MurphyA/hacker-news huggingface dataset:
by neilv | 2025-04-28 23:48:48+00:00
Understood, though I didn't have that idea about #2. My impression was that it was a well-known problem (going back to talk radio and Rupert Murdoch properties, and then growing and being more in our face with everything the Internet enabled).

Maybe one of the problems is that, online, a flood of dozens of angry tweets stomping on someone, by (for the sake of argument) a small minority of people who are having a bad day... has the effect that people are routinely (almost systematically) stomped, because there's always some dozens of people having a bad day? And they all sound the same, so maybe it's a rotating vocal minority that looks like a bigger problem than it is?

Regarding death threats...

I think we have different expectations about the possibility of gov't help (I'm still a bit Pollyanna on this). Local police might or might not have the resources to take the report and coordinate with federal resources, but it's likely inter-state, so the victim could go direct to the FBI.

I'm sure I've read news stories of the senders of death threats being tracked down by law enforcement.

And, I suppose the sender just might be linked to a domestic group/network (or foreign agitators) that the FBI is already tracking.

If the researchers are under a university or NGO, are they getting support from their organization, or do they need to confront the org's administration into interfacing better with law enforcement regarding death threats?

(I'm speaking of baseline situation in recent years; I have no idea what the situation at the FBI is this week, given the various gov't disruption going on, and the keyword "climate" being targeted by some. Even if the situation is complicated at the moment, maybe lead the reporting of a crime and request for assistance with the death threat part, and then the details relevant to the investigation/analysis include that the victim is a climate researcher?)

If all else fails, an org's lawyer (and investigator they hire) might also identify doxing and egging activity (especially online) that's traceable to death threats, and be able to do more with law enforcement and/or civil courts.
by tptacek | 2025-04-28 23:49:03+00:00
Another AD example: Ben Toews, in our Vault replacement secret storage system Pet Semetary, uses the AD on SQLite ciphertexts to bind them to a particular row (and/or a particular key path).

I wrote a local file encryption tool, around the same time Filippo was doing `age`, and used the AD on Chapoly to authenticate the chunk offset into the file. (The only thing interesting my tool did was that it could pull keys from AWS KMS).

So one use for AD is to authenticate headers; another is contextual binding.

If it helps (because 'stavros asked across the thread why bother having AD at all rather than just including it in the ciphertext), authenticated data can include data that doesn't even appear in the message, but rather is derived from the context at the time the message is encrypted and decrypted. A message only meant to be decrypted on a particular host (or whatever), for instance, could include the host in its AD, but never record that in the actual bits of the message.
by a_tartaruga | 2025-04-28 23:49:11+00:00
It sounds like you're doing the normal sort of things that systems people do to get started. The fact that you have lots of ideas to jump off of is very good. In general just follow all of your ideas down as far as you can to the base systems. Write the TCP implementation for your HTTP server and run it over the internet for example. You've only gone too far when you start worrying about noise and debugging looks like randomly grounding metal things.
by xyzzyz | 2025-04-28 23:49:16+00:00
I really don't see how this thought experiment is helpful in understanding anything. It would never happen in real world. We have long and well established tradition to disenfranchise specific classes of people, and it is not controversial at all. None of this addresses my point, which is that if you extend the "voter suppression" label to cover things that are universally considered to be good and proper, like banning votes from toddlers, you only make the conversation more difficult.

> Even if 80% of the population was provably dumb, you'll still need a system that takes their voice into account to avoid the country getting overthrown or become a dictatorship.

I really don't see how it follows.
by codingdave | 2025-04-28 23:49:18+00:00
At least, not with the default rules. I read that discussion a few days ago and was surprised how few callouts there were that a WAF is just a part of the infrastructure - it is the rules that people are actually complaining about. I think the problem is that so many apps run on AWS and their default WAF rules have some silly content filtering. And their "security baseline" says that you have to use a WAF and include their default rules, so security teams lock down on those rules without any real thought put into whether or not they make sense for any given scenario.
by db48x | 2025-04-28 23:49:34+00:00
https://en.wiktionary.org/wiki/punitive

The owner of a restaurant who lays off waiters in order to spend less on salaries is not punishing the waiters. Nobody thinks that the waiters have broken any rules. The definition of “punitive” is that it is a punishment for breaking the rules. The waiters might think it’s unfair or niggardly, of course, but that’s not what “punitive” means. Pick a more appropriate word.
by breadwinner | 2025-04-28 23:49:41+00:00
The world needs an alternative to Starlink yesterday.

