …

simonwillison.net

3 21 200

Simon Willison @simonwillison.net · 3d

It's top tier surrealist Minecraft content

1

Simon Willison @simonwillison.net · 3d

Oops, thanks! Should be fixed now

1 1