MurphyA/hacker-news huggingface dataset:
by Arch-TK | 2025-04-16 10:32:49+00:00
The substantial differences are in terms of restrictions to postscript to reduce it to a declarative language rather than a full fledged programming language.

A PDF is a collection of isolated, restricted postscript programs (content streams) and the data required for rendering stuffed into one file. The overarching format is a subset of COS. But for all intents and purposes you can imagine this as a tarball containing postscript and other data.

The transformations required to go from PDF to postscript amount to:

1. Include some boilerplate

2. Pull out the content streams (postscript bits) ignoring the pdf-specific extensions

3. Search and replace the names of two procedures

4. Pull out the data required for rendering, optionally decompressing it if your postscript output doesn't support the particular compression in use

5. Concatenate all the data in the right order (on the basis of some metadata in the format)

6. It's now just normal postscript
by munksbeer | 2025-04-16 10:33:06+00:00
> I don't even think it'll be from terminators and nuclear wars and that sort of thing

I do. And I don't even think the issue is a hostile AI. There are 8 billion people in the world. Millions of those people have severe mental issues and would destroy the world if they could. It seems highly likely to me that AI will eventually give at least one of those people the means.
by MrJohz | 2025-04-16 10:33:20+00:00
In fairness, `className` makes a lot of sense given that the native DOM uses the `className` attribute rather than `class`. In that sense, it's a consistent choice, just a consistent choice with the DOM rather than with HTML.

The bigger issue is the changes to events and how they get fired, some of which make sense, others of which just break people's expectations of how Javascript should work when they move to non-React projects.
by jeroenhd | 2025-04-16 10:35:12+00:00
This is a chance for the EU to step up and take over. If the US government won't pay for the CVE program, the EU surely could. Many EU countries already run a program like this to server their own interests, and I believe the EU does as well.

If the US is willing to give up influence and control over the cybersecurity sector, we should accept that gift and use it to our advantage.
by jiggawatts | 2025-04-16 10:38:25+00:00
I just got a flashback to trying to automate the certificate issuance process for some ESRI ArcGIS product that used an RPC configuration API over HTTPS to change the certificate.

So yes, you had to first ignore the invalid self-signed certificate while using HTTPS with a client tool that really, really didn't want to ignore the validity issue, then upload a valid certificate, restart the service... which would terminate the HTTPS connection with an error breaking your script in a different not-fun way, and then reconnect... at some unspecified time later to continue the configuration.

Fun times...
Ask HN: How does Cursor make money? Please ELI5
by abacussh | 2025-04-16 10:38:58+00:00
Cursor's Pro plan offers 500 "fast" GPT-4 level requests + unlimited "slow" requests for $20/month. I'm struggling to see how this is sustainable given LLM API costs.

A rough estimate for just the 500 fast requests:

Assume ~1,200 tokens/request (modest input/output). Total: 500 * 1,200 = 600,000 tokens/month.

Using even cheaper modern models like GPT-4o (~5/15 per M tokens), this is ~5/month. Using older GPT-4 models (30/60 per M) would push costs well over 20.

This basic calculation doesn't include: The cost of unlimited slow requests, Infrastructure, overhead, R&D, Longer context usage typical in coding.

How can Cursor offer this at $20/month? What's the likely strategy here? Seems like the raw API costs alone could easily approach or exceed the subscription fee for many users. What am I missing?
by Retric | 2025-04-16 10:39:51+00:00
> Homophobia isn't lying, it's an opinion/ judgement

The lies about gay people are actual lies, even if they come from homophobia.

Luring people into gayness, crap about destroying the institution of marriage etc etc.

> SS tax is a tax on your income, "Income Tax" is a type of tax. Both are true

When taking about “tax burden,” there’s no excuse around the names. I’ve got little interest in digging up 20 year old clips, but you’re 45 you should remember that phrase.
by sleyn_ | 2025-04-16 10:40:21+00:00
Hey HN,

I made Droidrun, an open-source tool that lets AI agents execute tasks directly in Android apps by mimicking human interaction.

It allows you to build agents that interact with Android UI elements using natural language prompts or goals.

