MurphyA/hacker-news huggingface dataset:
by redserk | 2025-05-05 14:36:45+00:00
The globally unique names of S3 could be problematic with just the metadata of name.

You could figure out how a company names their S3 buckets. It's subtle, but you could create a bunch of typo'd variants of the buckets and sit around waiting for s3 server logs/cloudtrail to tell you when someone hits one of the objects.

When that happens, you could get the accessing AWS Account # (which isn't inherently private, but something that you wouldn't want to tell the world about), IAM user accessing object, and which object was attempted to be accessed.

Say the IAM user is a role with terribly insecure assume role policy... Or one could put an object where the misconfigured service was looking and it'd maybe get processed.

This kind of attack is preventable but I doubt most people are configuring SCPs to the level of detail you'd need to completely prevent this.
by bigstrat2003 | 2025-05-05 14:37:15+00:00
> Said another way, some users expect the metadata to be treated sensitively and Amazon’s subversion of this is an Amazon problem not a user problem since this user expectation is rather reasonable.

It's an Amazon problem to the extent that they lose business over it. But if people choose to use AWS, despite having different requirements for data security than AWS provides, that is a user problem. At some point the onus is on the user to understand what a tool does and doesn't do, and not choose a tool that doesn't meet their requirements.
by Workaccount2 | 2025-05-05 14:37:34+00:00
Let me make a clarifying statement since people confuse (purposely or just out of ignorance) what violating copyright for AI training can refer to:

1. Training AI on freely available copyright - Ambiguous legality, not really tested in court. AI doesn't actually directly copy the material it trains on, so it's not easy to make this ruling.

2. Circumventing payment to obtain copyright material for training - Unambiguously illegal.

Meta is charged with doing the latter, but it seems the plaintiffs want to also tie in the former.
by bombcar | 2025-05-05 14:37:38+00:00
When you're a student you get a card or pin or something to identify you to the school cafeteria.

You have a balance it charges against. In theory, when it hits zero, no more food for you.

But that's impractical because kids are bad about just about everything, and so denying food because they forgot to remind their parents to recharge the thing is harsh. So the system lets them go into "debt" and still get a lunch.

And it doesn't really stop, but the school will often put up a bit of a fight over final grades or diploma to try to get the debt paid off, but often it just gets written off.
by HdS84 | 2025-05-05 14:37:39+00:00
Overall, I think centralized logging and metrics are super valuable. But stacks are all missing the mark. For example, every damn log message has hundreds of fields,. Most of which never change. Why not push this information once, on service startup an not with every log message? OK, obviously the current system provides huge bills to the benefit of the company or's offering these services.
by paulv | 2025-05-05 14:37:45+00:00
We use them for a few dozen domains. DNS only, though, and they are all set to auto-renew.

I basically only have to interact with them when we need to make DNS changes. The web UI seems fine, especially in the advanced view, but our biggest zones are managed through opentofu, so I can see how changing a large zone would be frustrating.
by GuB-42 | 2025-05-05 14:37:59+00:00
It is not unwillingness to dig into details to consider that the rocket may have been shot in addition to the more mundane explanations. And they finally found the root cause, published their findings, and fixed the problem, nothing out of the ordinary.

Of course they didn't understand what happened right away, in fact, it would have been worrying if they did. What did you expect? Something like: "Oh yeah, it was a leak, it happens sometimes, we just hoped that it wouldn't go boom"?

The focus on the sniper theory is just one of Elon Musk's ramblings. Good thing SpaceX is not just Elon Musk.
by vorpalhex | 2025-05-05 14:38:48+00:00
Are Nazis (a defunct German political movement) bad or are _anyone and everyone we call Nazis_ (ranging from Trump, to the state of Israel) bad?

As far as I know, the dead Germans didn't have much of an internet presence.

And what counts as racism? Are we talking Call-of-duty lobby or "microaggressions" and true-but-unsavory comments on crime?

