MurphyA/hacker-news huggingface dataset:
by kunalsin9h | 2025-04-23 15:45:09+00:00
We recently identified a sophisticated supply chain attack vector in the npm ecosystem. The package "express-cookie-parser" impersonates the popular "cookie-parser" but with a critical difference: unlike most malicious packages that trigger during installation, this one maintains perfect API compatibility and only executes its payload when loaded by the application at runtime.

Key findings:

- Uses a domain generation algorithm (DGA) with SHA256 hash to create C2 domains - Self-deletes and removes references from the original index.js - Downloads a "startup.js" payload to Google Chrome's user data directory - Executes using the Node executable in path

This represents a concerning evolution in supply chain attacks, as it avoids detection during installation and security scanning. The npm team acted quickly to remove the package once reported.

We're also working on dynamic analysis tools for open source packages to better detect these types of sophisticated threats. Happy to answer any questions about our methodology or findings!
by pessimizer | 2025-04-23 15:45:59+00:00
Then I think that you would probably need to create some sort of centralized European FOSS software support, because in the ideal case that everything was interoperable without too much work, you're left with 20 different software projects to get in contact with if something goes wrong. And if something goes wrong in the interop between those 20 projects written on wildly different stacks, there's nobody to call.

If some genius hasn't already put together a turnkey umbrella project that meets your needs, you're going to have to find your own genius. That's different than just calling MS or Apple, even if their support is slow or annoying. I think Oracle counts, too.

It's not like Europe couldn't build these systems out of FOSS (just like Oracle and others, btw), they just haven't done it until now and it would have been just as easy to do 15 years ago. I think they'd rather get courted and bribed by American behemoths.
by bootsmann | 2025-04-23 15:46:13+00:00
Your cars touchscreen is not a marketplace. The M in DMA is for markets, which is what the regulation targets. Now if your car manufacturer sold the car and someone else sold the touchscreen then you could talk about this but as it stands its a false equivalence.

Apple has a market within iOS over which it can arbitrarily enforce anti-competitive rules, the EU regulates this type of behaviour.
by wolvesechoes | 2025-04-23 15:46:44+00:00
The issue is that it is not enough to throw money at random projects. There should be at least high-level plan and rather specific goals. Frankly, "reclaim public internet" is a nice slogan, but it is too abstract to be a good, meaningful goal.

Also money is but a one issue. Free software has a big problem with coordination of efforts. Though many claim it is its strength, it is a handicap when it comes to political action (and free software is a political action).

In short, what we need is an equivalent of grand industrial policies of the past, but this time for free software.
by cityofdelusion | 2025-04-23 15:46:59+00:00
It is more intuitive if you spend more time in academia / higher education. Even around me, with a bunch of mid-lower tier schools, PhDs and masters are being pumped out semester after semester in very niche areas. In all my time searching through job boards, I've probably seen a tiny handful of chip design jobs compared to the absolute boat load of things like more generalized engineers, business analysts, financial/accounting, and so on.
by scientator | 2025-04-23 15:48:29+00:00
I believe the royal society for the protection of birds studied whether cats are a threat to bird populations and concluded that they really aren't. Obviously cats do kill birds, but overwhelmingly the major threat to birds is habitat loss caused by humans. Also, cats kill rodents, which indirectly helps birds because rodents are a big threat to bird populations, because rats take eggs from their nests. In fact, cats preferentially kill rodents. Something like 90% of their diet will typically be rodents. Birds, for them, are only opportunity kills. In other words, cats are an easy scapegoat because they quite visibly do kill birds, but humans (as is usually the case) are the true underlying problem.
by ksec | 2025-04-23 15:48:50+00:00
It was more of a problem of Intel, they failed to market it, failed to innovate on the tech, failed to increase yield, failed to increase the demand for it which leads to sending money to Micron for unused capacity. Yes. Failure of Intel CEO.

But the technology also wasn't as promising as people think it is. Z-NAND offer something similar in read, slower in sustainable random write at 50% of the price. In the end even Z-NAND failed to reach any customers. XL-Flash is only thing left. And judging from news I wont be surprised they would stop in 2025 or 2026 as well. Normal NAND is fast enough for most things.

