MurphyA/hacker-news huggingface dataset:
by bbsz | 2025-04-18 17:10:05+00:00
Author here,

No, they didn't. Not in this case. That's not to say they wouldn't at some point. In some of the previous cases we dealt with, North Koreans were obsessively trying to get write access to CI/CD from the repo owners. They will also try to get your PAT tokens if possible. Similarly, any other access tokens (AWS etc.). We had one case where malicious npm dependency was injected after few months of regular work.

DPRK IT Workers focus is not hacking, it's:

1. Getting paid (The quality of work is variable, sometimes they are not that bad, but most of the time they are basically stubborn junior devs)

2. Then, stealing secrets to exfiltrate to actual DPRK hackers

3. Then, credibility building, so they could return to your co-workers with a job offer or some repository code with an "issue to debug" and force you to open code/attachments.

They will also recommend each other for jobs. If you'll hire one and signal that you want to hire more, they will invite their "friends". In some organizations this can go as high as 3 to 5 DPRK IT Workers for the 10 people team.
by freedomben | 2025-04-18 17:10:38+00:00
Yes, to be clear I'm not suggesting they have pure motives, nor am I suggesting they don't deserve the criticism. You are reading into my statement things that aren't there.

What I'm saying is that's irrelevant to the claim they are making. It is an ad hominem, which is a formal logical fallacy and has been for a very long time (going back well over 2,000 years)[1]. It didn't used to be controversial to say that ad hominem was a fallacy.

Are you disagreeing with me that the above is ad hominem? Or that ad hominem is a fallacy?

Wouldn't it be much better to just refute the claim instead of attack the person's motives? I.e. I think it's pretty damn easy to demonstrate that non white men have been great leaders who have gotten things to work. Refuting that claim is the non-fallacious approach and may actually convince someone honest (likely some third-party who is reading it later, you'll probably never convince the original speaker).

[1]: https://en.wikipedia.org/wiki/Ad_hominem
by steveklabnik | 2025-04-18 17:11:10+00:00
> People want to be able to specify partial borrowing in the signatures.

That's correct. That's why I said "Some people want to relax that restriction. I personally think it's a bad idea."

> The usual pattern in C++ etc is to just have a giant "GrahpicsState" struct that contains all the data you need. Then you just pass a reference to that to any function that needs any state.

Yes, I think that this style of programming is not good, because it creates giant balls of aliasing state. I understand that if the library you use requires you to do this, you're sorta SOL, but in the programs I write, I've never been required to do this.

> So instead you end up with 30 functions that each take 20 parameters and return 5 values, and most of the code is shuffling around function arguments

Yes, this is the downstream effects of designing APIs this way. Breaking them up into smaller chunks of state makes it significantly more pleasant.

I am not sure that it's a good idea to change the language to make using poorly designed APIs easier. I also understand that reasonable people differ on this issue.
by grumio | 2025-04-18 17:11:28+00:00
> The media pretends that everything is uniquely bad when Trump happens to do it and they turn a blind eye to Democrats doing the exact same stuff. It is exhausting to argue with people who refuse to understand this hypocrisy happening right before their eyes.

Got it. Did Clinton try to gain the presidency despite losing? Did she ask the vice president to "do the right thing" and throw out electoral votes?

That's what Trump did.

They did not do the "exact same stuff".
by itsanaccount | 2025-04-18 17:12:38+00:00
Article: I didn't care about a corporation restricting people's freedom until it hurt me.

Comments: Its not the corporation, its the government. Its not the corporation, its just the way things are. Its ok the corporation restricts freedom, everything is a tradeoff and everyone does this. Gollygee I hope this gets better.

real elevating curious conversation here /s that never self reflects, is our culture of software making the world worse? will one day our intentional naivety around power fail to protect us from that truth?
by rjurney | 2025-04-18 17:12:48+00:00
I am building a knowledge graph using BAML [baml-py] to extract documents [it's opinionated towards docs] and then PySpark to ETL the data into a node / edge list. GPT4o got few relations... Gemini 2.5 got so many it was nuts, all accurate but not all from the article! I had to reign it in and instruct it not to build so vast a graph. Really cool, it knows a LOT about semiconductors :)
by CharlesW | 2025-04-18 17:13:02+00:00
"That One Time It Powered a Genocide" is just an older example of how IBM is happy to put profit over principles. They have a long history that includes happily selling to authoritarian regimes¹, knowingly selling technology that doesn't work², commercializing biometric data without consent³, age discrimination, and more.

