MurphyA/hacker-news huggingface dataset:
by anyfoo | 2025-05-15 00:24:58+00:00
This seems to theorize an attack where you are interested in particularly data of the particularly visited website, and at the same time assuming that the attack would have to be carried out on the same website.

The vulnerability however allows arbitrary reading of any memory in the system in at least some circumstances, the presented PoC (https://www.youtube.com/watch?v=jrsOvaN7PaA ) demonstrates this by literally searching memory for the system's /etc/shadow and dumping that.

Whether the attack is practical using JS instead of a compiled C program is unknown to me, but if it is, it's not clear to me why the attacker would need to inject JS code into other websites or know what addresses to target. (If it is not, the question is moot.)
by makeitdouble | 2025-05-15 00:25:47+00:00
> While it captures something profound about human needs and wants, it can be subtly conservative and its dominance is symptomatic of a worrying turn against analysis and critique.

I was surprised at how this part is presented in the conclusion. This is a lot more obvious to my eyes, I wonder if people really see it as subtle.

To back my point: art was initially commanded by rich and powerful people/entities. Even if you had original popular stories, are those being formated into art required a skilled person being kept afloat by a patron. Nowadays I'd argue it's not that different, a movie studio backing a multi-million project has specific constraints.

Subversive art only existed for the pleasure of the higher class (thinking Voltaire for instance) or in closed socieities, with limited diffusion and was extremely risky for the author. That's not what would stay in history as classics or see wider adoption.

In comparison a government will helpfully propagate tales that promote social harmony and align the population with the nation's values. Classic hero tales and storytelling structure converging on tropes and the same messages hammered again and again is exactly how it is supposed to work.

This is also why foreign tales have different structures and landing points: they don't promote the same values nor need to anchor the same points. But they also have their tropes and carcan.

I don't deny creativity and authorship, but if we're looking at wide public entertainment that typically require wide distribution, these aspects cannot be overstated.

PS: outside of the narrative structure, the very fact that a story is centered around a set of protagonists, making decisions and being responsible for what happens in the plot is itself deeply cultural and polarized.

For instance showing a revolution as something triggered and lead by heroes, instead of a phenomenon that raises from a social situation, and would happen in some way regardless of who lead it, is a very specific and coded social choice.
by moonikakiss | 2025-05-15 00:25:48+00:00
great blog. It seems like you might benefit from columnar storage in Postgres for that slow query that took ~20seconds.

It's interesting that people typically think of columnstores for strict BI / analytics. But there are so many App / user-facing workloads that actually need it.

ps: we're working on pg_mooncake v0.2. create a columnstore in Postgres that's always consistent with your OLTP tables.

It might help for this workload.
by vlmutolo | 2025-05-15 00:25:54+00:00
Modern mini-led monitors are very good. The “local” dimming is so local that there isn’t much light bleed even in the worst-case situations (cursor over black background makes it particularly apparent).

The advantage of LEDs is they’re brighter. For example, compare two modern Asus ProArt displays: their mini-LED (PA32UCXR) at 1600 nits and their OLED (PA32DC) at 300ish nits. The OLED is 20% more expensive. These two monitors have otherwise comparable specs. Brightness matters a lot for HDR because if you’re in a bright room, the monitor’s peak brightness needs to overpower the room.

Plus for color managed work, I think LED monitors are supposed to retain their calibration well. OLEDs have to be frequently recalibrated.

And so-called micro-LEDs are coming soon, which promise to make “local” so small that it’s imperceptible. I think the near-term future of displays is really good LEDs.
by Sabinus | 2025-05-15 00:26:10+00:00
There have got to be community fine-tuned models for this floating about.

I mostly work with image gen so I can't give you recommendations, but there are plenty of people fine tuning their own models to make smut. Discord servers and patreon accounts.

You would probably have to get into the community to find the best fine-tunes for adult chat but they're certainly out there.

HN is a bit too high brow for this request, you'll probably have better luck on Reddit.
by thaumasiotes | 2025-05-15 00:26:45+00:00
> All the references to the original movies are on point

How I Met Your Mother was a very popular show.