If you criticize Musk on X, the self-proclaimed “free speech absolutist” will reduce distribution of your posts [1].

We don't want someone like that owning critical internet infrastructure.

[1] https://www.nytimes.com/interactive/2025/04/23/business/elon...
by tptacek | 2025-04-28 23:51:06+00:00
I don't understand what you're finding unclear about the Chapoly docs there. AEAD encryption is a first-class abstraction in the standard Go crypto library; in the same sense that crypto/sha256 functions return a crypto.Hash, chacha20poly1305 returns a crypto.AEAD. AEAD itself includes clear usage examples.

Your `symcrypt` interface lands in a pretty weird place? AEADs in Go export "Seal" and "Unseal" --- with deliberately different names than crypto/cipher/Block's "Encrypt" and "Decrypt", because they're doing something different. The "Owner" thing in your package is kind of odd too.

You're exposing an interface over Go's AEAD primitives, but not letting users actually provide authenticated data. I don't much care except the whole point of this post is why that matters.
by bsder | 2025-04-28 23:51:24+00:00
> Never use UUIDs as your primary keys.

This seems like terrible advice.

For the vast, vast, vast majority of people, if you don't have an obvious primary key, choosing UUIDv7 is going to be an absolute no-brainer choice that causes the least amount of grief.

Which of these is an amateur most likely to hit: crash caused by having too small a primary key and hitting the limit, slowdowns caused by having a primary key that is effectively unsortable (totally random), contention slowdowns caused by having a primary key that needs a lock (incrementing key), or slowdowns caused by having a key that is 16 bytes instead of 8?

Of all those issues, the slowdown from a 16 byte key is by far the least likely to be an issue. If you reach the point where that is an issue in your business, you've moved off of being a startup and you need to cough up real money and do real engineering on your database schemas.
by omneity | 2025-04-28 23:51:41+00:00
Excellent release by the Qwen team as always. Pretty much the best open-weights model line so far.

In my early tests however, several of the advertised languages are not really well supported and the model is outputting something that only barely resembles them.

Probably a dataset quality issue for low-resource languages that they cannot personally check for, despite the “119 languages and dialects” claim.
by sgarland | 2025-04-28 23:51:41+00:00
I’ll go further; don’t automatically default to a BIGINT. Put some thought into your tables. Is it a table of users, where each has one row? You almost certainly won’t even need an INT, but you definitely won’t need a BIGINT. Is it a table of customer orders? You might need an INT, and you can monitor and even predict the growth rate. Did you hit 1 billion? Great, you have plenty of time for an online conversion to BIGINT, with a tool like gh-ost.
by cdev_gl | 2025-04-28 23:51:54+00:00
Really cool project! I like the twelve color palette the author presents, and the grayscales, but I'd love to see more about the choice to use twelve bits to encode it. Presumably enough of the rest of the possibility space is needed to justify writing a custom encoding. Or maybe it was done because custom color encodings are cool, which they definitely are.

The palette is so pretty, I wonder how the whole LCH color space quantized down to 4096 colors looks. I find limited bitdepth color spaces fascinating to look at, there's so many choices about how to represent color they can look wildly different.
by shmerl | 2025-04-28 23:52:34+00:00
Because it's a discouragement of learning based on mediocrity of AI. I find such idea perpetuating the mediocrity (not just of AI itself but of whatever it's used for).