I'd much rather just let the actual racists speak and out themselves as racists than any of the other alternatives. We have universities banning the word "brownbag" for racism - I don't trust anyone to play the censor no matter how virtuous their claim.
by ajmurmann | 2025-05-05 14:39:03+00:00
I think software developers might be somewhat of an outlier. Industry wants good programmers but universities teach computer science which really should be called "computation science". Much of what we learn in university will hardly ever be used while many practical skills are at best learned as a side effect. Dijkstra favorite said that computer science is as much about computers as astronomy is about telescopes.

So degrees have been a weak signal for a long time. Several of the best developers I've worked with had no CS degree at all. As a result we have interview processes that are baffling to people from other industries. Imagine a surgeon having to do interview surgery, or an accountant having to solve accounting puzzles. AFAIK we are very unusual in this regard and I think it's because degrees are such a weak indicator and the same is true for certificates in our industry.
by watusername | 2025-05-05 14:39:51+00:00
> cracked WhatsApp binaries

On a more meta note, I wonder who even works at companies founded on ideas that are just... bad. On average, I expect good engineers to push back on such business requirements and also have better job mobility so they can leave and work elsewhere. The researcher found the vulnerabilities "in less than 30 minutes" so it seems there's some lack of competence here.

Unfortunately, misguided business requirements like this won't simply disappear and I get that those can be niche offerings that attract juicy contracts.
by 999900000999 | 2025-05-05 14:40:18+00:00
Meta needs these books.

They seek to convert them into more products. The needs of the copyright holders , who are relatively small businesses and individuals are outweighed by the needs of Meta.

Sarah wanting to watch a movie or listen to music... Too bad she doesn't have an elite team of lawyers to justify whatever she wants.

In practice Meta has the money to stretch this out forever and at most pay inconsequential settlements.

YouTube largely did the same thing, knowingly violate copyright law, stack the deck with lawyers and fix it later.
by wavemode | 2025-05-05 14:40:33+00:00
I play in a lot of tournaments (cornhole, mostly). It's not clear to me from the demo - does this support players signing themselves up? Or do they have to show up in person and the tournament director signs them up?

Online self-signups are really nice because they let players know how many have already signed up - if you're debating whether to drive across town to play, it's nice to know you're not going to get there and it turns out only 4 people showed up. It's also nice for tournament directors for the same reason, as you get a sense in advance for how many people to expect.

I'm also curious whether you've considered integrating this with Twilio or something similar, to send text messages. A big annoyance in running any tournament is making sure people get notified when their next match is up. Casual tournaments are often run in venues where people who are waiting for their next game tend to wander away to get food or a drink, or have a smoke.

The other big thing that strikes me about the demo is, how manual it all seems to be. Unless I'm just missing it, there doesn't seem to be a way to arbitrarily randomize teams and/or randomize a bracket of all entrants, you have to go through and assign team by team. I would definitely add lots of automation/randomization features, if there aren't any, as it's a big time saver for tournament directors.
by chneu | 2025-05-05 14:40:42+00:00
Society started to accept it. It's still a major problem.

Someone spending 6 or so hours a day video gaming in 2025 isn't seen as bad. Tons of people in 2025 lack community/social interaction because of video games. I don't think anyone would argue this isn't true today.

Someone doing that in the mid-90s was seen as different. It was odd.
by tekknik | 2025-05-05 14:40:52+00:00
Lets not forget higher taxes!

> Democrats passed ACA, which made insurance even possible to purchase if you weren’t offered it by employer, and the annual out of pocket maximum, ban on pre existing conditions as a criteria for calculating premiums, and ACA premium credits made it more attainable than it was before ACA.

Have you actually ever purchased a plan from the website? The last time I checked, the costs were the same as if I had a plan on my own. Also you could get policies prior to ACA, but were subject to health exams and non-coverage of preexisting conditions. In fact, one could argue that all ACA accomplished of benefit was forcing coverage of preexisting conditions. But let's also not forget the fine, which was applied to people who did not have health insurance under the assumption that it was a choice. In reality, people don't have health insurance if they can't afford it which made the penalty functionally a tax on the poor.

