MurphyA/hacker-news huggingface dataset:
by userbinator | 2025-04-09 07:07:26+00:00
> the actual argument value the JVM receives is "/jars/*", and in turn decides to be helpful, and expand the wildcard anyway

Whenever I see such things, I immediately think "whatever the resulting order is, it had better not matter"; and if it does, which is definitely true for Java classpaths, I consider it a bug that needs to be fixed ASAP, before it causes what happened in the article.
by simonask | 2025-04-09 07:08:15+00:00
You seem to consider convenient dependency management a security hazard, which I have always found to be a pretty weird take. It logically follows that the severe difficulty of managing dependencies in C and C++ projects is actually a security feature, or how else are we supposed to understand this opinion?

Let's not pretend that anything is better on the traditional C/C++ side, where the approach is usually one or more of:

1. Vendoring dependencies in-tree. This can result in security problems from missing out on bugfixes upstream.

2. Reinventing functionality that would otherwise be served by a dependency. This can result in security problems from much less battle-tested, buggy in-house implementation. In closed-source code, this is effectively security by obscurity.

I've seen both of these cause issues in large C++ projects.

For reference, the Rust/Cargo ecosystem contains a lot of tools and infrastructure to address supply-chain security, but it will always be a difficult problem to solve.
by mock-possum | 2025-04-09 07:08:18+00:00
I’ve literally never, in almost 20 years in the industry, been asked to or expected to wear a suit. I’ve never ever had anyone say anything to me about my clothes period. It’s simply not a consideration in my experience. In fact the one time I worked for a place that had a dress code, it specifically exempted my department (software engineering) from the policy - and if that hadn’t been the case I wouldn’t have taken that job.

The real answer here is: know the dress expectations of the place you’re applying to, and consider whether you feel comfortable working for a place that won’t pay you the courtesy of letting you dress yourself.
by kappasan | 2025-04-09 07:08:26+00:00
I wonder if it's possible to design a new formal language (something like lojban [1], with a grammar strictly based on formal logic) but with better UX so that it can be used by regular folks like me? Maybe combine something like Attempto [2] with a dedicated visual UI?

I would think a language like that could speed up knowledge base construction. Maybe it can also serve as a substitute for natural languages in some situations where we want our communication to be logically airtight.

[1] https://en.wikipedia.org/wiki/Lojban

[2] https://en.wikipedia.org/wiki/Attempto_Controlled_English

On a separate note, I've always wondered how Cyc is pronounced. Is it "sike", or is it "see-why-see"?
by Zefiroj | 2025-04-09 07:09:16+00:00
The rust language is not well-specified, and if you take rust as the language specified by the compiler, then it has many soundness bugs. So even if you stay within "safe rust", you can segfault.

The "memory safety" of rust is oversold since "safety" is not formally proven for the rust language. While anecdotally memory-related bugs seem less likely, rust without unsafe is not absolutely safe.
by pjmlp | 2025-04-09 07:11:13+00:00
Oberon-2 was my entry point into the Oberon ecosystem, the world of systems programming with automatic resource management languages, and all the cool ideas that are routinely explored on that parallel computing universe where the whole OS stack is mostly safe.

Unfortunely moving past UNIX clones and C seems a task only to be fulfiled by the true hero that is yet to come as per the old prophecy, routinely told by village elders on cold Winter nights around a warm fireplace to keep children entertained.
by exodust | 2025-04-09 07:11:57+00:00
3-5 prompts doesn't get you a professional restaurant website.

The key word is professional. A good restaurant website begins with taking good photos of the premises and the food. AI won't come around to your business and take professional photos.

There's a lot of bits and pieces to a website for bookings, content management, menu updates, etc.

HTML templates and themes have been around for a long time. AI can basically spit out those templates and themes, which is great. But there's still a lot to do before you get to www.fancy-dining.com.
by diogotc | 2025-04-09 07:12:15+00:00
> I have never heard a single person complaining about BankID really.

