MurphyA/hacker-news huggingface dataset:
by lyu07282 | 2025-04-10 23:28:20+00:00
In my experience it was precisely when it wasn't abstracted properly that injection attacks became more prevalent, not the other way around.

In PHP, people used to just call mysql_query on a string and all the escaping was done with mysql_escape_string. According to you that nice locality of query construction and sanitization that should've improved security, but my god did it ever not do that.

It was exactly layers of abstractions, moving things far away from the programmer, with prepared statements to ORMs, that meaningfully reduced the number of SQL injection vulnerabilities.

Another example is JavaScript, how many XSS vulnerabilities never happened because of all the shadow dom frameworks? Layers of abstractions like these (JSX,etc) are a major reason we don't see many XSS vulnerabilities nowadays.
by mortar | 2025-04-10 23:29:29+00:00
> If a single interpolation is expensive to evaluate, it can be explicitly wrapped in a lambda in the template string literal

I’m having trouble understanding this - Can someone please help out with an example use case for this? It seems like before with an f string we had instant evaluation, now with a t string we control the evaluation, why would we further delay evaluation - Is it just to utilise running a function on a string first (i.e. save a foo = process(bar) line?)
by ethbr1 | 2025-04-10 23:32:48+00:00
Early Tom Clancy, before he monetized his name, was pretty amazing. The Hunt for Red October was published by the Naval Institute Press. [0]

It was also the first adult book I read. Probably around 6 or 7? Before Jurassic Park, which I read before that movie came out.

I'd asked my father if "There were books about other things, because kids books were boring."

He handed me Tom Clancy off his bookshelf.

[0] https://en.m.wikipedia.org/wiki/United_States_Naval_Institut...
by taftster | 2025-04-10 23:32:50+00:00
We're stretching the metaphor here. I know, kind of obnoxious.

If I have accidentally lifted too much weight, I want a spotter that can immediately give me relief. But yes, you're right. If I am always getting a spot, then I'm not really lifting my own weight and indeed not making any gains.

I think the question was, "I'm stuck on this code, and I don't see an obvious answer." Now the lazy student is going to ask for help prematurely. But that doesn't preclude ChatGPT's use to only the lazy.

If I'm stuck and I'm asking for insight, I think it's brilliant that ChatGPT can act as a spotter and give some immediate relief. No different than asking for a tutor. Yes maybe ChatGPT gives away the whole answer when all you needed is a hint. That's the difference between pure human intelligence and just the glorified search engine that is AI.

And quite probably, this could be a really awesome way in which AI learning models could evolve in the context of education. Maybe ChatGPT doesn't give you the whole answer, instead it can just give you the hint you need to consider moving forward.

Microsoft put out a demo/video of a grad student using Copilot in very much this way. Basically the student was asking questions and Copilot was giving answers that were in the frame of "did you think about this approach?" or "consider that there are other possibilities", etc. Granted, mostly a marketing vibe from MSFT, but this really demonstrates a vision for using LLMs as a means for true learning, not just spoiling the answer.
by AStonesThrow | 2025-04-10 23:32:52+00:00
Good. Our lack of tariffs and our soft vulnerability in the Chinese trade wars enabled them to pull scams like Temu.

My mother became addicted to catalog shopping, and she flooded our home with cheap Chinese shit, even before website catalogs were a thing. Even our USPS mailbox was clogged with thick glossy catalogs full of useless trinkets that would cost us nearly nothing.

I regularly turn into Marie Kondo's disciple, and I get rid of the useless crap my Mom foists on me from those catalogs. They do not spark any joy! I try to destroy/break it really good before I toss it out. Sometimes, I capture the more dramatic destruction sessions on video. I've got to check into those new services where you go in and you put on armor and then you break stuff to release aggression. I would prefer to bring in my own items to destroy.

China has been buying US debt; they've been accepting metric fucktons of garbage and refuse from us; they've been selling us horrible stuff including worthless religious tchotchkes. Sometimes I imagine working-class Chinese in the factories being converted to Christ and seeking baptism, simply because they spend 100s of hours hand-painting Sacred Heart of Jesus and images of Our Lady of Fàtima!