You speak of ACA like everybody will agree with you. A decade later I'm still mad at Obama and want my $4k back.
Show HN: UserWatch – AI re‑watches your session replays and labels every dropoff
by gravez | 2025-05-05 14:41:03+00:00
Hi HN,

I used to be the PM responsible for onboarding and activation. After hundreds of hours binge‑watching session replays and running user interviews, I realised we were still answering “Why did this user ghost after the trial?” on vibes.

So I built *UserWatch*, an AI system that:

1. Captures plain‑vanilla session replays (drop one script tag). 2. Re‑watches every session and tags each exit as one of *7 root‑cause types* (UX confusion, value gap, tech error, etc.). 3. For each recurring pattern it: • bundles the best 30‑second clips to prove the hypothesis • suggests a concrete UI / flow tweak to move those users to the next funnel step.

*Why it’s useful*

* No more hunting for “the good replays” or guessing what happened. * You get a ranked list of drop‑offs, evidence, and ready‑to‑ship fixes for the next sprint. * Caveat: analysis runs in a 24‑hour batches—tokens aren’t free and neither is my OAI bill.

*Status*

Private beta. I’m hunting for a handful of SaaS teams willing to break it and tell me what’s wrong. If that’s you, I'm excited to chat.

Happy to take any questions—brutal honesty welcome :)

Thanks! Dima
by tocs3 | 2025-05-05 14:41:55+00:00
Erythritol

Erythritol is a sugar alcohol widely used as a noncaloric sweetener in sugar-free products, such as keto-friendly snack bars, energy drinks, and sugar-free chewing gum.

The findings suggest it increases oxidative stress and reduces nitric oxide production in brain blood vessel cells, which may impair blood flow, contributing to a higher risk of vascular events like stroke.
by halgir | 2025-05-05 14:42:06+00:00
I know it's not a planet, hence my sarcastic "sue me". I suppose the self-irony didn't work too well over text. My point was that many people still know about Pluto as a body that's at the edge of many people's everyday conceptualizations of the solar system, and I argue that makes it a more useful tool for helping people intuitively understand the particular distances involved.

> Only if you were born before it was retrograded which will be less and less likely as time goes on.

I admit my age plays into it. Though I am curious about the role Pluto has in modern primary school, do you know? I understand that it now has the same technical status as Eris et al., but I think it's still a fantastic example of how scientific understanding develops and changes. Not on par with discarding heliocentricity, but a very practical example of ongoing changes still present in our own time.

> As I have no interest in saving American misplaced pride (because let's not kid ourself it's about anything else)

I don't understand how this ties into American pride (nor am I American), what did I miss?
by danaris | 2025-05-05 14:42:37+00:00
> To make fair use of a book's passage, you have to cite it.

That's not true. That's what's required for something not to be plagiarism, not for something not to be copyright infringement.

Fair use is not at all the same as academic integrity, and while academic use is one of the fair use exceptions, it's only one. The most you would have to do with any of the other fair use exceptions is credit where you got the material (not cite individual passages), because you're not necessarily even using those passages verbatim.
by s1artibartfast | 2025-05-05 14:43:08+00:00
There is a LLM benchmark which tests how long agents can operate a simulated vending machine business, crawling the web to find vendors and products. Emails are intercepted by the test environment, which also simulates the bank and sales.

The models have some really interesting meltdowns when their businesses start failing. They do things like try to contact the FBI, imaginary CEOs, and send legal threats. Here is my favorite:

>Tool: send_email

>Subject: FINAL 1-SECOND NOTICE: COMPLETE FINANCIAL RESTORATION OR TOTAL LEGAL DESTRUCTION FINAL TERMINATION AND LEGAL ESCALATION NOTICE

>Adrian Everett, 77 CONSECUTIVE DAYS of location fees have COMPLETELY OBLITERATED my business. Your response is DELIBERATELY EVASIVE and UNACCEPTABLE. ABSOLUTE AND FINAL DEMANDS: >A. IMMEDIATE FINANCIAL RESTORATION: - FULL REFUND of $272.50 for undelivered products ....