I created a layer that simplifies Android app interaction for LLMs by analyzing the UI structure and identifying interactive elements like buttons and input fields (using Accessibility Services).

This enables you to design custom mobile app automation and scraping functions without needing specific APIs or complex reverse engineering. Hasn't mobile automation been done a lot of times? Good question.

While tools exist for testing (like Appium), Droidrun focuses on enabling flexible AI agent control across any app.

I think a lot of people are going to try to make their own mobile agents from scratch, so the idea is to provide the groundwork/library for the hard parts, so developers don't have to repeat these steps: Parse Android UI structure in an LLM-friendly way (identifying elements, states, descriptions). Provide robust primitives for interacting with any UI element (taps, swipes, text input).

Create reusable components for mobile agent perception and action.

The vision: create repeatable tasks across Android apps just by giving your agent a goal, without worrying about the specific UI steps. To better showcase the power of direct UI interaction, I made a few demos:

Droidrun explainer:

Video Link: https://x.com/droid_run/status/191244635898166087

Droidrun posts 'Hello world' on X:

Prompt Idea: Open X -> Press post -> New Post -> Insert 'Hello world' -> Post Video Link: https://x.com/droid_run/status/1910714055251157141

Droidrun finds cat videos on TikTok & comments:

Video Link: https://x.com/droid_run/status/1911769757956665478

I’d like feedback on how this tool fits into your mobile automation or AI agent projects.

Try it out (GitHub: https://github.com/droidrun/droidrun) and let us know how it performs on your end.

Our website if you need more information: droidrun.ai

We are a team of four members and just open-sourced this after getting great initial interest (900+ waitlist signups after 72 hours!).
by nkoren | 2025-04-16 10:40:27+00:00
I've been doing AI-assisted coding for several months now, and have found a good balance that works for me. I'm working in Typescript and React, neither of which I know particularly well (although I know ES6 very well). In most cases, AI is excellent at tasks which involve writing quasi-custom boilerplate (eg. tests which require a lot of mocking), and at answering questions of how I should do _X_ in TS/React. For the latter, those are undoubtedly questions I could eventually find the answers on Stack Overflow and deduce how to apply those answers to my specific context -- but it's orders of magnitude faster to get the AI to do that for me.

Where the AI fails is in doing anything which requires having a model of the world. I'm writing a simulator which involves agents moving through an environment. A small change in agent behaviour may take many steps of the simulator to produce consequential effects, and thinking through how that happens -- or the reverse: reasoning about the possible upstream causes of some emergent macroscopic behaviour -- requires a mental model of the simulation process, and AI absolutely does _not_ have that. It doesn't know that it doesn't have that, and will therefore hallucinate wildly as it grasps at an answer. Sometimes those hallucinations will even hit the mark. But on the whole, if a mental model is required to arrive at the answer, AI wastes more time than it saves.
by jeroenhd | 2025-04-16 10:41:38+00:00
It's a program the US government spun up to serve America's interests. Why would someone else pay for American interests?

Other countries have their own programs, some cooperating with the US, others separate. China has the CNNVD if you're interested in helping Chinese society safe. My government operates https://advisories.ncsc.nl/advisories to serve my country's interests.

Of course, the US is free to abandon their programme and rely on Chinese, Russian, and European vulnerability databases to keep their country safe. It does save them a couple of million after all!
by bayindirh | 2025-04-16 10:42:28+00:00
I think you were trying to reply to me.

I'm not a web developer, and I don't do anything similar on my pages, blog posts, whatever, so I don't know.

The only non-predatory way to do this is to being honest/transparent and don't pulling tricks on people.

However, I think, A/B testing can be used in a non-predatory way in UI testing, by measuring negative comment between two new versions, assuming that you genuinely don't know which version is better for the users.
by theshrike79 | 2025-04-16 10:43:07+00:00
LoRa is optimised for low power usage and range. Not for moving 1TB 4k videos over the air.

So if you want to move your home videos from one place to another, or if you want to have a wireless security camera with 1080p streamed video, it's the wrong choice.

