MurphyA/hacker-news huggingface dataset:
by captn3m0 | 2025-05-15 14:59:25+00:00
The current mechanism has security flaws that are hiding because of SSR. Try to implement the same flow in pure-vanilla-js and you'll realize that you're hitting replay attacks instantly. This is the same vulnerability that companies which try to "hash the password on the client side to protect it" face - they've merely transformed the password to a different one (the hashed one) which has the exact same semantics as the original password for an attacker.

Your encrypted customer ID has the exact same semantics as the original customer ID for an attacker, and is insecure.
by simonw | 2025-05-15 14:59:58+00:00
I have a custom tool I use to help out posts like this together: https://tools.simonwillison.net/annotated-presentations

I updated the design with Claude 3.7 Sonnet (thinking) last night, notes on that here: https://simonwillison.net/2025/May/15/annotated-presentation...
by notepad0x90 | 2025-05-15 15:00:01+00:00
> Waking up at 6am to make some commits, reading documentation on the subway, and coding to dubstep at night wasn’t getting me anywhere. But I was happy.

That's the key friend. put in your 8hrs and do what your bosses want at your job. but if open source work makes you happy, why not do that on your free time? don't do it to get a job or to pad a resume, but because it is fun. pick projects you enjoy and limit your contribution so that it won't affect your happiness.
by lillecarl | 2025-05-15 15:00:24+00:00
I've worked at a Swedish streaming company, we bought a filesystem from IBM called "GPFS" or something before it was renamed. Well we had shit performance, reliability and everything else that could be bad. It was running on FC switches recommended by IBM, config from IBM, everything from IBM and it was an absolute fucking joke, metadata timed out regularly and the solution was "deal with it". I think my superiors should've been harder claiming we haven't received what we bought but we're Swedish so we'd rather just fall over and die.
Show HN: Freshstuff.net – Stream of Projects Releases
by raphinou | 2025-05-15 15:00:33+00:00
TLDR; https://freshstuff.net

I often missed freshmeat.net since it was discontinued. For those that don't know, it was a website where FOSS project could announce their releases. I liked to browse it to discover new projects.

I often thought about building a substitute, but it never got high enough on the priority list, until now. Due to 2 reasons:

- I worked on a project publishing a mirror of checksums files [1] published by projects hosted in Github, and I reused this F# code base [2] to collect data for Freshstuff.

- AI can accelerate the development of side projects like this one. Assigning tags to repos and generating the static site from the collected data is all done by code generated by Gemini 2.5 and RooCode [3].

The code generated is not the most efficient one, but it allowed me to finalise the project and see if there is enough interest in such a website these days to warrant further development. And I've seen some tags are erroneously assigned. That would probably be the first thing to fix if there is interest in freshstuff.

The list of releases is not exhaustive, but currently covers 4000+ projects. It only covers Github Releases at this time.

I hope it can be interesting to some others than me. Let me know here or via the about page!

1: https://github.com/asfaload/checksums

2: https://github.com/asfaload/collector

3: https://github.com/RooVetGit/Roo-Code
by NickC25 | 2025-05-15 15:02:28+00:00
It's partially due IMO to people wanting "more" from corporations, which I don't really understand. It's a corporation. It exists to make money for shareholders, and DEI is, at best, marketing. If it has a noticeable positive impact on making money, great. If it doesn't, why are folks so indignant when a corporation says "we're here to make money"? I don't want companies in my stock portfolio spending tons of money without return to placate a few people who really don't generate a congruent amount of money for the corporation.

If you work at a corporation that ditched DEI and are indignant, put your money where your mouth is and just fucking donate to causes that really address societal inequality. Or, work at a company that will match any donation you make to a registered 501c3 charity. I have a buddy that works at Goldman Sachs and know for a fact that any time he makes a donation under a certain $$ limit, Goldman matches it dollar-for-dollar. He's donated to a lot of great charities and Goldman has been all too happy to follow his donation. Doctors without Borders, Red Cross, Habitat for Humanity, no-kill animal rescue shelters, soup kitchens, etc - all great causes.