It's like imagine saying, I don't want to learn how write a good story because AI always suggests me writing a bad one anyway. May be that delivers the idea better.
by AndrewKemendo | 2025-04-28 23:52:54+00:00
It’s the same approach as always: Capture the reference data as close to the source as possible

So any standard around RAG will be a place to attach the adserver

Any UI will catch the semantics in the metadata analysis in order to parallel construct in some sense the affinity graphs

So there’s always leaky personal targeting data - with enough users you don’t even need to provide much data to fall into a targeted group
by tptacek | 2025-04-28 23:53:21+00:00
Not generally. An AEAD composed the way you're describing, out of (say) non-authenticated CTR mode and an HMAC MAC, would be described as "a generic composition". The more common AEADs, at least the way we think about them, aren't compositions of otherwise user-serviceable components. I'm not sure there's a name for them; they're the norm, so we describe those integrated, hermetically-sealed constructions (like GCM) as "AEAD".
by atombender | 2025-04-28 23:53:43+00:00
Thanks, that seems promising. So much of the documentation is schema-oriented, I didn't see that it supported dynamic schemas.

I find it interesting that Greptime is completely time-oriented. I don't think you can create tables without a time PK? The last time I needed log storage, I ended up picking ClickHouse, because it has no such restrictions on primary keys. We use non-time-based tables all the time, as well as dictionaries. So it seems Greptime is a lot less flexible?
by derbOac | 2025-04-28 23:53:53+00:00
Following the monetary focus — the last exception has some parallel in contract law, the idea of specific performance and that some things can't be replaced by any monetary value because of their uniqueness.

So in the relationship example, it's not just "inertia", it's the value you have by virtue of your unique position in the situation, in terms of history etc. Similar arguments can be said of your parents or children: in some abstract sense you could imagine other children or parents you could evaluate the relative value of, but they are not actually your children or parents and so don't have that value.

It's an interesting issue because there's a point at which something leaves the realm of monetary (or more broadly, fungible value) considerations per se, and different rules start to apply.
by ghc | 2025-04-28 23:54:39+00:00
I'm generally speaking of the stage right after a startup closes an institutional seed round. Across 75+ such investments over the past 10+ years, I've seen gaps in each of those areas be catastrophic. It definitely doesn't require "a few dozen employees" to mess up.

Especially on the operations side, I think engineers underestimate the amount of stuff there is to do. Have a distributed team? Welcome to state taxation hell. Have some pilots? You're going to have to deal with a lot of NDAs, cooperation agreements, onerous contracting requirements, building trust by connecting advisors (but not using them too much), etc. Mess up your banking and miss payroll? Your best employees will leave. Fail at reference checks during hiring and hire someone who results in a sexual harassment allegation? Your investors will have your head.

I think you're also misunderstanding what I mean by the product skillset. There are plenty of founders out there who can write amazing backend code, but couldn't deliver a usable product to their customers if their life depended on it. Sometimes that's ok, but most of the time being able to deliver a useful product can work even if your backend engineering is lacking -- not so the other way around. Ideally your technical co-founder can do both, but sometimes, especially when all the founders are engineers, a product-oriented CEO and an engineering-oriented CTO can work really well.

While sales is important, it really should be all the founders learning it, and good investors will go through great pains to help, either by sending founders to "sales school", recommending specialized advisors, or even pitching in themselves, using their connections to get you in the door at "big logos". In my experience, having a founder whose primary skill is sales can either be a positive or negative, depending on what else they bring to the table. If they bring nothing else, it's usually a negative.
by haberman | 2025-04-28 23:55:18+00:00
> C++ has been faster than C for a long time.

What is your basis for this claim? C and C++ are both built on essentially the same memory and execution model. There is a significant set of programs that are valid C and C++ both -- surely you're not suggesting that merely compiling them as C++ will make them faster?

There's basically no performance technique available in C++ that is not also available in C. I don't think it's meaningful to call one faster than the other.
by brigade | 2025-04-28 23:55:37+00:00
It's incredibly niche, but Gemma 3 27b can recognize a number of popular video game characters even in novel fanart (I was a little surprised at that when messing around with its vision). But the Q4 quants, even with QAT, are very likely to name a random wrong character from within the same franchise, even when Q8 quants name the correct character.

