MurphyA/hacker-news huggingface dataset:
by clintonb | 2025-04-02 15:16:54+00:00
This is a nice setup for Attribute-Based Access Control (ABAC). I arrived at a similar design a couple weeks ago, using Casbin as our authorization backend. The challenge is that I want to store user's roles and domains and use those domains to limit access. However, I do not want to replicate my existing DB to create a record in Casbin for every resource that might be accessed.

This means, yes, when validating access, you must load the data you want to access and compare its attributes against the user's authorization. One advantage of doing this is that the system can either return a 404 if the object belongs to a completely different domain, or, if the object belongs to a sub-domain, return a 403 and sufficient data to power a request for temporary privilege escalation.

I'm open to ideas for improving this.
by meowface | 2025-04-02 15:17:06+00:00
If you're using the right models (Claude 3.7 Sonnet, Gemini 2.5 Pro) and are good at prompting it very possibly can write and deploy thousands of lines of code to production without you needing to change a single thing.

Of course, odds are there in fact is something you need to change - maybe a poor design choice or a bug or missing logic. So you of course do need to always thoroughly review it. But reading 1000 lines is faster than coming up with 1000 lines you plan to write and writing them. And also, if you see a missing thing, you can just do a follow-up prompt in the same chat context rather than actually typing a single thing into the text editor.

I know it can feel alien, and I definitely still spend a lot of time manually writing and editing code, but I'm trying to outsource more and more to the model and trying to put myself into a mindset of "first try to see if I can accomplish all this with prompts, and then fallback to 'raw coding' if it fails after a few tries" for everything and I find it's speeding me up a lot.

You should try to give it another shot. Could maybe wait another year first for the editors and models to get even better than they are right now.

>I'm referring to wholly AI generated code with no human input besides a prompt or "vibe coding." You literally can't put enough context into a prompt to have it write the exact code you'd need in every case. Your prompt would end up just being code at that point.

True, but... you can do that! It may or may not be faster than writing the code you want, true, but sometimes I think it will be faster/simpler. Gemini 2.5 now (or soon?) supports a 2 million token context window. You can write a very precise spec in the prompt. Use formal language, or use a little DSL you invent on the spot, or say "it should do X and Y and account for Z and also try to cover other things if you realize there are more", etc. There's a lot you can do.

There absolutely will still be many scenarios where it's faster overall to just write the code or where it really is harder to express what you want to say in English vs. in code, but those scenarios may be less common for you than you currently think or expect.
by alabastervlog | 2025-04-02 15:17:17+00:00
They decided to ramp anti-piracy up a big ol' notch, I see. No benefit at all to this for the user. Defeats much of the point of buying the physical game instead of digital (not quite all if this still lets you "share" [carry around and use on other consoles] the game without being stuck with their very-limited digital game sharing system)

Also, we're currently dealing with a Switch with a broken SD card slot that won't read cards anymore (can they please make these children's toys more durable this time?) so physical game cartridges with actual game data on them are the only thing keeping our console from being literal garbage... another reason to dislike this.

This'll hurt system longevity, too. Fewer physical games that continue to function once they shut down online service for the console.
by agentultra | 2025-04-02 15:17:27+00:00
If you don't care, I can't help change your mind.

I took a small company that was living contract to contract into a world where they started making millions in annual recurring revenue.

There's no secret, magic bullet. All I did was make sure we were delivering progress at a regular cadence. Kept communication channels open. And tried to, but ultimately failed at, training the sales team to stop with the secret deadline negotiation.

I understand the sales cycle at the enterprise SaaS level is a long song-and-dance of promises and and punishments. I understand that money only changes hands when the customer feels like they will get their money's worth or else your business will go out of existence. It's a difficult game to play.

However... they were never unhappy. Steady, reliable, and consistent beat out guessing, promising, and hoping to deliver every time. The dollars proved it.
by I_Am_Nous | 2025-04-02 15:17:29+00:00
You might be thinking of the Hubble Ultra Deep Field image (https://science.nasa.gov/asset/hubble/hubble-ultra-deep-fiel...). I believe it was the result of NASA saying "Let's look at what appears to be a completely dark spot in space, zoom in as far as we can, and see what's there."

