MurphyA/hacker-news huggingface dataset:
by nativeforks | 2025-05-13 03:03:05+00:00
JetBrains has released the first stable version of Compose Multiplatform for iOS, enabling developers to use Kotlin and Jetpack Compose to build native user interfaces across Android, iOS, desktop, and web — from a single codebase.

This brings full cross-platform UI development closer to reality with shared UI logic, native performance, and official tooling support in IntelliJ IDEA and Android Studio.

Has anyone tried using Compose Multiplatform in production yet?
by s3p | 2025-05-13 03:03:54+00:00
+1 this. Whisper works insanely well. I've been using the medium model as it has yet to mis transcribe anything noticeable, and it's very lightweight. I even converted it to a coreML model so it runs accelerated on apple silicon. It doesn't run *that* much faster than before.. but it ran really fast to begin with. For anyone tinkering, ive had much success with whisper.cpp.
by john8675309tm | 2025-05-13 03:03:58+00:00
Hi, today I was working on moving some of my mssp clients to IPsec as fortinet is getting rid of sslvpn I think in 7.6.3, I use Linux, and I guess NetworkManager’s version of l2tp no longer supports xauth. I went looking for another NetworkManager based IPsec/l2tp client. I didn’t find one, but I did find Shrew Soft VPN https://www.shrew.net/ last updated in 2013 this was almost the vpn I was looking for it didn’t have NetworkManager support. Only supported Ubuntu 20 with OpenSSL 1.x (I use Debian 12). I decided to fix it for 2025 it has OpenSSL 3.x support and QT5 so hidpi works. I probably won’t use this at all and should have spent my time fixing NetworkManager, but here we are.
by kaydub | 2025-05-13 03:04:49+00:00
You are getting ripped off.

The 3paos can do FedRAMP audits for much lower. I've seen as low as $150k. We dropped our auditor for another because we were priced at $X, but when they came into our office and saw that we bring in a ton of money (we used to have our sales info on every screen on every floor of the office) they updated their pricing for next year's audit.
by xyzzy_plugh | 2025-05-13 03:05:34+00:00
Reproducibility is a second order effect. It's not a direct goal (at least originally) and as already discussed in this thread, more or less to death, not something that is required. It is very easy to write a derivation that cannot be reproduced. Sometimes it's even useful. Purity isn't really required at all. I wouldn't even say reproducibility is encouraged. It just sort of falls out of the system.

If Nix was worried about impurities that impact reproducible builds, they certainly wouldn't make live timestamps readily available in the pure environment, would they?
by somenameforme | 2025-05-13 03:10:38+00:00
I think you're more observing an issue with experimental models not challenging a null hypothesis, than with poor null hypotheses themselves. In other words, papers creating experiments that don't actually challenge the hypothesis. There was a major example of this with COVID. A typical way observational studies assessed the efficacy of the vaccines was by looking at outcomes between normalized samples of nonvaccinated and vaccinated individuals who came to the hospital and seeing their overall outcomes. Unvaccinated individuals generally had worse outcomes, so therefore the vaccines must be effective.

This logic was used repeatedly, but it fails to account for numerous obvious biases. For instance unvaccinated people are generally going to be less proactive in seeking medical treatment, and so the average severity of a case that causes them to go to the hospital is going to be substantially greater than for a vaccinated individual, with an expectation of correspondingly worse overall outcomes. It's not like this is some big secret - most papers mentioned this issue (among many others) in the discussion, but ultimately made no effort to control for it.
by YouWhy | 2025-05-13 03:12:23+00:00
> This raises the question of what constitutes "dramatic impact"

That's a valid critique. What I had in mind is the overwhelming prevalence of researchers who in my opinion have never even carried out a high risk high reward project, regardless of impact (not every high risk high reward project is going to make impact, and that's fine).

As example of what I have in mind by high risk high reward, I'd like to point at the work of Katalin Karikó and James P. Allison, both highly untypical science practitioners who have been rejected and indeed denigrated during much of their careers.

There are two root causes that for the most part, grad student do not develop into a Karikó or an Allison:

(a) Most grad students are never put in a position where choosing a high risk high reward project is legitimate.