Niche of a niche, but just kind of interesting how the quantization jostles the name recall.
by sgarland | 2025-04-28 23:56:31+00:00
The problem is that companies tend to only hire DB expertise when things are dire, and then, the dev teams inevitably are resistant to change.

You can monitor and predict the growth rate of a table; if you don’t know you’re going to hit the limit of an INT well in advance, you have no one to blame but yourself.

Re: auto-incrementing locks, I have never once observed that to be a source of contention. Most DBs are around 98/2% read/write. If you happen to have an extremely INSERT-heavy workload, then by all means, consider alternatives, like interleaved batches or whatever. It does not matter for most places.

I agree that UUIDv7 is miles better than v4, but you’re still storing far more data than is probably necessary. And re: 16 bytes, MySQL annoyingly doesn’t natively have a UUID type, and most people don’t seem to know about casting it to binary and storing it as BINARY(16), so instead you get a 36-byte PK. The worst.
by jeffbee | 2025-04-28 23:56:52+00:00
This is not really the point. Again, your hypothesis lacks explanatory powers. Virtually all of the works undertaken so far on the "rail" project have been roads: bridges, trenches, and relocations of car stuff. So if California can spend tens of billions every year on car stuff through the caltrans budget, it should be more than capable of moving a few of those dollars over the get the HSR project finished. It's a matter of political leadership.
by ellisv | 2025-04-28 23:57:30+00:00
Congratulations!

I also wrote an iOS app to do this exact same thing, although it’s unfinished and unpublished. I had a lot of trouble getting the app to perform well (what’s your secret?!)

Couple of things I implemented that you may want to consider:

1) onboarding flow to help users setup the app on first launch

2) filter certain workouts to include/exclude by type, duration, etc

3) home screen widget

Id love to chat if you’re open to it.
by abdullahkhalids | 2025-04-28 23:57:44+00:00
I don't think I have the time to go to different stores to buy different things based on what is cheap. I have one fixed one.

However, what I would like is a product where I upload my shopping receipt for a few weeks/months from the one store I go to. The application figures out what I typically buy and then compares the 4-5 big stores and tells me which one I should go to for least price.
by franklin_p_dyer | 2025-04-28 23:57:47+00:00
As someone who is both an avid language learner and a software developer - what’s the value added in this platform, for someone who is already pretty comfortable as a programmer and autodidact?

It would take a lot to convince me to pay that much for a product like this. True, it can be inconvenient trolling around for content in your target language, but as a software dev I am pretty experienced with finding obscure things on the internet by finessing search queries. And there are plenty of other apps out there that do spaced repetition for you, and open source tools and data sets that can be used to help you scrape/process vocab (again, if you don’t mind spending some time debugging, which I personally do not). Besides that, I really don’t find it that inconvenient to manually write down words/phrases from books or movies and copy them into my SR deck. On the contrary, I think this overhead actually helps the phrases stick better!

So how would you sell your site to someone in my situation? What would I get out of it?
by jasonthorsness | 2025-04-28 23:58:19+00:00
Beautiful palette!

CSS recently has been adding way more color features, here's the palette represented in oklch:

#817 → oklch(0.44 0.1815 335.38) #a35 → oklch(0.51 0.1559 7.49) #c66 → oklch(0.63 0.1298 21.44) #e94 → oklch(0.75 0.1415 62.42) #ed0 → oklch(0.88 0.18646 103.9148) #9d5 → oklch(0.82 0.181 131.77) #4d8 → oklch(0.80 0.1757 154.39) #2cb → oklch(0.76 0.1298 184.05) #0bc → oklch(0.72 0.123861 206.321) #09c → oklch(0.64 0.129199 231.0549) #36b → oklch(0.52 0.1448 260.03) #639 → oklch(0.44 0.1603 303.37)

You can see the lightness and chroma moving within a narrow range as it sweeps the hue. These new color space functions make making palettes like this way easier.
by cantrecallmypwd | 2025-04-28 23:58:26+00:00
History lesson for the cheap seats in the back:

Compressed tars are terrible for random access because the compression occurs after the concatenation and so knows nothing about inner file metadata, but it's good for streaming and backups. Uncompressed tars are much better for random access. (Tar was a used as a backup mechanism to tape (tape archive).)

