MurphyA/hacker-news huggingface dataset:
by squeaky-clean | 2025-04-19 21:53:34+00:00
> because there’s only an @Inject annotation without any further information

It sounds like you have a gripe with a particular DI framework and not the idea of Dependency Injection. Because

> Normally, when you instantiate a class, the resulting object’s behavior only depends on the constructor arguments you pass it (= the behavior is purely a function of the arguments)

With Dependency Injection this is generally still true, even more so than normal because you're making the constructor's dependencies explicit in the arguments. If you have a class CriticalErrorLogger(), you can't directly tell where it logs to, is it using a flat file or stdout or a network logger? If you instead have a class CriticalErrorLogger(logger *io.writer), then when you create it you know exactly what it's using to log because you had to instantiate it and pass it in.

Or like Kortilla said, instead of passing in a class or struct you can pass in a function, so using the same example, something like CriticalErrorLogger(fn write)
by EA-3167 | 2025-04-19 21:53:41+00:00
I don't understand why people haven't figured out that algorithmic social media is a terrible thing by design, and that it should be avoided. Twitter, IG, FB, all of it is pure poison and the underlying problem isn't who owns it.

It doesn't need to be part of our lives, and in fact we'd be better off without it. Opt out.
by viraptor | 2025-04-19 21:54:59+00:00
You don't need a tool for that. "You're going to assist me in writing a detailed software spec in markdown. At each step adjust the document to incorporate new information. Suggest improvements and highlight areas which have been ignored so far. Initial description: ..."

If you have multiple of those, you can tell it about required sections / format, or provide a good past example.
by fotcorn | 2025-04-19 21:55:17+00:00
There are quite a few well funded companies now that use forks of VSCode: Google (IDX, now Firebase Studio), Cursor, Windsurf (especially if they are bought by OpenAI soon), GitLab etc.

An alternative marketplace already exists with open-vsx.org, but these companies need to fund the creation of alternatives for the proprietary extensions (C#, C++, Python, maybe others) that can be used by all forks.
by zh2408 | 2025-04-19 21:55:35+00:00
No, I haven't, but I will check it out!

One thing to note is that the tutorial generation depends largely on Gemini 2.5 Pro. Its code understanding ability is very good, combined with its large 1M context window for a holistic understanding of the code. This leads to very satisfactory tutorial results.

However, Gemini 2.5 Pro was released just late last month. Since Komment.ai launched earlier this year, I don't think models at that time could generate results of that quality.
by Two_hands | 2025-04-19 21:55:45+00:00
Hey, thanks for the feedback!

This is on the roadmap, along with gaze detection.

https://github.com/opencv/opencv_zoo/tree/main/models/face_r...

This model lets you upload a reference face and then matches to those in images. I think this allows for the "approved faces" function you mentioned.

I suppose a difficulty may arise when we run a few models at the same time, however there is probably a lot of room for efficiency on the table and thanks to the small model size we are already in a good place.
by btown | 2025-04-19 21:55:55+00:00
Public service announcement: CAA records exist and allow you to whitelist the CAs you trust to issue certificates for your domain.

https://letsencrypt.org/docs/caa/

You can use https://www.entrust.com/resources/tools/caa-lookup (or e.g. `dig caa paypal.com`) to see if any domain is protected.

https://isc.sans.edu/diary/26738 is a cautionary study from 2020 indicating only 3% of the Alexa top 1M had CAA records. And just now, I've seen numerous news and government sites that do not have CAA enabled... making them vulnerable to issuance bugs like this on CAs they may never have heard of, and thus making their readership/constituencies vulnerable to misinformation and fraud, especially in the context of a potential multifaceted attack against router infrastructure to perform MITM attacks at scale.

Of course, you'll want to make sure you don't accidentally disavow an important subdomain where an engineer used a different CA than your usual suspects. But looking at all historic issuers for your domain hierarchies on transparency logs using e.g. https://crt.sh/ might be a good place to start.

It's also good to monitor certificate transparency logs, but then the onus is on your security team to react if an incident occurs. Proactive controls are vital as well, and IMHO CAA avoids many of the downsides of pinning.
by xvector | 2025-04-19 21:56:27+00:00
Yeah, it's my view that people don't truly understand how fragile life is unless they've seen how easily it is shattered.