(b) Many grad student in the first place do not have the character such projects (tolerance to sparse rewards and inclination to long term project risk management)

Regardless of the root cause, I observe that a grad student who was never trained to properly manage a big bet project is not likely to succeed doing that after graduating.

To be clear, I do not blame anyone in that situation. The graduate school system selects candidates for being good underlings to the thesis advisor, and down the road for aligning into field/department politics. There's little wonder to me how this system perpetuates a meek research mentality.
by xyzzy_plugh | 2025-05-13 03:12:56+00:00
Yocto is significantly better than what proceeded it. I could fill a book on ways it has pushed the envelope for embedded development.

Is Yocto a steaming pile? Yes absolutely. But it remains a means to an end.

I'd struggle to accomplish with Nix what can be accomplished out of the box with Yocto. Now that being said I'd certainly try and use Nix over Yocto any day of the week.

I remain optimistic and that the two will converge and it will more or less not matter, though I'd much prefer Nix to consume embedded development than Yocto become Nix-pilled.
by catboybotnet | 2025-05-13 03:14:20+00:00
Why care about stars in the first place? Github is a repo of source repos, using it like social media is pretty silly. If I like a project, it goes into a folder in my bookmarks, that's the 'star' everyone should use. For VCs? What, are you looking to make an open source todo app into a multi million dollar B2B SaaS? VCs are the almighty gods of the world, and us humble peons do not need to lend our assistance into helping them lose money :-)

Outside of that, neat project.
by throwanem | 2025-05-13 03:15:29+00:00
Perf, though? If a perf optimization changes the UI noticeably other than by making it smoother or otherwise less janky, someone is lying to someone about what "performance" means. Likely though that be, we needn't embarrass ourselves by following the sad example.

No, UIs churn because when they get good and stay that way, PMs start worrying no one will remember what they're for. Cf. 90% of UI changes in iOS since about version 12.
by kaydub | 2025-05-13 03:15:37+00:00
If it's costing $15-$20M to get a FedRAMP ATO you are probably doing at least some things VERY wrong. A ton of the security controls you should already be implementing in ANY environment.

Care to explain those numbers? Bigger places I could see racking up the costs, but those numbers seem absurd.

Just for a reference, I've been the technical side of a FedRAMP audit for 2 different companies, 1 getting a moderate ATO and the other we first got a li-saas and then later a moderate ATO to encompass more of our products.

The first company, when I started, didn't even hit $10M ARR. The audit itself, at least the first one, cost us $150k (went up to $250k the next year). I migrated their workloads from a rack in a data center to AWS GovCloud and implemented all the FedRAMP security controls. The FedRAMP instance probably cost us $150k per year to run, plus probably $250k/yr in additinoal salaries. We heavily depended on free open source software, but there were definitely some tools I would've preferred to buy. Most of the controls should have already been enabled and there were only a couple which "cost" us anything.

The company I'm at now is much bigger. We're kinda a cybersecurity SaaS and we practice what we preach. Our FedRAMP audits have always gone off without a hitch. Took minimal changes to hit all security controls. It definitely helps that we're 100% cloud and cloud native though.
by kadoban | 2025-05-13 03:15:37+00:00
> If you read the post, the scenario clearly states “no further silicon designs ever get manufactured”. It’s a thought experiment, nothing more.

This kind of just breaks the thought experiment, because without the "why?" of this being vaguely answered, it makes no sense. How do you game out a thought experiment that starts with an assumption that humanity just randomly stops being humanity in this one particular way? What other weird assumptions are we meant to make?
by danielmarkbruce | 2025-05-13 03:20:15+00:00
Read a little bit about key generation.

We abdicate decision making to random processes in many places. Quant finance, all kinds of physical processes simulation and optimization where decisions are made in real time by systems (like oil refineries).

And really, AI models are only black boxes in the aggregate. You can go through and understand every single calculation. You can understand it in training (except perhaps at initialization), you can understand it in inference (except perhaps if you want to use randomness in sampling). I'd suggest that Google Search pre-ML was a black box in the aggregate too... no one could really understand it all.
by crabmusket | 2025-05-13 03:20:44+00:00
I visited after having read Jane Jacobs the year before and becoming quite sympathetic to her vision of city life and active neighbourhoods through mixed uses. The Barbican felt like the philosophical opposite.

