MurphyA/hacker-news huggingface dataset:
by whoisthemachine | 2025-05-26 13:24:15+00:00
> The vast majority, hard to quantify, but I'd guess well over 99% of professional musicians (certainly outside the US) never play a ticketmaster venue. They're not operating at that scale. When they tour it's at smaller venues - there are orders of magnitude more small bars and dedicated venues not owned by ticket master.

This is probably true, but I'm guessing smaller artists are also at much lower risk of scalpers (at least my anecdata backs that up) so probably much less applicable to the problem at hand.
by felipemesquita | 2025-05-26 13:24:32+00:00
The post is about how webhook requests are usually signed and api responses are not.

For me it seems clear that the reason for this different approach is that api requests are already authenticated. Signing them would yield little additional security. Diminishing returns like the debate over long lived (manually refreshed) api keys versus short lived access tokens with long lived refresh tokens - or, annoyingly, single use refresh tokens that you have to keep track of along with the access token.

Webhooks are unauthenticated post requests that anyone could send if they know the receiving url, so they inherently need sender verification.
by supriyo-biswas | 2025-05-26 13:24:47+00:00
> banks that limit the efficacy of these kinds of attacks?

In my country, transfers of very large sums often require upping the transaction limit by visiting the bank branch, filling out a form and then submitting it at which point it’ll be accepted in a few days.

While obviously inconvenient when trying to transfer funds for investments, etc. it’s easy to see why the system prevents fraud of this sort.
by flippyhead | 2025-05-26 13:25:04+00:00
That's only how it seems. General purpose deep research just doesn't work as well.

Thanks for taking the time! I love these guys. They are definitely way more useful in that they are general-purpose. What we're doing is much more specific, and the results are very different. Try both and compare!

I have no doubt we'll soon get taken over by general-purpose systems. But for now, all we do is deep research to find competitors, and the results are for sure much better with us for that narrow use case.
by prmph | 2025-05-26 13:25:38+00:00
You're still perpetuating this myth that it is about the tools, when every interaction I've had with coding assistants and LLMs veers into the territory OP describes. To be fair, the work I am doing is pretty complex and novel.

And I use a wide range of model/versions.I mostly use Claude, from 3.5 to the newest 4.0. I also use Gemini and with Copilot.
by ido | 2025-05-26 13:25:55+00:00
Maybe the best universities are in the U.S.

For undergraduate I don't think it matters that much as you're far enough removed from the state of the art at that point anyway- you'll probably get about the same level of bachelor-level CS education at any decent university in the developed world as you would in the top US institutions like Stanford and MIT (and most Americans don't go to these elite institutions anyway)?

For graduate/research it's of course a different case altogether, these elite institution seem to mostly be elite in research, not pedagogy. What probably does matter is that the base level of tertiary education is good enough (which seems like it's the case in western Europe, but maybe not in a lot of the developing world).
by der_philipp | 2025-05-26 13:26:32+00:00
Unfortunately not; But to be honest: The episodes are titled after the tools they cover.

The podcast is a short-format that explains the problem, the tool as a solution and some side notes.

Example: "File renaming is annoying and complicated. Then I found the `renameutils` package and from that i use qmv. It opens your favourite editor with the names of all files you want to rename. Once you are done with the modifications, you close the editor and the files are renamed. That's it! Enjoy!"

I actually started it as I just LOVE cli tools and want to spread some love for them. Also I love telling people about them and so many people were thankful for the hints and later-on told me "oh that tool saved me so much time! i love it." And the podcast is just the idea to spread the knowledge of those tools
by vegims | 2025-05-26 13:26:32+00:00
Just wanted to say, really loving this so far. Tried it on a couple of real PRs today and the summaries alone saved me a chunk of time. It actually understood what the change was doing instead of just paraphrasing file diffs, which is more than I can say for most tools I’ve tried.