We see stars in our galaxy because they are close enough to us that we see them as individual stars. Compare that to the Andromeda Galaxy, which is far enough away that without intense zoom, it looks like a single source of light. There are galaxies even farther away, which we cannot see with the naked eye at all, but zooming in on them like Hubble did means we eventually get enough resolution to see they are individual galaxies, unfathomably far away.

JWST being able to see infrared means we'll see galaxies that are so far away, their light is redshifted so we (and Hubble) cannot even see them at all.

With regards to your question about how to test the bubble hypothesis posted by parent, we would be limited by how variable our point of view can be. We can gather what data we can at one end of Earth's orbit, and then try to see from the opposite end and compare what we see, comparing data sets to see if certain galaxies or stars are in different positions. We already do some of this when dealing with gravitational lensing and I believe it's one of the primary ways we can detect black holes, as they bend light a lot.
by bloopernova | 2025-04-02 15:17:36+00:00
Especially since he seems to ignore those children except the one he drags around with him.

Maybe he has some dream about being a patriarch of a giant family.

Actually, considering his "pay someone else to play video games" actions, it makes sense that he's paying others to raise his kids. He seems to want the appearance but none of the work behind it.
by Puraido | 2025-04-02 15:18:04+00:00
Puraido | Senior/Staff Backend/Fullstack SWE | On-site/Hybrid/Remote | Bangkok (Thailand) | Full-time

At Puraido, we're building a B2B payment orchestration platform focused on recurring payments. Our system integrates multiple payment gateways into a single easy-to-use platform. It handles order processing, payments, email notifications, third-party callbacks and risk management. We face ongoing challenges from the constantly changing payment landscape with each payment channel requiring immense flexibility from our platform.

We aim to develop high-grade software by providing our developers the space and time to create solutions that make sense from both engineering and business perspectives. We make as few shortcuts as possible. We're building for the future and scaling up as a first-grade SaaS to attract new types of clients, while remaining focused on our existing clients' needs.

Our informal team works from a large penthouse-style office in central Bangkok, with plenty of space to work, relax and socialize. We offer both remote and flexible on-site positions to accommodate our engineers from various nationalities across the globe. All positions come with comfortable Thai market salaries, plus we can offer visa sponsorship.

We are looking for:

- Senior/staff level backend developer

- Senior/staff level frontend (fullstack) developer

Our tech stacks:

- Backend: Kotlin/Java, Spring Boot, Hibernate/JPA, ActiveMQ/JMS, PostgreSQL

- Fullstack: TypeScript, Next.js, React, PostgreSQL

- Infra: AWS, EKS/Kubernetes, Helm, RDS, Terraform, GitLab CI/CD

Apply directly by sending your resume to me, Roan at roan@puraido.com

For more jobs check out our website https://puraido.com/jobs/
by maerF0x0 | 2025-04-02 15:18:26+00:00
I understand what you're saying... You're talking about total gains over a long period of time like a 10 year sedentary steroid use versus a 10 year natural lifter doing lots of the right things... I'm not sure if there's any data on the subject besides anecdotes.

Do you have a longitudinal study source?

> "Untrained males without prior AAS use gained more muscle over a 10 week non-exercise period than similar males who performed exercise."

There's lots of studies that show steroid users accumulate about 2x as much muscle as non steroid users, but those are both in trained groups. Unclear about what happens if someone takes steroids across 10 years, and how much total muscle they accumulate relative to a natural over the same time period.
Ask HN: Built a policy engine for LLMs – open-source it or keep trying to sell?
by iLikeFunctional | 2025-04-02 15:18:37+00:00
We’re two engineers who built a system that acts like a guardrail/policy enforcement layer for large language models (GPT, Claude, etc). It analyzes both prompts and responses in real time, and applies configurable policies like:

Blocking PII (emails, IPs, phone numbers, etc.) Detecting company secrets (e.g., passwords, API keys) Preventing accidental leaks of proprietary code Filtering toxic/inappropriate language Catching mentions of competitors, people, or locations

Each policy can be tuned (strict or lenient), and you can decide whether to just log it or actually block the message. Everything is logged with full metadata: policy IDs, timestamps, token counts, etc.

