MurphyA/hacker-news huggingface dataset:
Show HN: I made a client MCP react app for Supabase's MCP server
by michaelmilst | 2025-05-14 17:58:43+00:00
hey! I made a react app hooked up to Supabase's official MCP server, so I can chat to my Supabase project without really having to code any interactions to Supabase.

I also added some react components as UI tools so the AI responses show more than just text.

If you have a different MCP server you want it to intereact with, just switch the MCP url passed into the <TamboProvider>
by ajross | 2025-05-14 17:59:16+00:00
It's not "usually right" though. Rust can't compile a doubly-linked list[1] without unsafe!

And people trip over this immediately when they start writing Rust, because that kind of code is pervasive in other environments. Thus statements like "Rust just doesn't like dangling pointers" are unhelpful, because while it's true it's not sufficient to write anything but the most trivial code.

[1] Or basically any graph-like data structure that can't be trivially proven to be acyclic; even lots of DAG-like graphs that "should" be checkable aren't.
by narag | 2025-05-14 17:59:39+00:00
In biology one thing is made similar to other ("assimilated") in order to absorb it. In the same way, some ideas are packed in some format known to be easy to digest.

The trick in this topic is how dissimilar to some vague canon should a story be to qualify for an answer to your question.

Would you say Alien is a good example?
by jgalt212 | 2025-05-14 18:00:08+00:00
> The phishing site can forward the password and TOTP you type into the real system, gaining your access.

To me this seems harder to pull off than a fraudulent password reset (either via social engineering, or a hacked email account). My TOTP fell in the drink a few years back, and some accounts very hard to reset and others were too easy.
by Workaccount2 | 2025-05-14 18:01:22+00:00
Interestingly, it seems alphaevolve has already been in use for a year, and it is just now being publicly shown. The paper also mentions that it uses Gemini 2.0 (pro and flash), which creates a situation where Gemini 2.0 was used in a way to train Gemini 2.5.

I don't know if I would call this the fabled "self improving feedback loop", but it seems to have some degree of it. It also begs the question if Alphaevolve was being developed for a year, or has been in production for a year. By now it makes sense to hold back on sharing what AI research gems you have discovered.
by shadowgovt | 2025-05-14 18:02:10+00:00
Good news, unfortunately, rarely radiates with the power or urgency of bad news.

The mass-starvation concerns of the '70s-'80s were resolved by an army of agriculture and biological scientists developing revolutionary breakthroughs in staple food crops and farming techniques. These fundamentally staved off the "cold equations" starvation risk (most starvation in the modern era is logistical error; the food exists, it isn't where people are).

Unfortunately, key pieces of the solutions involved practices we know aren't sustainable indefinitely (fertilizer production is fossil-fuel heavy), so there's more work to be done (and some non-zero benefit if we were to discover that the global human population was falling without some mass-tragedy causing it).
by zahlman | 2025-05-14 18:02:33+00:00
> Not understanding the lifetimes of objects is what makes shared mutability hard.

Well, no; in my experience the difficulty overwhelmingly comes from thinking about the semantics. I.e.: these two clients currently share a mutable object; should they observe each others' mutations? Or: if I clone this object, will I regret not propagating the change to other clients?
by Calwestjobs | 2025-05-14 18:02:49+00:00
only system which does it securely is bitcoin cold wallet / offline computer signed transaction

or as you pointed out, signing it on smartcard with keypad reader.

but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline.

and there is no way for attacker to MITM, and here lies the problem. companies can not blame you as easily as with currently deployed technologies... they hide breaches all the time, f... PCI
by zzyzxd | 2025-05-14 18:04:49+00:00
Still, as a candidate, it sucks that they worked for hours and only got a rejection with a templated message. At least tell me the reason why you don't like my work, so I can learn something from it!