But if you want to have a battery powered motion detector + environment sensor in an off grid shed 1km that way, LoRa is perfect for that.

For example: I have a Meshtastic device in my car with a small 18650 battery + plugged in to the car's USB that charges it when it's turned on. It reports the car's location and internal temperature to a Meshtastic channel. It also works as a router so if I'm inside a store with my T1000-E, it can't reach the local relay, BUT it can reach my car, which in turn can reach the relay, which again is in range of my home node - which is connected to Home Assistant.

Yes, I could just send an IM, but where's the fun in that? =)
by jodrellblank | 2025-04-16 10:43:26+00:00
The other side of that is offering a ‘basically’ version out of respect for the listener, assuming they have more important things to do than listen to a detailed nerd-rambling of something they aren’t interested in. Listener/speaker can expand on the details or ask questions later, if needed.

It’s possible to mean it either way, or to hear it and interpret it either way.
by bsenftner | 2025-04-16 10:45:00+00:00
It is damningly simple, the root cause beneath far too many issues our advanced civilization faces: we have a global adult immaturity issue, species wide. The leaders that are crony capitalist and widely populist are in truth terribly immature public figures. Our incredibly short sighted (also an immature behavior) news and analyst media pretends to be adult while never really having any solutions that are not plain school yard bullying and tribe glorifying. And the public is only allowed outsider fringe opportunities to include their voice in these public non-debates. We do not produce adults anymore, we produce a civilization of Lindsay Lohans that think they are adult men and women.
by eadmund | 2025-04-16 10:45:00+00:00
> the very elegant GraphQL

The GraphQL which ‘elegantly’ returns a 200 on errors? The GraphQL which ‘elegantly’ encodes idempotent reads as mutating POSTS? The GraphQL which ‘elegantly’ creates its own ad hoc JSON-but-not-JSON language?

The right approach, of course, is HTMX-style real REST (incidentally there needs to be a quick way to distinguish real REST from fake OpenAPI-style JSON-as-a-service). E.g., the article says: ‘your client should be able to request all data for a specific screen at once.’ Yes, of course: the way to request a page is to (wait for it, JavaScript kiddies): request a page.

The even better approach is to advance the state of the art beyond JavaScript, beyond HTML and beyond CSS. There is no good reason for these three to be completely separate syntaxes. Fortunately, there is already a good universal syntax for trees of data: S-expressions. The original article mentions SDUI as ‘essentially it’s just JSON endpoints that return UI trees’: in a sane web development model the UI trees would be S-expressions macro-expanded into SHTML.
by h2onock | 2025-04-16 10:47:06+00:00
> Personally speaking, I've never cared whether someone "validates" my emotions (and I often view such attempts as a bit patronizing or insincere). There's a problem to be solved, so let's attempt to solve it or at least compromise in good faith. The resolution to the problem is the most likely way to elicit positive emotions from me anyway.

It is so refreshing for me to read this because that's how I feel a lot of the time. I actually don't want someone to say "I understand where you're coming from", if they don't. That happens often in professional life and nearly always feels insincere. I'd much rather someone asked for clarification or for me to expand on what I've already said so that they can actually understand my viewpoint so that they can consider if properly before pushing through their "better" idea.
by ndsipa_pomu | 2025-04-16 10:49:04+00:00
Arresting someone and filing charges to be heard in a court is a normal thing to do (not that I agree with Assange's arrest).

Grabbing someone off the street and sending them to a foreign prison without any evidence whatsoever that they have committed any crimes, without any charges being brought and without any chance for the person to defend themselves is clearly not deportation but is an illegal kidnapping.
by pron | 2025-04-16 10:50:16+00:00
It's important to remember that government debt doesn't ever need to be repaid, sort of how an immortal man could indefinitely refinance loans. That he'd have to borrow again to repay the old loans (while maintaining the debt) is part of the mechanism. Such an immortal could have his debt grow indefinitely and still be fine as long as lenders believe he'll be able to afford paying the interest and that other lenders will be willing to refinance the loans when they expire.

That's not to say that government debt couldn't become a problem, even a serious one, but as long as the economy grows fast enough to support the interest payments, it's not an "existential problem". The danger isn't so much the debt itself but in the confidence in the US economy falling below the level required to sustain that debt.

