MurphyA/hacker-news huggingface dataset:
Show HN: SQL-tString a t-string SQL builder in Python
by pgjones | 2025-05-16 12:48:22+00:00
SQL-tString is a SQL builder that utilises the recently accepted PEP-750, https://peps.python.org/pep-0750/, t-strings to build SQL queries, for example,

from sql_tstring import sql val = 2 query, values = sql(t"SELECT x FROM y WHERE x = {val}") assert query == "SELECT x FROM y WHERE x = ?" assert values == [2] db.execute(query, values) # Most DB engines support this

The placeholder ? protects against SQL injection, but cannot be used everywhere. For example, a column name cannot be a placeholder. If you try this SQL-tString will raise an error,

col = "x" sql(t"SELECT {col} FROM y") # Raises ValueError

To proceed you'll need to declare what the valid values of col can be,

from sql_tstring import sql_context with sql_context(columns="x"): query, values = sql(t"SELECT {col} FROM y") assert query == "SELECT x FROM y" assert values == []

Thus allowing you to protect against SQL injection.

As t-strings are format strings you can safely format the literals you'd like to pass as variables,

text = "world" query, values = sql(t"SELECT x FROM y WHERE x LIKE '%{text}'") assert query == "SELECT x FROM y WHERE x LIKE ?" assert values == ["%world"]

This is especially useful when used with the Absent rewriting value.

SQL-tString is a SQL builder and as such you can use special RewritingValues to alter and build the query you want at runtime. This is best shown by considering a query you sometimes want to search by one column a, sometimes by b, and sometimes both,

def search( *, a: str | AbsentType = Absent, b: str | AbsentType = Absent ) -> tuple[str, list[str]]: return sql(t"SELECT x FROM y WHERE a = {a} AND b = {b}") assert search() == "SELECT x FROM y", [] assert search(a="hello") == "SELECT x FROM y WHERE a = ?", ["hello"] assert search(b="world") == "SELECT x FROM y WHERE b = ?", ["world"] assert search(a="hello", b="world") == ( "SELECT x FROM y WHERE a = ? AND b = ?", ["hello", "world"] )

Specifically Absent (which is an alias of RewritingValue.ABSENT) will remove the expression it is present in, and if there an no expressions left after the removal it will also remove the clause.

The other rewriting values I've included are handle the frustrating case of comparing to NULL, for example the following is valid but won't work as you'd likely expect,

optional = None sql(t"SELECT x FROM y WHERE x = {optional}")

Instead you can use IsNull to achieve the right result,

from sql_tstring import IsNull optional = IsNull query, values = sql(t"SELECT x FROM y WHERE x = {optional}") assert query == "SELECT x FROM y WHERE x IS NULL" assert values == []

There is also a IsNotNull for the negated comparison.

The final feature allows for complex query building by nesting a t-string within the existing,

inner = t"x = 'a'" query, _ = sql(t"SELECT x FROM y WHERE {inner}") assert query == "SELECT x FROM y WHERE x = 'a'"

This library can be used today without Python3.14's t-strings with some limitations, https://github.com/pgjones/sql-tstring?tab=readme-ov-file#pr..., and I've been doing so this year. Thoughts and feedback very welcome.
by arctek | 2025-05-16 12:48:23+00:00
Similar to my experience, it works well for small tasks, replacing search (most of the time) and doing alot of boilerplate work.

I have one project that is very complex and for this I can't and don't use LLMs for.

I've also found it's better if you can get it code generate everything in the one session, if you try other LLMs or sessions it will quickly degrade. That's when you will see duplicate functions and dead end code.
by scosman | 2025-05-16 12:48:29+00:00
I had this happen on a consumer startup with referrals. Every month like clockwork one person would fake referrals to get a free moth, which involved jumping through non trivial hoops (re-installing all, creating content in the fake account, going back). all to save $5, and when we had a free plan with almost the exact same quality.

I think the thrill of beating a system and getting away with is as much a factor as anything. And I get it.
by Terretta | 2025-05-16 12:48:50+00:00
> Cloud providers aren't going to care too much about this. ... [E]nterprise companies e.g. banks ... and none of them have any use for something like this.

