MurphyA/hacker-news huggingface dataset:
by ownagefool | 2025-05-23 12:54:45+00:00
> Please elaborate on your dissenting opinion and try to avoid personal attacks. What are those ways?

Killing shitty meetings, including the standup, was one of those dissenting opinions, obviously.

Here's another.

PMs, or any other role that abstracts the developers from value, serve to infantilise the developer. Instead of owning the most expedient way service a customer or generate revenue, they're instead owning the minutia of frameworks, architecture, or tooling.

Of course, you can still make an argument for the PM via efficiencies and skill specialization, but when you effectively give a non-technical person control of what the team works on, you in many circumstances no longer have a person with a view across both commercial and technical realities.

And whilst there are many ways to try and plug this gap, like Engineering Managers or arguments like you're holding it wrong, where exactly are these tech leaders learning those skills when in the vast majority of teams the PM keeps them in the dark? Thus, propagates the cycle where the technical are not commercially mature enough to make business decisions, which necessitates the need for adults in the room.

Point being, it's a trade-off and there's circumstances where the trade-off makes sense, and others where it doesn't.
by castillar76 | 2025-05-23 12:54:52+00:00
Having my ACME client munge my webserver configs to obtain a cert was one of the supreme annoyances about using them — it felt severely constraining on how I structured my configs, and even though it’s a blip, I hated the double restart required to fetch a cert (restart with new config, restart with new cert).

Then I discovered the web-root approach people mention here and it made a huge difference. Now I have the HTTP snippet in my server set to serve up ACME challenges from a static directory and push everything else to HTTPS, and the ACME client just needs write permission to that directory. I can dynamically include that snippet in all of the sites my server handles and be done.

If I really felt like it, I could even write a wrapper function so the ACME client doesn’t even need restart permissions on the web-server (for me, probably too much to bother with, but for someone like Rachel perhaps worthwhile).
by myfonj | 2025-05-23 12:54:57+00:00
For the recent resources it might matter: unless the training data are curated meticulously, they may be "spoiled" by the output of other LLM, or even the previous version of the one that is being trained. That's something what is generally considered dangerous, because it could potentially produce unintentional echo-chamber or even somewhat "incestuously degenerated" new model.
by horsawlarway | 2025-05-23 12:55:17+00:00
Is this a joke? I don't even know where to begin with this comment... It reads like a joke, but I suspect it's not?

TCP is just a bunch of bytes... You can't process a bunch of bytes without understanding what they are, and that requires signaling information at a different level (ex - in the bytes themselves as a defined protocol like SSH, SCP, HTTP, etc - or some other pre-shared information between server and client [the worst of protocols - custom bullshit]).
by TheNewsIsHere | 2025-05-23 12:56:06+00:00
My reading of the article suggested to me that the author took exception to the code that touched the keying material. Docker is immaterial to that problem. I won’t deign to speak for Rachel By The Bay (mother didn’t raise a fool, after all), but I expect Docker would be met with a similar regard.

Which I do understand. Although I use Docker, I mainly use it personally for things I don’t want to spend much time on. I don’t really like it over other alternatives, but it makes standing up a lab service stupidly easy.
by Bender | 2025-05-23 12:57:05+00:00
Modules are not yet supported.

I am probably the exception but I make heavy use of several modules to block bots. I would love to try out bpfilter when they support connlimit, tcpmss, length, limit, owner, recent, set, tcp, ttl and maybe u32. In regards to performance I get some gains using NOTRACK in the raw table for ports I expect high packet rates in combination with stateless rules.
by unscaled | 2025-05-23 12:58:28+00:00
Yes, JOSE is certainly overengineered and JWK is arguably somewhat overengineered as well.

But "the rest" of ACME also include X.509 certificates and PKCS#10 Certificate Signing Requests, which are in turn based on ASN.1 (you're fortunate enough you only need DER encoding) and RSA parameters. ASN.1 and X.509 are devilishly complex if you don't let openssl do everything for you and even if you do. The first few paragraphs are all about making the correct CSR and dealing with RSA, and encoding bigints the right way (which is slightly different between DER and JWK to make things more fun).