Also appreciated that it flagged a subtle performance issue I almost missed. This feels like the kind of assistant I wish GitHub had built into reviews by default.
by Brian_K_White | 2025-05-26 13:27:23+00:00
Please describe exactly the software change you imagine would produce this result, and describe how it gets from the attackers head onto the machines where it needs to run.

In other words I think you have hanwaved and imagined 2 different required things which probably simply don't exist. Or at least, may exist but could easily not exist.

There may be no such thing as a software change that will give a back door to the data. It depends hpw the system is designed, which I do not know.

And there may be no such thing as a way to get such software change onto customers machines without passing through review by multiple someone else's. Even if one, as owner of a business has the power to change the review policy itself, it's still physically impossible to do that without everyone else knowing it happened.

tarsnap would have to be a sole developer sole propriator business (or a multi employee business run as badly as crypto custodians aparently all are) for that to even be physically possible. Which maybe it is but it's not the impression I've formed of that company over the many years. Not a customer, and know nothing of either the software or the company's internal workings.
by dcow | 2025-05-26 13:27:41+00:00
> Signing requests does give extra security points, but why do we collectively place higher security requirements on webhook requests than API requests?

TFA is exploring the juxtaposition of signed web-hook requests vs bearer token api requests, both of which provide authentication but one of which is arguably superior and in common enough use to question why it hasn't become common practice at large.

To flip the question: if there aren’t meaningful benefits to signing requests, why don’t web-hooks just use bearer token authentication?
by paulryanrogers | 2025-05-26 13:27:44+00:00
Being raised Republican, you are taught from elementary age that taxes are morally evil. They should only be imposed as necessary and as a disincentive against evil behavior.

Also the government is incompetent, bloated, and also evil. The only truly good government is god and his appointed ~grifters~ [messengers].

I wish I was joking. That's what I was taught at home for like 30y.
by HenryBemis | 2025-05-26 13:28:23+00:00
I tend to spend 15mins to write clear requirements (functional and non-functional specs). And then ChatGTP works its miracle. When I ask it "do write code in X language that does so-and-so", it's proper crapware. But those 15mins of reqs, save me 4-5 hours of writing back and forth, looking at manuals, etc (I'm not a super dev, I'm not even a professional dev.) But I do ask it to write code for me as am I trying to solve (my) small IT problems, and from seeing various marketplaces, nobody has posted code/software to do what I want.

Perhaps one day I'll 'incorporate myself' and start posting my solutions and perhaps make some dough.. but the I benefit far more than the $20 a month I am paying.

The right 'prompt' (with plenty of specs and controls) saves me from the (classic!) swing-on-tree example: https://fersys.cloud/wp-content/uploads/2023/02/4.jpg
by AstroBen | 2025-05-26 13:29:14+00:00
> would garner enough judgment to stop that person in their tracks

I don't agree the judgement itself should be the factor that stops them. Having that as an overly strong measuring stick is incredibly limiting. It's an indicator of something, sure.. but you should look for actual reasons and where it's coming from

If you ask "everyone seems to think this is a terrible idea.. why?". Well in the 'dilapidated building in a depressed town' case you'd pretty quickly find 100 reasons not to do it, as you pointed out. In a lot of other situations though there are none. Everyone is just following everyone else and no-ones truly considered the alternatives on their own merit

I'm with you that there's a good balance. I don't see a reason in being actively non-conformist or anything. There's an innate drawback to not conforming.. it makes you a little weird and un-relatable. Just need to make sure the benefits make up for it
by morsecodist | 2025-05-26 13:29:14+00:00
I have had a pretty similar experience to you. I have found some value here:

- I find it is pretty good at making fairly self-contained react components or even pages especially if you are using a popular UI library

- It is pretty reliable at making well-defined pure functions and I find it easier to validate that these are correct