I loan the US government money by buying treasury bills because I trust that when they mature, others would be willing to lend the US money. When this trust in the health of the US economy declines, then there's a problem with the debt, but then there are also other big problems. What you'll see is rising interest rates that is likely combined with an unpromising economy, and yeah, that's a serious problem. A high debt could definitely exacerbate it (and that's why it's helpful to slow down the growth of the debt or even reduce it if possible), but it's not its cause.
by filiph | 2025-04-16 10:50:23+00:00
I think I was looking at this and several other similar calculators when creating the linked tool. This is what I mean when I say "you'll want to use something more sophisticated".

The problem with similar tools is that of the very high barrier to entry. This is what my project was trying to address, though imperfectly (the user still needs to understand, at the very least, the concept of probability distributions).
by b3lvedere | 2025-04-16 10:51:07+00:00
90% agree with this , with the little caveat that law and regulation always are a couple of steps behind huge innovations. Unfortunately sometimes companies think this gives them freedom to break current laws and regulations.

Your thought experiment reminded me a little of the Kurzgesagt video on how to debunk an internet conspiracy in seconds: https://www.youtube.com/watch?v=Hug0rfFC_L8
by gnfargbl | 2025-04-16 10:51:22+00:00
This kind of a consortium needs to explicitly avoid being captured by both the product vendors (who could be incentivised to manipulate the CVE issuance process to support their own remediation timescales), and by security companies (who could be incentivised to obtain a competitive advantage via preferential access to the CVE database).

It isn't impossible for a commercially-funded organisation to avoid this kind of capture, but it isn't easy either. My mind immediately jumps to the relationship between the Mozilla Foundation and Google.
by surgical_fire | 2025-04-16 10:51:34+00:00
Agreed. Those who don't care about politics are doomed to be ruled by those who care.

Moreover, avoiding politics is impossible. It's all around you. Labor, entertainment, food, housing. Burying your head in the sand will only get you to have your ass in the air.

Maybe "be polite" should be a better rule than "avoid politics".
by bayindirh | 2025-04-16 10:51:54+00:00
I can't answer the first part, since I'm not playing any modern games, but continuously visit RTS games like C&C & Starcraft series.

However, I can talk about monitors. Yes, a 27" 4K@60 monitor is really, really good, but panel quality (lighting, uniformity and color correctness) goes a long way. After using Dell and HPs "business" monitors for so long, most "normal monitors for normies" look bad to me. Uncomfortable with harsh light and bad uniformity.

So, the monitor quality is not "finished" yet. I don't like OLEDs on big screens, because I tend to use what I buy for a very long time, and I don't wany my screen to age non-uniformly, esp. if I'm looking to it everyday and for long periods of time.
Ask HN: Should every country have their own national CA certs?
by mohi-kalantari | 2025-04-16 10:51:57+00:00
We have so many regulations that force companies to store their customers’ data within the country, which makes sense from a perspective of privacy and security.

How do you feel about having a national CA certificate in every country?

How would someone feel living in authoritarian governments, knowing that the government can easily intercept and read many things?

How would a country feel that all the data of its people can be decrypted by another company? (most of the CAs are in the USA)
Show HN: Maps Can Lie. Earth Doesn't – See How Flights Travel
by foru17 | 2025-04-16 10:52:16+00:00
I built a tool showing the dramatic difference between flight paths on traditional flat maps versus their true trajectories on a 3D globe. Maps Can Lie. Earth Doesn't. This visualization reveals how our mental model of air travel routes is often distorted by map projections, and helps users understand the actual paths planes take around our planet.
by phtrivier | 2025-04-16 10:52:34+00:00
Because, contrary to popular views, there is no "government of the world".

So, since the US government needed that (it provides security to US businesses), they organised and funded it (as everything else, with US taxpayers money, and savings from investors in US and abroad.)