The architecture has two parts: a self-hosted data plane (which handles all sensitive message content), and a hosted control plane (for configs and API keys). So it can be used in privacy-sensitive environments.

You can integrate it via API, browser extension, or a simple chat UI.

Now here’s where we’re struggling:

We don’t have a strong network of buyers or investors. Most of our outreach has been cold emails, and it hasn’t led to much traction. Pricing experiments (per seat, per org) haven’t helped. So it’s unclear whether the idea isn’t good—or we’re just not getting it in front of the right people.

We’ve started thinking about open-sourcing it. The idea would be: self-host for free, pay us if you want the hosted version (similar to MongoDB/Redis models). Probably support bring-your-own-encryption-key for hosted users.

But I’m honestly torn. Open-sourcing sounds right for trust and adoption—but we’ve spent a lot of time on this, and there’s that fear of releasing it and getting little to nothing back.

So: if you work with LLMs, or have faced issues around privacy/compliance/safety, I’d really love your take. Does this sound useful? Would open source make it more attractive? Are we just early to a problem people don’t feel yet?

Not promoting anything, just hoping to learn from folks who’ve walked this path.
by ty6853 | 2025-04-02 15:18:45+00:00
Because the law isn't based on justice, morality, or ethics. It is merely a system by which power is wielded. You are basing your judgement on a fictional caricature that is not reality. What 'should' happen has zero bearing there. The immigration judges are merely delegates of the AG, and only empowered to the extent the AG allows. It is an administrative action without protection criminal defendants get.
by dkarl | 2025-04-02 15:18:59+00:00
Perl is mature, too.

Maven is awful. SBT is awful. Gradle is awful. I've used them all professionally, and the best I can say about them is that you can get the job done with them.

Newer languages and newer build systems are much better experiences, because of decades more hindsight and because language designers think about tooling from the start. Java was designed with the assumption that all software projects were built with Make, and with no ambition to improve on that. There was no Java-specific build tool until Ant was released as a standalone tool circa 2000.

> What is wrong with CMake for C++?

Granted, most of what's wrong with CMake is the problem it solves. Probably there's no solution that wouldn't be at least close to as awful as CMake. But it is objectively a hideous experience compared to any language created in the last 15 years.
by LinuxBender | 2025-04-02 15:18:59+00:00
True and even a SCIF is not foolproof. From the 50's to the 90's the US and Soviet military played a lot of fun games one of which included typing up a classified document in a SCIF and the Russians met up with the contest judge with an exact replica of the document. There were thousands of such games. I learned about many of them in the military. Between those stories and the fact we bought transmitter parts from them during the cold war showed me that each nations military were never enemies, just the bureaucrats were.
by neverartful | 2025-04-02 15:19:13+00:00
Have you discussed this with your doctor? If not, I would schedule an appointment ASAP. It's possible that medication might be able to help significantly. If it does help, it could be that it helps you enough to turn things into a more manageable situation at work. This might not be your long-term optimal solution, but it could make life less miserable until you do find your long-term optimal.
by ctc24 | 2025-04-02 15:19:57+00:00
Prequel | Staff Frontend / Full Stack Engineer / SWE Intern | ONSITE in New York City | Full Time | https://prequel.co

- Prequel is the customer data access platform. We enable SaaS companies like LaunchDarkly, Gong, and LogRocket to make data accessible to their customers.

- Transferring trillions of rows between data stores every month.

- Revenue is up 50% since Jan 1.

- We're launching a new product which is quite frontend heavy, and want to bring a pro onboard who can act as tech lead for it. This is not your standard CRUD app -- a big part of it is building complex SDKs and APIs used by engineers at top-tier companies.

- Frontend in Typescript/React, backend in Go.