- It can be good for boilerplate in popular frameworks

I sometimes feel like I am losing my mind because people report these super powerful end to end experiences and I have yet to see anything close in my day to day usage despite really trying. I find it completely falls over on a complete feature. I tried using aider and people seem to love it but it was just a disaster for me. I wanted to implement a fairly simple templated email feature in a Next.js app. The kind of thing that would take me about a day. This is one of the most typical development scenarios I can imagine. I described the feature in it's entirety and aider completely failed, not even close. So I started describing sub-features one by one and it seemed to work better. But as I added more and more, existing parts began to break, I explained the issues to aider and it just got worse and worse with every prompt. I tried to fix it manually but the code was a mess.
by specialist | 2025-05-26 13:29:29+00:00
> have enough neuroplasticity

I think so. It's hard. But doable.

I've reprogrammed myself at least 4 times so far (now 57yo).

Most recently, a few years ago, I went thru Swedish Hospital's Pain Clinic program. Synthesis of all the life skills recommended for trauma, mental health, and ADHD, plus some new ones for pain management.

I don't even believe this woo woo stuff even works. Yet it worked on me despite my skepticism. So what do I know?
by HybridCurve | 2025-05-26 13:29:30+00:00
I've only had great luck with the LLMs(chatgpt 3o) generated Perl code. It was able to synthesize code for a GTK2/3 application fairly consistently, without generating any syntax errors. Most of the code worked as described, and it seemed to make more mistakes misunderstand my descriptions of features rather than when implementing them. My colleagues suggested it was because Perl's popularity had fallen significantly before 2016, and the training data set might've had much less noise.
by ChrisMarshallNY | 2025-05-26 13:30:03+00:00
Eh. It is what it is.

We have different points of view.

One of my personal philosophies, is that I stand behind my words. I don’t hide behind anonymity (I’m a reformed troll -this was not always my personal credo). I make it easy to verify (or refute), anything I say, and do my best to treat community venues with respect.

I do know that there are some folks here that seem to be obsessively in hate with me. I’m not exactly sure what I’ve done, to earn their regard, but at least one of them, has tried taking their rancor “offline.” Didn’t really do much damage, and hasn’t caused me to change my approach. I've had literal axe murderers angry with me, IRL, so some Internet Tough Guy Magazine cover model isn't going to rattle me much.

It has, however, confirmed to me, that this place is not above some fairly childish behavior.
by lyu07282 | 2025-05-26 13:30:05+00:00
> fairly popular position even outside of traditionally leftist politics

Only leftist politics will actually be able to address the issues. Of course people will just mindlessly scream "sOcIaLiSm!" at anything and everyone, but it ultimately doesn't matter. We still have to be optimistic, once enough people have the vocabulary to think about their increasingly parlous circumstance, things will change in our direction inevitably.
by dhavaln | 2025-05-26 13:30:09+00:00
I am working on a simple tool to help founders:

StackAdvisor (A tech-stack advisor for MVPs and beyond)

- Understand the idea, team, budget, skillset, preferences (cloud services, language, frameworks), time to market, etc

- Generate smart questions and iterate based on answers

- Suggest rationale optimal architecture to begin with and implementation detail

- Include In Scope / Out Scope tasks, Week-1 to Week-12 plan

- Suggest low-code/no-code/AI-assisted tools for implementation
by InsideOutSanta | 2025-05-26 13:30:10+00:00
>It would be crazy if in an auto factory people were measuring to make sure every angle is correct

Yeah, but there's still something checking the angles. When an LLM writes code, if it's not the human checking the angles, then nothing is, and you just hope that the angles are correct, and you'll get your answer when you're driving 200 km/h on the Autobahn.
by kccqzy | 2025-05-26 13:31:46+00:00
I've used plenty of proprietary issue tracking systems and GitHub is missing several features that I now consider quite important though certainly not essential:

* The ability to write an issue summary separate from comments. When you are debugging some hairy bug, some manager doesn't really want to wade through all the comments to get an idea; an editable summary at the very top of the page communicates high-level points to stakeholders while others continue to comment on details. People work around this by editing the initial comment of the issue but it's better if there's something more dedicated.