How ever I do wonder in the age of AI if Optane could have a different role.
by kayge | 2025-04-23 15:48:58+00:00
Here's a real one:

“The county has, for whatever reason, also refused to produce the network routers. We want the routers, Sonny. Wendy, we got to get those routers, please. The routers. Come on, Kelly, we can get those routers. Those routers. You know what? We’re so beyond the routers, there’s so many fraudulent votes without the routers. But if you got those routers, what that will show, and they don’t want to give up the routers. They don’t want to give them. They are fighting like hell. Why are these commissioners fighting not to give the routers?”

https://www.youtube.com/watch?v=dyzz9mUt6x0
by advisedwang | 2025-04-23 15:49:14+00:00
My understanding was that chain-of-thought is used precisely BECAUSE it doesn't reproduce the same logic that simply asking the question directly does. In "fabricating" an explanation for what it might have done if asked the question directly, it has actually produced correct reasoning. Therefore you can ask the chain-of-thought question to get a better result than asking the question directly.

I'd love to see the multiplication accuracy chart from https://www.mindprison.cc/p/why-llms-dont-ask-for-calculator... with the output from a chain-of-thought prompt.
by mschuster91 | 2025-04-23 15:49:47+00:00
> At the very least, I can get a bunch of people and bang on their doors with some pitchforks.

For that, you gotta hear about the issue first. Local reporting is all but dead, and the few local journalists that remain and have the expertise and time to do investigative pieces on local money wastes are way more easily silenced by SLAPP lawsuits and political pressure (up to and including death threats) than something like, say, the New York Times.
by Aurornis | 2025-04-23 15:50:05+00:00
In a world where I can have my iPhone battery replaced for $99 by Apple with official parts and a quick turnaround, my desire for self-replaceable batteries is completely gone.

I’ll take the reduced size, lower weight, sturdier construction, and better waterproofing I get from the current build style.

Saving tens of dollars and an hour or two of my time every 4 years isn’t worth the compromise.
by ivan_gammel | 2025-04-23 15:50:31+00:00
But you are not Putin and he is not you. Attacking Ukraine wasn’t a gamble for him, it was a presumably easy win, like Georgia in 2008. Attack on NATO on Baltic shore isn’t an easy win, it’s a gamble. And what is this test for? America has already learned the lesson and is withdrawing from Russian periphery. Europe has no interest in power games, UK is in irreversible decline. NATO is not going to expand anymore in foreseeable future, primary military goal achieved and Russian authoritarianism is secure. Why he would attack Baltics?
by netsharc | 2025-04-23 15:50:45+00:00
I've been wondering how to get off the Zuckerverse (I still post on Instagram) and wondered if I can streamline uploading pictures to my own website. I imagine a Telegram bot that receives an image + caption, with backend code that creates such a blog post and does a git push is one way of doing it.

It seems this post talks about blogging from the desktop. But I just installed Obsidian on Android, it allows a filesystem vault. I think pairing it with Syncthing and some automation on my NAS (to do a git push to Github/Gitlab) could make it very streamlined.
by fc417fc802 | 2025-04-23 15:51:00+00:00
Sure it is. Lots of us also go on about private property rights and freedom of association. Apple is restricting the behavior of entities doing business through them on a platform they own. The logic is that you remain free to speak - elsewhere. Meanwhile Apple remains free not to do business with you if you can't or won't accept their terms.

(Well really the legal argument is that Apple isn't the government and so the first amendment doesn't bind their policies but there's an ideological aspect in addition to the legal one.)

The issue missed by such an analysis is the outsized impact the megacorp has. Without strong competition (ie not a duopoly or even an oligopoly) regulation is required to protect consumers against practices that otherwise would be financially discouraged.