¹ http://www-cs-students.stanford.edu/~cale/cs201/apartheid.co... ² https://www.healthcaredive.com/news/stat-ibms-watson-gave-un... ³ https://www.cnet.com/tech/computing/ibm-stirs-controversy-by...
by pvg | 2025-04-18 17:13:03+00:00
A lot of repetitive discussions of tech things get moderated all the time as well, you can just email them in and the moderators sort them out. There's a lot of mod commentary on how things like releases, feature updates, 'launch week' etc are handled, one recent example

https://news.ycombinator.com/item?id=43129444
by yjftsjthsd-h | 2025-04-18 17:14:14+00:00
It's probably intuitive to anybody who's tried to do this the hard way, but if your target is people without that experience, you might want to dumb it down even more. So this is from your readme:

attune repo create -u 'http://localhost:9000/debian' -d bookworm attune repo pkg -r 1 add -c stable/v17 ~/Downloads/teleport_17.4.4_arm64.deb

And I think I know what `-d bookworm` must be, but I've no clue what -r or -c are doing in the second command.

Also, from your post here (and why are the quick start steps different here?),

attune repo create --uri https://apt.releases.example.com

What is that URI supposed to be? Is that where the thing will eventually get served from and I have to run this on the server, or synchronize an output directory to the server, or is that going to do some sort of magic upload itself?
by thewebguyd | 2025-04-18 17:14:26+00:00
> My gut feel here mostly has to do with how I view the activity overall. Smoking I see as a social ill that both adults and children would be better off without, so I don't particularly mind an ID check that inconveniences adults, and that can be opted-out from by simply not smoking. (Social media I see as pretty akin to smoking.)

The big difference for me is, the person looking at my ID at the gas station isn't storing all the data on it in some database, which may or may not be properly secured.

If age verification can be done ephemerally, then I think it's largely a non-issue. But of course it won't, you'll have to submit some combo of personal info + a photo or face scan, and that information will be stored by any number of third parties, probably permanently, only to end up in the next data breach.

There's also an issue of anonymity, which is increasingly under attack on the web. Even in the gas station example, while I'm not truly anonymous when I buy alcohol, the gas station attendant likely isn't going to remember me or my name, and it's certainly not being stored along side an entire customer profile.

For services on the web, we need a similar level of privacy with the age verification, otherwise it's not just age verification it's identity verification as well (and by extension, the tying of all of your activity on that service directly to you) which I do have a big problem with.

If we want age verification online, we have to have a way to do it ephemerally and psuedo-anonymously.
by whitehexagon | 2025-04-18 17:14:55+00:00
Hah, indeed, a similar experience here. The desktop option is worse, trying to get a webcam to focus on an ID card took forever. The next step wanted a 3rd party company to do a live webcam session, no thanks! Closed the account. Or at least tried, after a several step nag process, they still keep the email blocked to that account, in case you change your mind...

There seems no way to push back against these technologies. Next it will be an AI interview for 'why do you transfer the money?'
by ChuckMcM | 2025-04-18 17:15:02+00:00
A small bit of historical context. When I was participating in the PKP meetings at RSADSI, I believe it was Ron who insisted that DER was the only reasonable choice if we were going to encode things with ASN.1 (which we were because both DEC and RSA had already insisted that it had to be OSI compatible or they wouldn't support it, my suggestion that we use Sun's XDR was soundly rebuked, but hey I had to offer)

Generally it was presumed that because these were 'handshake' type steps (which is to say the prelude to establishing a cryptographic context for what would happen next) performance wasn't as important as determinism.
by kjkjadksj | 2025-04-18 17:15:36+00:00
A big part of why college towns work so nicely is economic circumstances of the student body. Simply put most students aren’t bringing a car to campus and by definition now need to live somewhere closer to get to class. And on top of that the town is a monocrop where maybe the couple tens of thousands of kids are the vast majority of the population.

This is why it can’t really play out as nicely everywhere. You might work across town from your partner vs merely across campus, or in another town. Your location is compromised by definition and not benefiting from economies of scale like it was when it was at least compromised with another 40k people in your demographic with a similar commute and life pattern within 2 square miles. And you don’t have to pay a couple thousand a year for parking privileges either so you might be taking the car on trips that would have been a forced walk in college for lack of car.

The disneyland point is a bit tired and worn imo among internet urbanists and doesn’t even make sense in practice if you’ve ever been to disneyland. Main street isnt the draw. It is this strip of shops you are obligated to walk through as you enter the park to try and tempt you from your dollar. You can’t even hang out there; all the shops are packed with people looking at merchandise, all the restaurants on main are like coffee and ice cream “please leave and keep walking” places, and during fireworks display it is a miracle and a testament to the staffing that there isn’t a crowd crush from people leaving through the bottleneck as well as people staying to see fireworks framed with the castle. In these situations they actually open up a staff only alley to the public that is parallel to main street to relieve some of this bottleneck.
by philipkglass | 2025-04-18 17:16:35+00:00
The article popped up a login-wall but I was able to bypass it with a quick refresh and switch to Reader Mode. It's a short article:

Chinese scientists have achieved a milestone in clean energy technology by successfully adding fresh fuel to an operational thorium molten salt reactor, according to state media reports.

