MurphyA/hacker-news huggingface dataset:
by quectophoton | 2025-05-26 16:19:09+00:00
> Now I'm trying to think through what the actual threat model is here, and why it doesn't apply in reverse to the REST API endpoints that we also maintain. I can see the point of signing rather than an included credential if you allow webhooks to http endpoints, but is that it? Probably better to just not allow non-https delivery URLs anyway.

My best guess: Maybe signing the webhooks assumes the TLS-terminating middlewares might not be trusted? Or some other middleware between that and the final handler.

To the best of my understanding, the two options mentioned in the article require a shared secret: API keys include that secret verbatim in the request, while the signing uses the secret in an HMAC function.

If asymmetric cryptography were somehow involved, I would somewhat buy the arguments about validating the origin of the request, because only one party would be able to create a valid signature. But that's not the case here, because with HMAC both parties have access to the same secret used to create a "signature" (which is more like a salted hash, so creating and validating a signature are the same process).

So, if both parties can produce the hash for a valid signature, and the secret is known to both ends, and there's no advantage over API keys when using TLS (assuming TLS is not broken), then I can only think that the problem is what happens outside TLS.

That's why I think the threat model would be a compromised TLS-terminating proxy, or some compromised component in between TLS-terminating proxy and the final application handling the request.

Sounds like zero-trust shenanigans.

If I'm misunderstanding anything, I'm more than happy to be corrected.
by wkat4242 | 2025-05-26 16:19:17+00:00
They're not as noticeable as Google's. Huge difference. Their basically hidden cameras. Google glass has this huge weird glowy glass brick sticking out and the camera hole is also way bigger (I have the enterprise version myself here). I rarely wear it around others though and if I do I put red tape over the camera so they can see it's inoperative.

Though I mainly bought them as a curiosity (second hand for very little). I find an xreal much more useful.
by urlwolf | 2025-05-26 16:19:21+00:00
I moved to nix around Nov last year and couldn't be happier, the motto 'nix fixes that' is true. First time I can say linux is trouble free. Upgrades are painless. Dev environments, reproducible. Largest repository of packages in the linux world. Next to zero time wasted configuring things. Foundation LLMs now know enough nix to get you out of trouble most of the time. It's perfect as a linux experience.
by thatguy0900 | 2025-05-26 16:20:53+00:00
Why would you go to jail unless you're doing something illegal? Are you honestly saying startups should be legally exempt from pollution laws and allowed to cheat brazenly on commissions tests by public agencies? It's fair for rich people to just lose some income(and still be rich) for crimes while poor people have to go to jail is honestly a unhinged take
by hxii | 2025-05-26 16:21:04+00:00
I finally got my yaml task runner to a workable state.

Getting the parts that I absolutely HAD to implement while not descending into feature-creep hell (driven by my own curiosity) was challenging.

Then again so were the self-debates about the syntax and documentation.

Maybe one day I’ll learn Go or something, but until then - Boku is my yaml-based task runner written in Python.

https://git.sr.ht/~hxii/boku/tree/main/item/README.md
by crabbone | 2025-05-26 16:21:53+00:00
Not really (at least, not very easily). There's no guarantee that for whatever reason curl won't hang.

To do it properly, you'd need some code before the loop to start a separate process that would check on the parent process... but, really, you don't want to go there, not in Bash anyways.

But, assuming curl won't hang, you could compare timestamps. It's better than counting iterations (in terms of emulating timeout command).

But then, you might want to get fancy and implement exponential backoff or whatever other strategy you fancy to not overload the whatever thing you are polling... again, probably not in Bash.
by francislavoie | 2025-05-26 16:22:07+00:00
I don't like it much, using JSON as the transport has some problems if encoded in a URL as required by many auth flows. Paseto encodes the whole version+payload+signature to make it easier to transport. Of course you could just base64 encode the whole Coze JSON, but that isn't part of the spec, which means the spec is weak.
by AstroJetson | 2025-05-26 16:22:20+00:00
I always wonder when I see all these best notebooks / note taking systems, etc. why people don't spin up any of the dozens of wiki servers.