As former CTO of world's largest bank and cloud architect at world's largest hedge fund, this is exactly opposite of my experience with both regulated finance enterprises and the CSPs vying to serve them.

The entire foundation of the IT industry is based on trusting the privacy and security policies of Azure, AWS and GCP. And in the decades since they've been around not heard of a single example of them breaking this.

On the contrary, many global banks design for the assumption the "CSP is hostile". What happened to Coinbase's customers the past few months shows why your vendor's insider threat is your threat and your customers' threat.

Granted, this annoys CSPs who wish regulators would just let banks "adopt" the CSP's controls and call it a day.

Unfortunately for CSP sales teams — certainly this could change with recent regulator policy changes — the regulator wins. Until very recently, only one CSP offered controls sufficient to assure your own data privacy beyond a CSP's pinky-swears. AWS Nitro Enclaves can provide a key component in that assurance, using deployment models such as tinfoil.
by tbrownaw | 2025-05-16 12:49:00+00:00
> Time spent on tasks was never as relevant as hitting deadlines without backtracking or building up technical debt. Managers and their employees alike only ever focused on hours because they hated their jobs.

Where I work, the budget people like to have at least some idea of how much different projects actually cost. And they like to know time spent on capitalizable vs not things, which I guess has something to do with taxes.
by carlosjobim | 2025-05-16 12:49:26+00:00
Don't you think rap music has a negative influence? Or pornography?

When was it decided that it's not true that popular culture and technology can have a destructive influence on people? This was decided before I was born, so why should it be my duty to accept it as true?

The more I notice this, the more crazy it seems. When was it decided that the TV should be center in every home and treated like the most important thing in life? Those are just people in a studio, yet most people and especially old people consider those people to be gods, deserving the greatest reverence. Who told them to buy a TV and put it into their homes? How could that become normal?
by russfink | 2025-05-16 12:49:32+00:00
First, congrats on having a successful company and doing what you love (and employing others - a great feeling to know you are helping technical folks live their dream).

Second, some thoughts.

A. State in your policy that multiple trials are possible but may incur a rest period between activations for a “given company.” Even 5 days should be reasonable for honest folks but cause a pain point for dishonest ones.

B. If you can add a license activation feature to your software, collect metrics when you present the license activation screen, and “bake in” the telemetry to your trial license key request. Things like CPU ID, hard drive serial numbers, TPM quotes, asset tag serial number. Use that telemetry to determine “given company.” The abusers are likely installing this on the same system over and over.

C. Independent of the activation idea, If the trial hard-stops after 30 days, maybe you could delay the approval process on all new trials by X days (X randomly chosen from range 0..5, and all trial requests independent of requestor) and then activate the product for 30-X days. Assuming the dishonests have integrated the VM into their production systems, this will cause an unpredictable unavailability and trigger a pain point somewhere. At worst, it will cause them to step up their request efforts.

As others probably are saying, this might be one for the lawyers.
by jillyboel | 2025-05-16 12:49:34+00:00
> Porn sites suing because Apple won't allow them to put apps in their store and that's costing them their livelihood

Great example, actually. Why do you think it's okay for apple to unilaterally decide what more than a billion people are allowed to use their device for? Is it because you are projecting your own fears and insecurities on everyone else?
by codeduck | 2025-05-16 12:49:49+00:00
I call shenanigans on this. Suicide rates are not a reliable signal for underlying mental health issues in isolation

Bullying via social media and group chats is endemic, and phones function as a massive signal amplifier in this regard.

Furthermore, there is a growing body of evidence which link early smartphone use to poor outcomes in social skills, degraded critical thinking ability, and elevated rates of depression.

This feels very much like someone picking data to fit their hypothesis.
by amiga386 | 2025-05-16 12:50:20+00:00
... Hoyk (Hawick), Kircoodbree (Kirkcudbright), Mullguy (Milngavie), Cooriss (Culross), Geeree (Garioch), Eyela (Islay)

However, some Americans even have trouble with Glasgow (Glaz-go, not Glass-gow) and Edinburgh (Ed-in-burra, not Edin-bro)
by berdario | 2025-05-16 12:50:35+00:00
> What's wrong with [...] You need to send money to a family member (immediate or extended),

I tend to agree, but the same applies if one family member is in Belarus or Russia, and the other one is in the USA.