But when I watched it, I was struck by the fact that in many, many places where an ordinary sitcom would have a joke, HIMYM instead had a continuity reference. Everything about the structure of the scene would suggest that the reference had been a comical beat, and the laugh track would play, but there was not even the faintest suggestion of... a joke.

If I want to hear about things that happened in the original movies, I can watch them. Does referring to them improve Andor somehow?
by panzi | 2025-05-15 00:28:25+00:00
Not sure why those are json_agg() instead of array_agg() in that example. Why would you use a JSON array instead of a native properly typed array? Yes, if you have some complex objects for some reason you can use JSON objects. But those where all just arrays of IDs. Also why was it json_agg() and not jsonb_agg()? Is there any reason on why to use JSON over JSONB in PostgreSQL?
by cadamsdotcom | 2025-05-15 00:28:40+00:00
It'd be great to forbid comments eg. using some of the techniques pioneered by Outlines, Instructor et al.

For now I'll do it with some examples in my context priming prompt, like:

Do not emit comments. Instead of this:

# frobnicate a fyzzit def frobnicate_fyzzit(self): """ This function frobnicates a fyzzit. """ # Get the fyzzit to frobnicate. fyzzit = ... ...

Do this:

def frobnicate_fyzzit(self): fyzzit = ... ...
by chungy | 2025-05-15 00:29:18+00:00
Fossil's "file format" is not intimately tied to SQLite: https://fossil-scm.org/home/doc/trunk/www/fileformat.wiki

That being said, it's the only existent implementation and none other are planned. If you'd like to port it to PostgreSQL, go for it, but it probably would lose a lot of the appeal of being a distributed version control system.
by insane_dreamer | 2025-05-15 00:30:12+00:00
I have mixed feelings about the USPS.

On the one hand, it seems like a good public service -- and certainly essential when it was created and up until recently.

But 99% of what comes in my mail box goes straight in the trash. We do everything we can to stop email spam, why not stop postal spam?

If the government offered email as a public service, perhaps there wouldn't need to be any reason for postal mail in terms of ensuring a means of communication that reaches every one.

The Postal Service could still exist but would be quite expensive and only used for things that actually matter (i.e., original legal documents like car title, etc.)
by wagwangbosy | 2025-05-15 00:30:27+00:00
He's probably talking about the walgreens on 4th and townsend and that area (also near where i live) has been getting worse in the past year. It was 1 of 2 neighborhoods that had an uptick in crime to the tune of 50%+. https://www.sfchronicle.com/crime/article/sf-neighborhoods-d...
by jjice | 2025-05-15 00:30:58+00:00
I believe it’s either released now or at least a feature flag (maybe only some systems). It’s absolutely absurd it took so long. I can’t believe it wasn’t the initial implementation.

Funny relevant story: we got an OOM from a query that we used Prisma for. I looked into it - it’s was a simple select distinct. Turns out (I believe it was changed like a year ago, but I’m not positive), event distincts were done in memory! I can’t fathom the decision making there…
by bee_rider | 2025-05-15 00:32:21+00:00
People build houses to protect ourselves and our stuff from the elements (and other climate control reasons), for privacy, for security, that sort of stuff. They are necessary for high-density living (plumbing helps to keep poop away).

Generally though, I would expect camping to be healthier than a hotel room. Hotel rooms and airbnbs are places that many humans go through, and humans are generally the main carriers of human pathogens. The only germs on your camping gear are your own ones.
by toomuchtodo | 2025-05-15 00:32:37+00:00
Almost 60% of US households have no kids in them [1]. We can infer demand for Manhattan housing stock by vacancy rates and rent levels [2] [3] [4] [5].

[1] https://www.visualcapitalist.com/how-american-households-hav...

[2] https://www.mns.com/manhattan_rental_market_report

[3] https://inhabit.corcoran.com/nyc-residential-rental-market-r...

[4] https://www.brickunderground.com/rent/nyc-manhattan-brooklyn...

[5] https://www.elliman.com/corporate-resources/market-reports/n...
by nine_k | 2025-05-15 00:33:21+00:00
Can you offer an example of a situation when the second factor authentifies without identification?

