MurphyA/hacker-news huggingface dataset:
by hardwaresofton | 2025-05-02 08:34:25+00:00
Fully agreed, other than the fact that Rust is absolutely beating Haskell in being the usable-in-production choice (and Haskell is WAY ahead of any other ML languages). Rust has just enough ML type goodness to make a big improvement AND it has the affine types which are legitimately novel.

Haskell is still struggling with what exactly to do about Linear types (and get the whole ecosystem on board), and strictness. While lazy-by-default is really amazing for certain things, Rust's approach just wins out for production code, I think.

> In general the lack of quality is a side effect of the lack of liability in many software fields, not the programming language that gets used.

This is true, until you have languages with truly novel features, like an implementation of affine types, and strong compilers.

Even just the difference between errors-as-values versus exceptions is a huge difference in my book -- Rust code gives you a clear chance/requirement to handle every possible error.
by jamiejquinn | 2025-05-02 08:34:44+00:00
If you don't use zig, you might have missed why that error indicates a stdlib bug. The error in the article is down to a quirk of the type system where literals (like the literal float) have their own unique type (comptime_float) that can coerce to related types (f32, f64) but in this particular case, when atan switches on the type, it doesn't explicitly include comptime_float and fails. Seems like an oversight in the stdlib to me.
by nake89 | 2025-05-02 08:34:51+00:00
I loved David Bushell's writing. Very entertaining as always.

I do agree many of Deno's products are in decline.

But I think deno is by far the superior typescript/javascript runtime. And deno can be run on many reputable edge providers. So deno deploy is not necessary. It's too bad because I did like the simplicity of deno deploy, but other edge provides seem to be good too.

Some of it does indeed need tweaking to get it work. But I find many amazing pieces of software written for Deno. And I find deno's tooling and security way more mature than node or bun.

As long as the tooling stays good and the runtime is updated. I'm staying.

I will be willing to switch to bun if the tooling/security gets good. I should revisit bun to see if it is now good. To my knowledge bun does not have granular permission levels like Deno. I don't understand why the runtime should have access to everything by default. I much prefer deno's way of doing things.
by skissane | 2025-05-02 08:35:12+00:00
> People still don’t know how LLMs work and think they can be trained by interacting with them at the API level.

Unless they are logging the interactions via the API, and then training off those logs. They might assume doing so is relatively safe since all the users are trustworthy and unlikely to be deliberately injecting incorrect data. In which case, a leaked API key could be used to inject incorrect data into the logs, and if nobody notices that, there’s a chance that data gets sampled and used in training.
by globular-toast | 2025-05-02 08:35:26+00:00
I do feel similarly that there are huge conflicts of interest in the finance industry. Mortgages and house prices is another one that comes to mind. Finance doesn't just react to the reality, it plays a part in driving the reality. It's a bit of a chicken and egg thing. I feel like in general humans are particularly susceptible to complicated things being abstracted by simple numbers and the finance industry is just cashing in on this susceptibility.
by DCKing | 2025-05-02 08:36:44+00:00
> I mean, if my threat model starts with "I have a mal/spyware running alongside my browser with access to all my local files", I would pretty much call it game over.

This is a big problem I have with desktop security - people just give up when faced with something so trivial as user privileged malware. I consider it a huge flaw in desktop security that user privilege malware can get away with so many things.

macOS is really the only desktop OS that doesn't just give up when faced with same user privileged malware (in good and bad ways). So there it's likely a good mitigation - macOS also doesn't permit same user privileged processes to silently key log, screen record, network trace and various other things that are possible on Windows and common Linux configurations.
by febusravenga | 2025-05-02 08:37:08+00:00
Yes, it is.

Just create _strict_ content security profile, which doesn't allow any external requests (fetch) and only allow load of resources (css, image, whatever) from predefined manifest.

App cannot exfiltrate any data in that case.

You may add permissions mechanisms of course (local disk, some cloud user controls, etc).

That's a big challenge in standards and not sure if anyone is working on such strongly restricted profile for web/js.
by charlie-83 | 2025-05-02 08:37:09+00:00
I always found SO really slow. Often I would get stuck on something, ask a question and then have to wait an hour for a response (which would often become a back and forth of comments with large periods of time between them). Even on discords for less popular languages/libraries you generally get an answer in minutes.

I think this is likely due to the incentives SO creates. I have never actually answered a SO question because it feels like you need to answer perfectly or get torn apart. I will often contribute to a discord question even if I don't full know the answer just because I think I can add something useful.
by yuriaguernsey | 2025-05-02 08:37:43+00:00
SEEKING WORK | Remote | Mobile, Web, Automation, AI

Hey, I’m Yuri. I am a full-stack developer based in Guernsey UK. I have been helping businesses ship mobile apps, websites, and automation for over 5+ years. I focus on fast-moving, high-impact work

My background blends hands-on mobile dev, backend systems, and no-code/low-code automation. I’ve helped founders, agencies, and businesses turn messy ideas into real, working software.

