MurphyA/hacker-news huggingface dataset:
by brianshaler | 2025-04-16 20:52:08+00:00
This is a little off-topic and nitpicky, so I waited a day to avoid cluttering comments while the thread was on the front page..

I believe the term "going concern" means exactly the opposite of what you were trying to say here. Generally, comments about pedantry aren't helpful or uninteresting. This case was amusing to me in the context of assuring people Cohere is likely to stay around by boldly stating Cohere is at risk of being insolvent or ceasing operations ("Cohere is not a going concern"). Beyond that, I think it's pretty interesting how understandable it is to look at the term without knowing its meaning and assume the presence of the word "concern" must mean people are concerned about it going [bankrupt?].

I'm sure given the context nobody got the wrong impression. If anything, it makes me wonder if the term could, at least in informal contexts, reach a point of semantic inversion.
Show HN: Milter in Rust to Add Headers
by wagoYYP | 2025-04-16 20:52:16+00:00
Here's a milter in Rust that adds List-Unsubscribe headers. It creates a URL that has encoded email-from, rcpt-to and a HMAC SHA 256 verification hash using a shared secret key. Possibly it improves delivery of newsletters and transactional emails.
by gus_massa | 2025-04-16 20:52:26+00:00
It has a [dead] comment that says

> Please don't post unsubstantive comments to HN. [link to guidelines]

My guess is it was a parody/impersonator account.

You can enable "showdead" in your profile to see [dead] comments ans posts. Most of them are crap, but there are some false positives an errors from time to time.
by ldoughty | 2025-04-16 20:52:33+00:00
It's not about saying the word, it's about the word that is put in front of 12 year olds on the home page of the app, and in any supporting material they can find online.... and what their parents think about their 12 year old seeing that word.

If this is meant as a tool similar to DVWA, I figured the author might want to be aware that DVWA causes a LOT of problems in K-12 because of it's name. If someone renamed it to "Darn", it would have saved a collective hundreds if not thousands of hours of K-12 educator time.

Many K-12 educators will not touch DVWA because of its name.

I figured the author of DVMCP would like to know that, if they want to improve adoption.
by qwerpy | 2025-04-16 20:52:48+00:00
> owned/operated by an unregulated billionaire nutcase that will turn off your access if he doesn't like you any more (c.f. Ukraine front line)

Is this actually true?

https://en.wikipedia.org/wiki/Starlink_in_the_Russian-Ukrain...

> In 2022, Elon Musk denied a Ukrainian request to extend Starlink's coverage up to Russian-occupied Crimea during a counterattack on a Crimean port, from which Russia had been launching attacks against Ukrainian civilians; doing so would have violated US sanctions on Russia. This event was widely reported in 2023, erroneously characterizing it as Musk "turning off" Starlink coverage in Crimea.
by marcusb | 2025-04-16 20:53:03+00:00
I tried to read this with an open mind, but I think the poster is talking about a lot of problems that are adjacent to CVE (coordinated vulnerability disclosure and vulnerability scoring, primarily) while missing the primary value that CVE provides (a consistent vocabulary to talk about vulnerabilities and a centralized clearing house for distributing vulnerability data) and as a result their proposed solution misses the mark.

The article quotes a lobsters post approvingly:

1. We end up with a system like CVE where submitters are in charge of what’s in the database other than egregious cases. This is what MITRE supported as the default unless someone became a CNA, something they’ve been handing out much more freely over the last few years to address public scrutiny. 2. We end up with a system not like CVE where vendors are in charge of what’s a vulnerability. This seems to be what Daniel and others want.

I guess the first problem with this is that the CNA system very much puts vendors in de facto control of what goes in the database. But, this description of CVE-like systems is missing the forest for the trees, in that the alternative to CVE is not one of the two scenarios described, but the wild-west situation that existed before CVE, where vulnerability info came from CERT, from Bugtraq/Full Disclosure/etc., and from vendors, often using wildly different language to describe the same thing.