Assume a service S wants a confirmation that user U is indeed legitimate. The centralized auth service A could receive from S a bunch of data S knows about U, like name, address, phone, SSN, whatever S needs to know about U. Then A should respond whether the fields match the data which A knows about U, without revealing to S any additional data that A may know about U.

The problem if a centralized service is that it's a SPOF, and the juiciest target for compromising.

I still think that TOTP and personal crypto tokens like yubikey are the most resilient, and technically the easiest, solution to that.
by reillyse | 2025-05-15 00:33:37+00:00
this is worth thinking about. The idea that the small toll charge actually pays for the streets it covers is flat out untrue. The citizens of the US vastly subsidize the streets and roads of the country. Just purchasing the land used for roads in Manhattan would cost a massive fortune and the people paying taxes in the US have and are paying for it. Not to mention the cost of maintaining the roads (physical infra) and policing the roads. So if NY put the land to more productive use and didn't have to maintain the roads I think they could save a lot of money.
by JumpCrisscross | 2025-05-15 00:33:43+00:00
> the modern equivalent of a wallet with the silk screened face of Che Guevara on it

Sure. And I'd argue someone with that wallet is more likely to be knowledgeable about various elements of American and Latin American sociopolitical history than someone who doesn't. Even if just from reactions they get to it.

> It only serves to boost a domesticated leftist rethoric

In the short run. In the long run it breeds healthy scepticism among the intelligent. (It probably also radicalises some idiots. But I don't really have a systemic solution to stupid people.)
by czl | 2025-05-15 00:33:46+00:00
> And it will start with people are not respected or valued for their work, so they can leave, once left, they will not be replaced or replaced lower skilled folks and at some point that position stop existing altogether.

Automation changed farming for the worse? Farmers today are not respected / valued for their work? Farmers were replaced with low skilled labor? Do you think the job of a farmer (aka "food grower") will stop existing?

I do not predict future only look at what happened in the past and my answer to each question above about farming is the opposite what your comment would imply if it was applied to farming.
by adamcharnock | 2025-05-15 00:35:41+00:00
The Fog of War is definitely worth a watch. It was a fairly harrowing experience when I saw it. Actually, it is probably one of the hardest films I have watched. He clearly details the war crimes he presided over, and is open about the fact that he would have been tried as a war criminal had they lost.

He also pioneered the use of seat belts while at Ford. Which does make the morality-math a little more unusual.
by kccqzy | 2025-05-15 00:37:28+00:00
> the right law enforcement request will instantly unlock every service you have access to regardless of jurisdiction.

You are conflating the old model of "log in with Google" and the new model of Google syncing your passkeys in an E2E way. The latter is more resistant to law enforcement misuse (not 100%, see All Writs Act in the San Bernardino shooter case).
by FireBeyond | 2025-05-15 00:39:18+00:00
This notion that revenues are a problem for busses is also not universal, even in the US. In the PNW the bus services in the city I am in and nearby are free - no fares charged. Their revenue is elsewhere (note that I'm not saying ridership is unimportant, but if you're deriving revenue from ads which then ties to miles driven, then it becomes less important).
by josecodea | 2025-05-15 00:40:14+00:00
I know "minimal terminal email client in golang" sounds like a small feat, but it is not simpler than a webapp, it would be about equivalent, at least.

TUI libraries are more of a PITA than HTML. Also you gotta learn the entire API of a specific TUI library to make it work, this learning will never be useful to you again. With HTML at least you know it is a standard.

And remember, they told me:

> We always have a lot of candidates, some they do the basic, some provide a lot of extra features [...] From hiring point of view, we prefer stronger assessments.

and the instructions mention:

> Do the project in a way that shows off your skills as a developer

The instructions also mention "web app" as a valid solution, literally.

So why should I conclude that making the minimal effort would give me a better chance as an applicant?

There is simply no rhyme or reason to the entire process and communication from the company.
by Aurornis | 2025-05-15 00:40:22+00:00
The hardware itself is flexible and relies on software for things like calibration, setting frequencies, and setting power.

> Seems like security by obscurity.

There are legal standards to meet around protecting the system from users modifying things like output power. They don’t literally say that the source code must be private, of course, but keeping it closed source makes it much easier to demonstrate that you were not making it easy for people to exceed the regulatory limits.