- Team is stacked, with alums from Stripe, GIPHY, Google, Flatiron Health, and more.

- We're based in NYC with our HQ in Chelsea.

Apply here: https://www.ycombinator.com/companies/prequel/jobs/wdjx5KE-f... or email careers (at).
by reverendsteveii | 2025-04-02 15:20:33+00:00
https://www.youtube.com/watch?v=DRLTjESyuQk

Fun fact: it seems to be somewhere around 33 beats per minute that people lose the connection between one beat and the next and therefore lose the ability to perceive rhythm. Though oddly enough this video asserts that and then immediately disproves it by having a band play a 33 BPM song while the audience counts along.
by apothegm | 2025-04-02 15:20:57+00:00
There’s a huge and worsening shortage of people in trades in major cities as people who would have gone into them a generation and a half ago have increasingly been choosing college and white collar work instead. As a result, they can charge as much as they like, and rates and salaries are pretty good for anything that requires real skill.

“Handyman” has mostly been replaced by Taskrabbit et al. But just try finding an electrician, a plumber, a roofer, someone who can lay tile or install windows properly, etc. for real home renovations or even just troubleshooting that goes beyond snaking a drain.
by carlsverre | 2025-04-02 15:21:04+00:00
Thanks! And great idea. I haven't deep dived into DuckDB's storage format yet, however I know that they split up the data into row groups which internally are columnar. I'm not sure how that maps to the pages in the file. If it doesn't align well, or they do a lot of shifting style writes (writes that cause all subsequent data to shift forward or backward) it may not be a great fit for Graft.

Either way, it's 100% a great idea that I'd like to explore. If any DuckDB contributors are reading I'd love to know if it would work!
by ajb | 2025-04-02 15:21:24+00:00
Not the GP, but I'll give it a go:

You may be familiar with the layer structure of communications: Internetwork layer,below that transport, below that link layer, and at the bottom the physical layer. The physical layer is where it gets really messy: noise, interference, reflections,whatever.

In human interaction, at the bottom layer is the simple fact that at any time, any human can just not follow the rules. That's not necessarily wrong. Maybe the rule just isn't important, and everyone recognises that. Or maybe some deep moral principle should override it. But at that point, other people have to make a moral call - do they ignore this breach of the rules? Do they object? Do they assess the moral principle as overriding?

The military have some usefully neutral terms for behaviors, one of which is 'revisionist'. A revisionist power wants to change the rules, a status quo power wants to keep them. It's fairly clear that the US government is presently a revisionist one. That means that pretty much everyone has now to make the call as to whether what they see is allowable or, given the scale and power of the US federal government, a five-alarm fire. And they will often want to take that to places where they have some kind of trust in the intelligence or good will of the other people there. For a lot of engineers, that's right here. If this were a workplace or uni, there would be break rooms and water-coolers where this kind of discussion could go. But HN has none of that - there's only one category of discussion. So if you flag every such discussion, you're denying them the opportunity to do that. And that's not keeping politics out of HN - that's a political act itself.
by glaugh | 2025-04-02 15:21:25+00:00
My personal experience, having had low testosterone for much of my life and then now being on testosterone replacement therapy:

- It’s obvious to me that I (n=1) gained a ton of muscle and lost a ton of fat very quickly without having done dramatic changes in workouts at first

- It also made it waaaay easier to work out. I used to hate it bc I was exhausted all the time, and now I don’t really mind, and sometimes even enjoy it. In actual practice pulling these variables apart is hard

PSA: T levels have declined markedly over the past generation or two. But when one tests for low T, the goalposts move bc every time a new population is studied for setting benchmarks (generally every decade or two), the definition of clinically “low” is moved to the new 2.5%ile of that study, such that someone in the current 3rd %ile (considered A-okay by most doctors) would have been in maybe 2.4th %ile (considered red alert by most doctors) using the previous benchmarks (made up numbers but roughly right).