The whitepaper[0] that led to the CVE system described a pretty typical scenario:

Consider the problem of naming vulnerabilities in a consistent fashion. For example, one vulnerability discovered in 1991 allowed unauthorized access to NFS file systems via guessable file handles. In the ISS X-Force Database, this vulnerability is labeled nfs-> guess [8]; in CyberCop Scanner 2.4, it is called NFS file handle guessing check [10]; and the same vulnerability is identified (along with other vulnerabilities) in CERT Advisory CA-91.21, which is titled SunOS NFS Jumbo and fsirand Patches [3]. In order to ensure that the same vulnerability is being referenced in each of these sources, we have to rely on our own expertise and manually correlate them by reading descriptive text, which can be vague and/or voluminous.

That, and a central clearing house, are what is at stake if a system like CVE disappears, and I fail to see how any professional licensing scheme -- unless the licensing body replicated the CVE system or something like it -- would do anything to address that.

parliament32's comment in this thread perfectly addresses the issues with the articles treatment of CVSS, so I'll not rehash that here, other than to say that the actual score output of CVSS is bad and the people who designed it should feel bad.

0 - https://www.cve.org/Resources/General/Towards-a-Common-Enume...
by mppm | 2025-04-16 20:53:03+00:00
I'm not much of an expert, but maybe this can be useful: AlN is a somewhat widely used insulating substrate that is chosen where sapphire is insufficient (~40 W/mK), but BeO (~300 W/mK) is too expensive or toxic. The intrinsic conductivity of single-crystal AlN is very high (~320 W/mK), but the material is extremely difficult to grow into large single crystals, so sintered substrates are used instead. This reduces thermal conductivity to 170-230 W/mK depending on grade. Can't comment on pricing though.
by cma | 2025-04-16 20:54:19+00:00
As long as you get the model weights without agreeing to the license, there has been no case in the US yet at least where model weights have been ruled to be subject to copyright and it is likely they are a mechanical transform of data. FB probably owns copyright on some of the data used for instruction tuning the model, but they rely on the transform also removing that copyright if it removes the copyright of the other underlying data they don't own the copyright to.

They want to have their cake and eat it though and these companies are all lobbying hard in a political system with open bribery.
by gnabgib | 2025-04-16 20:54:32+00:00
Discussion (in past thread) https://news.ycombinator.com/item?id=43704827

Related CVE program faces swift end after DHS fails to renew contract (1856 points, 18 hours ago, 1066 points)

Related CVE Foundation Launched to Secure the Future of the CVE Program (209 points, 9 hours ago, 43 comments) https://news.ycombinator.com/item?id=43704430
by detaro | 2025-04-16 20:54:39+00:00
> surely the big ones all can and do respond in less than 90 days?

LOL. old-fashioned enterprises are the worst at "oh, no, can't do that, need months of warning to change something!", while also handling critical data. A major event in the CA space last year was a health-care company getting a court order against a CA to not revoke a cert that according to the rules for CAs the CA had to revoke (in the end they got a few days extension, everyone grumbled and the CA got told to please write their customer contracts more clearly, but the idea is out there and nobody likes CAs doing things they are not supposed to, even if through external force).

One way to nip that in the bud is making sure even you get your court order preventing the CA from doing the right thing, your certificate will expire soon anyways, so "we are too important to have working IT processes" doesn't work anymore.
by _DeadFred_ | 2025-04-16 20:54:44+00:00
Very well isn't good enough when peoples lives/the continuous functioning of society is at stake.

Facebook had a shit ton of teething problems. If social security/Medicaid has teething problems, people die. If Social Security has teething problems, people can't eat/pay rent/property tax, they get kicked out, their credit is ruined, and they can't qualify for new housing. Miss medication. Die. A little different than a blank page on Facebook. Facebook is also 'optional', and people can use other things to replace it. Society has committed to people over their entire lifetimes on Social Security/Medicaid. America should honor it's commitments, even when it's a little bit harder/inconvenient/more expensive. Especially when at the same time it's making 4 trillion dollar optional tax cuts instead of honoring it's promises to it's people.

Should blood bank typing software move fast and break things? Should your bank move fast and break things? Should your car's anti-lock braking system software move fast and break things? But the funds people depend on to live (Medicaid pays for the majority of nursing homes for the elderly, Social Security is many people's entire retirement income) should?

I disagree that that is how the United States should treat it's 'use cases' and 'constraints' in serving it's citizens/honoring it commitments.

And unlike Facebook, the current systems have actually worked for decades. How many times has Social Security needed a major uplift?

Now compare that to how often Facebook has had to overhaul its tech stack.