You haven't met any foreign people then, BankID is a common complaint among international students. I've moved to Sweden recently for university and getting BankID was/is a nightmare. It requires you go get a bank account (which I don't want nor need, and has yearly fees), and since the ID card we get from Skatteverket does not have NFC, we need to go to the bank to setup it on a new phone every time (at least on SEB). And getting a bank account is not a simple process either, it took me like 3 months doing paperwork (and had to mail it physically, they don't do in-person appoitments for this), and I'm an EU citizen. Obviously for Swish you'd need a Swedish bank account, but my point is that you should be able to get a digital eID from the government without any other requirements (like I got my physical ID card from Skatteverket).
by roenxi | 2025-04-09 07:12:38+00:00
> The 10-year U.S. Treasury yield , the globe's benchmark safe-haven anchor...

The US government is ~37 trillion dollars in debt and rising. They're not going to do anything to cut spending until they hit a crisis so massive that they just can't spend any more. Which is going to have to be a shocker of a crisis given how they've handled the last couple. Raising taxes seems to be off the table too.

While it is true that US treasuries are low risk, they are low risk in the way that lending the broke town drunk money are low risk - you can come up with accurate estimates of how likely you are to get the money back. The real mystery has for some time been why people persist in feeding the US government money voluntarily. The math doesn't seem to be ambiguous, the value lent can't be paid back in real terms. Foreign holders of these things are engaging in charity.
by kortilla | 2025-04-09 07:12:41+00:00
> but it may mean building new standards on top of the duct-taped 1980s-era networking stack the modern Internet still runs on.

That’s a path directly into a money burning machine that goes nowhere. This has been tried so many times by far larger companies, academics, and research labs but it never works (see all proposals for things like content address networking, etc). You either get zero adoption or you just run it on IPv4/6 anyway and you give up most of the problems.

IPv6 is still struggling to kill IPv4 20 years after support existing in operating systems and routers. That’s a protocol with a clear upside, somewhat socket compatible, and was backed by the IETF and hundreds of networking companies.

But even today it’s struggling and no company got rich on IPv6.
by simonask | 2025-04-09 07:13:26+00:00
Coming from C++, my favorite take on Rust is that it is fundamentally about productivity.

Avoiding UB is a serious drain on productivity in C++, and every new language or library feature comes with additional pitfalls, increasing the mental load.

This is to say: The benefit of Rust is not actually about "security critical scenarios", but much more generally about delivering the same quality of code in a fraction of the time.
by CraigJPerry | 2025-04-09 07:13:38+00:00
> How much do you trust your government with your money?

The money that they issue? Your question is radically flawed.

That aside your main point is that crypto continues to be as relevant in cross jurisdiction payments even after the introduction of a pix like system of payments in each country.

Crypto transaction volumes across all crypto currencies are so low compared to FOREX in any of the worlds currencies (even relatively unused ones - currency speculators still drive transactions even there) that it’s basically irrelevant today in this use case. So your argument becomes it’s irrelevant today and will continue to be tomorrow.

If you’re to express the volume of all crypto transactions, not just those for the purpose of international transaction, just everything in all crypto currencies. The daily volume compared to transactions in all the other non crypto currencies ends up looking like a homeopathic dilution ratio, 0.00000000000000…%
by DeathArrow | 2025-04-09 07:13:41+00:00
Programming GUI using existing frameworks like GTK, QT, Fltk, Avalonia and mainstream programming languages like C/C++, .NET, Java, Python, is hard, buggy and not future proof.

So a guy writes his own toolkit using Common Lisp.

It would made more sense if he just wanted to experiment, learn or have fun.
by bongodongobob | 2025-04-09 07:13:51+00:00
The entitlement of the modern artist/musician is unprecedented. Never have I seen so many people expect to be handed a living because they've posted some "content". Musicians and artists now have global distribution with a plethora of platforms. You have to harness that and then work and grind it out. You have to travel and play gigs and set up a booth at art shows.

There's this new expectation that you should just be able to post some music on Spotify or set up an Etsy shop and get significant passive income. It has never ever worked that way and I feel this new expectation comes from the hustle/influencer types selling it.