I get it that it's not always realistic to do, especially if the hiring manage reviews hundreds of applications for a hot role. But that's why take home assignment sucks. Some candidates may waste hours of their lives for nothing. Both sides need to be respectful of other people's time.
by smb06 | 2025-05-14 18:04:56+00:00
Hey folks - just wanted to share that CodeRabbit recently shipped AI code reviews for Cursor, Windsurf and VS Code.

In order to have code reviews fit seamlessly into the daily coding work in the editor we had to completely rebuild our AI code review agent so that we could fast, and accurate code reviews in the editor.

Objective was to review every code change well before the PR is raised so that there are fewer comments and back-and-forth in the PR.

Would love to hear your feedback on how we balanced code review quality with speed of delivering review comments.
by bicx | 2025-05-14 18:05:01+00:00
I've been part of an acquisition as a first-year engineering manager, during which I had to navigate subsequent two rounds of layoffs. I was also a part of the group to help restructure teams and help make calls on who to keep. Morale was terrible, and the cultures also did not gel at all.

It led to some serious burnout and I took several months off. I'm now happily working as an IC again.
by nearbuy | 2025-05-14 18:05:04+00:00
One Harvard study trained an AI that could reliably determine someone's race from a chest X-ray. AIs can be trained to see things we can't.

The difficulty is likely in making a good training dataset of labeled images with pathologies radiologists couldn't see. I imagine in some cases (like cancer), you may happen to have an earlier CT scan or X-ray from the patient where the pathology is not quite yet detectable to the human eye.
by devmor | 2025-05-14 18:06:20+00:00
>Apple's customers generally have more of a "save us from ourselves" mentality.

FWIW, this could also be described as a "My phone is a tool and not a hobby project" mentality. That is half of what prompted me to change daily drivers from Android to iOS.

I do not get as much freedom for my apps to do whatever I want - but I don't need to do as much work vetting developers or tinkering either. It's a tradeoff of time priority.
by Temporary_31337 | 2025-05-14 18:06:46+00:00
The future is not too expensive- people have just grown balooning expectations of what is minimal sustenance for children - people on <$200 month have 5 children families all over hte world and then you see people on 100k+ salaries saying they can't 'afford' to have chlidren. The truth is they can't afford to keep all the nice things - free time for hobbies/sports etc (childcare), holidays etc while still having children. Sacrifice some of that and suddenly most people can afford children but most people don't have enough moral value and a sense of duty to the society to sacrfice anything for a better future - in fact it's opposite - with credit cards and debt you sacrifice the future for sake of some frivolous consumption now.
by notpushkin | 2025-05-14 18:06:47+00:00
There’s no mention of Tart in there, but I’ve looked into Lume CLI some more and it seems it’s basically a superset of Tart in functionality. (And both use container registries as the VM image store, neat!)

> aligning to a container interface here seems a natural step for us

It might be tricky since you do have to escape from the container to run the actual VM, though I guess you can figure something out here. I still think it’s the wrong layer to build your abstractions upon, but let’s see how it goes! Just don’t discontinue the CLI, it’s really cool :-)
by game_the0ry | 2025-05-14 18:06:48+00:00
When I first saw samsung, I was sure we would soon see a world where laptops were obsolete bc you would just plug your phone into some dock attached to a keyboard, mouse, and display, and that would be your workflow.

I am surprised it never came to fruition. I guess its more profitable for manufacturers to push you to get a range of devices in all form factors (macbook + ipad + iphone).
by picture | 2025-05-14 18:06:52+00:00
Integrating over a longer time to get more accurate light measurements of the a scene has been a principal feature of photography. You need to slow down the shutter and open up the aperture in dark conditions.

Combining multiple exposures is not significantly different from a single longer exposure, except the key innovation of combining motion data and digital image stabilization which allows smartphones to approximate longer exposures without the need of a tripod.
by xavcochran | 2025-05-14 18:07:04+00:00
We utilize some of LMDB's optimizations such as the APPEND put flags. We also make use of LMDB handling duplicates as a one-to-many key instead of duplicating keys. This means we can get all values for one key in one call rather than a call for each duplicate.