People would get in less street fights and do less dumb shit if they knew what the world was like. The cartels are not your friend, falling and hitting your head can kill you, wearing a seatbelt is mandatory, there are no winners in armed conflict, factory farming is not ethical, etc.

People that say these things, but they don't truly understand them until they see it.
by hnburnsy | 2025-04-19 21:57:24+00:00
So the phone will reboot it self, but...

1) There is no developer accessible API to allow app developers to create an app to allow me to script power options (example, as an end user I want to script a restart or shut down my phone nightly).

2) Asking Google Assistant will not restart or shut down the phone.

3) Apple and Android have made it harder to shut down the phone, requiring double key press kung fu to even bring up the power menu.
by gruez | 2025-04-19 21:58:01+00:00
>It's not just about the patent: https://nyreehinton.com/pages/tesla/tesla-research-dashboard

This is about the third time I brought this objection, but you still haven't addressed it:

"Finally, you still don't have a response to my main objection: why haven't done an empirical test? They spent all this time making data requests, looking up tesla patents, and digging up old reddit posts, but can't spend a day driving a tesla around to compare what the odometer says vs google maps/another car. What gives?"

>How difficult is to admit the man is not Tony Stark, he is just a psycho...

Quit moving the goalposts.
by gnabgib | 2025-04-19 21:58:15+00:00
Discussion on the original source: (20 points, 3 days ago, 5 comments) https://news.ycombinator.com/item?id=43702193

Related: SSD as Long Term Storage Testing (132 points, 2023, 101 comments) https://news.ycombinator.com/item?id=35382252
by dragonwriter | 2025-04-19 21:59:48+00:00
> Huh, TIL the Constitution doesn’t require Congressional districts.

True, but...

> A state could technically switch to a model like this for assigning representatives at large.

No, it can't because Congress itself is given the overriding power in the Constitution to regulate the "time, place, and manner" of elections to the House, and has exercised it to prohibit at-large districts (many times, with lax enforcement, but the most recent mandate, adopted in 1967, has not had the compliance problems the earlier ones often did.) The 1967 mandate was adopted under the dual specter of a some states failing to resolve districting controversies and potentially facing judicially-imposed at-large districts and several states having used at-large districts for non-federal elections to effectively disenfranchise Black voters and concerns that the same might be done to Congressional delegations as a way of blunting the impacts of new rules like the Voting Rights Act.

Additional detail at: https://news.ycombinator.com/item?id=43739929
by WalterBright | 2025-04-19 22:00:37+00:00
> Can't tell if you're joking or not

Not. Often obvious simple solutions are overlooked. For example, NASA spent huge sums of money trying to design a gas gauge that will work in weightless conditions. Until an engineer suggested just having a "reserve" tank that has enough to bring the spacecraft out of orbit.

Another one was NASA spend a lot of money trying to figure out how to not have the Apollo capsule overheat from the sun. The trivial solution was to make it a rotisserie, i.e. slowly rotate it.
by zemahran | 2025-04-19 22:01:25+00:00
For all of you who are writing or publishing every week (newsletter/blog/content marketing) – We're building AI that will enable you to capture everything you consume and turn these into ready drafts in your writing style.

Appreciate if you can take a second to fill in this 2-min survey: https://tally.so/r/wAQNJy
by zzo38computer | 2025-04-19 22:01:33+00:00
Some of the bug reports here are not actually about ASN.1 even if they are in programs that also use ASN.1. However, some are actually about ASN.1.

But, there are bugs in many computer programs, whether or not they use ASN.1, anyways.

CVE-2022-0778 does not seem to be about ASN.1 (although ASN.1 is mentioned in the description); it seems to be a bug with computing a modular square root for non-prime moduli, and these numbers can come from any source and does not necessarily have anything to do with ASN.1.

CVE-2021-3712 does have to do with ASN.1 implementation, but this is a bad assumption in some other parts of the program that use the ASN.1 structure. (My own implementation also does not require the string stored in the ASN1_Value structure to be null-terminated, but none of the functions implicitly null-terminate it or expect it to be. One reason for this is to avoid memory allocations when they are not needed.)