Most art is crap and most music isn't worth listening to. In the modern age, it's easy for anyone to be a band or artist and the ability to do this has led to a ton of choice, the market is absolutely flooded. If anyone can do a thing (for very loose values of "do") it's inherently worth less. Only the very best make it and it will always be that way.

Source: made a living as a musician for 20 years. The ones who make it are relentlessly marketing themselves in person. You have to leave the house, be a part of a scene, and be constantly looking for opportunities. No one comes knocking on your door, you must drive your product and make yourself stand out in some way. You make money on merch and gigs, and it's always been that way.

This is all to say that copyright law only affects the top 0.1%. The avg struggling artist will never have to worry about any of this. It's like Bob the mechanic worrying about inheritance taxes. Pipe dream at best.
by atoav | 2025-04-09 07:14:45+00:00
I do not sympathize with NK at all, they are monsters.

What I am surprised about is that the same people who criticized other countries for doing X will not criticize their own/allied country doing a variation of X. I believe that we in the free West have a duty to keep our democrackes and we do that by not copying rules from the like of North Korea and by not constantly creating tools that help abolishing the division of powers.

That means when I critique Australia for that law I do so on the moral ground that Australia should know better, while North Korea is more or less openly evil.

I am a big fan of fixing our own problems instead of pointing elsewhere where it is even worse.

But I learned that there is a big group of people who think that pointing out that there is dog shit on the carpet makes you somehow a traiter and not someone who wants to live in a country without dogshit on the carpet.
by intermerda | 2025-04-09 07:15:07+00:00
> It's hard to say where the lower bound for the value of American companies is now. Is it zero?

Come on, it's definitely not zero for most of the companies, even if tons of small businesses go bankrupt.

> But the current administration seems to be set on redirecting those earnings away from investors towards the government. And I don't see what could limit the extent to which they do so.

The objective of the current administration is to implement fascism. Companies can operate and make profit, as long as it’s allowed by the government. See the blackmailing of law firms and tech companies for examples.

Ironically, Thomas Sowell made that argument back when Obama dared to give Americans healthcare - https://www.creators.com/read/thomas-sowell/06/12/socialist-.... And he also rang similar alarm bells during the Biden administration - https://www.foxnews.com/media/thomas-sowell-systemic-racism-.... But he has offered nothing more than milquetoast commentary about tariffs being bad when it comes to the current administration.
by amarcheschi | 2025-04-09 07:15:21+00:00
I'm taking a course on computational health laboratory. I do have to say gemini is helping me a lot, but someone who knows what's happening is going to be much better than us. Our professor told us it is of course allowed to make things with llms, since on the field we will be able to do that. However, I found they're much less precise with bio-informatic libraries than others...

I do have to say that we're just approaching the tip of the iceberg and there are huge issues related to standardization, dirty datas... We still need the supervision and the help of one of the two professors to proceed even with llms
by aj7 | 2025-04-09 07:15:29+00:00
No one will hire the people you are describing. We had 3.5% unemployment, before Trump began destroying the world economy. People in most fast food restaurants are making $30k. In fact the “entry level workers” and “illegals” were relatively happy. It’s the middle class workers who vary between desperate and enraged, because $45-$65k does not approximate the expectations raised in their childhood. What I’m saying is vastly oversimplified, but you get my drift. There is tremendous housing shortage, due to government policies that surreptitiously favored rising prices for incumbent homeowners, and corporate speculators. Healthcare is apportioned according to education level. Food is remarkably expensive.
by maknee | 2025-04-09 07:15:43+00:00
Great work! It's nice seeing another observability tool. Demo is neat and easy to navigate.

Couple of questions:

What's the overhead of tracing + logging observed by users? I see many tools being built on top of the OpenTelemetry eBPF tracer, which is nice to see.

The OpenTelemetry eBPF tracer uses sampling to capture traces. Do other types of logging in the tool use sampling as well (HTTP traces)?

When finding SLO violations, can this tool find the bug if the latency spikes do not happen frequently (ie, latency spikes happens every 5minutes - 1hour)? I'm curious if the team have had experienced such events and even if those pmax latencies matter to customers since it may not happen frequently.

