MurphyA/hacker-news huggingface dataset:
by paxys | 2025-04-25 14:52:06+00:00
"You never know..." is the worst form of security, and makes systems less secure overall. Passwords must be changed every month, just to be safe. They must be 20 alphanumeric characters (with 5 symbols of course), just to be safe. We must pass every 3-letter compliance standard with hundreds of pages of checklists for each. The server must have WAF enabled, because one of the checklists says so.

Ask the CIO what actual threat all this is preventing, and you'll get blank stares.

As an engineer what incentive is there to put effort into knowing where each form input goes and how to sanitize it in a way that makes sense? You are getting paid to check the box and move on, and every new hire quickly realizes that. Organizations like these aren't focused on improving security, they are focused on covering their ass after the breach happens.
by turtleyacht | 2025-04-25 14:52:36+00:00
Waiting for code reviews after requesting one. Hard to get fixed. Just have to retry with backoff. Workaround is fork off and rebase (carefully).

Long-running automation. Caching helps, but breaking up a monolith is long-term work.

Flaky tests. Hard to fix on memory-starved hardware. One alternative is to separate scraping from validation.

Upgrading minor versions of dependencies that are breaking changes. Just have to stay on the older one if a fix cannot be found within a timebox.
by Imustaskforhelp | 2025-04-25 14:52:55+00:00
Cloudflare workers can do wasm and js.

I haven't tried with wasm personally because well, it has a limit of 25 mb and I am not sure but last time I read somewhere in their forums about some guy wishing to run golang, it had the issue that wasm could only be 1-2mb and golang's most basic example had it taken 1-2mb so they can't cook anything good.

Of course I can be wrong & I am just too lazy to search that article to remember the facts again.
by TheOtherHobbes | 2025-04-25 14:53:19+00:00
This is a basic feature of capitalism and every other acquisitive social system.

Without forced redistribution of wealth/power that set hard limits you're going to get a runaway, and the whole thing melts down.

This won't happen if the people with wealth/power care about consequences and have the wisdom to model outcomes accurately. But the kinds of people who care about consequences in capitalism are unlikely to be chasing huge wealth in the first place.

The system cannot work. It's fundamentally manic depressive, alternating between irrationally exuberant booms and catastrophic crashes, and consuming talent and raw materials for self-defeating ends.
by htrp | 2025-04-25 14:54:28+00:00
> But what happens with generations that will grow up with AI readily available? There is a good chance that there will be a generational skill atrophy in the future, as less people will be inclined to develop the experience required to use AI as a helper, but not depend on it.

Just like there is already generational gap with developers who don't understand how to use a terminal (or CS students who don't understand what file systems are).

AI will ensure there are people who don't think and just outsource all of their thinking to their llm of choice.
by leni536 | 2025-04-25 14:54:30+00:00
So Github attests that the merge was done on Github's side, but what does "commit came from a particular person" mean? Who opened the PR? Who is the author of the commits in the PR (can be impersonated)? Who are the "committers" of said commits? Who pushed the merge button?

Github doesn't put the info of who pushed the merge button into the merge commit message that it signs. I wonder what it actually attests by putting authors and coauthors into the merge commit.

edit:

The Co-authored-by fields can be trivially forged, and then Github signs it. The only question is who it acknowledges as the author. It seems to be the PR opener, from what I could gather.
by mjr00 | 2025-04-25 14:55:02+00:00
> I disagree with other posts here, it is partially a balance between security and usability.

And economics. Many people here are blaming incompetent security teams and app developers, but a lot of seemingly dumb security policies are due to insurers. If an insurer says "we're going to jack up premiums by 20% unless you force employees to change their password once every 90 days", you can argue till you're blue in the face that it's bad practice, NIST changed its policy to recommend not regularly rotating passwords over a decade ago, etc., and be totally correct... but they're still going to jack up premiums if you don't do it. So you dejectedly sigh, implement a password expiration policy, and listen to grumbling employees who call you incompetent.