Stack:

- Mobile & Web: Flutter, AstroJS, PHP, JavaScript, HTML & CSS

- Backends: Supabase, PostgreSQL, Prisma, Drizzle, NodeJS

- Automation & AI: n8n, OpenAI API, custom workflows

Approach: Direct, iterative, async-friendly. I try to focus on tools that get the job done.

I’m open to freelance work, short-term retainers, or long-term async partnerships. 20–40 hrs/week availability depending on scope.

Guernsey (GMT timezone) Website: https://yuriguernsey.com Email: aeveagg@pm.me

Let’s keep it simple and ship something solid.
by ahofmann | 2025-05-02 08:38:07+00:00
No, there isn't a need for appreciation. We all cheered at that time where Google was building a great JavaScript engine and a browser around that. But in hindsight it is clear, that Google was just running the old embrace, expand, extinguish playbook on a scale that we where unable to comprehend. We would've be just fine with Firefox, webkit and maybe Microsoft would have made Internet explorer somehow not total shit. Google captured the whole web as a market and we used the opportunity to build endless JS frameworks in top and went wild with all the VC and advertising money.
by motorest | 2025-05-02 08:38:26+00:00
> Yes, anti trust rules should have stopped amazon. But they didn't, this directly hurts open source.

What absurd, twisted logic. No, it does not affect open source. What are you talking about?

> The problem is Amazon, not elastic that's trying to survive.

No, the problem is Elastic trying to coerce end-users to pay them for using FLOSS projects. It makes absolutely no difference if AWS provides a managed service or if I run Elasticsearch in a AWS EC2 instance I pay for.
by withinboredom | 2025-05-02 08:40:47+00:00
AI doesn’t destroy jobs. That’s like saying bulldozers destroyed jobs. No, it makes certain jobs easier. You still have to know what you’re doing. I can have an AI generate a statement of work in 30 seconds, but I still need to validate that output with people. You can sometimes validate it yourself to a degree, just like you can look at hole from a bulldozer and know it’s a hole. You just don’t know if it is a safe hole.
by squidbeak | 2025-05-02 08:41:39+00:00
You're correct to say Liverpool have won 20 titles. But it's also fair to differentiate between eras in which the game was fundamentally different. The Premier League's launch fundamentally altered the commercial side of the game, and the back-pass rule (same year) fundamentally altered the game itself. So it's understandable why the study confines itself to the Premier League era.
by lukan | 2025-05-02 08:41:52+00:00
Well, and I tend to roll my eyes about arrogance leading to humans repeating the same misstakes again and again.

Because even though I personally tend towards mysticism - as the universe is a pretty big mysterious place to me, this is just curiosity:

"But since we only know so very little when going really small or really big, I do say it is an interesting thought to give room for quark or dark matter based life, or the theoretical organism of a black hole."

I made no claim of anything here. "Just stating, hey things get already pretty wild and unexpected on the border of our understanding. I don't think it is smart ruling anything out yet." If you roll your eyes to this, so be it.

It is just, that I was a bit interested in the history of science and I know rolling eyes is a tradition of the established ones.
by oliwarner | 2025-05-02 08:41:58+00:00
This is an awful set of arguments, even suggesting at one point that most developers would be happy letting Apple garnish their in-app purchases for 30%. Handling your own payments is so simple cheap these days. These models need to die.

And no it's not unbelievable, incredible or any other bombastic phrase to mean the same that lying to a court gets you in serious trouble.
by Raiev | 2025-05-02 08:42:36+00:00
Alright, I understand you — you're evaluating not the project, but the person, because what matters to an investor is not even the project, but the partner. But what does your test have to do with evaluating a person? A machine assembled in 2010 in the central part of the US — is it good or bad? Should I have bought it? How will you understand from that test the level of intelligence, motivation, willpower, creativity of thinking, or depth of market understanding? It’s just a way to filter out those whose project is already generating income — especially those for whom this is not their first profitable project. This test shows nothing more.
by timewizard | 2025-05-02 08:43:11+00:00
You've misunderstood my point. It's not what the server admins want it's what the security policy will allow. If two sites, on two different domains, both use the same script, served directly from their domains, it creates absolutely no workaround for third party cookies. This is because the two sites have different origins. CSP does not create a bypass in this case.
by shikaan | 2025-05-02 08:44:08+00:00
I went back and forth about the file system and disk stuff a fair bunch, to be honest. Most of it, as you say, was mostly due to wrestling the space constraints.

If one day I'll give in and take the shell out or go multi-stage, I will definitely look at that.