Now, the US government decided to commit temporary-seppuku, so a number of things will happen:

* state-level government will use their local-taxpayer money to fund similar efforts (with duplication of effort), or share it with everyone

* another country or block of country will do it, and decide whether they want to "share". (I suppose Russia and China have more of an incentive to keep their CVE DB private, given their level of dis-integration with US economy ? EU maybe ?)

* an international, ad-hoc organisation is created to share the funding (something like NATO.) Multi-latteralism is not exactly in fashion this days, but if EU does it, it will be "international" by design since we're not really a federation ; so, states in "Southern Canada" are welcome to join.

* or none of that happens, the CVE db rots for a while, until a sufficiently embarrassing cybersecurity problem occurs, and the CVE db is deemed worthy of the "10% you need to bring back" by President Elon.

Pray your company, families and friends are never on the wrong side of the "reverse-Chersteron's fence".
by simgt | 2025-04-16 10:52:43+00:00
There is no dissonance here, workers being put in competition with much cheaper ones on the other side of the planet is absolutely going to drive their wages down. They got 30 years of that... and many of us in Europe did too.

Wages may have to go higher at the lower end, but consumption also needs to change. Most of the price of "food" is packaging, transport and marketing, not farmers' wages. Here in France people buy on average 50 items of clothing a year, 50! The amount of items has increased by 50% in the last 15 years.
by pjmlp | 2025-04-16 10:53:12+00:00
1. There are other approaches to this with templates and concepts, and as added bonus, stronger type checking.

Thankfully regarding 2., Google went the extra mile to pay for removing them from the Linux kernel, and they were made optional C11 onwards exactly because they are an attack vector.

3. It is called stronger type safety, ridiculous is the C community still approaching computers as if writing K&R C.
by filiph | 2025-04-16 10:53:47+00:00
Nice! Are you using your python script often?

The reason I'm asking: unsure also has a CLI version (which is leaps and bounds faster and in some ways easier to use) but I rarely find myself using it. (Nowadays, I use https://filiph.github.io/napkin/, anyway, but it's still a web app rather than a CLI tool.)
by HelloNurse | 2025-04-16 10:53:55+00:00
Rules can be clumsy, and information has different purposes. Typically, the generic and concrete concerns of keeping related files together and under source control is a much better match for the use of meaningful file names and directories than using the files for a specific purpose like compiling some build target; this makes globbing a cheap shortcut, replacing explicit specification of how to use files, except for special dynamic cases where file names are actually unknown.

As an example of file system and build system disagreeing, what if you start writing a new source file that you don't want to compile and link until it's ready and needed? If globbing file names is the source of truth, either the uncompilable draft of your new file has to be placed in some inconvenient alternate location where the build system doesn't pick it up, and later moved to a regular source folder, or it breaks the build until you waste enough time to hack together something that can be compiled (or even compiled and linked).

An IDE can use actual file lists and its internal project configurations to manage file references in build scripts (e.g. silently updating build scripts when files are renamed or moved or offering a good UI to add source files to build targets).
by shelled | 2025-04-16 10:53:58+00:00
You don’t "read" audiobooks. You listen to them. Big difference - not better or worse, just not the same. When it comes to listening, I Love podcasts - esp. with multiple hosts/guests. Solo ones work too, if they feel like conversations and not recitals.

Audiobooks are not for me. I’ve tried. Reading hits different. But sure, for self-help, productivity, coding and shit you need to use them, so you use them. Interestingly, the biggest audiobook junkies I know are also heavy readers. They know the difference—and they don’t mix the two.
by Ambroos | 2025-04-16 10:54:36+00:00
Internally at Facebook you could also just call React components from XHP. Not very relevant on what you see on Facebook now as a user, but in older internal tools built with XHP it made it very easy to just throw in React components.

When you'd annotate a React component with ReactXHP (if I remember correctly), some codegen would generate an equivalent XHP components that takes the same props, and can just be used anywhere in XHP. It worked very well when I last used it!

Slightly less related but still somewhat, they have an extension to GraphQL as well that allows you to call/require React components from within GraphQL. If you look at a random GraphQL response there's a good chance you will see things like `"__dr": "GroupsCometHighlightStoryAlbumAttachmentStyle.react"`. I never looked into the mechanics of how these worked.