...

The development was announced by the project’s chief scientist, Xu Hongjie, during a closed-door meeting at the Chinese Academy of Sciences on April 8, the official Guangming Daily reported on Friday.

The experimental reactor, located in the Gobi Desert in China’s west, uses molten salt as the fuel carrier and coolant, and thorium – a radioactive element abundant in the Earth’s crust – as the fuel source. The reactor is reportedly designed to sustainably generate 2 megawatts of thermal power. ...

A reactor with a thermal power output of 2 megawatts is a long way from a commercial power reactor. A modern Chinese power reactor has a thermal output of over 3000 megawatts (over 1000 megawatts electrical output):

https://pris.iaea.org/PRIS/CountryStatistics/ReactorDetails....

2 megawatts is actually smaller than the original molten salt reactor experiment at Oak Ridge National Laboratory, which had a 7.4 MWth output:

https://en.wikipedia.org/wiki/Molten-Salt_Reactor_Experiment

Still, it's good to see another country reviving experiments with this technology.
by oezi | 2025-04-18 17:16:51+00:00
Your arguments are a bit all over the place for me to follow. I don't think it is kicking down the can if you don't have enough information to not get to much into panic mode.

If this turns out to be an issue we can act. At the moment it looks like it to me that the climate crisis is more relevant than the demographic change, because as you said: Less people are actually better for the planet.

With AI becoming more capable each year we might find that many of the issues of large elderly populations can be alleviated.

Let's check back in 5 or 10 years if the demographics is really shaping up to be a problem.
by xixixao | 2025-04-18 17:16:56+00:00
I’m traveling through Puerto Rico. On every nice beach, when there are people, they are playing loud music. Now that is part of the local culture. To me (a European), it is abhorent, ruining the supposedly relaxing atmosphere of a beach (even more so that the music to me seems extremely repetitive).

I could not convince anyone here to stop doing this. Again, for locals, this is their culture.

Similarly, I don’t think most Americans can grasp the difference between American cities (including in Puerto Rico) built for cars vs for pedestrians. Most will argue (including here), that this is a function of the size of the place. And America is big, and in places sparsely unpopulated, undeniably. But this is not the reason. Europe too is big. With many less populated places. And there are cars everywhere, most people own one.

It’s now cultural. Culture can change, but when combined with architecture at an industrial scale, I’m afraid the change will take much longer than a natural human lifetime.
by smallerfish | 2025-04-18 17:17:07+00:00
I've been trying to sign up for Apple TV for the past several days, as we wanted to catch up on some of the Apple shows.

There is an Android app, and that installs smoothly enough, but trying to start a subscription initially errored out on both my & my wife's phones.

I then tried to create a new user through the Apple website, and got stuck on this screen, which was throwing 500s every time I clicked on the continue button: https://www.reddit.com/r/applehelp/comments/17zawel/continue....

After a couple of days that screen cleared, but then I found that their website won't take payment from me (I'm based outside of the US, but have a US billing address, so that's likely the cause of that.) I did find that their app at this point allowed me to subscribe through Google Play subscriptions (once I had gotten this account fully setup), so that almost got me to the finish line (except for some reason I got blocked and decided to start again with a new account, so back to square 1).

I'll also note that (of course) they don't support chromecast (as I think all or most other streaming apps available on Android do); the workaround is apparently to open the Apple TV site in chrome and cast from there.

Kind of a shitshow, overall.
by chrisBob | 2025-04-18 17:17:25+00:00
I have gotten bees in the mail twice. The first time they delivered to my home, the second time I had to go pick up at the post office. Both times the carriers I interacted with seemed a little worried about the contents.

The first set didnt' do well at all. I probably lost more than 60% of the 5 lbs. of bees, and that hive never thrived. My most recent ones are still going strong and I think I can officially say at this point that they made it through the winter :)
by goku12 | 2025-04-18 17:18:17+00:00
Same as @conradludgate's answer, but stated differently. If you say you need &String in your function, then you can pass only &String in a function call. But if you say you need &str in your function, then you can pass either &str or &String. Rust will automatically convert the &String to &str using a mechanism called 'Deref coercion'.