Besides that I don't know much about the ACME spec, but the post mentions a couple of other things :

So far, we have (at least): RSA keys, SHA256 digests, RSA signing, base64 but not really base64, string concatenation, JSON inside JSON, Location headers used as identities instead of a target with a 301 response, HEAD requests to get a single value buried as a header, making one request (nonce) to make ANY OTHER request, and there's more to come.

This does sound quite complex. I'm just not sure how much simpler ACME could be. Overturning the clusterfuck that is ASN.1, X.509 and the various PKCS#* standards has been a lost cause for decades now. JOSE is something I would rather do without, but if you're writing an IETF RFC, you're only other option is CMS[1], which is even worse. You can try to offer a new signature format, but that would be shut down for being "simpler and cleaner than JOSE, but JOSE just has some warts that need to be fixed or avoided"[2].

I think the things you're left with that could have been simplified and accepted as a standard are the APIs themselves, like getting a nonce with a HEAD request and storing identifiers in a Location header. Perhaps you could have removed signatures (and then JOSE) completely and rely on client IDs and secrets since we're already running over TLS, but I'm not familiar enough with the protocol to know what would be the impact. If you really didn't need any PKI for the protocol itself here, then this is a magnificent edifice of overengineering indeed.

[1] https://datatracker.ietf.org/doc/html/rfc5652 [2] https://mailarchive.ietf.org/arch/msg/cfrg/4YQH6Yj3c92VUxqo-...
by ChemSpider | 2025-05-23 12:58:29+00:00
You are good with insulting, but weak on math.

Even with your 2022 data/source, I get a salary that is >=Harvard.

And if you look at the latest 2025 salaries the difference is even more striking and in favor of Germany:

https://www.jobs-beim-staat.de/tarif/tvoed-bund_e13

But according to you, how much does a German Postdoc earn per year, in US$?
by fpoling | 2025-05-23 12:58:48+00:00
The issue is that the client needs to access the private key, tell web server where various temporary files are during the certificate generation (unless the client uses DNS mode) and tell the web server about a new certificate to reload.

To implement that many clients run as a root. Even if that root is in a docket container, this is needlessly elevated privileges especially given the complexity (again, needless) of many clients.

The sad part is that it is trivial to run most of the clients with an account with no privileges that can access very few files and use a unix socket to tell the web server to reload the certificate. But this is not done.

And then ideally at this point the web servers should if not implement then at least facilitate ACME protocol implementations, like, for example, redirect traffic requests from acme servers to another port with one-liner in config. But this is not the case.
by eitally | 2025-05-23 12:58:59+00:00
From an exercise physiology point of view, it's generally accepted that ATP-CP powered motility is possible for only about 10 seconds (that is to say, you only store enough ATP for about 10 seconds of high intensity work -- sprinting, maximal weight lifting, etc). After that, other energy systems become dominant ... both of which create ATP but depend on either glycolysis (anaerobic) or oxidative phosphorylation (aerobic) for the process/conversion.
by medstrom | 2025-05-23 12:59:31+00:00
Question, since you maintained many packages:

> I'm back to using the AUR for most

Have you tried makedeb then as a second channel? https://www.makedeb.org/ It uses PKGBUILDs, so pretty easy to translate. It seems so well-placed to help packagers I'm not sure why it isn't heard of more.
by matja | 2025-05-23 13:01:03+00:00
Lucky that 415031 is prime :)

The steps described in the article sound familiar to the process done in the early 2000's, but I'm not sure why you'd want to make it hard for yourself now.

I use certbot with "--preferred-challenges dns-01" and "--manual-auth-hook" / "--manual-cleanup-hook" to dynamically create DNS records, rather than needing to modify the webserver config (and the security/access risks that comes with). It just needs putting the cert/key in the right place and reloading the webserver/loadbalancer.
by Forgeties79 | 2025-05-23 13:01:05+00:00
Yeah “AI” tools (such a loose term but largely applicable) have been involved in audio production for a very long time. They have actually made huge strides with noise removal/voice isolation, auto transcription/captioning, and “enhancement” in the last five years in particular.