It's been a while since I've been through a process like this, but given how infamous log4shell became, it wouldn't surprise me if insurers are now also making it mandatory that common "hacking strings" like /etc/hosts, /etc/passwd, jndi:, and friends must be rejected by servers.
by redwood | 2025-04-25 14:55:41+00:00
To be explicit I believe your concern is the fact that they are not requiring that the training data and training methodology they used to generate the open source model be made accessible so that anyone can essentially build the model themselves from raw ingredients right? In other words imagining for a moment that folks have access to the kind of compute necessary to do that. Right?

Nevertheless giving people a building block that they can do what they want with certainly seems like free as in freedom to me. So I personally sympathize with the OSI approach but in general I'm not a big on the zealotry around the open source community.

It's almost like we have a third category here: free as in freedom but you can't necessarily rebuild it yourself.

In practice I would argue that intellectual talent has always been a hidden part of this anyway and therefore we're being intellectually dishonest to imply that this hasn't always been a de facto reality even for traditional software.
by Imustaskforhelp | 2025-04-25 14:55:59+00:00
Cloudflare is literally magic with typescript. I swear, people like to give me that cloudflare example of gambling and show the time where their sales team messed up so hard but If we read that article, I think I can agree with Cloudflare because they were a gambling site... my gripe is that cloudflare could've been more professional, but hey mistakes happen , I genuinely hope that Cloudflare has moved on, Since if I ever create any website, any service whatever, Its most likely going to be on Cloudflare and I just hope that I don't get messed up like that guy.

And also one key thing to note is you should probably not keep the domain itself in cloudflare if you are thaat paranoid and write something in hono if you really want portability (maybe its overkill??) and if you really get messed up like the gambling blog guy then you can easily switch away...

Still ITS way too unlikely to happen I guess.
by haswell | 2025-04-25 14:56:01+00:00
This is not what I took away from the experience or what I’m trying to communicate with my comment.

I’ve elaborated in various sibling comments, but my point is closer to this: regardless of what is possible, many people simply don’t have the skills for a rapidly and drastically altered social arrangement.

To your point, people can gain those skills. Society will adapt. But the worrying thing to me is the rate of change. Whatever we can imagine about a future in which we’re not bound to our jobs, there is also the harsh reality that we have to collectively agree about an awful lot of things to get there, and that agreement isn’t happening at the same rate as technological progress.

If anything, some forms of “progress” (social media) are grinding healthy collaboration and agreement to a halt while big tech ushers in a new era of tools despite the fact that we haven’t adapted to the last major advancements.

None of this is assuming this is how things must be. It’s more about the very real problems that will come with such a transition and the fact that we’re already doing a pretty bad job of ushering in such a future in a way that is actually beneficial to people.
by thomascountz | 2025-04-25 14:56:11+00:00
They own the trademark "Open Souce Initiative," which they say you can use with no advanced written permission if you follow all specific guidelines, including:

> the use of the term “Open Source” is used solely in reference to software distributed under OSI Approved Licenses. [1]

So you can refer to any software as "Open Source," regardless of their definition. But, if you call a piece of software "Open Source" alongside the use of the Open Source Initiative's trademark, then you must also use their definition of "Open Source," unless you otherwise have written permission.

[1]: https://opensource.org/trademark-guidelines
by coldpie | 2025-04-25 14:56:26+00:00
> There is a temptation to just turn the rules off

Definitely, though I have seen other solutions, like inserting non-printable characters in the problematic strings (e.g. "/etc/ho<b></b>sts" or whatever, you get the idea). And honestly that seems like a reasonable, if somewhat annoying, workaround to me that still retains the protections.
by johannes1234321 | 2025-04-25 14:56:38+00:00
In that context it is important to differentiate Free from Open Source software.

The OSI is specifically built with a different vision from the FSF.

Free software, shall always be free, with almsource and ideally all derived works.