I spent a few months in early 2022 working at a company that had recently hired a DEI team. That team told me my team needed more diversity...which was odd, because my team consisted of me (a WASP, albeit one on the ADHD/Autism spectrum), a young jewish dude from the midwest fresh out of college, a mid-30s jewish guy, an older gay Bahamian guy, 2 hispanic females, a hispanic male, an Egyptian muslim guy and an older gentleman from Boston who was of Irish descent. What were we missing?
by sundaeofshock | 2025-05-15 15:02:41+00:00
The primary value of a bus is that it significantly reduces congestion. For example, an articulated bus can carry 50 - 120 passengers. That’s 120 private vehicles from the road.

Removing the driver does not change the efficiency of mass transit. In fact, I’d think you could run even more buses on the same route by removing the driver.
by xivzgrev | 2025-05-15 15:03:21+00:00
what the engineers did seems fair to me. The rule is 50 minutes, they booked right after, so yea the meeting room is theirs.

The author of this story seems to be just adjusting. Like "really, we mean 60 minutes?" New rule is, book for 60 if you need 60. Leave it at 50 if not.

at the same time, do you really need a meeting room for a standup?
by taurath | 2025-05-15 15:04:13+00:00
I've made solutions before that a product can have many permissions, a product can have many prices, and a product can also be a bundle of products. The products service does the heavy lifting by having systems to determine things like addons (If have Product1 that gives Permission1, you can purchase Product43 as an Addon to give Permission2).

This will not give you clean easy to understand reporting if you make bundles willy-nilly (N product line makes $ dollars, if bundled products exist), but to me, it gives accurate data that matches up with the pricing complexity that the business is designing.
by lockhead | 2025-05-15 15:04:15+00:00
This would help detecting legit BOTs for sure, but as Origin you would still have the same issue than before, as you still need to be able to discern between "real" Users and all the malicious Traffic. The Amount of "good" bots is way smaller than that, and by good behavior and transparent data much easier to identify even without this kind of stuff. So to make real use of this, Users would also need to do this and suddenly "privacy hell" would be too kind to call this.
by apercu | 2025-05-15 15:04:29+00:00
> IMO data should be radioactive for companies, especially if it approaches PII. Companies should be forced into thinking deeply about every single bit of data they collect from people, and they should be terrified of receiving data and be chomping at the bit to get rid of it ASAP.

100%. Unless a cooperative model (like most businesses should be run, bit that's a different issue) exists in which I am compensated for you having my data. At that point all the time and friction I have to spend/deal with because all of you have my data is worth it. Right now all this friction in my life because you have my data and I'm dealing with your beaches is "paid" for by me, and that's lame.
by __jonas | 2025-05-15 15:04:31+00:00
It kind of is though, regardless of what the LLM did there, the 'happy path' with something like Phoenix is using the phx.new and the generators which gives you a ton of files and structure that is a bit overwhelming for people used to more 'minimalist' web frameworks.

Check this out this guide from the Phoenix docs:

https://hexdocs.pm/phoenix/json_and_apis.html

That's a ton of stuff just to return some JSON from an endpoint. Sure the structure probably helps when you get into big complex projects, but for a beginner not used to this style of framework it looks like a lot.
by PaulHoule | 2025-05-15 15:05:23+00:00
A few weeks ago Palantir put up their thesis on the door to my building

https://bsky.app/profile/up-8.bsky.social/post/3ln2kmdug4s2r

but they had no idea how harshly the engineering school deals with unauthorized posters on the doors. Lately they stuck one up on the bus, no idea if they paid for an ad or if they just stuck it up there the way that I parodize ads I see on the bus and stick replacements up.