Lastly, for your comparison to work, you are claiming you are willing to fund government tech on the same level that Facebook funds their tech (otherwise the comparison makes no sense). Are you REALLY saying you are willing to fund government software development at the same expense level as Facebook? That's $60 billion and $65 billion in 2025 alone.
by parhamn | 2025-04-16 20:55:08+00:00
JS is web's (and "hip" developer's) python, and in many ways it is better. Also the tooling is getting a lot better (libraries, typescript, bundling, packaging, performance).

One thing I wonder that could be cool: when Bun has sufficient NodeJS compatibility the should ship bun --compile versions so you dont need node/npm on the system.

Then it's arguably a, "why not JS?"
by kazinator | 2025-04-16 20:55:21+00:00
Hash tables or dictionaries can be S-expressions.

Some Lisp dialects do not have printed-representations for these; that is a bug, and needs no further discussion.

Common Lisp and Scheme have vectors: they are notated as #(...). That is an S-expression.

CLISP has a #<N>A(...) notation for multidimensional arrays, which it can print and read:

[8]> (make-array '(2 2) :initial-element 0) #2A((0 0) (0 0))

There is a little bit of a restriction in that backquote doesn't support multi-dimensional arrays:

[2]> (let ((x 42)) `#2A((,x 0) (0 ,x))) *** - READ: unquotes may not occur in arrays

But this does work for vectors (as required by ANSI CL, I think):

[11]> (let ((x 42)) `#(0 ,x 0)) #(0 42 0)

You might think that #(0 42 0) is just some list variation, but in fact it is a bona-fide vector object, with fast numeric indexing, and without the structural flexibility of lists. Vectors are typically implemented as flat arrays in memory. (Though they could use something else, particularly if large, like radix trees.)

Hash literals look like this in TXR Lisp:

1> #H(() (a 1) (b 2) (c 3)) #H(() (a 1) (c 3) (b 2))

You can see the order of the keys changed when it was echoed back. The first element in the #H syntax, (), gives properties. It's empty for the most general form of hash, which uses equal comparison, and doesn't have weak keys or values.

Binary search trees are likewise printable. The #T notation gives a tree (concealing the nodes). The #N notation for individual tree nodes:

1> (tree) #T(()) 2> (tree-insert *1 1) ; *1 means value from repl line 1 #N(1 nil nil) 3> (tree-insert *1 3) #N(3 nil nil) 4> (tree-insert *1 7) #N(7 nil nil) 5> (tree-insert *1 4) #N(4 nil nil) 6> (tree-insert *1 2) #N(2 nil nil) 7> (tree-insert *1 8) #N(8 nil nil) 8> (tree-insert *1 0) #N(0 nil nil) 9> *1 #T(() 0 1 2 3 4 7 8) 10> (tree-root *1) #N(3 #N(1 #N(0 nil nil) #N(2 nil nil)) #N(7 #N(4 nil nil) #N(8 nil nil)))

The #T notation is readable. It gives the values in order, but they don't have to be specified in order when you write a literal:

11> #T(() 3 2 1) #T(() 1 2 3)

If we ask for the tree root, we see the actual nodes, and how they are linked together:

12> (tree-root *11) #N(2 #N(1 nil nil) #N(3 nil nil))

All these notations are something we can casually use as data in a file or network stream between TXR Lisp programs, or anything else that cares to read and write then notation.

The printed notation of any object in a Lisp is a S-expression. S-expression syntax usually strives for print-read consistency: when an object's printed notation is read by the machine, a similar object is recovere. (In some cases, the original object itself, as with interned symbols).
by csdvrx | 2025-04-16 20:55:40+00:00
I wanted to limit the space needed on the EFI, and keep as much as possible on the Windows partition because there's also the question of where the bitlocker key would go.

With something like a chainloader using a special part of the NTFS partition posing as bad blocks, Windows could "remove" this access easily, without having to touch the EFI partition or the boot variables.
by ahartman00 | 2025-04-16 20:56:08+00:00
They aren't really scheduling though. They can feel when their udders get full. It actually can be painful if you don't milk them on time. Its comparable to eating or drinking, they go eat when they feel hunger. It is pretty cool that they learn to associate the machine though, its not like it smells the way food does, or like there is any instinct involved.
by parliament32 | 2025-04-16 20:56:12+00:00
We've also felt the pain for OAuth secrets. Current mandates for us are 6 months.