There are also a few other blindspots people here tend to have regarding regulation. In particular that sometimes detrimental behaviors exist that are perversely incentivized rather than discouraged by the market despite being obviously worse for consumers. A lot of people here seem to conveniently forget that such things are even within the realm of possibility.
by treeblah | 2025-04-23 15:51:05+00:00
I had a near identical approach for my blog but I recently moved to a headless CMS. The bugbear being that it wasn't easy to publish if I wasn't at my desktop. With a headless CMS, I auth through Github via my phone, which also serves as the draft/publish step since posts in the CMS manifest as pull requests. It's been working great so far, with the caveat that the writing experience isn't as nice as Obsidian.

FWIW the CMS is Decap CMS and I have it configured likewise with Cloudflare Pages (since Pages supports functions that are needed for the auth/callback cycle).
by eichin | 2025-04-23 15:51:53+00:00
With a catchphrase like "reclaim the public internet" I expected they were funding Anubis https://xeiaso.net/blog/2025/anubis/ (don't get me wrong, they've got a neat list of projects, I'm just quibbling with what's "public internet" about solar powered motherboards or Ada bootstrapping.)
by Jamesbeam | 2025-04-23 15:52:26+00:00
Interesting piece, but the narrative of Musk personally hitting a "suppress Loomer" button feels a bit too simplistic, though maybe not entirely wrong.

On one hand, you absolutely have plausible deniability via standard X operations:

"Freedom of Speech, Not Reach": This is literally their stated policy. Content deemed "awful but lawful" gets visibility filtered. Given Loomer's history across platforms , hitting policy thresholds isn't surprising.

Algorithmic Blowback: Musk himself cited high block/mute rates from "credible" (verified) users tanking reach and triggering spam filters. Loomer complained about spam labels , which fits this. Provocative accounts likely attract negative signals.

Technical Glitches: X is notoriously buggy. Verification/Premium features breaking, especially around affiliate links (like the speculated "ConservativeOG" issue ), isn't out of character. Automated account locks/restrictions happen constantly due to generic "unusual activity" flags.

However, dismissing the NYT's core claim entirely ignores:

Musk's Track Record: He does intervene directly and target critics. His control is absolute. The "Evil Housekeeper Problem" applies. He has the keys.

The Timing/Cluster: The H-1B spat immediately followed by specific, similar issues (verification, monetization, reach) for Loomer and ~13 other conservative critics is... convenient timing for purely random glitches or standard enforcement suddenly kicking in for all of them simultaneously.

Targeted Automation: Direct manual suppression is inefficient. But could Musk have ordered tweaks to the algorithm or enforcement rules targeting patterns associated with his critics? E.g., changing spam filter sensitivity, adjusting criteria for verification removal based on certain speech, weighting blocks from certain user groups differently. That's still intervention, just automated.

Opacity: We simply don't know what happens internally at X. Musk's "spam" explanation is unfalsifiable without internal data.

My personal conclusion. Direct, manual suppression by Musk seems less likely than a combination of standard algorithmic/policy effects and maybe some technical debt hitting at an opportune time. But the possibility of indirect intervention (Musk ordering system changes to target critics) fueled by the public spat can't be ruled out, especially given the timing and Musk's history. The NYT might be connecting dots without a smoking gun, but the pattern is suspicious enough that just blaming "the algorithm" feels incomplete.
by mightyham | 2025-04-23 15:52:29+00:00
Wow, I never imagined you would respond to my comment, a little embarrassed ngl :D

I understand that under the hood Solid's reactive system is not quite simple; though, the mental model needed to use it, is very simple, which I greatly appreciate when building complex application logic on top of it. That's really my main concern: that one-way "push" semantics are easy to follow and think about, and adding new mechanics complicates that picture. It seems deceptive that what presents itself, at least conceptually, as just a value access, might now cause arbitrary code execution (another way of putting this is that it feels like it violates the principle of least astonishment).

As I mentioned before, I also haven't run into situations in practice where lazy memos seem like a desirable behavior. If I initialize a derived value, it's because I plan to use it. If some computation needs to be "delayed", I place it inside an if statement with a reactive condition, for instance, createMemo(() => shouldCompute() ? computeValue() : undefined).