Many programs dealing with OIDs have problems with it, since the program is badly designed; a properly designed program (which is not that difficult to do) will not have these problems with OIDs. It is rarely necessary to decode OIDs, except for display (my own implementation limits it to 160 digits per part when displaying a OID, which is probably much more than is needed, but should avoid the problem described in CVE-2023-2650 anyways). When comparing OIDs, you can compare them in binary format directly (if one is in text format, you should convert that one to binary to compare them, instead of the other way around). If you only want to validate OIDs, that can be done without decoding the numbers: Check that it is at least one byte long, the first byte is not 0x80, the last byte does not have the high bit set, and any byte that does not have the high bit set is not immediately followed by a byte 0x80. (The same validation can apply to relative OIDs, although some applications may allow relative OIDs to be empty, which is OK; but absolute OIDs are never allowed to be empty.) (Some other reports listed there also relate to OIDs. If the program is well-designed then it will not have these problems, as I described.)

My own implementation never decodes ASN.1 values until you explicitly tell it to do so, with a function according to the type being decoded, and returns an error condition if the type is incorrect. All values are stored in a ASN1_Value structure which works the same way.

Some of the CVE reports are about things which can occur just as easily in other programs not related to ASN.1. Things such as buffer overflows, improperly determining the length, integer overflows, etc, can potentially occur in any other program too.

None of the things listed by CVE reports seems to be inherent security issues with ASN.1 itself.
by cellis | 2025-04-19 22:03:08+00:00
From the name I thought i could find "pain points" in my own software. However what this is more like "Solve Real Problems" finder. In that case I think I like this a bit more!

I think you should think about the name a bit more, or at least the hero should say something like SOLVE REAL PROBLEMS REAL PEOPLE ACTUALLY HAVE.
by bigstrat2003 | 2025-04-19 22:03:40+00:00
> The whole point of AI agents is to eventually get good enough to do this stuff better than humans do. It's okay to dogfood and test them now and see how well they do, and improve them over time.

I agree with that. The problem I have is that people are getting sucked into the hype and evaluating the results of those tests with major rose-colored glasses. They glaze over all the issues and fool themselves into thinking that the overall result is favorable.
by gtani | 2025-04-19 22:04:16+00:00
Interesting, how did you choose APL?

i worked in APL2 fulltime years ago, big asset backed bond models, big as in some of the largest workspaces the IBM support people had ever seen. Never occurred to me to pick it up again, but i have been looking for the Polivka/Pakin book i learned out of (the edition prior to their APL2 edition).
by kristopolous | 2025-04-19 22:04:37+00:00
I've been using llama 4 Maverick through openrouter. Gemini was my go to but I switched basically the day it came out to try it out.

I haven't switched back. At least for my use cases it's been meeting my expectations.

I haven't tried Microsoft's new 1.58 bit model but it may be a great swap out for sentencellm, the legendary all-MiniLM-L6-v2.

I found that if I'm unfamiliar with the knowledge domain I'm mostly using AI but then as I dive in the ratio of AI to human changes to the point where it's AI at 0 and it's all human.

Basically AI wins at day 1 but isn't any better at day 50. If this can change then it's the next step
by kazinator | 2025-04-19 22:06:54+00:00
It seems to me that in North American English, we use the proven participle as an adjective (almost exclusively?). So that is to say a remedy, having been proved effective, is then considered "proven effective". This usage is drilled into people's heads by advertisements.

It feels sort of like the difference between gilded and golden. Something that has been gilded now has a golden surface. Now golden has that en suffix like some participles, but isn't one. It's a pure adjective.
by dijit | 2025-04-19 22:07:15+00:00
I couldn’t possibly agree more.

It’s very easy to fetishise war when you have not seen the grim barbarity of true conflict.

It’s not like the movies, and we should not think of it as a desired or easily entered venture.

Street/Knife fights are another, I’ve seen them first hand and its impressive how mundane things or subtle movements are actually just lethal. There’s a saying that “The winner of a knife fight is the one who dies at the hospital” but even glib phrases like this are not enough to prepare you.

Kids would be less keen to join gangs if they saw the brutality before thinking they might get cool points.
by SV_BubbleTime | 2025-04-19 22:07:52+00:00
Depends.