* Sophisticated access control. More than once when someone writes a bug report they are referring to a bug experienced by a single user. For user privacy reasons there needs to be a per-issue permission system to restrict access beyond the permission implied by the repo.

* The ability to add personal notes to an issue without publishing it. Whether it's a draft form of a comment or something else, it gets rid of the need to maintain your own notes.
by ben_w | 2025-05-26 13:31:51+00:00
> The evidence for man made consciousness is ... ??? At this point, we don't even have a good definition of what consciousness is.

We have 40 definitions; while I suspect you're right that they are not good enough, some of them may be.

The evidence for machine consciousness is "look at what this does, it's acting in the way we spent the last 76 years saying machines could only act like if they were conscious".

Which is weak evidence given the arguments about what defines consciousness, but it's more than nothing.

To use your alchemy analogy, it might be to actual consciousness as iron pyrite is to gold — shiny, but not the real thing.
by exe34 | 2025-05-26 13:34:04+00:00
I've managed to use ChatGPT to write a small app in Kotlin, and later used Cursor to fix some issues around performance. Personally I'm not a finish-it kind of guy unless I'm getting paid for it.

To be fair, I'm not sure the quality of the code is much worse than all the boatloads of crapware in all the app stores out there.

I suspect that the reason "revolutionary products" and "blazing fast iteration" isn't blowing our minds is because the problem was never the code - it was always the people around it, who know better than their customers. The best way to make good software is to test it on real people and iterate - that's going to take a long time no matter how fast the coding part is.
by voidhorse | 2025-05-26 13:34:24+00:00
Completely agree. If anything LLMs have just made this completely transparent and are revealing that actual engineering in software is limited to rare cases.

All of theses middling developers who are so excited about these tools don't seem to realize that they are perfectly primed to eventually eliminate precisely the kind of worker responsible for hooking up existing APIs for solved problems into a web app, the kind of work the market hitherto greatly over esteemed and overpaid for isn't my going to be so esteemed or highly valued anymore. The only real work that will remain is actual hard engineering work (solving novel technical modeling problems, not just plugging apis together). All of these lazy devs are hyped for precisely the automation that's goin. to significantly reduce their pay and labor prospects in the long term lol. I'm shocked at times at how people can fail to see the writing on the wall when it's been written in gargantuan red ink
by lolinder | 2025-05-26 13:34:41+00:00
Why are you framing this as being primarily about Google being un-sueable? There's clearly a problem with Google being difficult to work with to re-claim ownership of a business profile (no customer support, as always) and Google obviously has deep pockets that would be tempting to get access to, but isn't Lieferando the one engaged in the extortionate business practices?

Under US law I can see a few different things that would make the Lieferando behavior you describe illegal, whereas all Google is doing is being the unwitting vector for their illegal activity.

It's always more difficult to pin fault for a crime on unwitting enablers even when their negligence arguably rises to the level of a crime. The big question here is why businesses haven't successfully fought back against the ones doing the actual crime?
by Qwertious | 2025-05-26 13:35:29+00:00
The "stability" is referring to how Trump's trade policies are constantly changing every few days, and are thus too unstable to plan business policy around. If Trump wants to promote US manufacturing, it's important that his policies to do so are stable enough for investors to plan profitable future US factories.

It is not talking about a stable government and the benefits/drawbacks of that.
by incomingpain | 2025-05-26 13:35:54+00:00
Polls are all in the 35-45% range, just like brexit. If Alberta separates, after replacing everything the federal government does, they'll have freedoms returned and have $25 billion/year more to spend on themselves.

Albertan culture and identity has been under attack for 10 years and it has caused a great division in the country. Certainly an unprecedented national unity crisis with 3 active serious separatism movements.

There are a number of interest groups who are going to boost alberta separatism.

USA greatly benefits due to oil and food trading; but more importantly the oil is priced in USD. Alberta likely switches to the USD or rolls their own.