Zips are terrible for streaming because their metadata is stored at the end, but are better for 1-pass creation and on-disk random access. (Remember that zip files and programs were created in an era of multiple floppy disk-based backups.)

When fast tar enumeration is desired, at the cost of compatibility and compression potential, it might be worth compressing files and then taring them when and if zipping alone isn't achieving enough compression and/or decompression performance. FUSE compressed tar mounting gets to be really expensive with terabyte archives.
by robalpha | 2025-04-28 23:59:25+00:00
This makes zero sense. Fibre is not going to be economically viable in rural areas at all. If that's the only option, they won't have any internet at all. I also don't think we'll be moving to >10g plans anytime soon. Only a small portion of users have even close to 1g, and everyone else seems fine with it.
by dzhiurgis | 2025-04-28 23:59:46+00:00
Completely anecdotally from a friend who has BYD Atto3 - he had couple of issues with cameras. Plus some early rust (which is not unheard of in forums). So did his sister.

My impression of driving it - materials are nice, but overall experience (interior looks and software, aka what you use the most) was quite terrible in the context I own Tesla Model Y. I'm sure going from 15 year old Nissan you'd be ecstatic.
by kulahan | 2025-04-29 00:00:10+00:00
I recently found out my wife wants a gecko, so I’ve begun planning for a mega-paradise. I want weather systems, every sensor I could possibly ram in there, cameras, and more. Planning to jury rig a toilet setup to run water from the reservoir to the rain system.

The gecko comes from New Caledonia, so my goal will be to replicate that environment as closely as possible. This will be difficult, since most of the plants on the island are only found there, but you can get surprisingly close.

One awesome fact I learned about this: conifers actually started out in warm climates. They just got out-competed once angiosperms (flowers!) came about.
by snypher | 2025-04-29 00:01:01+00:00
>In the meantime it's been quite a satisfying project. I would LOVE to run a simple web server like this on solar power.

Does anyone recall the details of that one solar powered website? I remember the pages background color changed based on sunlight, or battery level

Edit: I think it was https://solar.lowtechmagazine.com/
by corysama | 2025-04-29 00:02:43+00:00
Professional high-performance C++ game engine dev here. At a glance, their game looks great. But, to be frank, it also looks like it could have been made in the DOS era with sufficient effort.

Going hard with Rust ECS was not the appropriate choice here. Even a 1000x speed hit would be preferable if it gained speed of development. C# and Unity is a much smarter path for this particular game.

But, that’s not a knock on Rust. It’s just “Right tool for the job.”
by christophilus | 2025-04-29 00:04:15+00:00
I’ve found the key to the JS ecosystem is to be very picky about what dependencies you use. I’ve got a number of vanilla Bun projects that only depend on TypeScript (and that is only a dev dependency).

It’s not always possible to be so minimal, but I view every dependency as lugging around a huge lurking liability, so the benefit it brings had better far outweigh that big liability.

So far, I’ve only had one painful dependency upgrade in 5 years, and that was Tailwind 3-4. It wasn’t too painful, but it was painful enough to make me glad it’s not a regular occurrence.
by caf | 2025-04-29 00:05:23+00:00
This is potentially the first real black start of a grid with high renewable (solar/wind) penetration that I am aware of.

The South Australia System Black in 2016 would count - SA already had high wind and rooftop solar penetration back then. There's a detailed report here if you're interested:

https://www.aemo.com.au/-/media/Files/Electricity/NEM/Market...
by pcwalton | 2025-04-29 00:06:37+00:00
> I really don’t think Rust is a good match for game dev. Both because of the borrow checker which requires a lot of handles instead of pointers and because compile times are just not great.

I completely disagree, having been doing game dev in Rust for well over a year at this point. I've been extremely productive in Bevy, because of the ECS. And Unity compile times are pretty much just as bad (it's true, if you actually measure how long that dreaded "Reloading Domain" screen takes).