I can see "domination" being the goal on the battlefield but not so much the factory floor and definitely not the operating room.
by santoshalper | 2025-05-15 15:05:25+00:00
Hacker News is primarily read by young, affluent, intelligent men. In the old days, people like us would often fall hard for Ayn Rand's bullshit (I know I did!), now they fall for this new bullshit.

Really, it's the same thing though - it feels good to have someone tell you that you are exceptional and that your biggest problem is that someone (women, minorities, The Man, bureaucrats) is holding you back from becoming the next Steve Jobs or Frank Lloyd Wright.

You gotta understand that most people are not principled and operate solely on a vibes-based ethical framework: "If it feels good, it's probably right."
by int_19h | 2025-05-15 15:06:39+00:00
Why stop at WA-18, though? I-90 is wide and not particularly busy past that point even at peak times, so you can easily get to North Bend in only a few more minutes.

The real cutoff point for commuting to Seattle is just past exit 34, because that's where they close Snoqualmie Pass when there's too much snow.
by jemiluv8 | 2025-05-15 15:07:20+00:00
I'm fascinated to see how modern interviews especially those with take-home cope with developments like LLMS. But one thing that probably makes sense is introducing more ambiguity in the requirements for the candidate. That's what I'll do because we are no longer just testing for technical skills but also judgement, autonomy and good taste. Todays developers are more like builders and to a large extent product developers.

The actual software engineering and coding is now a lot less valuable as compared to building something useful within constraints. Anyways, here are my thoughts

1. The interviewee failed to truly appreciate the need for ambiguity. Some people felt the interview was over after the submission of the proposal and I agree with them. Coming up with your own requirements was necessary. And this requires your judgement in determining what was essential or not. This skill is surprisingly rare.

2. Good taste is also now more important than ever. It is also hard to test but the interview questions were really good in that regard. They gave you nudges towards the ideal state and left the door open for you to determine the best "path" towards that goal. This tends to reveal a lot about a developer that they might not even be aware of - like over engineering. For a take home like this, I felt the proposal and the half a dozen AWS services was not in good taste. It was probably more complicated than it needed to be.

3. Deadline and deliverables. Exceeding the deadline is a negative. The final solution is not terminal inspired and those alone may qualify as basis of rejection.

4. Of course the hiring manager should probably have rejected the proposal but will that be fair on other candidates? I also feel giving you access to a hiring manager is a stroke of genius. They can assess you via the kind of questions you asked. And I doubt this candidate asked the "right questions". Right here means that they understood the point of the take-home and also what needed to be built. I didn't get that impression from the candidate.

5. I truly believe take-homes like this should be paid. I just don't know how it might work in the real world or whether they are sustainable. The payment here is just a consolation for those that never make it so that their valuable time will be respected. Even more so because I feel a lot of people will probably diverge from the spirit of the exercise.
by bsdpython | 2025-05-15 15:07:47+00:00
Thanks. I know the last one is controversial, but the way I am starting to think about it is that we are just moving to a new layer of abstraction. I no longer understand very well how hardware works, nor do I know in detail how a browser renders a page, nor the full fine details of how many of the libraries I use work. My own AI generated code, in pockets, is starting to work in the same way. And I'm starting to become OK with that risk.
by iamacyborg | 2025-05-15 15:07:50+00:00
> Look in front of you and only a single plane will be in focus (and only your fovea produces any sort of legibility). Look towards a bright light and you might get flaring from just your eyes. Stare out the side of a car or train when driving at speed and you'll see motion blur, interrupted only by brief clarity if you intentionally try to follow the motion with your eyes.

The problem is the mismatch between what you’re looking at on the screen and what the in-game camera is looking at. If these were synchronised perfectly it wouldn’t be a problem.
by markisus | 2025-05-15 15:08:36+00:00
The application has this feature and lets you switch back and forth. What you are talking about is the standard pointcloud rendering algorithm. I have an older video where I display the corresponding pointcloud [1] in a small picture in picture frame so you can compare.