I see that the flamegraph is a CPU flamegraph - does off-cpu sampling matter (Disk/Network, etc...)? Or does the CPU flamegraph provide enough for developers to solve the issue?
by DoingIsLearning | 2025-04-09 07:16:12+00:00
As a European I feel like I have a lot of safety and guarantees.

I also have children and I obviously worry a great deal about what the world will look like when they grow up.

Whatever is happening at the moment has been set in motion in the past 15 years in this slow tectonic movement towards a likely repetition of past history. In that context there seems to be a huge information /misinformation/propaganda/psy ops operation happen under our feet.

The wake up call for me was during the past US presidential campaign. I heard in my social circle (three separate) under 25 yr old males (all raised and living in social-democratic Central Europe) repeating tiktok/instagram talking points, about how Trump "...will be good for 'the economy' ".

In light of past interesting discussion in HN, I ask the question:

How can we as citizens contribute to counter this? And how can governance / intelligence counter act something that now appears unstoppable and entrenched?
by lynx97 | 2025-04-09 07:17:15+00:00
Assuming you are actually from the US, your point feels a lot like system justification[1] theory hard at work... If close to 50% (or even more) people around you have moderate to serious weight issues, I can imagine how you end up normalising the status quo, looking for explanations that rationalise it...

[1] https://en.wikipedia.org/wiki/System_justification
by blue_cookeh | 2025-04-09 07:17:38+00:00
Honestly, there have been so many businesses and individuals that lose out on their domain because they just didn't buy it as soon as they saw it was available. I don't understand why - in the grand scheme of things a 5, 10 or even $100 domain isn't going to break the bank. Just buy the thing as soon as you find it and avoid this mess.
by prashanth_docai | 2025-04-09 07:18:14+00:00
Sharecare | BI Engineer (Contract) | Remote – Mexico / South America

------------------------------------------------

We're hiring a BI Engineer to join our fast-moving data team. This is a contract position with remote flexibility (Mexico / South America preferred time zones).

==============

What we offer:

===============

* Startup culture with zero BS meetings

* Work alongside world-class engineers (MIT, Yahoo, Amazon alumni)

* Competitive compensation

======================

Who we’re looking for:

======================

* Expert in SQL, including complex joins, window functions, and performance tuning

* Strong hands-on experience with BigQuery

* Looker Studio wizard – from modeling to dashboards

* Comfortable with non-relational data and documenting warehouse architecture

* Fluent in Git / GitHub

* Clear English communication (written & spoken)

* 3+ years working with BigQuery & Looker

---------------------------

If you thrive in fast-paced environments and love building clean, meaningful data experiences — let’s talk.

reach me: prashanth.iyer at sharecare.com
by blub | 2025-04-09 07:19:03+00:00
So you’re using formal methods, sanitizers, the whole gamut of verification and yet you can “quickly” find new issues just by fuzzing. Sounds like there’s some significant problem there that you’re not mentioning.

Microsoft and Google have a ton of legacy code, they need to have high performance because they’re pushing everything to the web in order to spy better on people, they always churn their software and they are a very juicy target. As far as I’m concerned, they should rewrite everything in Rust and stop telling other people what to do.

But of course, they also need to sell Rust to the public, otherwise they would run out of developers or would have to maintain everything themselves. Hence the cheerleading.

This blog post is much closer to the reality of using Rust in production. In fact I’d add a couple of pitfalls myself:

* original cheerleader gets bored of the Rust rewrite/moves on and the project dies.

* original cheerleader moves on and the project lives under maintenance with non-Rust programmers which do not enjoy working on it and delay and reject changes and/or feature requests.
by _Chief | 2025-04-09 07:19:39+00:00
> the only info we do store is your session's cookies (and only if you're logged in).

If this truly is the only cookie you store, then you may not need the cookie banner, you can explain the cookie usage in your Privacy Policy.

For gdpr[1], strictly necessary cookies, like for login as you describe, do not require consent to be obtain as long as their usage is explained like in your privacy policy.