I read somewhere, I wish I could remember where, that some urban designers in the 60s had the feeling that people should spend their recreation time in their private homes rather than outside.

The Barbican felt like it had achieved that ideal of lifelessness, with bizarrely large and featureless open spaces, scant seating, etc. Of course that contrasted with the spaces around the arts centre which were bustling.
by nothercastle | 2025-05-13 03:21:42+00:00
Somewhere there was an excellent blog post that I lost the link to that explains that fusion and nuclear have basically the same requirements for energy extraction. You can therefore estimate the ideal cost of a perfect fusion reactor and zero out the cost of the generation side and get a rough estimate of the lowest possible cost for fusion with current technology. I think that put you at somewhere near the 20c mark. Solar is 4-5c and going down, it’s hard to beat that. Also you have to be careful when comparing solar to fusion because there are significant lifecycle costs on fusion that are not present in solar. So you have to take that into account when calculating total cost
by mr_toad | 2025-05-13 03:21:46+00:00
The model is not compressed data, it’s the compression algorithm. The prompt is compressed data. When you feed it a prompt it produces the uncompressed result (usually with some loss). This is not an analogy by the way, it’s a mathematical equivalence.

You can try and argue that a compression algorithm is some kind of copy of the training data, but that’s an untested legal theory.
by 0_____0 | 2025-05-13 03:22:21+00:00
Found this one anecdote in that thread and I'm pretty sure this would be me as well.

> I tried to code on shrooms once.

> I ended up writing a C++ program that just made the internal speaker beep in an infinite loop, and tried to compile it with a C compiler.

> I started laughing hysterically and I became quite scared that the C compiler was going to get angry with me, so I went outside and stayed away from my computer in fear.
by xyzzy_plugh | 2025-05-13 03:23:47+00:00
What made these games different was that the musical themes were significant and well known long before you installed your SoundBlaster. The music was mixed at high intensity out of the box allowing it to influence you, each track tailored to the moment.

This gave the series a leg up in that the music could actually communicate information effectively -- a tense moment, the shifting tide of the battle, the calm after a victory -- whereas other games simply had to put up waveforms that sounded pleasing.

To be fair many games experimented with sound design in this era, but few had such legendary IP to build with. An unfair advantage to say the least. The folks wielding iMUSE clearly knew what they had.
by Ambitious_9410 | 2025-05-13 03:26:02+00:00
Hi HN!

I wanted to share something we built at Cuppa support to help solve a challenge we were facing as a small team: managing emails efficiently. For the longest time, we used a shared Gmail account, but as our email volume grew, things got messy. We didn’t know who was handling which emails, and responses were getting lost. We tried various tools, but most were either too complex or way out of our budget.

So, we built Cuppa support – a simple shared inbox tool designed for teams like ours. Here’s what we focused on:

Affordable, no per-seat pricing: We wanted a solution that didn’t charge based on the number of people on the team. It’s a fixed, affordable price.

Simplicity: No ticketing system or convoluted workflows—just a straightforward shared inbox where team members can claim and respond to emails.

*Collaboration: It helps teams track replies, assign emails, and keep everyone in the loop without chaos.

Our goal is to provide a tool that makes email management easier for small teams who just want to get things done without dealing with complex systems. We're not trying to build a full CRM—just something that solves a real problem.

If you're part of a small team that needs to manage shared emails and are tired of overly complicated systems, we’d love for you to give Cuppa Support a try. We’d also love any feedback, especially from teams that are facing similar challenges.

You can check it out here: https://www.cuppa.so

Looking forward to hearing your thoughts!
by AStonesThrow | 2025-05-13 03:26:37+00:00
Yeah so like, every time I ran AV software it was quite obvious where the paranoia settings were, and how to tone down the aggressive "scan everything everywhere every time" settings.

For 98% of systems, there is probably no reason to scan every file on opening it. If people have enabled that setting, or left that default on, then that's their problem; it's not Windows Defender's fault.