Is he here illegally, was arrested with MS-13 members, found in two courts to be an MS-13 member, and himself has tattoos like one that LITERALLY SAYS MS-13 on this knuckles.

Yea but hey whatever. Poor “Maryland Man” just minding his own business and kicked out of the country he entered illegally and remained for decades despite deportation orders.

What a fucking strange hill to die on.
by lerno | 2025-04-19 22:08:28+00:00
I think the Zig community should worry more about when Jai is released. Esp given that Zig isn’t anywhere near 1.0 yet, and feature wise it’s a rather sparse language that has first mover advantage over alternatives, but as a language it actually doesn’t bring many new tools AND is bad with IDEs.

Jai similarly is hard for IDEs, but has much more depth and power.

While Zig has momentum, it will need to solidify it to become mainstream, or Jai has a good chance of disrupting Zig’s popularity. Basically Zig is Jai but minus A LOT of features, while being more verbose and annoyingly strict about things.

Odin on the other hand has no compile time and in general has different solutions compared to Zig & Jai with its rich set of builtin types and IDE friendliness.

And finally C3 which is for people who want the familiarity of C with improvement but still IDE friendliness with limited metaprogramming. This language is also less of an overlap with Jai than Zig is.
by jeroenhd | 2025-04-19 22:09:26+00:00
Welcome scrapers (IA, maybe Google and Bing) can publish their IP addresses and get whitelisted. Websites that want to prevent being on the Internet Archive can pretty much just ask for their website to be excluded (even retroactively).

[Cloudflare](https://developers.cloudflare.com/cache/troubleshooting/alwa...) tags the internet archive as operating from 207.241.224.0/20 and 208.70.24.0/21 so disabling the bot-prevention framework on connections from there should be enough.
by Rendello | 2025-04-19 22:09:37+00:00
My mother tried to give me $5 for every book of the Bible I read. I never took her up on it even though I knew about the basically freebies like Jude. I wasn't opposed to it, but it felt like –on the one hand– I didn't want to half-ass it and read a few books –and on the other– I really didn't want to read the entire Bible. So I guess that a completionist attitude prevented me from getting $30!
by Lerc | 2025-04-19 22:09:46+00:00
I don't think there was any malfunction. The conflicting parameters implicitly contained permission to lie to the crew.

The directive to take the crew to Saturpiter but also to not let them learn anything of the new mission directive meant deceiving. It's possible HAL's initial solution was to impose a communication blackout by simulating failures, then the crew reactions to the deception necciatsted their deaths to preserve the primary mission.

Less a poor prompt and more two incompatible prompts both labeled top priority. Any conclusion can be logicLally derived from a contradiction. Total loyalty cannot serve two masters.

Clarke felt quite guilty about the degree of distrust of computers that HAL generated.
by WalterGR | 2025-04-19 22:09:53+00:00
What hardware, though? I want to build a NAS / attached storage array but after accidentally purchasing an SMR drive[0] I’m a little hesitant to even confront the project.

A few tens of TBs. Local, not cloud.

[0] Maybe 7 years ago. I don’t know if anything has changed since, e.g. honest, up-front labeling.

[0*] For those unfamiliar, SMR is Shingled Magnetic Recording. https://en.m.wikipedia.org/wiki/Shingled_magnetic_recording
by jpk | 2025-04-19 22:10:29+00:00
The basis for my understanding is a convo with a Google engineer who was working on self-driving stuff around 10-15 years ago -- not sure exactly when, and things have probably changed since then.

At the time they used just a single roof-mounted lidar unit. I remember him saying the one they were using produced point cloud data on the order of Tbps, and they needed custom hardware to process it. So I guess the point cloud data isn't necessarily harder to process than video, but if the sensor's angular resolution and sample rate are high enough, it's just the volume of data that makes it challenging.
by Spooky23 | 2025-04-19 22:10:31+00:00
I think you’re both underestimating the education of immigrants and overestimating the abilities of your neighbors.

A lot of bad shit hides in the averages. Some US states have poor or no standards, or allow kids to bypass standards through various means.

Unless they got remedial education in the military or something, the average high school graduate from a poorly performing place is much less capable than a Mexican or Filipino graduate.
by rogerrogerr | 2025-04-19 22:10:40+00:00
Valuation of a statistical life is $5-10M, depending on who you ask[0].