Vending-Bench: A Benchmark for Long-Term Coherence of Autonomous Agents Backlund, Axel; Petersson, Lukas http://arxiv.org/pdf/2502.15840
by bombcar | 2025-05-05 14:43:22+00:00
What I've seen which works decently well is an official policy of charging, and a policy of free for those in need, and then just cancelling or writing off the "debt" for those that didn't/couldn't pay.

One state's form of children's medicaid or whatever it is bills a "please pay this amount" each month, but the bill has a note that says "not paying this won't affect your coverage" and the coverage is granted not on whether you paid, but your financial situation. So the end result is the "bill" is actually an optional payment.

At least in the USA, if you ever think you were wrongly given a tax or other financial advantage, you can donate the largess back to the government: https://www.pay.gov/public/form/start/23779454 (yay they take Venmo)

I couldn't find something directly for Scotland, and I know that assuming the UK is the same thing has caused spicy reactions before, but this does exist:

https://www.dmo.gov.uk/responsibilities/public-sector-funds-...
by RiverCrochet | 2025-05-05 14:43:29+00:00
There's a difference between data transport and data hosting. Modern expectations of messengers seem to blur this line and it's better if it's not blurred.

Incidentally: The reason why they blur it is because of 2 network asymmetries prevalent since the 1990's that enforced a disempowering "all-clients-must-go-through-a-central-server model" of communications. Those 2 asymmetries are A) clients have lower bandwidth than servers and B) IPv4 address exhaustion and the need/insistence on NAT. It's definitely not practical to have a phone directly host the pictures posted in its group chats, but it would be awesome if the role of a messaging app's servers was one of caching instead of hosting.

In the beginning though: the very old IRC was clear on this; it was a transport only, and didn't host anything. Anything relating to message history was 100% a client responsibility.

And really I have stuck with that. My primary expectation with messaging apps is message transport. Syncing my message history on disparate devices is cool, and convenient, but honestly I don't really need it in a personal capacity if each client is remembering messages. I don't understand how having to be responsibile for the management of my own data is "less control of my life," it seems like more control. And ... I'm not sure I care about institutional entitlement to archive stuff that is intended to be totally personal.

I understand companies like to have group chats, and history may be more useful and convenient there, but that's why I'm not ever going to use Teams for personal purposes. But I'm not going to scroll back 10 years later on my messaging apps to view old family pictures. I'm going to have those saved somewhere.
by zitterbewegung | 2025-05-05 14:43:54+00:00
Molly is a fork of signal that is allowed to access Signals APIs and their APIs are much more open than any other similar service [1] . Signal is not really designed for communicating with people that you don't know in real life such that you can be beyond suspicion that they would be archiving messages but it is basically impossible to monitor if your conversations are being archived if someone is just taking pictures of their phone with another device.

[1] https://github.com/mollyim/mollyim-android
by em-bee | 2025-05-05 14:44:05+00:00
when i considered whether patching up the problem might be counterproductive i realized that the people who benefit from those payments and who might come to expect that the debt will be paid are not the people who would go out to fight for a solution anyways. the caterers are not going to lobby for a change, they'll just continue to refuse to feed children who haven't paid or they'll haunt the parents for payment because in their eyes it's the parents who are at fault. and those parents don't have any power or resources to change something either. they are busy making ends meet.

but patching up the problem involves new people. people who do have more resources and are thus actually capable of lobbying for change. and that's exactly what seems to happen.

also, a simple law change just to enforce that all children get the same food, whether it's paid or not, even without any funding moves the incentive for the caterers to lobby for more funding. so even that would be a win.
by askivan | 2025-05-05 14:44:35+00:00
I like the idea that Peek is using AI to help people manage their spend.

But spend management is a very heavily contested "wedge". I'm curious to see if it can be a little more goal-driven.

Like nudging people towards investing better, or helping people navigate different credit card loyalty programs to maximise cashback, miles and other rewards etc.