I hate Adobe, I don’t like to give them credit for anything. But their audio enhance tool is actual sorcery. Every competitor isn’t even close. You can take garbage zoom audio and make it sound like it was borderline recorded in a treated room/studio. I’ve been in production for almost 15 years and it would take me half a day or more of tweaking a voice track with multiple tools that cost me hundreds of dollars to get it 50% as good as what they accomplish in a minute with the click of a button.
by sgarland | 2025-05-23 13:01:22+00:00
The platonic ideal of DevOps is fine, yes. The problem I’ve consistently run into is there is a vanishingly small percentage of devs who want to do Ops, or even consider that a server with real constraints is running their code. Performance takes a backseat to DX, which AFAICT is code for “I don’t want to do anything but write code and push.”

I should note that I think this is fine, if and only if you have specialist teams who respect each others’ abilities and recommendations. A dev team shouldn’t have to worry about standing up infrastructure, but similarly, when the infra team tells them that their app is consuming far more compute than it should be, the dev team should profile and improve their code instead of asking for more compute.
by rollcat | 2025-05-23 13:01:22+00:00
Here's my €0.03:

I really wish Linux distributions started adopting a similar model to the BSDs. Ship a base system that's minimal but rock solid; stick to LTS kernels, etc. Issue patches/updates for security issues ONLY. Ship another major release once or twice a year. (Fedora Silverblue is kinda going in that direction.)

Everything else? Pick from Flatpak, Snap, or AppImage, but just go all-in on that. Focus all development on making the experience first-class. Let Gnome, KDE, etc ship their own builds.

The tricky question is how much to include in the base system vs Flatpak. It's kinda-obvious that for workstations, the installation media must ship enough GUI to get you a functioning desktop, a web browser, and an app manager ("store"). OpenBSD's base system includes X11 and a couple basic WMs, but the story is a bit more complex if your target audience is less technical.

This path would kinda dilute the difference between distributions, but that would actually be good for them. I already tell friends, if you want to try Linux, just pick between Ubuntu and Fedora. They're both OK.

Servers? Go all-in on Docker/Podman. There are plenty of existing distros that do exactly that.
by sylware | 2025-05-23 13:02:01+00:00
This is what I was implying: I don't know what my mobile IPv6 ISP is providing to my modem (/64? /96? /128?). All I know, my modem is providing a randomized /128 to my laptop (then this is bad omens).

It is impossible to know. There is no way to get in touch with the guys who know.

I would have to get into my 4G LTE USB modem, and I have other things to do, not to mention I am not up to competence on that matter.

BTW, you should quit digital ocean, as self hosted, their ASes are entirely blocked due to the fact they are infestations of scanners, hacking bots (script kiddy grades), etc.
Show HN: I built an AI that turns boring lecture slides into interactive lessons
by etiennek_ | 2025-05-23 13:02:39+00:00
As a student, I got tired of the messy way everyone uses ChatGPT for studying. You're constantly switching between random prompts, copy-pasting notes, and trying to force a chatbot to act like a tutor when it's just not built for that.

So I spent the last 3 months building QuizzMe. Instead of prompting ChatGPT with "help me study this," you get a proper learning flow: concept explanation → practice questions → targeted feedback → move to next concept.

I'm using Google's brand new Gemini Flash model under the hood, and honestly it works like magic for this use case. The way it understands context and generates pedagogically sound questions is incredible.

Would love feedback from other developers who've tried to build education tools, or anyone who's frustrated with current AI study methods. Has anyone else experimented with Gemini Flash for specialized applications like this?
by adolph | 2025-05-23 13:02:42+00:00
Which reminds me of The Cagots were a persecuted minority who lived in the west of France and northern Spain [0]

The origins of the Cagots remain uncertain . . . . Despite the varied and often mythical explanations for their origins, the only consistent aspect of the Cagots was their societal exclusion and the lack of any distinct physical or cultural traits differentiating them from the general population.