I.e. just because it's morally ok, it doesn't mean that it's without risk (if you lie about the purpose) and that the banks will facilitate it.

OTOH, before EO2022, I know that transfers between Russia and countries in Europe were sometimes still happening. Disappointintly (but it's not very surprising), sending small money to family would usually be impossible, but if you had to transfer substantial amounts of money, and you could prove that it was from e.g. sale of a home, that could still happen.

On one hand, that makes sense: the bigger the amount, the more it makes economic sense to allow extra time and effort to check that all the i are dotted and all the t ate crossed.

But OTOH, the people with lots of housing property are sometimes precisely using housing to launder the provenance, and they are also not necessarily the honest workers whose family end up split across borders.
by rideontime | 2025-05-16 12:50:52+00:00
There's a certain sort of "snarkiness" that's very easy to spot. There's a convicted scammer named Craig Wright (long story) who uses ChatGPT to write long, smug essays on X which have the exact same sort of tone, complete with the weird florid analogies.

> Hard to say if it was a mistake, a flex, or just their way of making sure we didn’t miss who was milking the trials.

> It’s tested. It updates with a single click. It saves time and reduces risk. That’s what we sell. And that’s what they keep pirouetting around with their email dance.

> We’re not going to waste days chasing them. But at some point, this goes beyond saving a few bucks: it becomes performance art.
by MichaelZuo | 2025-05-16 12:51:42+00:00
I don’t think it’s even theoretically possible to defend an aircraft carrier sized target against a sufficiently concentrated missile/drone attack within say a 5 minute window 200 km offshore.

Even if we assume absurdities like quadrupling the number of reactors, 100% efficient lasers, a dozen escort ships also with their own lasers, etc…
by chii | 2025-05-16 12:52:03+00:00
and most 2fa security dont use sms any more. It's an insecure option - forcing it sucks for the legit customers. But if you don't force it, then one can bypass the sms and thus no longer need a phone number. Or you can try force sms on first login, _then_ allow the move to use a OTP app.

And even with this, what happens if the company simply shares the company phone, authenticate, then remove the phone and switch to OTP (for each time, or each user)? Unless if a phone number cannot be used twice...which means you have to keep storing it, and handle the support requests when a number is legitimately recycled (and how do you differentiate that?)

Offering something that is quite full featured for free (even as a trial) will get it exploited; it's only going to increasely be the case going forward. The internet is hostile, and getting more hostile.
by bgwalter | 2025-05-16 12:52:17+00:00
They were quite a bit behind the schedule that was promised five years ago.

Additionally, at this stage the severe political and governance problems cannot have escaped Microsoft. I imagine that no competent Microsoft employee wants to give his expertise to CPython, only later to suffer group defamation from a couple of elected mediocre people.

CPython is an organization that overpromises, allocates jobs to the obedient and faithful while weeding out competent dissenters.

It wasn't always like that. The issues are entirely self-inflicted.
by debugnik | 2025-05-16 12:53:01+00:00
The problem is not that it doesn't write them for you, but that `as MyType` is way too ergonomic of a syntax for unchecked assertions, whereas checked assertions require effectively parsing the structure manually with typeof checks.

TypeScript desperately needs a way to derive type-guarding functions from types (and so does every gradually-typed language). There're libraries for this but you need to define the types themselves through combinators.
by theGeatZhopa | 2025-05-16 12:53:05+00:00
I cant help you on the XCode thing, but.. from my experience, never tell anyone how you've found it out. I've often have had students who delivered "bad" work but I still have to give a fair mark for it. So I always asked "have you written your assignment at 2am yesterday night? or, why is it so bad?" If they've said "no, i've worked since a week on it" then, I hiddenly looked at the file's metadata "creation time" - aaaaaaand... 3am - file created - 4am last change of the file. Then I looked deeply in their eyes and said "I've have a hidden talent... I can see it in your eyes. you started at 3am and stopped at 4am. So, what mark would you give yourself for such work, if you compare it to others?" ... If they say "no no.." I just answered "you're lying to me. Be honest to me and yourself.." ... and so on. The mark then have a punishment for lying built in. I explicitly tell this the students. It can be appealed agaist, but then some proof of the students version is needed. This makes them afraid of cheating.. or, at least, be honest about that.