My current AV dashboards are screaming at me that I'm only 35% protected. That's because I've exercised a lot of prudence in enabling paranoid settings, based on my rather limited and simplistic threat modeling. Installing AV software comes with the understanding that it can steal resources, but they nearly always have plenty of settings that can be disabled and win back your system responsiveness.

I am beginning to believe that commenters giving bingo-card winnings are not the brightest bulbs in the Windows MCSE pool, honestly. I can relate: Linux and Unix admin in general is far more intuitive and comfortable for me, so I have generally stayed on that side of things, but knowing how to properly set up Windows is an indispensable life skill for anyone.
by Revozzy | 2025-05-13 03:26:51+00:00
Most people chasing new Mersenne primes — the rare numbers of the form 2^p - 1 — look for the real thing: big, beautiful primes used in encryption and number theory.

But while studying these, we found something odd:

Some composite numbers built from the same formula look exactly like Mersenne primes in binary — 100% 1’s, no difference in structure — and only fail at deeper primality tests.

We believe: • These “Mersenne impostors” could help sharpen how we screen for real primes • They might even explain false-positive cases in cryptographic applications • And this pattern doesn’t seem to be documented in any major research database
by tomhow | 2025-05-13 03:28:32+00:00
I've updated the title to something less sensationalist and more representative of the article's content.

HN does have a policy of using the original title from the submitted article, unless it is misleading or linkbait, and we try to be rigorous in enforcing it.

Users can help us by emailing us (hn@ycombinator.com) when they see a case where a title seems to be misleading or linkbait.
by transpute | 2025-05-13 03:29:17+00:00
Public discussions, https://github.com/FedRAMP/rfcs

RFC-0005: Minimum Assessment Scope Standard, https://github.com/FedRAMP/rfcs/discussions/17

RFC-0006: 20x Phase One Key Security Indicators, https://github.com/FedRAMP/rfcs/discussions/18

RFC-0007: Significant Change Notification Standard, https://github.com/FedRAMP/rfcs/discussions/19

RFC-0008: Continuous Reporting Standard, https://github.com/FedRAMP/rfcs/discussions/27
by pveierland | 2025-05-13 03:33:41+00:00
Yes, I agree that reproducible builds is something that can be solved fully independently of Nix, and that Nix alone does not solve it, and that as such it is independent of Nix.

However, as the point of Nix is to achieve reproducible software deployments through a pure and functional description of the deployment, where it also provides mechanisms that systematically improves build reproducibility, I feel that orthogonal is misleading (as was my original disagreement) because reproducible builds correlate with Nix, and because achieving reproducible software deployment is a clear original goal of Nix, e.g. by seeking to remove implicit dependencies through mechanisms such as sandboxing of builds.
by satisfice | 2025-05-13 03:34:03+00:00
Safer is not necessarily better. That’s a choice you are making.

I gave up driving a motorcycle when I got married, because I no longer enjoyed putting myself and others at risk. It fascinated me how instantly I lost interest in it, because I hadn’t realized that risk had been the prime motivator.

Maybe the sensation of risk is an important vitamin for the spirit of a man. Anyway, you don’t know that it isn’t.
by distrustryan | 2025-05-13 03:34:20+00:00
that Rust example is gonna bite us in the ass until the day i die, i need to remove it.

The Keyfork project is probably the best example of how an _actual_ Rust project is developed and shipped with stagex (disclaimer, I'm a maintainer of both). Actual Rust programs are built using the following steps:

1. Before building, the stagex tooling downloads and verifies a hash-locked version of the source package * Additionally, all dependencies for the package (compilers _and_ linked libraries) are verified to have been built. 2. Packages and pallets (collections of packages) are unpacked `FROM scratch` into a bare container 3. `cargo fetch --locked` is then invoked to fetch all the dependencies. 4. `RUN --network=none` is used when compiling the actual binary to ensure no network access happens _after_ the `cargo fetch` stage. Admittedly, it is not ideal to allow turning network access on and off throughout a build, but `--network=none` has helped us identify some odd cases where network access _does_ happen. 5. Once the binary is built, the binary is added on top of the base "filesystem" package, and is considered "done".