You can put it online so you can get to it anywhere

You can run it off a stick to keep it with you (Tiddlywiki)

You can cross link pages to be able to collect things together

You can search. Some even have auto link builders so you can build a page of links to pages that match a category.

Some support Markup so you have formatting the way you want.
by johnisgood | 2025-05-26 16:22:50+00:00
Which makes "next to zero time wasted configuring things" false, very much so. You will have to write your own derivation(s) using Nix[1].

In any case, from the article, what does not apply to Guix, too? I am leaning towards Guix because of its language (Scheme, i.e. Lisp-y), but I wonder about the differences between the two, today (besides userbase and hype).

[1] https://nix.dev/tutorials/nix-language.html
by krapht | 2025-05-26 16:23:02+00:00
I tried to give Nix a chance but I never figured out how to package dependencies that didn't already have a derivation written for them.

Particularly since I do a lot of ML work - I never figured out how to handle mixed Python/C++ code with dependencies on CUDA.

It's just way easier, even if not reproducible, to build an environment imperatively in Docker.
by tsarchitect | 2025-05-26 16:23:39+00:00
Dabvid Blevins has a great video (2018) that mentions JWTs https://www.youtube.com/watch?v=osQmFNm0YDU

He discusses the architectural advantages of JWT but also discusses JWTs lacking

"JWTs are a passport without a picture. A very dangerous thing".

His solution: OAuth2 + JWT + Signatures
by ahofmann | 2025-05-26 16:23:56+00:00
I have no idea where you live. As a European, I think that what you just said, is batshit insane.

I trust, and I have to trust, that my government acts (mostly) in my interest. If I stop doing that, I'm at war with my own government and I leave the "moral territory" of democracy. Nothing good can come out of that.
by ta12653421 | 2025-05-26 16:24:34+00:00
I wasnt the OP :)

They are expanding credit, but they need customer funds on the central banking level to actually move away the money the created on their local core banking; thats the reason why banks needs customer funds: Without them, their central bank account would be empty and they couldnt transfer any money that they created. the question regarding minimum reserve is another angle and not relevant to the question of how money is technically created and then transfered.

EDIT: for sure, they can also acquire central bank money as a credit to make the payments transfer happen, but usually its more easier and convenient to use customer funds instead of borrowing from the central bank or on the interbank level
by sawmurai | 2025-05-26 16:24:35+00:00
Today I tried to use Copilot to go through a code base and export unexported types, interfaces and unions (typescript). It had to also rename them to make sure they are unique in context of the package. Otherwise I would have used search&replace :)

It started out promising, renaming the symbols according to my instructions. Slower than if I had done it myself, but not horrible slow. It skipped over a few renames so I did them manually. I had to tell it to continue every 2 minutes so I could not really do anything else in the meantime.

I figured it’s quicker if I find the files in question (simple ripgrep search) and feed them to copilot. So I don’t have to wait for it to search all files.

Cool, now it started to rename random other things and ignored the naming scheme I taught it before. It took quite some time to manually fix its mess.

Maybe I should have just asked it to write a quick script to do the rename in an automated way instead :)
by lspecian | 2025-05-26 16:26:17+00:00
To clarify even further how this might translate into real-world advantage: I’m not trying to displace databases or reinvent grep, I’m aiming at use cases where agents need durable, fast-access memory that doesn’t disappear when a container shuts down.

Imagine an agent running inside a microVM or container. It doesn’t call Pinecone or Redis—it mounts VexFS. When it stores an embedding, it’s not going into a remote vector store, it’s being written alongside the file it came from, locally and semantically indexed. The agent can reboot, restart, or crash and still recall the same memory—because it lives inside the OS, not in RAM or ephemeral middleware.

This also means the agent can snapshot its cognitive state—“what I knew before I re-planned,” or “the thoughts I embedded before the prompt changed.” These aren’t just filesystem snapshots, they’re points in vector space tied to contextual memory. You could even branch them, like cognitive git commits.

Even search becomes something different. Instead of listing paths or grep results, you’re getting the files most semantically relevant to a query—right at the kernel level, with mmap access or zero-copy responses.