Most other oil trade nations are going to boost for their separatism.

Gun rights advocates will essentially undo the gun bans. Not to mention allow handguns for wildlife protection. Absurd that Canada prohibits carrying a handgun in grizzly territory.

national defense corporations like lockheed martin will be able to sell the F35 to Alberta no problem. They benefit billions right away.

oil and gas industry unlocks trillions of $ by separating.

Quebec separatists will do all they can to get them to separate; alberta goes first and quebec will be able to follow.

Liberals, especially in Toronto, will heavily insult and push albertans out of canada. Without alberta, Canada essentially becomes a single party democracy run by the liberals.

There's so many interest groups boosting separatism, it's going to pass easily. Can you tell me even 1 group that has any good arguments for alberta to stay in confederation?
by pjmlp | 2025-05-26 13:37:21+00:00
WebGPU is currently only a Chrome API available across macOS, Android and Windows.

Everywhere where Chrome runs is an experimental API.

On Firefox and Safari, who knows when they will ever get out of preview API, and in what platforms, especially on Firefox's case.

WebGL 2.0 took about a decade to reach a wide enough audience, and WebGPU isn't yet widely available since the whole effort started in 2016.

This is why most companies are either doing native or streaming for 3D content.
by mtndew4brkfst | 2025-05-26 13:37:23+00:00
I was a Magit user for most of a decade and I deeply missed it when I first switched to jj. I still think something like it would be a huge boon for the community and I hope one comes to fruition eventually, but in an editor-agnostic form like matklad suggests here:

https://matklad.github.io/2024/12/13/majjit-lsp.html

With that yearning in mind, jjui is the jj TUI I like best so far having tried them all. It's snappy, has useful and intuitive keybinds and presents them well, and good stability so far. Doesn't quite seem to like it if I resize the surrounding zellij/terminal pane while it's open though.

Lazyjj was a little laggy and crash-prone for me on all of the same repos, and jj-fzf is a tragic pile of bash so I can't recommend ever using that.
by okanat | 2025-05-26 13:38:03+00:00
Which is a direct replacement to Docker Desktop unlike Podman. It matters when you have a WSL2 setup and want to access to the same container database from both Windows and Linux side (useful for cross-platform software).

With Podman you can only use main Podman distro to the fullest capability. While you can expose the socket to other WSL distros and use remoting, it doesn't work with bind mounting local folders to the container.
by romec | 2025-05-26 13:38:34+00:00
> And how is this useful to someone who can't get into these top schools because life is happening? Also, your outlook seems very unrealistic to me.

If you can't go to school because of life, chances are you can't self-study because of life as self-studying is harder.

> This is software development we're talking about, not medicine, not mechanical engineering.

Software development in many ways has more competition than those fields that have entry level positions in more rural areas.

> To be a top tier software developer, you need access to a decent computer and good resources to learn.

No, not to be a top tier software developer.

> Add to that the excellent guidance of curricula like OSSU, TeachYourselfCS, and others like them,

Someone who want to become a software developer shouldn't prioritize studying CS.

> if you have the mind for it and a bit of discipline, your skills will be as sharp as any top school graduate's

It will be many times as hard reaching that level yourself.

> Regardless of your path, these are the real gems companies are after, and if you truly have them, you will NOT be invisible in this domain.

Little to no indication that this is true. More like companies might still hire someone they need if they pass all the recruiters and tests favouring the traditional path.

> Getting hired in software has always been about showing that you can build software.

Always has been a academic, military and business field. That is why hackers happened in the first place.

Since we are at HN, you can look at YC.

https://www.ycombinator.com/people

Almost every partner and the founders have an elite or close to elite education. Something only around 1% of the population have, yet they make up all of the people. That is in an untraditional firm which literally runs Hacker News.

But let's say I'm wrong. No harm, no foul. Just go self-study then. Should be easy with that $432 lifestyle. https://news.ycombinator.com/item?id=44074340