check on meta-data of the file, then you know when. and then you can derive out of experience, if the time needed for the assignment is much longer than Now minus .xuserdatad creation time - then, one can assume its done by a experienced professional. And then you can use the psychologic trick to get the information you want..
by lolinder | 2025-05-16 12:53:59+00:00
This article's methodology leaves a lot to be desired. They throw out dozens of studies with a flippant, poorly justified dismissal and then proceed to take a cursory, high-level glance over a single other study that supported their desired conclusion. Having given that study a passing thought they proceed to wonder at "just how glaring this data is" from that single report and how it is that everyone else can't see it.

Ironically, the whole thing reads like someone did all the research and writing on a smartphone and didn't take the time to really construct an argument.

I don't disagree with the title—my assumption is also that parenting would have the largest impact—but the article does a very bad job justifying it and the conclusion that therefore technology isn't worth talking about is absurd. We do a lot of research that is aimed at helping out with marginal gains because marginal gains matter! The entire field of K-12 education exists to be a marginal improvement on top of what parents are already offering. Should we stop researching that field because there's evidence that parents are the single biggest factor in educational outcomes?

Most of our policy choices surrounding children are there explicitly to be a safety net for children whose parents can't provide the environment that they need.
by kqr | 2025-05-16 12:54:02+00:00
I get a very strong 1960s Bauhaus graphic design feeling from this. That makes it feel like yet another fad.

You could argue "but this is well researched so it cannot be a fad" but I think they're focusing on the wrong things. Sure, the send button is 4× faster to find according to their research – but I don't want a huge send button near the keyboard. The send button is the most dangerous button in my email client! I'd like it to be small and require deliberate effort to hit.

(Besides, it doesn't move around – I hope – so I will already know where it is when I compose my email. I'm not shooting down a fighter jet. I don't need to acquire the target quickly.)

On the other hand, this seems to be Google backtracking and saying "Ooops, sorry, our previous recommendation of a UI where all components blend into each other looks sleek but is hard to use" so I guess that's an improvement.
by Terretta | 2025-05-16 12:54:35+00:00
> The only way is to not use cloud computing at all and go on-premise.

This point of view may be based on a lack of information about how global finance handles security and privacy critical workloads in high-end cloud.

Global banks and the CSPs that serve them have by and large solved this problem by the late 2010s - early 2020s.

While much of the work is not published, you can look for presentations at AWS reInvent from e.g. Goldman Sachs or others willing to share about it, talking about cryptographic methods, enclaves, formal reasoning over not just code but things like reachability, and so on, to see the edges of what's being done in this space.
by OutOfHere | 2025-05-16 12:54:39+00:00
Sennheiser has a bit less pressure than the other brands like Bose, but of course it does still has some.

When listening to music, I keep the volume as low as feasible, and I disable ANC. When listening to podcasts, I enable ANC.

In general, in music apps, the volume is already too boosted, and so even the minimum volume is too high and damaging. This is not an issue in podcast apps like AntennaPod.

There actually is evidence that ANC music makes it hard for people to understand what others are saying in the real world. If this effect starts to happen, reverse course immediately before it becomes permanent.
by TZubiri | 2025-05-16 12:54:56+00:00
Ah I didn't consider that. International case certainly is going to be more complex.

That said, I think that small cases are still worth pursuing on a matter of principle and strategy.