Maybe it's worth blogging about the journey; it's been a few weeks of merciless trade-offs to reach a usable API. It can make for a fun read (:

Thanks for taking a look!
by pseudony | 2025-05-02 08:44:17+00:00
I actually don't think it's that cut and dry. I expect especially that rust (due to lifetimes) will stump LLMs - fixing locally triggers a need for refactor elsewhere.

I actually think a language like Clojure (very functional, very compositional, focus on local, stand-alone functions, manipulate base data-structures (list, set, map), not specialist types (~classes) would do well.

That said, atm. I get WAY more issues in ocaml suggestions from claude than for Python. Training is king - the LLM cannot reason so types are not as big a help as one might think.
by Scarblac | 2025-05-02 08:44:59+00:00
Not even that, it's to prevent clubs going bankrupt all the time.

Without rules, every club is going to invest huge sums betting on achieving a top result that would give return on investment, and only a few can achieve that each year.

Investors throwing lots of money at the sport is a feature, not a bug, from the viewpoint of the people involved in the sport. So by itself that doesn't need to be prevented.
by thom | 2025-05-02 08:45:09+00:00
I think the AI hype (much of which is justified) detracts from the fact that we have Actually Good NLP at last. I've worked on NL2SQL in both the before and after times, and it's still not a solved problem, but it's frustrating to talk to AI startup people who have never really thought deeply about named entity recognition, disambiguation etc. The tools are much, much better. The challenges and pitfalls remain much the same.
by danielovichdk | 2025-05-02 08:45:40+00:00
Some of these open source licenses are somewhat flawed when it comes to building a business on things that are "free".

Wouldn't it be possible to add a clause to some of these licenses that if you are using open source software and generate a certain amount of revenue from it, something has to be given back to the project.

I totally understand that the software is meant to be free but isn't there a balance here, where at some point it must be enforced that some the money it generates in a business, must flow back to its contributors/project ?

I have worked plenty of places where Redis was a thing that served at least some backbone for success for a business. Those places could pay a fee for generating revenue based on free software ?

Does it make sense ?
by namaria | 2025-05-02 08:45:47+00:00
People have been saying that about code for several decades now. I have on my shelf a book published in 1980 discussing this very theme.

Data compression on a massive scale and NLP search on top of that will not be the thing that finally does it. Code is logically constrained so it can be load bearing.

If NLP coding is ever solved that might change. But LLMs did not solve NLP, they improved massively on the state of the art but they are still riddled with glaring issues like devolving into nonsense often and in unpredictable ways.

All LLM-as-AI hype hinges on some imaginary version of it that is just around the corner and solves the current limitations. It's not about what is there, but what ought to be in the mind of people who think it's the silver bullet.
by fc417fc802 | 2025-05-02 08:46:16+00:00
I think imitating TLS (and who knows how many other protocols) by coupling the asymmetric key with a symmetric one instead of a bearer token is the obvious upgrade security wise. That way you could prove possession of the PSK with every request, keep it short lived, and (unlike bearer tokens) keep it hidden from callers of the API.

That said, the DBSC scheme has the rather large advantage that it can be bolted on to the current bearer token scheme with minimal changes and should largely mitigate the current issues.
by Mr_Minderbinder | 2025-05-02 08:46:35+00:00
> I've never understood the hate for table layouts.

Then I would say you have never understood HTML. Using tables for layout conflates content/structure/semantics with presentation and this is a problem in general with the HTML standards prior to HTML4 Strict. The reasons why this is bad have been expounded upon for near thirty years and are well known. HTML tables are not a “base tool” for layout.

A good litmus test for bad Web-design is “does it fail on screen readers?”. Indeed this does; it makes pages near unnavigable.
by eddythompson80 | 2025-05-02 08:46:55+00:00
Yeah, not really sure that’s simpler or even addresses the same attack vector Google’s option does.

First of all, this approach have the nice fact that now we need new TPMs capable of doing that, and even if people could update it, we will need to wait for everybody to update their TPMs. So lets wait another 10 to 15 years before we’re really sure.

Second, the attack vector google’s approach is trying to protect against is assuming someone stole your cookies. Might as well assume that someone has gained root on your machine. Can you protect against that? Google’s approach does regardless of how “owned” your machine is, yours doesn’t.

It’s not like you’re gonna hand off the TLS stream to the tpm to write a bit into it, then hand it back to the OS to continue. The tpm can’t write to a Linux tcp socket. whatever value the tpm is returning can be captured and replayed indefinitely or for the max length of the session.

So you’re back where you started and you need to have a “keep alive” mechanism with the server about these sessions.

Google’s approach is simpler. A private key you refresh your ownership of every X minutes. Even if I’m root on your machine. Whatever I steel from it has a short expiration time. It cuts down the unnecessary step of having the tpm hold the cookie too. Plus it doesn’t introduce any limitations on the cookie size
by littlestymaar | 2025-05-02 08:47:17+00:00
> fixing locally triggers a need for refactor elsewhere.