0. https://en.wikipedia.org/wiki/Cagot
by Gigachad | 2025-05-23 13:02:52+00:00
On the weekends sure but during the weekdays it’s sporadic. There was a period I was working at a fully remote company and occasionally I’d get to around Thursday and hadn’t interacted with another person since Sunday and I’d just spiral in to depression.

I also mentally just don’t feel like my coworkers are real if I don’t ever see them. They are just like icons on a screen.

Currently working 2/3 days in office and it’s ideal. Can load all the meetings on those days, chat with everyone, but can still spend some days alone.
Show HN: Memoram – A user-owned memory layer to personalize any AI tool
by CodyGaskin | 2025-05-23 13:02:53+00:00
Hey HN,

We've developed Memoram, a platform that allows users to securely store and manage their personal data—like preferences, conversations, and other relevant information—across various AI tools. This ensures a consistent and personalized experience, regardless of the AI application in use.

Key Features:

Secure Data Storage: Users can store their data with end-to-end encryption, ensuring privacy and security.

Cross-Platform Integration: Memoram integrates with multiple AI tools, allowing seamless access to user data across platforms.

User-Controlled Sharing: Through unique MemoryKeys, users have granular control over which AI tools can access specific data.

Developer Platform: We've launched a Developer Platform that provides APIs for developers to integrate Memoram into their AI applications, enhancing personalization without building user data management from scratch.

We're eager to hear feedback from the community, especially from developers working on AI applications. How do you currently handle user personalization? Would a centralized, user-controlled memory system like Memoram be beneficial in your projects?

Looking forward to your thoughts and discussions.
by ii41 | 2025-05-23 13:02:55+00:00
> My question to the FOSS community is why Firefox is not used to build more independent browsers the way Chrome is?

I actually looked into this. Say you consider yourself as part of the FOSS community, and want to build a new browser, and you start to look for your options. The only things readily available as libraries are webkit (currently owned and open sourced by Apple) and webkit-gtk (based on the former). Apple is like Apple and doesn't really want you to use their open source lib, so even though webkit-gtk team made it happen anyway, good luck if you want to do it yourself. If you decide to just use webkit-gtk, you've made a decision similar to lots of other members of the FOSS community in this area (luakit, the Rust webview crate, etc.). Another option is Qt WebEngine. It's based on Chromium. It's part of the Qt ecosystem and though I think you can use it as a standalone library, carving it out still requires some engineering. So these are the options that are available as libraries. And where are the Firefox ones? Servo makes it clear at the beginning of The Servo Book that it isn't available as a library yet. And Gecko? Firefox source doesn't even include a directory named gecko. It's so tightly coupled with the other parts that you'll need a lot of engineering to carve it out. And this is in contrast to Blink, the engine of Chromium, which is nicely placed in its own directory, having its own webpage with some learning resources.
by TheNewsIsHere | 2025-05-23 13:04:05+00:00
Something that people don’t understand, which your comment sort of indirectly alludes to, is that Visa and MasterCard started as and for most of their existence were essentially a shared services center for financial institutions that wanted to participate in a common payment network.

The legal structure has changed, but the boards of both are still primarily comprised of executives from other major financial services institutions.

Risk averse and sensitive to regulatory pressure by nature, the issue isn’t with Visa and MasterCard directly. They’re just operating in a space.
by ramses0 | 2025-05-23 13:05:01+00:00
I solved it with different colored calendars in g-cal. Monthly => Rough => Detail => Actual.

Monthly is usually dragging a bunch of "all-day" events across multiple weeks. "school ends", "date night?" (across Fri->Sun), "vacation", "vacation pack", etc.

Rough is kindof planning out the upcoming week or two. I'll drag stuff across Saturday afternoon like "go to park?", and "buy paper towels from Sam's?" in the morning.

Detail is "15-min accuracy" of committed things. Doctor's appointments, birthday party invites, haircuts, or anything that is really "controlling" where I need to be or what I need to be doing at that point in time.

The "actual" calendar is for when I want to reconcile what actually happened vs what I'd planned to happen.

If I'm super "on it" with my detail calendar, maybe I didn't do "clean office" because in actuality I was doing "make dinner", "clean kitchen", and "watch movie with kids".