If you document the registers for setting output power (for example) then you’re giving the end user a roadmap for changing output power.
by MisterTea | 2025-05-15 00:41:36+00:00
A long time ago I would write these stupid long, wordy, emails to my manager summing up my work week. He finally told me, "please, keep it short and sweet. I don't need to know every wire or line of code you touched. Just summarize it into a few sentences." Best conversation ever. Went from 2 hours of typing Friday afternoon to 10 minutes or so. I'm stumped as to why we went backwards.
by throwanem | 2025-05-15 00:41:48+00:00
> Some percentage of the cost of operating a state is therefore "work" done to back the currency's value.

No, this is perfectly reasonable and catastrophically, dangerously inverted. We do not operate a state to generate money. We use money to fund the operation of the state. Otherwise we create a perverse incentive attracting what would be parasitism, had we not just incompetently surrendered effective beneficial ownership of the resource to the first sufficiently convincing comer.

Say, for example, the Afrikaner failson of a gemstone magnate, who is regrettably good at cosplaying a foolish person's idea of a wise person.
by const_cast | 2025-05-15 00:42:16+00:00
The unfortunate reality is that access to drivers licenses is correlated with race and poverty (which is, in turn, correlated with race).

The US is still largely segregated. If you just require voter id, then you will disproportionately affect black people. Not might, not may, will.

Our politicians aren't stupid, they know this. In fact, this is the sole reason these laws exist. This is the goal. If it wasn't, they would at least admit the risk of this. But they don't even do that.
by nullmuxer | 2025-05-15 00:42:47+00:00
As developers, we’re no strangers to Easter eggs-those hidden features or messages tucked away in our favorite apps, games, and codebases. But what happens when you take that geeky spirit and sneak it into something totally unexpected, like an adult humor picture book?

When I started writing and illustrating my latest book, I wanted to create something that would make people laugh, blush, and-if they had the right background-think a little deeper. That’s why “Molly’s Juicy Melons” isn’t just a book of double entendres and bold illustrations. Hidden within its pages is a code-cracking riddle, designed for sharp-eyed CS nerds.

Why hide a puzzle in a picture book? Because I believe that the best stories are the ones that invite you to play along. Whether you’re a developer who loves a challenge or just someone who enjoys a good laugh, there’s something extra satisfying about finding the hidden layer beneath the jokes.

The feedback so far? People love the mischief-and the competition. The first reader to crack the code earns eternal bragging rights (and maybe a little prize from me).

If you’re curious, I’d love to hear: What’s the best Easter egg you’ve ever found (or hidden) in code, books, or games? And if you want to take a crack at the riddle in “Molly’s Juicy Melons,” DM me or check out my profile for more info.

P.S. If you’re into wild wordplay, my other book “Bob’s Big Hose” is packed with innuendo and another sneaky CS puzzle. Because why not keep the fun going?
by roughly | 2025-05-15 00:43:39+00:00
AI isn't the one closing up shop, it’s the one looting all the stores and taking everything that isn’t bolted down. The AI companies are bad actors that are exploiting the openness of the internet in a fashion that was obviously going to lead to this result - the purpose of these scrapers is to grab everything they can and repackage it into a commercial product which doesn’t return anything to the original source. Of course this was going to break the internet, and people have been warning about that from the first moment these jackasses started - what the hell else was the outcome of all this going to be?
by kstrauser | 2025-05-15 00:44:16+00:00
That's an interesting perspective, and I can't strongly disprove it, but that doesn't match my impression. I cloned both repos (Gitea's from GitHub; Forgejo's from Codeberg, which runs on Forgejo) and ran this command:

git log --since="1 year ago" --format="%an" | sort | uniq -c | sort -n | wc -l

to get an overview of things. That showed 153 people (including a small handful of bots) contributing to Gitea, and 232 people (and a couple bots) contributing to Forgejo. There are some dupes in each list, showing separate accounts for "John Doe" and "johndoe", that kind of thing, but the numbers look small and similar to me so I think they can be safely ignored.