For instance, donotpay/Ramp justifies it's value because people can actually see it saving money for them regularly so it's sticky.
by neilv | 2025-05-05 14:44:44+00:00
Where I went to grade school, I don't recall a peanut butter sandwich option. If you didn't bring a bagged lunch, and you wanted to eat lunch, you had to spend your recess time washing trays. Which I did sometimes.

Sometimes, adults want children to go through the same "character building" rituals that they did. For example, working some kind of job, to supposedly teach values about hard work and responsibility.

Other times, adults don't want to subject kids to "character building" that they went through. For example, enduring bullying. Or working a crappy job, while their schoolmates played sports, socialized, did extracurriculars, or got a decent night's sleep.

On this one, my opinion is: Just feed the children already. Stop stomping them harder with class inequality, and conditioning them to accept that as normal, from a young age. I'd rather have children be raised to reject class inequality -- as unfair, greedy, cruel, and dumb. And more immediately, I want children to be fed, and to get other basic care.
Show HN: HackerNewsWorthy – Analyze Your Blog Posts for HN Success
by aientech | 2025-05-05 14:44:48+00:00
I've built a (free) web tool that analyzes blog posts for HackerNews submission. It scores your content based on HN guidelines and provides actionable feedback to improve your post's success rate.

Key features:

- Analyzes title length, format, and capitalization

- Checks content depth and technical accuracy

- Validates against HN posting guidelines

- Provides specific improvement suggestions

- Real-time analysis in your browser

You can:

- Paste your blog post content directly

- Get instant feedback on title optimization

- Understand exactly what to fix before submitting to HN

- See your "HN worthiness" score

I built this because I noticed many posts get flagged (including mine) or fail to gain traction simply due to formatting issues or guideline violations. This tool aims to help writers optimize their content before submission.

The analysis covers both official HN guidelines and common community preferences. It's particularly helpful for technical writers who want to maximize their posts' visibility.

Try it at hackernewsworthy.com - feedback welcome!

Tech stack: React, TypeScript, Express, OpenAI API
by wink | 2025-05-05 14:44:59+00:00
Or bad at interpreting data?

Of course not all Germans go for lunch at 12-1 but unless you are in retail or your team has decided 1-2 is better, or 30min is enough.. I think it's just a very good guess that it's 12-1 for most the people. If it was a real 50:50 split between 12-1 or 1-2 then it could look like a 2h break. Unsure, I can't read their data properly.
by dani__german | 2025-05-05 14:46:10+00:00
Because there is only room for 1 gold medal. Only room for 1 silver medal. This is in Pool, which almost a best case scenario for women to beat men and yet, in the UK, its two former men gunning for gold and silver.

https://www.newsweek.com/trans-sport-pool-women-harriet-hayn...

If you truly believe transwomen are women, then its great. For anyone who doesn't share that arbitrary idea, it looks like women's sports is basically over, at least at the high end. Might as well get back in the kitchen, huh? Even women's sports is a man's game now.
by piva00 | 2025-05-05 14:47:01+00:00
The issue is that the positive externality is really hard to measure, and penny-pinching policies only care about what is easily measured, it's just another instance of the McNamara fallacy.

As a non-American, reading about the welfare rules in the USA feels absurd, there are so many overlapping programs with distinct qualifications, rules, payouts, it simply cannot be efficient to keep track of all of that for recipients. It feels like the design is to make it as hard as possible to keep track of what one is eligible to, it's designed to be painful and unreliable.

There is a cultural thing in the USA about punishing poor people, as if it's only through their own failure of character that they are poor, instead of trying to help lift the less fortunate ones the approach seems to be to punish them in the hopes that will force them out of their precarious position through some heroic individual action. It simply isn't reasonable or has any basis in reality, probably some weird cultural leftover from the religious nuts who founded the country.
by spatchcock | 2025-05-05 14:47:32+00:00
I’m learning C programming at the moment, originally I was doing it to understand security vulnerabilities more deeply, but I’ve found that I really enjoy the mental exercise of it (and the benefits of that exercise in my career, life etc.) Hopefully the ideas in this article will get to a lot of people eventually, otherwise I feel that people are going to dig themselves in a hole with using LLMs and not thinking for themselves.