And integrating with work, sometimes I'll block a section (hour) in "actual" called "Work P1". That's supposed to be "the next item in the todo list", but it is sometimes really helpful to cross-check with "actual" and realize I was really "troubleshooting bug", or "helping coworker on xyz" or "continuing design discussion".

The "narrowing" and "accuracy" is helpful to learn how to do, and the big chunky things like "put fertilizer" and "in-laws visiting" help to make sure I don't schedule too much "detail" in times that already have a lot of external complexity.
by JoshTriplett | 2025-05-23 13:07:20+00:00
They show any site served over HTTP as explicitly not secure in the address bar (making HTTPS the "default" and HTTP the visibly dangerous option), they limit many web APIs to sites served over HTTPS ( https://developer.mozilla.org/en-US/docs/Web/Security/Secure...) , https://developer.mozilla.org/en-US/docs/Web/Security/Secure... ), they block or upgrade mixed-content by default (HTTPS sites cannot request HTTP-only resources anymore), they require HTTPS for HTTP/2 and HTTP/3, they increasingly attempt HTTPS to a site first even if linked/typed as http, they warn about downloads over http, and they're continuing to ratchet up such measures over time.
by epr | 2025-05-23 13:07:32+00:00
A bit confusing for sure, but I think (not sure) I get what they're saying. Training a nn (for visual tasks at least) consists of training a model with much more dimensions (params) than the input space (eg: controller inputs + atari pixels). This contrasts with a lot of what humans do, which is take higher dimensional information (tons of data per second combining visual, audio, touch/vibration, etc) and synthesizing much lower dimensional models / heuristics / rules of thumb, like the example they give of the 5 second per mile rule for thunder.
by ActivePattern | 2025-05-23 13:07:39+00:00
It's a OpenAI researcher that's worked on some of their most successful projects, and I think the criticism in his X thread is very clear.

Systems that can learn to play Atari efficiently are exploiting the fact that the solutions to each game are simple to encode (compared to real world problems). Furthermore, you can nudge them towards those solutions using tricks that don't generalize to the real world.
by pessimizer | 2025-05-23 13:07:58+00:00
There are still important legal principles in the US and other places around the world based entirely on the decisions of earlier English courts. The first local decisions will reference English cases, and English legal experts often would have been consulted.

Same thing with most of the world's parliaments and congresses having to reference English Parliamentary precedent in order to figure out how to operate themselves. The UK Parliament and courts may be terrible, but they invented the thing and we're forks.
by sgarland | 2025-05-23 13:08:17+00:00
Wants is the operative word. If you show up to a racetrack with zero experience and a Ferrari, you’re not going to be accepted if you try to pretend that you know how to drive. You’ll probably also hit the wall, which hopefully would provide an opportunity for introspection.

If you have an AI generate all your code for you, and then say that you made an app, you should expect people to push back.

I want to be around people who like learning and knowing things for the sake of learning. AI is a tool, but if you rely on it too heavily (or really at all when starting out), you’re stifling your ability to truly learn.
by eddieroger | 2025-05-23 13:08:40+00:00
I've done both, and this was not my experience. Nowadays, they're much more similar than different, but 10 years or so ago, "easy" was defined by if you knew Java or Objective-C. Android, like most Java, required a lot of code to do simple things (public static void main...), and tons of XML to make the app support so many devices. Objective-C had good boiler plate thanks to Apple and NeXT before it using the frameworks for years.

Now, SwiftUI and Compose are effectively cousins, as are Kotlin and Swift. Both App Stores have their quirks. Publishing is part of both workflows. It's really not harder for one or the other, it's just administrivia.
by NilMostChill | 2025-05-23 13:09:27+00:00
Perhaps you're conflating faith with religion.

Faith being "confidence, trust or belief in a thing , person or concept, sometimes in the absence of proof"

Not to be confused with "blind faith" which is the above but with wilful ignorance or dismissal of proof that contradicts the aspect of the faith.

Also not to be confused with "religion" which is the social construct or organisation around a central faith.

You can have faith without religion, but you can't generally have a religion without faith.