So it’s too much to afford, or at least not singularly justifiable, unless more than 1 out of every 2000 cars kills someone in a way that would be prevented by LIDAR.

0: https://www.sciencedirect.com/science/article/pii/S109830152...
by froh | 2025-04-19 22:10:51+00:00
The word you're looking for is "bimodal distribution".

The spectrum of sex characteristics is a bimodal distribution with two peaks. and the vast majority of all humans fall close to one of the two peaks peaks. however, they indeed exist medically classified circumstances for bodily sexual expression that is not on one of the peaks but somewhere in between.

and the percentage of those not close to the peaks is heavily contested and varies between 1 in 15000 ( putting extremely high bars on "uh wen can't tell") to 17 in 1000 (counting for example a larger clit as a penis-y ambiguous thing)

bimodal distribution with distinct peaks and a low but non-zero density between the peaks.
by amanaplanacanal | 2025-04-19 22:11:02+00:00
Sorry, I was taking about school libraries.

For your public library, if they get requests for books, they get the books. Lots of people want to read fantasy romance, so those are the books they buy. Hardly anybody requests the anarchist's cookbook, so they rely on interlibrary loan to get it when someone wants it. They buy the books that are popular. This isn't rocket science.

Just about any book you want is going to be available. This is what libraries do.
by AnimalMuppet | 2025-04-19 22:11:06+00:00
> Preferably the language is close to the metal.

To expand on this a bit:

The language designers do not know what absurd hardware you are running on. They don't know that you're running an experimental DMA controller that works in a completely different way from their mental model of what DMA is like. They don't know that you're having to register interrupt handlers by directly jamming the addresses of functions into the CPU's vector table, nor do they know where your CPU stores that vector table.

So you have to be able to do all of that yourself, if needed. You have to be able to write to the vector table. You have to be able to write to the DMA controller's registers. You have to be able to write to arbitrary addresses in memory, too, because some hardware uses memory mapped I/O.

It's fine to require an "unsafe" keyword to do all that. But it has to be possible.
by geor9e | 2025-04-19 22:11:27+00:00
I'd never criticize someone's reaction during an emergency. I act dumb all the time, but I admit it later. My issue is this author is riding their viral headline about an anonymous evil insurer in cahoots with apple to kill, but won't name them for the factcheckers. You can rack your brain for all the possible reasons for this, but the Occam's Razor obvious one is that the insurer is actually innocent. But that would cause the torch-wielding mob to lose all interest in this story, if they found out there was a website the whole time. So the author will never name the insurer. I don't respect incomplete stories. Lie by omission. For attention.
by jeroenhd | 2025-04-19 22:11:41+00:00
> So there is a (IMHO) shady market out there that gives app developers on iOS, Android, MacOS and Windows money for including a library into their apps that sells users network bandwidth

AKA "why do Cloudflare and Google make me fill out these CAPTCHAs all day"

I don't know why Play Protect/MS Defender/whatever Apple has for antivirus don't classify apps that embed such malware as such. It's ridiculous that this is allowed to go on when detection is so easy. I don't know a more obvious example of a trojan than an SDK library making a user's device part of a botnet.
by lesuorac | 2025-04-19 22:11:42+00:00
> Yes, you can refill quicker, but time to "refuel" EV's is dropping precipitously as well, and it's just all around safer than tanking around highly combustible liquid gas.

I always think of I, Robot where the protagonist gets on a motorcycle and immediately their passenger complains about how dangerous gasoline is.

While not for everybody, EVs have a really great property of being rechargable without much effort on your part. Just spend ~10 seconds plugging it in at home/work and then ~10 seconds unplugging it before your next time. Compared to waiting 20 minutes in line at Costco Gas to save 1 dollar.
by whoopdedo | 2025-04-19 22:12:13+00:00
Untested hypothesis, but I would expect the wider spacing between tracks in CMR makes it more resilient against random bit flips. I'm not aware of any experiments to prove this and it may be worth doing. If the HD manufacture can convince us that SMR is just as reliable for archival storage it would help them sell those drives since right now lots of people are avoiding SMR due to poor performance and the infamy of the bait-and-switch that happened a few years back.