Of course China has also sold us insanely useful things like a Windows 10 notebook from Lenovo in 2018. I purchased it with my FAFSA student aid funds and it was 100% configurable on the Lenovo's own website. It shipped to my place direct from Shenzhen in no-time-flat. It was a miracle of modern logistics, supply chain and engineering. That notebook lasted for over 6 years and 3 OS including Fedora Linux. I loved it. It was still 100% functional when I recycled it.
by Mawr | 2025-04-10 23:32:56+00:00
It's fascinating how differently languages approach the string formatting design space.

- Java's been trying to add f/t-strings, but its designers appear to be perfectionists to a fault, unable to accept anything that doesn't solve every single problem possible to imagine: [1].

- Go developers seem to have taken no more than 5 minutes considering the problem, then thoughtlessly discarded it: [2]. A position born from pure ignorance as far as I'm concerned.

- Python, on the other hand, has consistently put forth a balanced approach of discussing each new way of formatting strings for some time, deciding on a good enough implementation and going with it.

In the end, I find it hard to disagree with Python's approach. Its devs have been able to get value from first the best variant of sprintf in .format() since 2008, f-strings since 2016, and now t-strings.

[1]: https://news.ycombinator.com/item?id=40737095

[2]: https://github.com/golang/go/issues/34174#issuecomment-14509...
by refulgentis | 2025-04-10 23:32:59+00:00
I don't buy this as sold because Big Tech has very strict policies about IP ownership on code you write while you're working for them, even if it is totally separate from work.

Wish you the best of luck, but I also wish for a tradeoff towards honesty from salesmanship in this world.

EDIT: A cursory review of your Twitter reveals several significant departures from this narrative. I'm very confused but given your goals with this, would highly recommend you at least tighten things up enough so it doesn't take 1 missed piece of ingroup knowledge on your part, and ~1 minute of due diligence on X, to find out we're reading copy-pasta.

It's also really uncool to create two bits of "someone else did it" knowledge in the world that are absolutely false and irresponsible (built quickly parttime, quit after launch).

Also, if the other founders contracted you while they were still at big tech, that can be a major problem for them.
by nine_k | 2025-04-10 23:33:53+00:00
I understand your concern, and I think the PEP addresses it. Quite bluntly, t"foo" is not a string, while f"foo" is. You'll get a typecheck error if you run a typechecker like any reasonable developer, and will get a runtime error if you ignore the type mismatch, because t"foo" even lacks a __str__() method.

One statement the PEP could put front and center in the abstract could be "t-strings are not strings".
by kstrauser | 2025-04-10 23:33:59+00:00
On the subject of software freedom, I hate how accurately prophetic he is.

RMS: Here’s how they'll get ya!

Me: Nice, but that'd never happen.

Vendor: Here’s how we got ya!

Me: Dammit.

Seriously, he must have a working crystal ball.

Now, my agreement with him starts and ends on that subject. He says plenty of other things I wholly disagree with. But his warnings about proprietary software lock-in? Every. Single. Time.
by tylertreat | 2025-04-10 23:34:41+00:00
Also, what's interesting about Koreo is that you can actually build "meta" Workflows. That is, Workflows that produce Workflows, meaning you could implement something like Kro itself in Koreo fairly easily. This is why it's really closer to a programming language and runtime for programming Kubernetes control loops.

Koreo would also allow you to implement a workload spec such as Score rather easily for the same reason. https://score.dev
by dionian | 2025-04-10 23:35:21+00:00
Looks great - unlike java which is somehow recommending the format:

STR."Hello \{this.user.firstname()}, how are you?\nIt's \{tempC}°C today!"

compared to scala

s"Hello ${this.user.firstname()}, how are you?\nIt's ${tempC}°C today!"

STR."" ? really?
by Jaxkr | 2025-04-10 23:35:37+00:00
This is great. I’ve thought about building something like this for myself.

Complaints:

- Discover It rotating categories not factored in. These are 5% and very significant.

- Can’t add Amazon Chase Visa, as someone else pointed out.

Also I would LOVE an iOS shortcut where I can just type in what I’m buying and you categorize it with an LLM and it just tells me what card to use.
by ceejayoz | 2025-04-10 23:36:45+00:00
CBP asserts there isn’t privilege at the border. https://reason.com/2025/04/08/border-cops-try-to-make-an-end...