Yes, but such refactors are most of the time very mechanical, and there's no reason to believe the agent won't be able to do it.

> the LLM cannot reason so types are not as big a help as one might think.

You are missing the point: the person you are responding expects it to be superior in an agentic scenario, where the LLM can try its code and see the compiler output, rather than in a pure text-generation situation where the LLM can only assess the code from bird eye view.
by jumploops | 2025-05-02 08:47:22+00:00
I’m curious how this performs against Claude Code/Codex.

The “RustAssistant Algorithm” looks to be a simple LLM workflow[0], and their testing was limited to GPT-4 and GPT-3.5.

In my experience (building a simple Rust service using OpenAI’s o1), the LLM will happily fix compilation issues but will also inadvertently change some out-of-context functionality to make everything “just work.”

The most common issues I experienced were subtle changes to ownership, especially when using non-standard or frequently updated crates, which caused performance degradations in the test cases.

Therefore I wouldn’t really trust GPT-4 (and certainly not 3.5) to modify my code, even if just to fix compilation errors, without some additional reasoning steps or oversight.

[0] https://www.anthropic.com/engineering/building-effective-age...
by nailer | 2025-05-02 08:47:46+00:00
> This states that a Covid vaccine passing the placebo-controlled study requirement 4 years ago will not suffice to accept updated versions of the same Covid vaccine

Yes. That is what the comment you were replying to states.

> More concisely: it's an upper bound, but not a lower bound.

You can’t say it’s any bound at all. Maybe more than two milliseconds old (less than four years) is unacceptable, maybe 16 millennia (more than four years) is unacceptable. They’re just thinking about four years as being unacceptable. Which sounds reasonable.
by rckt | 2025-05-02 08:48:14+00:00
Location: Barcelona, Spain

Remote: Yes and only remote

Willing to relocate: No

Technologies: Frontend, JavaScript, TypeScript, React, Svelte, Next.JS, Three.js, WebSockets, WebRTC, API

Résumé/CV: https://rckt.cc/assets/documents/resume.pdf

Email: mail@rckt.cc

I'm a frontend dev with plenty of experience working with startups. Been working remotely in highly distributed teams for the last decade.
by CaptainFever | 2025-05-02 08:49:09+00:00
Ethics is also not as simple as "the author's wishes are always to be respected". For instance, free software was built on the ethical principle that restrictions on users' four fundamental freedoms (whether that be legal, technical, or in this case social), by IP holders, are unethical. This justifies piracy, and definitely justifies breaking this request.

I don't believe it is possible to reconcile these ethical views, as a ethical subjectivist.
by horsh1 | 2025-05-02 08:49:09+00:00
Unless we intend to surrender everything about human symbolic manipulations (all math, all proving, all computations, all programming) to llm in the nearest future, we still need some formal representations for engineering.

The major part of tradidional NLP was about formal representations. We are still to see the efficient mining techniques to extract the formal representations and analyses back from LLM.

How would we solve the traditional NLP problems, such as, for example, formalization of law corpus of a given country with LLM?

As an approximation we can look at non-natural language processing, e.g. compiler technologies. How do we write an optimizing compiler on LLM technologies? How do we ensure stability, correctness and price?

In a sence, the traditional NLP field has just doubled, not died. In addition to humans as language capable entities, who can not really explain how they use the language, we now also have LLM as another kind of language capable entities. Who in fact also can not explain anything. The only benefit is that it is cheaper to ask LLM the same question a million of times that a human.
by pedroataltar | 2025-05-02 08:49:56+00:00
Altar.io | Remote in Portugal (Europe) - must live here or open to relocate | Mid + Senior Backend and fullstack | Fulltime | https://altar.io

Hi, Pedro, lead recruiter from Altar.io here. We're a software house that wants its clients (early-stage startups, entrepreneurs) to thrive. We came together from various backgrounds with one vision: to bring a lean, user-centric approach to product innovation and software development by completely understanding the business needs before building anything.

Stack - node/express, angular/react, MongoDB/PostgreSQL. ~40 strong total team, ~14 devs.

Fully remote but must be Portugal-based. (Office in Lisbon, visits are fully voluntary).

All roles at careers.altar.io Comprehensive FAQ at careers.altar.io/#faq
by ignaloidas | 2025-05-02 08:50:39+00:00
Companies that build themselves on selling open source software put themselves in the position where anyone else can copy them and compete with them on price, and price alone. This is clearly the disadvantage of open source. It brings plenty of advantages, which is why people do it - but you can't have only the advantages and no disadvantages of open source.

Open sourcing your product is a risky investment, and as with all risky investments, it might pay out, or it might not.