For keys we are using UUIDs, but using the v6 timestamped uuids so that they are easily lexicographically ordered at creation time. This means keys inserted into LMDB are inserted using the APPEND flag, meaning LMDB shortcuts to the rightmost leaf in its B-Tree (rather than starting at the root) and appends the new record. It can do this because the records are ordered by creation time meaning each new record is guaranteed to be larger (in terms of big-endian byte order) than the previous record.

We also store the UUIDs as u128 values for two reasons. The first is that a u128 takes up 16 bytes where as a string UUID takes up 36 bytes. This means we store 56% less data and LMDB has to decode 56% less bytes when doing code accesses.

For the outgoing/incoming edges for nodes, we store them as fixed sizes which means LMDB packs them in, removing the 8 byte header per Key-Value pair.

In the future, we are also going to separate the properties from the stored value as empty property objects still take up 8 bytes of space. We will also make it so nothing is inserted if the properties are empty.

You can see most of this in action in the storage core file: https://github.com/HelixDB/helix-db/blob/main/helixdb/src/he...
by mikestew | 2025-05-14 18:07:36+00:00
20 minutes outside of Asheville, NC is hardly "an eccentric lifestyle". Let's break it down: which part of this is "eccentric"?

1. Has internet, has WiFi calling.

2. Has a cell phone, but the signal is crap at the house.

Before you answer, that describes my house exactly. And I live in Redmond, WA, and a 10 minute drive from the Microsoft main campus. Though the neighbors might disagree, there is nothing eccentric about my lifestyle.
by jermaustin1 | 2025-05-14 18:08:03+00:00
From my memory (I didn't record lost and damaged separately, just "claims") it was mostly damages (I think same with all of the carriers), but I have no idea how solid oak/walnut/cherry trays that are 3/4" thick wrapped in bubblewrap and in a bubble mailer gets damaged by anything other than someone stomping on it.

ETA: Except Christmas, that is basically 100% loss, though, about 50% of those losses seem to show up after the claims have been submitted.
by tsaifu | 2025-05-14 18:08:03+00:00
yeah, like the others have said, the tradeoff isn't really worth it for us as a business. spot instances also generally come with low qos guarantees (since they tend to be interruptible). tbf there are on-demand alternatives with better guarantees though

another thing to note is that we bootstrap the hosts, and tune them a decent amount, to support certain high-performance features which takes time and makes control + fixed-term ownership desirable

[disclaimer: i work at blacksmith]
by crote | 2025-05-14 18:08:36+00:00
This doesn't solve the problem, unfortunately.

The issue with hard tokens is that there is only one of them. By design, you can't back up a Yubikey's content to a second token. This means that any time you add 2FA to a new account, you must have all of your hard tokens in your possession to enroll them. This means a "one token on your keyring for daily use, one token in a safety deposit box as backup" approach isn't possible.

Yubico did propose a potential solution five years ago[0], but that proposal seems to have gone nowhere. Until something like that gets implemented, FIDO2 (and by extension Passkeys) requires some form software implementation backed by cloud synchronization to actually be usable for the average person.

[0]: https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...
by ijk | 2025-05-14 18:08:38+00:00
Where do we draw the line?

Does an anthology approach like Playtime (1967, dir. Jacques Tati) count? It's got kind of an arc to it, but doesn't really have anything like a recognizable struggle with an antagonist. Unless you view brutalism as the antagonist, I guess.

8½ (1963, dir. Federico Fellini) could, likewise, be shoehorned into a discussion of the arc of the film--which it, itself deconstructs in the third scene or so. It's primarily a film about making the film. There's _kind of_ a journey the protagonist goes on, but does it really count as being this same plot?
by xnx | 2025-05-14 18:09:02+00:00
> get the poor where they need to go

The poor would probably be much happier with a $250 Uber voucher than a bus pass.