And it looks to me like Forgejo is using a similar process of combining lots of smaller PR commits into a single merge commit. The wide majority of its commits since last June or so seem to be 1-commit-per-PR. Changing the above command to `--since="2024-07-1"` reduces the number of unique contributors to 136 for Gitea, 217 for Forgejo. It also shows 1228 commits for Gitea and 3039 for Forgejo, and I do think that's a legitimately apples-to-apples comparison.

If we brute force it and run

git log --since="1 year ago" | rg '\(\#\d{4,5}\)' | wc -l

to match lines that mention a PR (like "Simplify review UI (#31062)" or "Remove `title` from email heads (#3810)"), then I'm seeing 1256 PR-like Gitea commits and 2181 Forgejo commits.

And finally, their respective activity pages (https://github.com/go-gitea/gitea/pulse/monthly and https://codeberg.org/forgejo/forgejo/activity/monthly) show a similar story.

I'm not an expert in methodology here, but from my initial poking around, it would seem to me that Forgejo has a lot more activity and variety of contributors than Gitea does.
by const_cast | 2025-05-15 00:45:31+00:00
IME this is only a problem really in American cities because we put as close to zero effort into public transit as possible. We just plop buses on the road and expect that to do something.

I did also have this experience with the London underground during strikes, but it wasn't a surprise and we could still see when trains would arrive. So, much less unpredictable.
by AngryData | 2025-05-15 00:46:04+00:00
A consumption tax isn't going to make meat suppliers any more conscious of environmental effects from poor processes though, if any thing it will push them further away from it to try and lower prices more.

Also steak is a terrible example, cows eat alfalfa which is a nitrogen fixating crop and reduces artificial fertilizer usage that doesn't require pesticides and is basically free to grow anywhere it rains. And we don't grow alfalfa in arid places to feed US people meat, we grow it in arid places because it is near the ports and container ships need some sort of cheap bulk weight to send back to China as ballast.
by malfist | 2025-05-15 00:46:44+00:00
You had to pick battery or strings attached cash, before the update arrived. And the battery replacement required you to send your phone off for repair leaving you without one, and Google didn't offer an sla for turn around.

And let's be honest, inconveniencing me is hardly acceptable, even if the company makes a token effort to put things back to before they inconvenienced me.
by lexandstuff | 2025-05-15 00:47:07+00:00
Funny, I would give the absolute opposite advice. In my experience, the use of agents (mainly Cursor) is a sure-fire way to have a really painful experience with LLM-assisted coding. I much prefer to use AI as a pair programmer, that I talk to and sometimes get to write entire files, but I'm always the one doing the driving, and mostly the one writing the code.

If you aren't building up mental models of the problem as you go, you end up in a situation where the LLM gets stuck at the edges of its capability, and you have no idea how even to help it overcome the hurdle. Then you spend hours backtracking through what it's done building up the mental model you need, before you can move on. The process is slower and more frustrating than not using AI in the first place.

I guess the reality is, your luck with AI-assisted coding really comes down to the problem you're working on, and how much of it is prior art the LLM has seen in training.
by protocolture | 2025-05-15 00:47:27+00:00
I used to work for a not for profit. The level of legal graft was enormous.

We once got audited by a government agency. Said government agency had been extensively burdened with restrictions in its operation by lobbying from the NFP space.

After completing the audit, the gentleman running the government agency had a press release more less saying "I think it would be best if we were allowed to release our findings where they pertained to the expectations citizens have for the not for profit space, and not just where we find outright illegal behaviour. People should be able to understand exactly how much of a charities funding is used for its actual charitable purpose, and how much of its funds are effectively gifts for directors and staff"

Which sort of sums it up. Graft goes on it just finds a legal path.
Show HN: Fusion – A PHP Package Manager
by retlim | 2025-05-15 00:47:34+00:00
Hi there, I've been working on Fusion, a PHP package manager for PHP-based projects that automates repetitive tasks such as managing dependencies, migrating package states, extending packages, and registering loadable code.

Key features:

- Everything is a modular package

- Scoped metadata and snapshot files

- Lifecycle callbacks

- Auto-generated code registries

- Flexible package references

- Directory type indicators

- Interface-based customization

Repo: https://gitlab.com/valvoid/fusion/php/code

Would love any feedback.