All that's said, you've done a fantastic job with Solid. I hope you continue to innovate and prove my objections misguided.
by EGreg | 2025-04-23 15:52:29+00:00
I could go on. The point is this ... Paul and Luke wrote the majority of the New Testament. But their authority is circular. Jesus never taught Paul. Jesus' teachings were for Jews and he told them to follow the law. Paul said seemingly the opposite. Paul got his religion from his own visions. Paul argued with the very people Jesus did set up to run the Church. And from his letters, he doesn't seem to have related what they explicitly said, invoking all their authority. Luke somehow records that.

Today, after the Council of Niceae by Constantine 3 centuries after the events, nearly all Christian denominations follow Pauline doctrine. But where is his authority from? How is he any different from, say, Mohammad?

From all the Christian apologists I have talked to, they point to one verse and one verse only: Second Peter

15 And account that the longsuffering of our Lord is salvation, even as our beloved brother Paul also, according to the wisdom given unto him, hath written unto you,

16 as also in all his epistles, speaking in them of these things. Therein are some things hard to understand, which those who are unlearned and unstable wrest, as they do also the other Scriptures, unto their own destruction.

But most scholars consider Second Peter not to have been even written by Peter

https://bible.org/article/authorship-second-peter

Harris says, “virtually none believe that 2 Peter was written by Jesus’ chief disciple.”2 And Brevard S. Childs, an excellent rhetorical critic, shows his assumption when he says, “even among scholars who recognize the non-Petrine authorship there remains the sharpest possible disagreement on a theological assessment.”3

So what are we left with? One dubious link to Paul, from Jesus and his followers, in the entire Bible. And yet most people follow Paul.

Thomas Jefferson: I separate therefore the gold from the dross; restore to him the former, & leave the latter to the stupidity of some, and roguery of others of his disciples. of this band of dupes and impostors, Paul was the great Coryphaeus, and first corrupter of the doctrines of Jesus.

Anyway... that's my conclusion after studying the matter in as much depth as I could find, and talking to Christian apologists.
by fennecfoxy | 2025-04-23 15:52:32+00:00
Well presumably since they're individuals and not a business the consequences are much less severe legally - but public opinion still won't be great, but since when was it ever, for any new thing?

If I cut up a song or TV show & put it on Youtube (and screech about fair use/parody law) then that's fine, but people will balk at something like this.

AI is here, people.
by monkemonke | 2025-04-23 15:53:47+00:00
I actually built this for myself on my previous phone using Tasker. If you have root you can just set the charge voltage (basically redefining 100% as 4.1V or something to limit charge %) and current to whatever you want. It was especially nice to be able to limit the current to like 500mA while using Android Auto because GPS and data use gets the phone hot enough already. That phone's barely aged in the two years or so I had it.

On my current phone I use wireless charging overnight and the 80% limit and I think that gets me most of the benefits of that hacky solution without requiring root.
by bayindirh | 2025-04-23 15:54:06+00:00
You can install or use any of the open pixelfed instances instead of Instagram.

I stopped uploading to Instagram the day they started using images for AI training.

If any of the file syncing applications work directly on the filesystem, I think you can use Obsidian on these folders and it'll sync automatically. On iOS, Obsidian defaults to iCloud, for example.
by DrillShopper | 2025-04-23 15:54:07+00:00
None of that matters to companies who want to hire an offshore tech to click things in the MMC and maybe write a Powershell script to solve something really quick. Especially small companies who can't afford an entire IT department.

All of the Linux management tools are good, but they do not integrate as tightly with the OS and there are several competing ones. Microsoft has one tool and one thing to learn and that's it.