> Customs and Border Protection (CBP) asserts a very different principle: that your privacy rights disappear at the border. CBP policy gives officers the right to seize and search any electronic device that passes through customs. While the agency claims that copies of any attorney-client documents will be "destroyed" after a search, it doesn't recognize limits on its ability to collect and copy those documents in the first place.
by fuzztester | 2025-04-10 23:37:43+00:00
wow, fuck. unbelievable crap, but true, nonetheless:

after implying I should be accurate, you go on to make your own statements using weasel words like "very likely never said" and "wasn't particularly more detached" and more on the same lines in the rest of your comment. where is the proof for your weasel words, bro, just like you ask me to be accurate?

weasel words are not accurate words, bro, rather almost the opposite.

”physician, heal thyself” - before you fuck around advising other people what to do or not do.

i see a lot of trends of this on hn too. pathetic.
by thephyber | 2025-04-10 23:37:47+00:00
Russia isn’t much of a threat outside of its own railway system. The soviets build their military logistics around rail as the primary mode of transport. This is why UA being able to hit the exit rail depots where RU was massing equipment was so effective at stopping the RU advance (coupled with UA’s innovative use of drones to attack road-based supply lines).

NATO makes use of rail, but also has LOTS of varied mobility for delivery of logistics.

In this way, NATO can shut down an invasion by RU by attacking the rail system, with both conventional and cyber weapons.

The only counterexamples I can find are where the RU contractors do large scale ware for junta/warlords like in Syria and multiple countries in the Sahara. But they aren’t fighting a large modern army there — mostly insurgencies and militias.
by Uzmanali | 2025-04-10 23:38:21+00:00
One underrated takeaway is that AI’s top use cases in 2025 are increasingly human therapy, life organization, and finding purpose. This shift from technical to emotional shows how AI is becoming less about replacing jobs and more about amplifying lives. If you're working in this area, focus on "improving well-being" instead of "optimizing workflow." That's where lasting value comes from.
by atonse | 2025-04-10 23:39:40+00:00
I haven’t seen if the article covered this well but smart watches are a great bridge for kids this age where you can get everything you want as far as location tracking, but without all the addiction.

We’ve said for years that our kids will only get phones aged 14 or higher. Now we want to say 16. One can imagine how those conversations go.

Hopefully the movement to make it illegal under a certain age gathers momentum.
Show HN: Claude and 80 commits later: Web app for drawing curved text on photos
by popovicanja | 2025-04-10 23:40:44+00:00
This is my first hacker news post!

Problem: I wanted to add curved text to my photos for those aesthetic social media shots you see everywhere, without buying an iPad or learning complex design tools. Canva was the closest option, but it required breaking text into multiple elements and manually bending and repositioning each one - too tedious and time consuming.

Since I couldn't find a simple solution, I built one.

After weeks of orchestrating Claude, playing with svgs, fixing bugs, testing and tuning different curving algorithms, it does exactly what I needed. You draw the line and text follows.

It lets you: - Draw curved text over photos - Adjust font, color, and style easily - Export images with text instantly

Over 1,000 Reddit users tried it this week and I got really positive comments.

Try it here: https://www.curvedtext.io/

Would love to get your feedback!
by onionopionion | 2025-04-10 23:41:25+00:00
good point, I will add a demo profile to the website! For now feel free to view my profile here: https://career.heyopenspot.com/meet/julian-flieller-eoua

You can sign up using your resume or linkedIn and your profile will be curated for you, so it takes about 30sec ;)
by smitty1e | 2025-04-10 23:42:36+00:00
For a quick glance, I didn't see the corner case where the old-style `%` interpolation (may) shine over PEP750: building up a JSON document with a dictionary:

>>> hello_world = {"hello":"HELL" ,"world":"O'WORLD"}

>>> json_template='{"hello":"%(hello)s","world":"%(world)s"}'

>>> print(json_template % hello_world)

{"hello":"HELL","world":"O'WORLD"}
by fergal_reid | 2025-04-10 23:43:58+00:00
You are correct that variable results could be a symptom of a failure to generalise well beyond the training set.