Most importantly, all of this runs without needing an external stack. No HTTP, no gRPC, no network calls. Just a vector-native FS the agent can think through.

Still early, very early. Still rough. But if we’re going to build systems where agents operate autonomously, they’ll need more than tokens—they’ll need memory. And I think that needs to live closer to the metal.
by AdrianB1 | 2025-05-26 16:26:53+00:00
I tried using LLMs for 2 types of work:

1. Improve the code that I already have. Waste of time, it never works. This is not because my code is too good, but because it is SQL with complex context and I get more hallucinations than usable code, still the usable code is good for basic tasks and not for more.

2. Areas I rarely use and I don't maintain an expertise on. This is where it is good value, I get 80% of what I need in 20% of the time, I take it and complete the work. But this does not happen too often, so the overall value is not there yet.

In a way is like RPA: it does something, not great, but it saves some time.
by msarnoff | 2025-05-26 16:27:06+00:00
This comment needs to be higher. Atomoxetine is also known as Strattera and is prescribed for ADHD.

I tried it for less than a week and had to stop because there were VERY painful side effects _down there_.

I’m also a CPAP user and I’d 100% keep using it rather than go back on atomoxetine.
by crabbone | 2025-05-26 16:27:26+00:00
Neither Python nor Ruby offer a simple interface to concurrency, serialization and terseness. Not even close. And aren't moving in the desired direction. Perl could have tried... but it's a separate can of worms, and still not quite there.

PowerShell is a missed opportunity. A project with a ton of resources dedicated by a company with bottomless coffers... which ended up being sub-par.

I wish there was a sensible alternative, but I haven't found one yet.
by BurningFrog | 2025-05-26 16:27:37+00:00
A new Resmed machine is inaudible to my ears. But after 1-2 years, all 3 of mine has developed some kind of noise.

I recently found an online service that repaired one of mine, and it's quiet now.

There is also mask noise. If my nostril mask slips out a bit, there will be noise. Not too big a deal.

One fix that I think would work for most people is a white noise machine. It's briefly annoying, but after a while (a few nights at most is my personal guess) you stop noticing it, and it drowns out other noise.
by weinzierl | 2025-05-26 16:28:21+00:00
What is the supply chain security story with Nix packages?

I stick mostly to reasonably popular Debian packages. My thinking is that if one of them has a serious vulnerability it will get fixed quickly or a lot of people have much bigger problems than me. I always worry about niche package systems, where it should be much easier to sneak in something malicious and it could linger there for a long time undetected.
by davedigerati | 2025-05-26 16:28:23+00:00
With respect to energy balance comments and comparing this to other technologies: both processes of absorption and condensation are happening within the same material passively, meaning you do not need to put energy into it. The heat gained from absorption is lost in the next step of condensation. The impact of this discovery, therefore, is that you don't need the power of your AC or your dehumidifier or your moisture vaporator on the south ridge.

Always testing the AI's I thought this might be a fun one to watch how they think through it since it is about technology that they would not have been trained on. Grok thought through the process more thoroughly than I (B.S.ChemE) would've .

https://grok.com/share/bGVnYWN5_e80e8100-3682-4157-879e-c5ca...
by globie | 2025-05-26 16:28:24+00:00
Simple: Connect larger NICs and do "dumb" DDoS filtering at your fattest point.

Consider an HTTP daemon serving static content on a physical server. If that physical server has a 10Gig NIC it will withstand 90%[0] of the real-world DDoS attacks which would affect the same server with a 1Gig NIC.

"Dumb" DDoS filtering means blocking UDP and SYN floods, and other simple attacks. Your goal is essentially to block traffic which could be spoofed, making your downstream traffic somewhat attributable. Many ISPs provide functions like this, and is not nearly as complicated or invasive as letting Cloudflare MITM every bit of your traffic.

Any effort past that point should just be made in caching static assets, and optimizing dynamic pages. If your website uses sessions, you can implement basic rate controls very easily. No WAF required!