Open Source wants the code to be spread and for that allows inclusion with commercial software. (i.e. Microsoft was able to take open source TCP/IP stacks from BSD (BSD License) and integrate with Windows 95. That wouldn't have worked with a GPL Free Software implementation. (Even LGPL)

The supporting argument there is: By allowing that Microsoft's implementation was fully compatible to the rest of the world instead of having "bugs" (purposely?) in their own implementation, which would limit interoperability.

The free software argument is that they now took the code and closed it, not giving users a freedom to review (verify) and fix themselves. Which allowed Windows to play in TCP world instead of being an outsider.
by arnorhs | 2025-04-25 14:56:50+00:00
This looks super neat and probably a fun project to build.

> It's a nice dream, of a synthesizer where any knob can be pulled out and replaced with a patch cable, and any jack can have a knob plugged into it to set it to a fixed value. Whether it's actually practical to build a synth like this I'm unsure. It would probably only be worthwhile if you applied it to every single control on the modular, which rules out using other people's modules. You would have to invest heavily into the Eurorack Knob Idea. You couldn't even port other modules that easily, as many of them would expect a real potentiometer, whereas the encoder can only produce a voltage. Coupling it with a voltage-controlled potentiometer would work, but would be even more expensive.

Yeah, it's hard to imagine this fitting in nicely to everything since it's defintely more effort and work than just having a knob and a jack for the control of a particular thing. Esp. since most of the time, as a convention, you'll have a knob that controls the value, but when a jack is plugged in, this same knob acts as the attenuator for the signal.

I would have appreciated having an image or a pdf of the schematic for the design to understand it properly - i can get it from your github but I don't have kicad installed on this computer.

I'm esp. interested in the normalized behavior - ie. when you have a signal plugged in to the jack that is _not_ the potentiometer.. does it get passed through or does it have to go through this chip as well?

Having to supply a 3V to this to make it work as well is also an extra requirement of its usefulness in normal eurorack circuits - not a total dealbreaker but that does add extra requirements, and extra components to one's design.

Anyways... really cool idea :)
by trealira | 2025-04-25 14:56:50+00:00
> In C99, it was made expressly legal, but it was erroneously included in the list of undefined behavior annex.

In C99, union type punning was put under Annex J.1, which is unspecified behavior, not undefined behavior. Unspecified behavior is basically implementation-defined behavior, except that the implementor is not required to document the behavior.
by joemi | 2025-04-25 14:58:00+00:00
It's an interesting idea (truly a clever way to accomplish this!), but I think it's addressing the symptom, not the problem. The symptom is that some jacks don't have associated knobs. The problem is that either the module designer or the module user is overly obsessed with miniaturization. The designer is at fault if it's a parameter that really should have had a knob with the jack and they avoided including one in order to keep things small. The user is at fault if they're trying to stay so space-constrained that they can't fit a module that outputs an DC voltage set by a knob into their case. There are numerous modules that do this (and often that attenuvert as well) and many of them are fairly small too.
by flufluflufluffy | 2025-04-25 14:58:10+00:00
A company simply starts enforcing the terms of use that were being openly violated… what’s the issue here? The article claims it could stifle competition — HUh?! Cursor and others were relying on an extension created by Microsoft, now that they can’t do that, they will have to use an extension created by either themselves or another third party, increasing the use of that alternate extension. This will literally help competition. There was no competition beforehand, ppl just accepted the Microsoft extension with open arms. I really don’t know why everybody’s freaking out. You can always use a different editor, or make your own extension.
by entropi | 2025-04-25 14:58:10+00:00
It is not a binary choice between these two.

If you have ADHD, and you need to work for a living; in time, you come up with personal strategies. I found that I am able to focus on things better when I am under a lot of stress or pressure. So I actively try to put myself into these kind of situations. Or, I found that simply sitting down, removing all possible distractions, and consistently forcing myself to do a thing does work; although with severely reduced efficiency i.e. sit down 4 hours, get 1 hour of work done with ~20 internal interruptions. But it does get done.