Such failure could happen if the models were overfit, or for other reasons. I don't think 'overfit', which is pretty well defined, is exactly the word you mean to use here.

However, I respectfully disagree with your claim. I think they are generalising well beyond the training dataset (though not as far beyond as say a good programmer would - at least not yet). I further think they are learning semantically.

Can't prove it in a comment except to say that there's simply no way they'd be able to successfully manipulate such large pieces of code, using English language instructions, it they weren't great at generalisation and ok at understanding semantics.
by cstrahan | 2025-04-10 23:44:53+00:00
> It seems like before with an f string we had instant evaluation, now with a t string we control the evaluation

You don't completely control the evaluation.

From the PEP:

> Template strings are evaluated eagerly from left to right, just like f-strings. This means that interpolations are evaluated immediately when the template string is processed, not deferred or wrapped in lambdas.

If one of the things you are interpolating is, as a silly example, an invocation of a slow recursive fibonacci function, the template string expression itself (resulting in a Template object) will take a long while to evaluate.
by ryanbigg | 2025-04-10 23:44:58+00:00
On the topic of copy editing you raise: I wrote a book in DocBook for Manning in 2010. DocBook is XML, so I structured it with opening / end tags on their own line, content in the middle. As you would with a HTML document.

After copy editing multiple chapters, they sent it back to me with all the content on a single line. I was so incredibly upset that they ditched all my painstaking format that I almost abandoned the project there + then.

It sounds like from your experience that it has barely changed. I ended up moving to self-publishing so I have a greater control over the whole process. I wrote it up long-form here: https://ryanbigg.com/2015/08/my-self-publishing-success-stor...
by cbmask | 2025-04-10 23:45:11+00:00
The usual utopian fantasies are just a pretext. It is not possible to have large cities in this climate, which also famously makes mining difficult.

They want to steal the resources and control the Arctic sea routes.

Vance says Greenland has been mismanaged? Well, so far Greenland has not been invaded, unlike Ukraine, which had US and French security "guarantees".
by LegionMammal978 | 2025-04-10 23:45:48+00:00
> I don't think it's actually "flattening" the enums discriminant spaces (though maybe it is).

It is. One easy way to see this is with an Option<Option<bool>> [0]: if both options are Some, it takes the value 0 or 1 depending on the boolean; if the inner Option is None, it takes the value 2; and if the outer Option is None, it takes the value 3. And as you keep adding more Options, they take values 4, 5, 6, etc. to represent None, while still only taking up 1 byte.

[0] https://play.rust-lang.org/?version=stable&mode=debug&editio...
by weinzierl | 2025-04-10 23:45:52+00:00
"Absent is the plot twist of Pandora’s box that made it philosophically useful: the box also contained hope and opportunity that new knowledge brings."

Yes, add that and it might be something interesting but sure not the Black Mirror I want to watch. I mean it is called Black Mirror for a reason.

And it is not even true. Take the episode "San Junipro" for example? Isn't there some hope and opportunity in it? And yet, this episode (one of the best in my opinion) only works because the hope can shine against a black background.
by FactolSarin | 2025-04-10 23:45:57+00:00
I already pay for Google One storage, so it's the cheapest of the paid LLMs for me. That's 99% of the reason I use it, and honestly I don't really have any strong opinions on it compared to ChatGPT. It's about the same level, and with new models constantly being released for all the different LLMs I've kind of lost track of what it's particularly good or bad at compared to others.

I will say the video with Gemini live is pretty impressive. My family and I tried it a bit yesterday, and my kids wanted to show Gemini all our pets. My kid showed it our cat, picking it up roughly as she is wont to do, and I was impressed when it asked "Is [name of cat] always so patient being handled like that?"
by wholinator2 | 2025-04-10 23:46:04+00:00
> It takes effort, just like it did back then.

I think this is a sentiment missing from lots of the rose glasses back watching. It took effort to find all these fun things, it still takes effort to find fun things. The only difference is that now the effort floor is in the icy pits of hell and its so easy to slide all the way down there. Things were different but you still had to work for it. Sites were smaller and there were less people, those things still exist, probably more so, there's just an ocean now. We have to learn how to swim maybe but we can still cross.
by internetter | 2025-04-10 23:47:18+00:00
> Zig users tend to be (possibly notoriously) anti-dependency.