[0]: I made it up
by matt_s | 2025-05-26 16:28:25+00:00
Interacting with LLMs or AI APIs sounds like other software patterns, it doesn't matter that its AI or an LLM really, you are calling a function and providing inputs and expecting output. You get better output when your inputs are tuned to the scenario. Some of your inputs in this paradigm could be considered as optional parameters because you still get output without them.

If you need to remember parts of the inputs in between user sessions then you need to save state of those somewhere to a disk. Databases are a common choice especially in web development but you could also just put things in a file. Another option if this isn't a web development context is to use something like sqlite since it will help organize the data a little better than say CSVs or similar.
by FridayoLeary | 2025-05-26 16:29:22+00:00
They have kind of abandoned diesel engines, which the whole scandal was based around. It became clear that it would be impossible to create diesel engines which would comply with enviromental standards, which is a shame since they are more efficient and it is consumers who are losing out. They are still one of the main automotive conglomerations today. If anything American car companies are losing the market in Europe, Ford for example have abandoned their best selling model - the Focus, and in the UK at least they are the only US brand besides for Tesla.
by almusdives | 2025-05-26 16:29:42+00:00
I get why this is problematic for industries that depend on high traffic for ad revenue etc, but is bad for websites who are actually trying to market services that provide tangible value? Like if I’m searching for a dry cleaner in Glasgow, if I end up with the same provider, I don't care (and neither does the dry cleaner) whether I find them through traditional links or an AI-mediated search?
by dr_kiszonka | 2025-05-26 16:29:57+00:00
I love the idea of a physical device (esp. with buttons) but I get that it is not always practical. I wonder how much work it would take to add math symbols to something like Touch Portal. I haven't used it but read that many people do for controlling various software, including DAWs (which can be latency-sensitive).

https://www.touch-portal.com/
by fidotron | 2025-05-26 16:30:10+00:00
> 2. They notice that many of these streamers use Cloudflare for something, presumably CDN and load balancing.

And DDoS protection.

Sports broadcast piracy has a history of serious organized crime involvement, and then some, such as https://www.theregister.com/2002/03/13/murdoch_company_crack... where the allegation was NDS did the hacking and leaked the keys of the rival tech to various mob groups for exploitation.
by jmhmd | 2025-05-26 16:30:14+00:00
litevna.app - a DICOMweb compatible medical imaging archive, built on cloudflare workers, to optimize fast image delivery globally. Images are all encoded as HTJ2K for progressive image loading, and the popular OHIF zero-footprint DICOM viewer is built in.

Building mainly to power the next generation of pacsbin.com, but may offer as a standalone service as well.
by cl3misch | 2025-05-26 16:31:16+00:00
> In NumPy, AB works if A and B are both scalar. Or if A is 5×1×6 and B is 5×1×6×1. But not if A is 1×5×6 and B is 1×5×6×1. Huh?

> So, I removed it. In DumPy you can only do AB if one of A or B is scalar or A and B have exactly the same shape. That’s it, anything else raises an error. Instead, use indices, so it’s clear what you’re doing.

I also dislike the seemingly inconsistent adding of last axes with length 1.

I do like the capability that existing axes of length 1 will be broadcasted to any length of the other array in the operation, and use that all the time.

If I understand the text correctly, the author removed that as well.
by echelon | 2025-05-26 16:31:24+00:00
It's not performant enough for what we want to do, and the constellation of "standards" around it are ill-fitting, awkward, and difficult to use.

We need a binary format special purposed for the task. Not CSS and literal XML and Javascript.

None of this is accessible to the animator. Some programmer bro can pick it up, but nothing has ever been as simple and as easy to use as Flash.
by smeej | 2025-05-26 16:31:28+00:00
I think there's probably major overlap between "woo woo" and "all the stuff we don't understand about the brain yet," at least when it comes to woo woo effects on our own bodies.

Honestly, though, the hard part is figuring out which strategies are likely to work, and which are only woo woo, and then testing the theory. When things feel like they are getting worse, it's extremely hard to tell when they're "getting worse so they can get better" versus "getting worse because this is absolutely the wrong path and I'm hurting myself." It often takes years to be able to tell, and then I'm having to try to make decisions with whatever lower capacity I have then than when I started, so I'm even less likely to decide well.