> They also something like 20x the damage to roads that cars

This is very evident in my city where they had to install huge concrete pads at every bus stop because of the deep ruts and potholes busses cause when they start and stop.
by thaumaturgy | 2025-05-14 18:09:14+00:00
Sorry, I wasn't clear. Providing constructive feedback to a candidate is unlikely to have a direct positive impact on the relationship between that specific candidate and that specific company. It's more of ... whatever the opposite of the tragedy of the commons is. A policy that, if improved, would broadly improve the quality of many candidates for many companies.

Companies have been optimizing for candidates that are an immediate ideal cultural and technological fit. They are all competing for candidates that are the idealized developer, with perfect social skills, a brilliant CV, and deep technical experience that is an exact match for whatever the company is doing at the moment.

That's fine and rational and all, but a necessary consequence of this is that that pool is quite small and there are lots of companies competing for those people. Meanwhile, there are a lot of very good candidates who are underemployed because they aren't getting the opportunity or resources needed to become those idealized employees. This is a game theory outcome where both parties are optimizing themselves into a losing position.

I've been employed in this industry, off and on, for a long time. I assure you that companies didn't always behave this way. There has been a clear, obvious, and severe decline in the hiring experience, and these policies are hurting the entire industry.

It's generally socially frowned-upon to go on a couple of dates with someone and then ghost them. It happens, but it's not considered good practice. We recognize that it's cruel but also leads to a more cynical, detached, overall worse dating experience for everyone. Saying "I don't think this will work out, you seem nice but you're not what I'm looking for right now" is difficult and awkward, but it's also a necessary skill that needs to be maintained. Sometimes people don't react well, but that doesn't make it less necessary: it closes a feedback loop that ultimately allows earnest people who are looking for relationships to learn and grow and become better candidates for the next relationship.
by fasteo | 2025-05-14 18:09:25+00:00
>>> I really wish that were illegal. A phone number is a phone number.

European speaking. For completeness:

Financial directive PSD2[1] allows to use an SMS as a 2FA only because there is an KYC already done for that number (anon SIM are no longer allowed in the EU)

Also note that the 2FA is not the OTP code you receive. This code is just a proxy for probing "something you have", with the "something" being the phone number which, again, is linked to a physical person/company.

I have commented this several times, but as of today, SMS is the only 2FA method that can be easily deployed at scale (all demographics, all locations, compatible with all mobile devices)

[1] https://en.wikipedia.org/wiki/Payment_Services_Directive
by vlmutolo | 2025-05-14 18:09:59+00:00
You can definitely get around a lot of the pain points by using owned types like String as much as possible instead of borrowed types like &str. This is even generally recommended; there’s often no benefit to using the more advanced features of the language.

Usually the advanced features come in when you’re looking for better performance. It helps performance a lot to use reference types (borrowed types) to eliminate deep copies (and allocations) with .clone() in a loop, for example.

Library authors usually don’t have the luxury of knowing how their code will be used downstream, so diligent authors try to make the code reasonably performant and use these advanced language features to do so. You never know if the consumer of your library will use your function in a hot loop.
by disambiguation | 2025-05-14 18:10:01+00:00
Apologies for coming across as heated and getting carried away - my intent was not to convey pettiness, but rather highlight how those notions are highly subjective. Everyone has their own idea of what's fun and what's competent.

In the context of the original reply, I dislike it when colleagues are so ideologically intense and rigid about work because it puts me on the defensive; I have to impress them on whatever made up criteria they have. Maybe they think they're being right and fair, but I didn't ask to be judged, and more often than not their attitude is really just an ego trip - picking on the flaws of others rather than self reflecting. It's easiest to deal with these types by flattering their egos and staying out of their way; they'll eventually "fly to close to the sun."