I don't get anti-dependency, to be honest. Like say you want REGEX support in your database. You code a REGEX parser from scratch? What are the odds your parser doesn't have a vulnerability?

I think over zealous dependency usage is also bad, but it cuts both ways
by bigyabai | 2025-04-10 23:48:04+00:00
When did it promise that it would? I feel like people reject these stories not because they're counterproductive, but because they frighten them. We feel so personally and viciously attacked by modern narratives because they question everyday concepts and routines we're all comfortable with.

I'm reminded of growing up watching episodes of Twilight Zone and Star Trek that yes, were kitschy stories, but instilled lifelong lessons about independence in their audience. Black Mirror isn't my favorite show but it seems to resemble the same "near future cautionary tale" archetype that has remained popular for centuries.
by richardhenry | 2025-04-10 23:48:34+00:00
This isn't really true.

In California specifically, Labor Code Section 2870 limits an employer's claim over inventions or products created a) outside of work hours, b) without using company resources like your work laptop, and c) not related to/competitive with the company's business.

Even outside of California, it's extremely rare for companies to try to claim ownership of side projects that check all of the boxes above. Legal action is expensive and bad PR unless the employee is clearly infringing or building something competitive.
by adelmotsjr | 2025-04-10 23:48:41+00:00
Location: Curitiba, Brazil

Remote: yes

Willing to relocate: yes

Technologies: TypeScript, JavaScript, Pytho, Redis, MongoDB, PostgreSQL, MariaDB, Angular, ExpressJS, AWS, Rust, Axum, HTMX and TailwindCSS.

Résumé/CV: https://www.linkedin.com/in/adelmo-junior-2a576b156/ | PDF on request

Email: development@silvajunior.dev

I'm a software engineer working to help people build products and deliver value to their customers.

I can help build:

- web applications using modern principles with the latest technologies (Angular, React, TypeScript, Vue, TailwindCSS, HTMX)

- services that monitor equipments using telecommunications protocols (SNMP, NETCONF, TR-069)

- serverless programs on any business domain to help reduce costs and increase availability (AWS Lambda)

- microservices that expose REST APIs for consumption using battle-tested frameworks (SpringBoot, Quarkus)

- data processing applications and services that consumes streams of data using common parsing techniques (Rust with Nom)

- small CLI apps to help automate common tasks (Rust)

- integration of different services using distributed log (Kafka, AWS SNS), WebSocket (with NodeJS) or with simple HTTP requests

- proper documentation for common services using OpenAPI specification (Swagger)
by AlotOfReading | 2025-04-10 23:48:44+00:00
IP that doesn't relate to the role you're employed for, especially that wasn't made with company time, information or resources, is yours in California if you want to fight it out in court. Most bigtech companies also have a process to get explicit written recognition about such code before going to court because this is such a common thing. It usually amounts to filling out a form and sending it to legal for approval. There are a few companies with a reputation for somewhat more difficult processes (Apple, Amazon), but the above post is entirely plausible.
by southernplaces7 | 2025-04-10 23:49:09+00:00
>They’re just talking about destroying its ability to sustain life

You should really look deeper into the effects of large historical asteroid impacts and other major cataclysms. Literally, the worst that humanity could do even if it tried with current technology doesn't even come close to being so fantastically destructive. We could, tomorrow, start polluting the earth to the absolute straining maximum of our ability and follow this up with the launch of all our nuclear weapons everywhere in the world, and we'd kill ourselves off (or at least enough of us to no longer be able to continue our destruction efforts in a meaningful way) long before we'd more than pull off a tiny fraction of the destruction one large asteroid causes.

And no, we wouldn't at all ruin the Earth's ability to sustain life. Our planet and its ability to regenerate ecosystems has survived multiple impacts my massive asteroids, at least a couple of impacts by literal small planets, at least two total ice ages in which the planet turned into an essential snowball (think ice caps from pole to pole) and at least three massive magmatic events (that I can think of off the top of my head) spanning whole subcontinents worth of lava flow and multiple massive volcanoes erupting constantly, without pause, for hundreds of thousands of years, only for life to bounce back from all of this.

It's pure ignorant hubris to think that any human effort today could come close.