And if you are wondering what the difference between &String and &str is, you need to start with a regular String. Strings are utf-8 encoded strings that may be modified at runtime. They are made of 2 parts in the memory. The first part is on the heap memory - a memory buffer of specific size that is filled partially or fully with utf-8 encoded text. The second part is usually (but not always) on the stack frame of the current function. It holds the metadata about the heap memory text buffer I mentioned earlier - that is, the pointer to the start of the buffer, the full size of the buffer and the size of the text currently occupying that buffer. (If you are wondering why you need the metadata part, it's because it has a fixed size and structure known at compile time, unlike the actual text buffer). When we take the reference &String, we get a safe pointer to the second part (the metadata).

Now &str. It's a reference to a fixed sized sub-string (slice) of a full string somewhere in the memory. (That sub-string can be the full string too). Since it points to a fixed-size portion of a string, it has only a pointer to the beginning of the sub-string and the size of the sub-string. (It's not concerned with the buffer's size at all).

The Deref coercion of &String to &str converts the pointer pointing to the metadata part of the String, to a pointer pointing at the buffer containing the actual text. This happens transparently.

This long an answer is irrelevant to the topic in the article. That's perhaps why it's omitted.
by AnthonyMouse | 2025-04-18 17:18:27+00:00
> Keeping the same person for 40 years saves far more than 50k of onboarding costs over that timeframe. Employee churn is really expensive but if it’s not coming out of your budget middle management doesn’t care.

How does that change the number from the perspective of the employee?

The problem is not how to get an employee to stay for 40 years. The problem is, the employee who has just received $50k in training will take whichever job pays more, so the employer who paid the $50k has to offer the same salary as the one who didn't. And then who is going to pay the $50k when they could get the employee that someone else paid the money to train, for the same salary?
by cratermoon | 2025-04-18 17:20:07+00:00
The tax laws relating to carried interest, for example. Everyone, rich and poor, gets to take advantage of the lower rates compared to ordinary income. Sounds equitable on the surface, but the reality is that poor people don't have investment yields that are taxed as carried interest, they have ordinary income. Rich people, on the other hand, can all but eliminate their ordinary income and the taxes on it, and instead put their money in places where it's taxed as carried interest, which is to say at a much lower rate.

I don't know what finance and investment regulations were in place when Learned Hand was alive, but I do wonder if he'd take the same position in an economy and tax regime so heavily titled to favor the wealthiest.
by lenkite | 2025-04-18 17:20:08+00:00
Why is HN suddenly in favour of an illegant immigrant and domestic abuser who punched his wife and who had taken a protective order against him ?

The guy is also now sipping margaritas in a restaurant with Senator Van Hollen as was clearly seen in the Senators own post just some hours ago.

The only alarm emergency is the hand-wringing hysteria.
by Veserv | 2025-04-18 17:20:15+00:00
You truncate for all packet types.

Data in transit is almost never split for reasons other than fragmentation to avoid MTU problems. Any such split necessarily defines a fragmentation and reconstruction protocol so it still "preserves" the original send length information needed for truncation detection. If they have gone truly crazy and implemented a entire stream protocol transparently backing their flows then their transparent inner point-to-point layer would need to be aware of truncation in much the same way it would need to be aware of MTU limits anyways.

Forwarding generally corrupted packets should not be a problem unless your middleboxes are aggressively engaging in layering violations. From the perspective of a middlebox that is not engaging in layering violations you just have headers with blobs of data. Truncating the blob of data is basically uninteresting; at most you recalculate your integrity tags at your appropriate layer. You do not and should not recompute anything at higher layers. Furthermore, your endpoints must already be robust to blobs of garbage that pass your integrity tag checking because it is trivial for malicious actors to send you blobs of garbage with correctly calculated integrity tags. And, even if you were fully isolated, you can still get correlated bit errors that result in a correct integrity tag despite payload bit errors. Every client implementation that is not grossly incompetent must already be robust to getting garbage. You only get problems when your middleboxes start mucking around and trying to be too smart and violating your point-point transport abstraction.

You still get unidirectional protocols because you should manage truncation information out-of-band of any of your protocols. UDP or any other protocol should not communicate back to the sender that truncation happened. You do that some other way or even do not bother to do it at all. This is extra channel information that you can choose to communicate to let the other endpoint know about channel properties to make better data encoding decisions. You can transmit that in-band, out-of-band, on a different protocol, whatever. This is a higher level property of the communication channel between you and the other side.

Truncation is better authenticated because the packet reaches the other, known, authenticated endpoint who is the entity who can inform you, over a authenticated channel, that the transport channel has problems. You do not get nonsense like ICMP too large messages which come from unknown, unauthenticated entities. Furthermore, truncated messages can still be authenticated as long as you authentication tag the base header which should never be in the truncated section (you still need to have a minimum MTU below which you should always reject, but that number is small and much smaller than existing MTUs).