I say this as someone who has managed a fleet of Linux systems and whose current work is 100% Linux based. If a company can throw a smaller amount of money at something then they'll do it
by ofrzeta | 2025-04-23 15:54:11+00:00
I don't know about this display but I've tinkered a bit with Waveshare E-Ink, that has this disclaimer:

"For e-Paper displays that support partial refresh, please note that you cannot refresh them with the partial refresh mode all the time. After refreshing partially several times, you need to fully refresh EPD once. Otherwise, the display effect will be abnormal, which cannot be repaired!"

https://www.waveshare.com/wiki/1.54inch_e-Paper_Module_Manua...
Show HN: IfThisThenThat Linter (IFTTT-Lint)
by yablak | 2025-04-23 15:54:30+00:00
An open‑source implementation of Google's internal IfThisThenThat (IFTTT) linter tool. Enforce atomic pull requests by declaring file dependencies in your code: If this file changes, then that file or region must also change.

--

Disclosure: I work at OpenAI.

I've been missing IFTTT this since leaving Google, esp. for working in large repos. Wrote this over the weekend w/ codex; so don't judge too harshly. JS seemed like the right language for it, but I know basically zero. Happily, that's no longer a blocker for small projects like this one.
by _wire_ | 2025-04-23 15:54:33+00:00
This article wastes readers' time by pretending to command of a subject in a manner that is authoritative only in its uncertainty.

Pixel is an abbreviation for 'picture element' which describes a unit of electronic image representation. To understand it, consider picture elements in the following context...

(Insert X different ways of thinking about pictures and their elements.)

If there is a need for a jargon of mathematical "dimensionality" for any of these ways of thinking, please discuss it in such context.

Next up:

<i>A musical note is a unit of...</i>
by LunaSea | 2025-04-23 15:54:51+00:00
> They already had it from before people realized it was a bait and switch.

So you mean to say that they made the same mistake that the supposed European users did with the app stores?

> Upper middle class americans absolutely do, or they don't stay that way for very long.

Yet they are on the same very public and absolutely no private or secure social networks (Facebook, TikTok, Instagram) as the rest of the world?
by Ukv | 2025-04-23 15:55:00+00:00
There's a range of anti-competitive behavior which can subvert that ideal, and as such there's regulation aimed to prevent it. Apple used to forbid apps from telling users about Apple's 30% cut or cheaper places to buy the app, for instance, hindering users from making an informed choice.

Many of the policies in question are intentionally not publicized to end-users, often requiring first paying to be part of the developer program before you can even see what you need to agree to to publish an app.
by ty6853 | 2025-04-23 15:57:13+00:00
The libertarian position is highly anti-democratic. If the people vote for a lynch mob, they should get it, and the nebulous pollution of democracy through "my limitations on democracy are better than yours" do not sell well with the public who see a reduction in presidential power as a reduction in their own power.

If you're trying to change this in the USA, you've already lost. The people only learn through experience. Best to just move to Argentina or something where the pendulum is swinging the other way.
by mindcrime | 2025-04-23 15:57:50+00:00
I'm really tired of this take. Not because it's necessarily wrong but because it gets used as justification to basically abdicate from doing any up-front design whatsoever. And that, IMO, is absolutely wrong.

This is not an appeal to do "BDUF" and try to design every component, service, button, widget, class, etc. of your application up-front in UML or whatever. It's an appeal to actually do some level of rigorous analysis and design before you start building, and apply the wisdom one has access to (from personal experience, from reading about others experiences, whatever) to construct a design that supports the reasonable expectations for your app beyond what is right in front of your nose right this very minute.

I like to suggest we call this SDUF or "Sufficient Design Up Front". And granted, the exact details of the lines between NDUF (No Design Up Front), SDUF, and BDUF are a bit fuzzy and subjective. But that doesn't mean we can't try.

Sadly, the "agile revolution", while mostly a positive development, kinda sucked all the oxygen out of the room with regards to doing rigorous analysis and design and basically killed software architecture as a practice in many (most?) organizations. I think that was a mistake and that it's time to walk that back a bit.
by RHSeeger | 2025-04-23 15:58:00+00:00
One artist can take months painting a picture of a landscape where everything is perfect. And the next artist can throw 4 colors of paint at a wall. The fact that lots of people enjoy the work of the second artist doesn't invalidate the work of the first. The two artists are focusing on different things; and it's possible for both of them to be successful at reaching their goals.