(This is a dumb approach, the binary magic of the 2.5%ile (2 standard deviations), and it frustrates me greatly bc i was denied care bc my first test was 2.4%ile and 2nd was 2.6%ile and thus i was told i was fine bc of the 2nd result and offered anti-depressants instead).

Fixing this is not about muscles, it’s about having energy to live life fully and not be cranky.

So if you’re constantly tired, consider testing for this. And use a functional doc, as in my experience from shepherding 5-10 other folks through this process, the standard doc knows little about this stuff and thinks that having a condition like this is binary

Sorry, a bit off-topic, but no change in my life has been more important besides kids, so I try to spread the word where even somewhat appropriate
by bilekas | 2025-04-02 15:21:28+00:00
>If you are writing something like NodeJS, 99% of the time it will only ever be deployed server-side on Linux, most likely in a container.

I'm really curious where you're getting this impression from ? I for one never run docker containers on my dualcore atom server with 4gb ram.. but i have a lot of node services running.

> There is zero reason to even mess with a "works on my machine" or a "try a different node version" situation on this kind of NodeJS project

There are a lot of reasons to investigate these things, infact that's what I would expect from a larger more industry invoved companies, knowing the finer nuances and details of these things can be important. What might seem benign can just as quickly become something really dangerous or important when working on a huge scale such as CloudFlare.

Edit : BTW I do agree mistakes were made, and the hell that is NPM chain of delivery attacks is terrifying. Those are the points I would focus on more personally.
by rjeli | 2025-04-02 15:21:34+00:00
Author’s announcement xeet with some context and highlights: https://x.com/camrobjones/status/1907086860322480233

mirror: https://nitter.net/camrobjones/status/1907086860322480233#m

They link to the webapp which you can play yourself!

https://turingtest.live/

(I have a dozen games played and 100% success rate :3)
Why Git is no "good" for AI-generated code
by SnootyMonkey | 2025-04-02 15:21:40+00:00
When AI agents are generating some, most, or all of your code, then occasional git commits of the resulting source code aren't sufficient. You also need a tool that ties the generated code back to the prompts and AI interactions that generated it.

Here’s a short technical explainer video of GOOD, a Git companion designed for this: https://github.com/specstoryai/getspecstory/blob/main/GOOD.m...

The core tool will be free (as in beer), but we may or may not be FOSS. We’ll figure that out soon’ish.

I would love some feedback on this!
by Etheryte | 2025-04-02 15:23:12+00:00
The fact that Jest blindly calls whatever binary is installed as `sl` is downright reckless and that's an understatement. If they need the check, a simple way to avoid the problem would be to install it as a dependency, call `require.resolve()` [0] and Bob's your uncle. If they don't want the bundle size, write a heuristic, surely Meta can afford it. Blindly stuffing strings into exec and hoping it works out is not fine.

[0] https://nodejs.org/api/modules.html#requireresolverequest-op...
by gregatragenet3 | 2025-04-02 15:23:13+00:00
Should be afraid.. If people are more convinced an AI is human than a human is human, that means AI will be more likely to convince you to adopt their 'point of view'.

To put it another way, if an AI and a human post two different views on a subject, people are more likely to be swayed by the AI's point of view.

So for much cheaper now organizations can use AI at scale to sway public opinion in a way thats more effective than ever before.
by jmull | 2025-04-02 15:24:17+00:00
I wouldn't necessarily assume people's interest in science is limited to what meta analyses tell us.

A single study probably can't answer the high-level questions (like, "does creatine help build muscle?") but can nevertheless be pretty interesting to read and discuss. (Personally, I found this discussion interesting, and I don't care about the high-level question at all.)
by chris_va | 2025-04-02 15:24:21+00:00
It is amazing how inefficient water use seems to be in plants.

Dry biomass growth is ~1kg/m^2/year, wet maybe 4-5x that. But they see ~1m of rainfall, so 1000kg/m^2/year of water. The roots fail to take up some, but the rest seems to be ~99% lost due to transpiration (some of which is necessary for heat stress and/or pump up nutrients).

Maybe after C4 rice we can get C4/CAM coffee?