It's better to practice pursuing payment from international clients when it's small amounts you don't care about, so that you are prepared if you have an issue with a huge client and bankruptcy is on the line.
by amarcheschi | 2025-05-16 12:55:42+00:00
I'm not an expert on the subject, but I'm taking an ethics in it course and for what I've learned - be aware I'm in the eu -, while eu classifies some categories of risk, it leaves freedom of choice to the companies regarding how to make sure to stay in the guidelines - which is something I think companies themselves are interested in for the money, given that the guidelines aren't unreasonable, or at least for the part I studied. I'm sure there's much more though
by taylodl | 2025-05-16 12:56:02+00:00
I just commented last week that we should expect a 2.5% to 5% reduction in IT staff pretty much across the board as a result of AI. (https://news.ycombinator.com/item?id=43916814#43918067)

Companies are always looking for ways to reduce staff, or direct existing staff to new roles and avoid hiring.
by mek6800d2 | 2025-05-16 12:56:09+00:00
I recently started reading Peter Westwick's 2007 book, Into the Black: JPL and the American Space Program, 1976-2004. I've only gotten up into the 1980s so far and I find it a good read. Leadership? Sausage making. Per Westwick, there have always been contentious relations between NASA headquarters, the different NASA centers, JPL, and Caltech. (JPL is a NASA center, but staffed by Caltech employees, and relations between JPL and Caltech themselves are often strained.) At JPL, there were frequent shufflings of people in leadership roles. Add in the politics of the whole thing and trying to get funding from the government. If the Reagan administration had fully had their way, there wouldn't have been Voyager 2 flybys of Uranus and Neptune. Fortunately, many politicians (like Newt Gingrich, of all people!) supported NASA. (Westwick discusses all of this in his book.)

So my impression is that we were incredibly lucky that Voyager worked out so well in spite of its chaotic existence from its earliest developmental stages to now. I suppose there are some leadership lessons, but survivorship bias must be accounted for as many projects didn't make it off the drawing board.
by sgarland | 2025-05-16 12:56:15+00:00
> Instead, many reach for multiprocessing, but spawning processes is expensive

Agreed.

> and communicating across processes often requires making expensive copies of data

SharedMemory [0] exists. Never understood why this isn’t used more frequently. There’s even a ShareableList which does exactly what it sounds like, and is awesome.

[0]: https://docs.python.org/3/library/multiprocessing.shared_mem...
by 90s_dev | 2025-05-16 12:56:22+00:00
It's also a very old embeddable language, which is probably most of why it's so often chosen for that purpose. Many similar languages have been written from scratch inspired by Lua over the last 10-15 years, some of them almost definitely better than Lua in many respects, but they get no traction because Lua has all the steam. Unfortunate, because the authors of Lua are fairly happy with semantic and syntactic decisions that many of us are very unhappy with.
by tux3 | 2025-05-16 12:56:30+00:00
It has already been tried without a reward, there are dedicated channels where you can go to request or fulfill requests (e.g. Nexus has these).

But it's a bit of an endless chore for a person to do, there are always more requests coming. It helps one person, but it doesn't really feel like efficient use of your time when it's a drop in the ocean.

I'm not thrilled with the crypto token thing, but it's good to see new things being tried. The worst that can happen is it doesn't work, there's not much to fear from this particular initiative. The worst they can do if it turns bad is... publish scientific articles.
by jonstewart | 2025-05-16 12:56:31+00:00
Maybe I’m just writing code differently than many people, but I don’t spend much time executing complicated or unique shell commands. I write some code, I run make check (alias “mkc”), I run git add —update (alias “gau”), I review my commit with git diff —cached (“gdc”), and I commit (“gcm”).

I can see how an LLM is useful when needing to research which tool arguments to use for a particular situation, but particular situations are infrequent. And based on how frequently wrong coding assistants are with their suggestions, I am leery of letting them run commands against my filesystem.

What am I missing?
by benoau | 2025-05-16 12:56:53+00:00
Apple's guidelines pertaining to banning developers from linking to or communicating alternative payment methods were illegal. In the EU, in the US, now in Brazil too.

What's next is the EU fines them harder and faster than ever if they continue breaking the law in about 30 - 40 days, Brazil too in about 90 days, while the criminal contempt referrals hopefully leads to charges and at least one jailed executive, and the developers suing for restitution for unwarranted fees since the injunction prohibited the above behavior prevail, and the consumers suing for restitution in the US and UK prevail, because Apple broke the law to get and maximize those fees yet testified they do nothing for them.

And the DOJ antitrust later this year will feast on this.