In terms of working with incompetent people, I don't view it as binary, or even linear. When referring to incompetence what's usually meant is someone who is unmotivated or unknowledgable, but they don't take personal responsibility for helping them and investing in the team as a whole. I have never felt at the mercy of an incompetent colleague, there is always a path forward. Any perceived hindrance or drag is just that: perspective. And as a dev, it's just not my problem. It's up to management to decide what's an acceptable level of productivity and drag. That said, while I don't think I'm seen as incompetent, I'm not a rock star either or work on a rock star team. I can see this being more pertienent to someone in that kind of environment. For myself, I subscribe to the David Graeber philosophy, that a lot of our industry is "bullshit" jobs. It's hard to care about competence when the work doesn't really matter in the first place. Regardless, the word incompetent just isn't part of my vocabulary, it only facilitates complaining and doesn't serve a productive purpose.
by lovich | 2025-05-14 18:10:01+00:00
Why is it that when people speak about Native Americans using every part of the buffalo it’s with a positive connotation but when modern day organizations figure out how to turn waste products into something useful it’s spoken with disdain?

I am generally anti corporation but whenever I hear about a company turning something that used to be a waste stream into something useful, it gives me a nice dopamine hit to see capitalism actually working as intended
by alabastervlog | 2025-05-14 18:10:04+00:00
Mandalorian benefitted a lot from being far more episodic, though of course it also had some longer plot lines. Most shows that try to make their main thing the prestige TV “big damn plot” just aren’t very good at it. Episodic’s easier to get right, or at least to do OK.

It’s also a better star wars, in that it’s playing in the same space as the originals, and not a lot of things do that very well, so it’s nice to see anything doing it decently well. Andor’s competition is basically all of political action-thrillers, and that’s a crowded space in which it doesn’t really stand out.
by Const-me | 2025-05-14 18:10:23+00:00
> quite a similar model

Yeah, and that model is rather old: https://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule In practice, complex software systems have been written in multiple languages for decades. The requirements of performance-critical low-level components and high-level logic are too different and they are in conflict.

> you give the compiler an opportunity to optimise across those unsafe usages

One workaround is better design of the DLL API. Instead of implementing performance-critical outer layers in C#, do so on the C++ side of the interop, possibly injecting C# dependencies via function pointers or an abstract interface.

Another option is to re-implement these smaller functions in C#. Modern .NET runtime is not terribly slow; it even supports SIMD intrinsics. You are unlikely to match the performance of an optimised C++ release build with LTO, but it’s unlikely to fall significantly short.
by damnesian | 2025-05-14 18:10:34+00:00
>Have you noticed how unbearable silence feels when you’re not doing anything?

I feel fortunate to still value doing nothing. Though for me it's never nothing. It's more like quiet observation. Birds singing in the distance. Air movement. slight scents. the angle of light. It's similar to meditation, I think, I've never been good at orthodox by-the-book meditation. But I've been really good at sitting quietly and observing, from childhood.

Maybe it's because I first encountered screens as TV, then as arcade games at about the age of 12. I didn't have a smartphone until I was well into my 40s. All that brain development time with no easy dopamine generation might have something to do with it.
by pikdum | 2025-05-14 18:10:58+00:00
I've been using Ash for a few side projects and recently started using it at the day job too. We're mostly using it for new functionality, with the Ash APIs alongside our existing ones, but planning on slowly moving older things over too. It's been working well so far, and it's been easy enough to use the escape hatches for anything weird we're doing.

Getting started was a bit tricky though - definitely recommend the Ash book there. It works a lot better than the documentation as an introduction.
by icedchai | 2025-05-14 18:11:02+00:00
Sounds about right. I worked at couple of regional ISPs (maybe 20K users max), then in network engineering at an IT dept of a large local company. The local corp had offices all over the world. There, I managed the central firewalls, proxy servers, etc. We had 3 T1 lines for about 10K employees. Out of boredom, I'd regularly tail the proxy access logs and much of the traffic was porn or "adult dating." haha