[1] https://gdpr.eu/cookies/
by electroly | 2025-04-09 07:20:04+00:00
"Sniped" makes it sound like they did something wrong, but they didn't. I reject the idea at the end that there were ethical lines crossed. You need to buy your domain when you name the project, not when you release it. If you don't have the domain then you don't have the name. Buying the domain is naming it. Take the lesson for next time.
by farhanhubble | 2025-04-09 07:20:07+00:00
I am releasing JFK-TELL, a dataset I generated by extracting text from the scanned PDFs of the assassination records released until April 2025. The extraction was done with Google Gemini LLM API to generate Markdown text, using a very simple prompt. For detailed methodology, check out the Github repo at https://github.com/farhanhubble/jfk-tell
by tpm | 2025-04-09 07:21:53+00:00
> no European country has been seriously committed to it

I would argue several countries and the EU as a whole is seriously committed to it, but this commitment comes with usual European caveats: it will be slow and expensive. But it is happenning.

https://www.bmi.bund.de/SharedDocs/pressemitteilungen/EN/202...

> American companies dominate payment systems.

I think SEPA dominates payment systems and anything else is only a layer above than can be replaced. And there are several widely used country-specific systems that are not American.

> Governments moving to sovereign services is not enough - if the US can cripple your private sector you are finished anyway.

Moving government services is a necessary first step.

> There is no easy, quick or cheap solution.

Yes.
by tuoret | 2025-04-09 07:23:17+00:00
How is it not unethical to grab a domain you don't need and had no intention of buying until you learned someone else was interested in it? Especially since it usually involves extorting money from the would-be buyer.

I fully agree you need to buy the domain as soon as you name your project, and that's where this person went wrong, but that doesn't make domain sniping any more ethical.
by sherdil2022 | 2025-04-09 07:24:08+00:00
Before the likes of Polyfjord, we had MusAnim - https://www.musanim.com/

https://www.musanim.com/watch_mam.html has the link to their YouTube channel and https://www.musanim.com/Background/ has more information as well as https://www.musanim.com/Method/ and https://www.musanim.com/ProductionNotes/synchronization.html

Enjoy!
by DeathArrow | 2025-04-09 07:25:17+00:00
C++ can be safe enough if you proceed with care.

What I dislike of C++ is that it grew to become a monster of a language, containing all programming paradigms and ideas, good or bad, known to mankind.

It's so monstrously huge no human can hold its entire complexity in his head.

C++ allows you to do things in 10000 different ways and developer would do just that. Often in the same code base.

That being said, I would use a sane subset of C++ every day over Rust. It's not that I hate Rust or that I don't think is good, technically sound and capable. It just doesn't fit the way I think and I like to work.

I like to keep a simple model in mind. For me, the memory is just a huge array from which we copy data to CPU cache, move some to CPU registers, execute instructions and fetch data from the registers and put it again in some part of that huge array, to be used later. Rust adds a lot of complexity over this simple mental model of mine.
by Tor3 | 2025-04-09 07:25:31+00:00
An important factor is bird lungs, which essentially have a mechanism which keeps the lungs perpetually inflated. Air flows through. This makes it possible to provide way more oxygen to the body than our own inefficient lungs. Which again makes it possible for birds to fly over the Himalayas and still get enough oxygen to drive those power-hungry mitochondria.
by consumer451 | 2025-04-09 07:25:34+00:00
> I realized my GitHub repository was public, which was not my intention at all before launching the project.

I'm sorry, but aren't GitHub repos private by default?

edit: see down-thread, but they are private by default in GitHub Desktop, which is what I have used to create new repos for years. However, they are public by default on github.com.
by a1371 | 2025-04-09 07:26:59+00:00
Cybersquatting is one prime example of value extraction vs value creation. HugeDomain has sat on my obscure family name's .com domain name and wants to sell it to me. Every year their price goes up a thousand dollars.

Hot take:

We should work towards dethroning .com as the default so that all the people who trade domain names lose all the money they had never earned. I'm also for a more expensive .com base price. Some of the things that make moving away from .com hard is the blanket gtld level email/traffic bans in Sophos and other security firms