As someone who's reprogrammed yourself (presumably favorably?) four times, any pointers for figuring out what the right paths are, or who are the right guides to follow?
by csjh | 2025-05-26 16:31:39+00:00
Been working on a single-pass WebAssembly JIT compiler (atm only guaranteed to work on M1 air), been super interesting learning and thinking through strategies to balance fast compilation & fast generated code. It's the fastest single-pass JIT output-wise that I'm aware of, but the compilation speed could use some work.

Also: the README is pretty outdated, the real interesting stuff happens in https://github.com/csjh/mitey-jit/blob/main/backend/arm64/ba...

https://github.com/csjh/mitey-jit
by swyx | 2025-05-26 16:31:55+00:00
just 2c on the tagline but there was a time when this would be called "Copilot for Sales"... mixed feelings about what a better shorthand tagline would be but "Cursor for X" when there is no IDE, you're not forking anything, and you're forcing the user to do the comparison between actual competitors like Granola or Monterey... just a tough start

features sound great though, i would actually check it out if i were doing sales.
by couscouspie | 2025-05-26 16:32:02+00:00
To be fair, I presume learning a tool by manual is not very efficient. At least I personally find the manuals of most utilities lacking in detail and it hence difficult to understand what a certain thing is actually doing and how to use it just from reading the manual. Furthermore, reading about functionality feels like a waste of time, when you are not specifically needing it at the moment. I doubt anybody who is fluent in everything Vim has to offer learned that by reading through the manual once or twice.
by ProfessorZoom | 2025-05-26 16:32:18+00:00
I embed tons of separate pieces of information, save the vectors in a db. Embed the user's question, then have a stored procedure in the db to calculate the top 10 (or 20 or 50 depending on the model) similar pieces of information.

I have an editor where I can ask a question and it brings up the most related pieces of info, and if I change any of those pieces it will update the embedding in the db
by kqr | 2025-05-26 16:32:26+00:00
> is unwrapping IO one of the things that, if you do it, you're own your own

To be able to do it in the first place, I think you need to import libraries that expose compiler internals, so I would say it belongs in the "you're on your own" category, yes.

Also if you try to Google how to do it, every hit says "don't do it".
by stego-tech | 2025-05-26 16:32:50+00:00
Then maybe don’t put critical services on the open internet. I know most tech people would balk at such a possibility, but the status quo isn’t really compatible with either long-term goal:

* If we want the internet to be a place of anonymity and free speech, then we shouldn’t be putting critical services on the public internet - or we need to stop using intermediaries like Cloudflare where a single court order could disrupt legal services

OR

* If we want critical services online and widely available, then verifiable identity is a must from the outset, such that these sorts of blocks can be highly targeted when enforced.

Piracy exists between those two forces: an anonymous internet would be rife with piracy, while an authenticated internet would see minimal amounts of it because it’s so easily eradicated. Coexistence of both worked because the internet was optional, which is no longer the case.

But nobody wants to talk about that, I find. Everyone wants the status quo to continue unabated forever, because it’s familiar. Familiarity does not mean permanent, though.
by marcospassos | 2025-05-26 16:33:23+00:00
Yeah, exactly. My whole point is to avoid doing all that. It adds up fast. What I really want is something that handles the heavy lifting end-to-end: tracking, interpreting, and outputting a prompt-ready summary like:

"The user landed on the pricing page from a Google ad, clicked to compare plans, then visited the enterprise section before initiating a support chat."
by dagss | 2025-05-26 16:34:01+00:00
On 3), sorry, I should have been more specific -- I was talking about Norway specifically and also specifically about the middle class segment.

I was a bit clumsy -- I just meant that if people wanted to prioritize time over luxuries then SOME people, who are in a position to, not all, could have sent that signal. Because luxuries (vacations, cabins, boats) are still getting prioritized in the scandinavian middle class, and those specifically could have sent the signal they wanted more free time instead.

I agree with your points outside of that context and I should have specified it.