Because we run on Azure / AKS, switching to federated credentials ("workload identities") with the app registrations made most of the pain go away because MS manages all the rotations (3 months) etc. If you're on managed AKS the OIDC issuer side is also automagic. And it's free. I think GCP offers something similar.

https://learn.microsoft.com/en-us/entra/workload-id/workload...
by mystified5016 | 2025-04-16 20:57:15+00:00
However much you think it costs to lay new fiber, add three zeroes. If you lay a new line, you have to individually negotiate for easment rights with the owner of every single property your line crosses. You then have to pay for the construction and any remediations the property owner demands. Typically you have to put the land back to exactly how you found it.

This is the entire reason that the US forced Bell/AT&T to allow any company to lease a connection to their network. Without that, it would have been flatly impossible for any new provider to compete. There is simply no way that anyone could have ever built out a network to compete with Bell.

You can probably lease a connection to the fiber network in the same way (I haven't checked, but I assume common carrier applies), but if there's no fiber to the addresses you want to service you're SOL unless you want to front tens of thousands of dollars per customer. No ROI on that for many, many years.

Your only recourse there is to additionally stand up DSL/DOCSIS as a 'last mile' connection between the customer and your fiber. At additional unbelievable expense.
by Tech_Nomad | 2025-04-16 20:57:40+00:00
Hi HN, I built PromptQuick (https://promptquick.ai) because I was personally wasting too much time fighting with prompts for ChatGPT, Claude, etc. The constant trial-and-error to get decent, consistent output felt really inefficient.

My solution was to make a simple rulebook: just concise, categorized, copy-paste rules for common problems like vague answers, bad formatting, wrong tone. Stuff you can use right away, not a long course.

This is an MVP. The main goal right now is just validation – seeing if this structured, rule-based way of prompting is actually useful to other people using these AI tools a lot.

To figure that out, the site offers a free sample chapter covering rules for improving output quality and formatting. You give an email, you get the PDF. Simple.

I'd appreciate any feedback on the idea itself, the landing page, or the sample rules if you check them out. Does this actually solve a pain point you have?

Tech stack is Next.js, Tailwind, Supabase, Resend, Vercel Blob, hosted on Vercel.

Happy to answer any questions.
by nh23423fefe | 2025-04-16 20:57:45+00:00
Isn't that just inherent in binary operations? I feel like you are saying the same thing as: What is 0 sometimes people write 1-1 or 3-3 or -10+10.

by the linearity of ^, B = a^b = 1 * a^b = x*(x^-1) a^b = xa ^ (x^-1)b

So the bivector is the "hyperbola" of all touching parallelograms just like 0 is the set of all oppositely directed arrows of equal magnitude.

But the parallelograms only become a bivector after you wedge them. not before.
by oceanplexian | 2025-04-16 20:57:46+00:00
> AFAIK it’s still an open question whether there is any copyright in model weights

There's definitely copyright when you ask the model to spit out Chapter 3 of a Harry Potter book and it literally gives it to you verbatim (Which I've gotten it to do with the right prompts). There's no world where the legal system gives Meta a right to license out content that never belonged to them in the first place.
by runarberg | 2025-04-16 20:59:24+00:00
I’m not gonna answer any of your points here on material grounds. I think they speak for them selves, and reveal what you are attempting to do here.

I am gonna admit that I am not arguing in good faith. Off course I am not, I believe you are arguing from a racist belief that the Palestinian people do not have the same rights to their existence as you. There is no good faith argument to be had against such belief. The best I can attempt is call it out for what it is, and hope the moderators take it from there.
by elliot07 | 2025-04-16 21:00:10+00:00
Agree. My wish-list is:

1. Non JS based. I've noticed a ton of random bugs/oddities in Claude Code, and now Codex with UI flickering, scaling, user input issues, etc, all from what I believe of trying to do React stuff and writing half-baked LLM produced JS in a CLI application. Using a more appropriate language that is better for CLIs I think would help a lot here (Go or Rust for eg).

2. Customized model selection (eg. OpenRouter, etc).

3. Full MCP support.
by PaulHoule | 2025-04-16 21:00:29+00:00
In my town severe untreated mental illness is widespread and you routinely see things that seem unsafe.