Unless some source file gets completely yoinked off the internet (which has happened, and we've had to "rebuild the world" because of it), every stagex package should be 100% bit-for-bit reproducible even if run several years down the line.

There may be some cases where we miss a datestamp or something similar, but hopefully as time goes on, we get the infrastructure to mock system times and throw other wrenches to test how reproducible these packages really are.
by mindslight | 2025-05-13 03:35:27+00:00
The only dependency of the original Furby was AA batteries. If you find one in a drawer, you can clean out the battery compartment, pop in new cells, and you're probably good to go.

Meanwhile smartphones have enabled this trend writ large with devices now entirely dependent on surveillance-laden someone-else's-computer-connected throwaway apps that are only meant to work long enough to churn to the next product revision.
by crq-yml | 2025-05-13 03:35:57+00:00
CD and other formats create trade-offs vs MIDI event sequences - it's a simple playback method offering a lot of fidelity but in exchange, you're tied to having either "one track at a time and the CD spins up in between" (Redbook CD), cueing uncompressed sampled tracks(feasible but memory intensive) or cueing one or more lossy-compressed streams(which added performance or hardware-specific considerations at the time, and in many formats, also limits your ability to seek to a particular point during playback or do fine-grained alterations with DSP). So as a dynamic music system it tends to lend itself to brief "stings" like the Half-Life 1 soundtrack, or simple explore/combat loops that crossfade or overlay on each other. Tempo and key changes have been off the table, at least up until recently(and even then, it really impacts sound quality). DJ software offers the best examples of what can be done when combining prerecorded material live and there are some characteristic things about how DJs perform transitions and mashups which are musically compelling but won't work everywhere for all material.

MIDI isn't really that much better, though - it's a compatibility-centric protocol, so it doesn't get at the heart of the issue with dynamic audio of "how do I coordinate this". All it is responsible for is an abstract "channel, patch number, event" system, leaving the details involved in coordinating multiple MIDI sequences and triggering appropriate sounds to be worked out in implementation. An implementation that does everything a DAW does with MIDI sequences has to also implement all the DSP effects and configuration surfaces, which is out of scope for most projects, although FMOD does enable something close to that.

I think the best approach for exploring dynamic and interactive right now is really to make use of systems that allow for live coding - Pure Data, Supercollider, etc. These untangle the principal assumptions of "either audio tracks or event sequences" and allow choice, making it more straightforward to coordinate everything centrally, do some synthesis or processing, some sequencing, adopt novel methods of notation. The downside is that these are big runtimes with a lot of deployment footprint, so they aren't something that people just drop into game engines.
by winwang | 2025-05-13 03:36:43+00:00
1. Yes! Would love to contribute back to these projects, since I am already using RAPIDS under the hood. My general goal is to bring GPU acceleration to more workloads. Though, as solo founder, I am finding it difficult to have any time for this at the moment, haha.

2. Hmm, maybe I should mention that we're not "accelerating all operations" -- merely compatible. Spark-RAPIDS has the goal of being byte-for-byte compatible unless incompatible ops are specifically allowed. But... you might be right about that kind of quirk. Would not be surprising, and reminds me of checking behavior between compilers.

I'd say the default should be a focus on compatibility, and work through any extra perf stuff with our customers. Maybe a good quick way to contribute back to open source is to first upstream some tests?

Thanks for your great questions :)
by xarope | 2025-05-13 03:37:12+00:00
I rode something like this as part of a tour in switzerland, when turning left I was told to lean to the right (which is obviously different to a two wheeler where you lean in the direction of the turn), otherwise you'd pop-up on two wheels easily enough!

And you really have to push the handle bars, for steering. Again, very different to a two-wheeler.
by tguvot | 2025-05-13 03:37:13+00:00
I work for an established saas company with rather large and complicated system. For fedramp we had to build a new dedicated environment (because it was impossible to certify existing one which is hybrid, located in multiple countries ), hire dedicated us personal (agency requirements) and redo a bunch of internal processes to comply with fedramp controls.

I think cost was around $15m