These are rather exhausting things to be doing all the time. So you always work hard at working. But you don't get consistent results. If you work harder at working, you get less inconsistent results. My point was that its often worth it.
by mrj | 2025-04-25 14:58:17+00:00
This was what happened to us, we were a small company and were just buying Dells with Windows already installed. We had valid license keys from the factory on everything, so it didn't make sense to me that we needed some volume key for more Windows. So we didn't buy a volume license but still got the audit demand.

Microsoft was double-dipping for a long time, selling volume licensing deals to companies that were often buying preinstalled Windows anyhow, just out of fear of non-compliance. Then once you have the volume deal, Microsoft products become easier to use and dominate the company's tech and reaching new deals with Microsoft becomes a nice-business-you-got-there-shame-if-something-happened-to-it kind of conversation.

Microsoft hasn't changed a bit, just smarter about tactics.
by slightwinder | 2025-04-25 14:58:36+00:00
> This is the paradox of the post social media world. I see a lot of mid-tier talent—in all sorts of disciplines/industries—being elevated, while what I personally consider the "greats" get a fraction of the attention (e.g., this designer who I love and have bought stuff from but seems to be a relative unknown [1]).

Attention comes mainly from understanding. And all people are in the mid to low-tier of understanding things outside their own specialization, and too often even within their own specialization.

So to understand something great, you have to have enough insight into that area to see the greatness. And on the other side, there is also the false perception of thinking something is great, while you are just too low in your understanding, to see why it's just mid. Isn't this also basically what Dunning-Kruger-effect is about?
by Xmd5a | 2025-04-25 14:58:40+00:00
Indeed but the idea that this is a "cope" is interesting nonetheless.

>Your test is only testing for bias for or against [I'm adapting here] you.

I think this raises the question of what reasoning beyond Doxa entails. Can you make up for one's injustice without putting alignment into the frying pan? "It depends" is the right answer. However, what is the shape of the boundary between the two ?
by algorithmsRcool | 2025-04-25 14:59:11+00:00
If I understand correctly the "big idea" here is:

1. Juice up your Traces with every attribute possible 2. Use a telemetry backend that relies on cheap object storage so that your costs don't explode. 3. ...profit?

Ok, but now we are exporting and storing everything about every request just so we can derive some previously cheap metrics like server CPU consumption? I guess for most applications the overhead of buffering, formatting and sending all of this telemetry data doesn't matter for folks?
by amboar | 2025-04-25 14:59:24+00:00
Section J.1 _Unspecified_ behavior says

> (11) The values of bytes that correspond to union members other than the one last stored into (6.2.6.1).

So it's a little more constrained in the ramifications, but the outcomes may still be surprising. It's a bit unfortunate that "UB" aliases to both "Undefined behavior" and "Unspecified behavior" given they have subtly different definitions.

From section 4 we have:

> A program that is correct in all other aspects, operating on correct data, containing unspecified behavior shall be a correct program and act in accordance with 5.1.2.4.
Show HN: Zenkan – Drag and drop your notes in flexible nested boards
by peti_poua | 2025-04-25 15:00:09+00:00
Zenkan is a personal note-taking app with a 3-level nested board system. You can drag, resize, and arrange your notes and tasks in a flexible canvas with Markdown support (H1/2/3 titles, center text, code blocks, etc) for rich text formatting.

I created this app because I found myself a bit overwhelmed with Notion's complex and rigid databases (especially their kanban view), while also thinking that Google Keep was not structured enough for my needs.

Zenkan is a bit in the middle, I tried my best to add a nice drag-and-drop feel to it (also some satisfying sounds) while enforcing a nested structure for the cards. Zenkan can serve both as a Kanban for tasks and as a way to group related notes in a very visual way.