There is one person who is aggressive and in your face who rumors swirl around, I wonder just how many thousands if not hundreds of thousands of dollars a year this person costs the community. (He deserves at least some attribution for a college student I know leaving)
by gnabgib | 2025-04-16 21:00:41+00:00
Discussion (in past thread) https://news.ycombinator.com/item?id=43704827

Related CVE program faces swift end after DHS fails to renew contract (1856 points, 18 hours ago, 1066 points)

Related CVE Foundation Launched to Secure the Future of the CVE Program (209 points, 9 hours ago, 43 comments) https://news.ycombinator.com/item?id=43704430
by Animats | 2025-04-16 21:01:25+00:00
Sonic started as a little local ISP in Santa Rosa, CA.[1] Now it's huge in Northern California.

I have 1GB Sonic bidirectional fiber with unlimited data and could get 10GB if I wanted. The head of Sonic points out that long-haul prices have decreased over the years, and there's no real need for usage limits.

[1] https://en.wikipedia.org/wiki/Sonic_(ISP)
by morsecodist | 2025-04-16 21:01:37+00:00
I agree that the core problem of housing affordability is that housing serves a dual role as an investment and a place to live. But I think this policy will not do very much and in isolation would even be counterproductive.

Why focus on single family homes? If corporate ownership is as bad as you are framing it then why is it OK for someone who lives in an apartment to be advantage of? Worse still, these entities would still want to invest in real estate so presumably they would invest even more in multi-family properties. If their ownership is what causes unaffordability, are you not making things even worse for people who live in multi-family housing?
by Yeroc | 2025-04-16 21:02:38+00:00
I was just digging into this a bit and discovered ACME supports a something called DNS alias mode (https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...) which allows you to add a static DNS TXT record on your core domain that delegates to a second domain. This would allow you to setup a second domain with DNS API (if permitted by company policy!)
by cpach | 2025-04-16 21:03:31+00:00
It might be possible to run an ACME client on another host in your environment. (IMHO, the DNS-01 challenge is very useful for this.) Then you can (probably) transfer the cert+key to BIG IP, and activate it, via the REST API.

I haven’t used BIG IP in a long while, so take this with a grain of salt, but it seems to me that it might not be impossible to get something going – despite the fact that BIG IP itself doesn’t have native support for ACME.

Two pointers that might be of interest:

https://community.f5.com/discussions/technicalforum/upload-l...

https://clouddocs.f5.com/api/icontrol-rest/APIRef_tm_sys_cry...
by LeifCarrotson | 2025-04-16 21:03:57+00:00
I think this is compounded by the correlation of beliefs between modern cranks who reject their education and believe what science now knows to be absurdities like "the Earth is flat" or "carrying this crystal pendant will please the gods and protect you from getting sick" with smart ancient people who believed the Earth is flat or crystal pendants will please the gods and prevent you from getting sick.

Yes, perhaps both Homer (the author of the world-famous literary classic the Iliad and the Odyssey) and a hypothetical modern Homer (d'oh!) believed in a flat Earth. The modern Homer failed to understand or rejected the education he was offered, while a hypothetical modern observer, who feels more intelligent than the flat-earther, understood and accepted it. But that does not mean that the ancient Homer was of similar intelligence!
by mchusma | 2025-04-16 21:04:14+00:00
Thanks for sharing that. that was more interesting then their demo. I tried it and it was pretty good! I have felt that the ability to iterate from images blocked this from any real production use I had. This may be good enough now.

Example of edits (not quite surgical but good): https://chatgpt.com/share/68001b02-9b4c-8012-a339-73525b8246...
by breadwinner | 2025-04-16 21:04:17+00:00
No it was the team known as 18F that Elon Musk "deleted".

https://apnews.com/article/irs-direct-file-musk-18f-6a4dc35a...

Excerpt: Billionaire tech mogul Elon Musk posted Monday on his social media site that he had “deleted” 18F, a government agency that worked on technology projects such as the IRS’ Direct File program.
by reverendsteveii | 2025-04-16 21:05:13+00:00
just gonna echo what everyone else here has already said: eat right (that doesn't mean crash diet, it means making sure your body has what it needs but not in excess), sleep right (go to bed and wake up at the same time every day, even on weekends), exercise (I take two 15-20 minute exercise breaks every day) and stay away from endless algo-curated feeds.