Let me know if you have any questions or suggestions!
by cjbgkagh | 2025-04-25 15:01:00+00:00
It’s a very natural progression - an emergent behavior from an aversion to empathy so it’s pretty much pervasive. Generally people think you’re faking it because you look healthy and it’s almost a dare to say if it was really as bad as you’d say surely you’d just prefer to die.

My favorite examples are from people who believe they have a cure all, going for walks, vitamin C injections etc. Then when let them know it doesn’t work, you’ve tried it, it makes you sicker etc they’ll blame you for not doing it right and being difficult on purpose.

It really doesn’t help when the state is quick to diagnose people with hypochondria, and there is the catch-22 of if didn’t manage to fill out the proper forms you don’t have the condition but if you did then that’s a sign you don’t have the condition. And even if you are correctly diagnosed they don’t help, the doctors will push their pet cures like exercise. My aunt had what little quality of life she had left destroyed by doctors requiring her to exercise to keep her disability.

If you complain about a lack of disability support potentially sending you homeless they think they’re helping by suggesting another option you may not have thought of.

I’m very fortunate that I’m well off enough I don’t have to deal with the state and I manage my own health much better than the doctors could. But it happens to people I know and in many cases people who do take up the option do let others know that the reason they’re doing it is because they can’t afford to live anymore and homelessness is practically a death sentence anyway.

And even worse there are a number of fairly effective treatments but few people know about them because of the way medical science works. I was early on the use of GLP1-As and thank goodness that’s now going widespread in patient communities and even doctors - though I think doses should be kept very low. Off label use of GLP1-As for autoimmune disorders, including many mental health issues, is going to be absolutely huge.
by whs | 2025-04-25 15:01:46+00:00
I use public LLM the same way I'd use a search engine - to search public information only and never proprietary data. With Gemini in Google Workspace that can be used for proprietary information, but of course only if Gemini suits the tasks.

As for coding model my view is they're directly violating my copyright, especially that I checked some "open training data" corpus that it does confirm that my code is part of the corpus without honoring the license.
by sarah-brussels | 2025-04-25 15:02:03+00:00
A clean tie can also be super helpful! If you are say...choosing between two ties, and you get a 6/6 verdict you know they are equally good (or bad!) But thank you for commenting and reading my post...(not sure if you tried or not, but thank you if you did!) I'm sentimentally attached to 12, but like other things on JuryNow, I've learned to let go these past weeks! I wanted there to be no 'skip a question' option, and no chance of doing JuryDuty without a question, but have embraced the overwhelming feedback on both those!!
by canucker2016 | 2025-04-25 15:02:31+00:00
Later in the article, it mentions:

Improved experimental support for C++23, including: std and std.compat modules (also supported for C++20).

From https://developers.redhat.com/articles/2025/04/24/new-c-feat...:

The next major version of the GNU Compiler Collection (GCC), 15.1, is expected to be released in April or May 2025. GCC 15 greatly improved the modules code. For instance, module std is now supported (even in C++20 mode).
by myrmidon | 2025-04-25 15:02:40+00:00
It would not hurt, but this just makes no (economic) sense currently, and that's not gonna change any time soon.

Right now we don't have any CO2 scrubbing process without significant maintenance or operating costs, so this would add significant cost to all those ACs. Furthermore, the effect is marginal: With emissions of >6 tons of CO2/year/human, you would have to scrub a lot of air (>10m³/min with cost-free 100% efficiency, which is a pipedream) to compensate (for a single human); running the ACs on full flow all the time might not even be worth it depending on how efficient the scrubbing is and how clean the source of electricity.

You might say scrubbing clean 10m³/min of air for every human sounds kinda feasible, but just compare the realistic cost of such a setup to the options that are currently implemented, and how much popular resistance/feet dragging they already meet (renewables, nuclear power, electrification, CO2 taxation).

As a general benchmark, I would suggest that before the scrubbing technology in question has not managed to be installed at most major stationary sources of CO2 (coal/gas power plants, etc), it is not even worth discussing it for distributed air scrubbing.