I actually started with pointclouds for my VR teleoperation system but I hated how ugly it looked. You end up seeing through objects and objects becoming unparseable if you get too close. Textures present in the RGB frame also become very hard to make out because everything becomes "pointilized". In the linked video you can make out the wood grain direction in the splat rendering, but not in the pointcloud rendering.

[1] https://youtu.be/-u-e8YTt8R8?si=qBjYlvdOsUwAl5_r&t=14
by iandanforth | 2025-05-15 15:08:57+00:00
I applaud this effort, however the "Does it work?" section answers the wrong question. Anyone can write a trivial doc compressor and show a graph saying "The compressed version is smaller!"

For this to "work" you need to have a metric that shows that AIs perform as well, or nearly as well, as with the uncompressed documentation on a wide range of tasks.
by hn_throw2025 | 2025-05-15 15:09:13+00:00
Some of those criticisms are out of date.

> It also requires a binary to run, which would require different builds for each architecture deployed to.

https://www.prisma.io/blog/from-rust-to-typescript-a-new-cha...

> That coupled with their attitude to joins

https://www.prisma.io/blog/prisma-orm-now-lets-you-choose-th...

As another poster has mentioned, a thing Prisma has over the others is type safety if you use the raw SQL escape hatch for performance reasons.
by AStonesThrow | 2025-05-15 15:10:30+00:00
Someone who is neither contributing nor necessary to a meeting may still be required to attend the meeting. For example, a mandatory training meeting includes people who are being trained, who are in this category.

If the meeting fails to accomplish its objectives in 50 minutes, then participants may excuse themselves with a clear conscience, but they may find themselves less-informed than coworkers who chose to stay for the entire session. Especially if there is "Q&A" for clarifications at the end of it.
by hombre_fatal | 2025-05-15 15:10:37+00:00
Fair enough. Do you have a favorite ORM that makes what you feel is a decent set of trade-offs, all things considered?

Admittedly, most of my experience with ORMs was with Ruby on Rails' Active Record + Rails' generated SQL tables + the culture that ensued from it, like large production Rails applications that didn't use a single db transaction (and often no indexes). Though I reckon things could have changed in 15 years.

I can imagine that an ORM might be the best option for most people. It wasn't until I worked at one specific company that I learned how to really use Postgres. Before that, an ORM and its abstractions probably made more sense than expecting me to figure out how to use a database directly on my own.
by hnthrow90348765 | 2025-05-15 15:12:09+00:00
I've never liked the craft aspect of software, but at some point I think you'll turn it around and find the intrinsic value for yourself again to keep going at it.

FAANG will give you the perspective that software is just a hollow-feeling way to make money, which will eventually let you see the richness of what you were doing before.
by viridian | 2025-05-15 15:12:13+00:00
People are capable of looking past their nose, and I've never claimed the outcome will be mass starvation or a doomed civilization. Societies will just have to change, in a way that is without precedent.

And I think you are being playful, but it's worth remembering that the second derivative of position is what kills you in a car accident, and the third derivative gives you whiplash. We also just had an election where a top issue was both the derivative and second derivative of the value of a dollar.
by larholm | 2025-05-15 15:12:35+00:00
There is also no reason to believe that the fertility rates would go to zero. To an outside observer, we might simply be reaching a new equilibrium.

The idealized Star Trek society of production automation and exploratory self fulfillment might only be possible, and sustainable, if we are a billion people.

That is still plenty enough people to continue our ever accelerating and vast exploration of culture, science and space.
by ZeroGravitas | 2025-05-15 15:12:38+00:00
> While China’s indus­trial policy is boost­ing energy and resource secur­ity, it has also led to over­ca­pa­city, hammered count­less for­eign rivals and added to a sig­ni­fic­ant trade imbal­ance.

> The coun­try’s cleantech man­u­fac­tur­ing capa­city massively out­strips domestic demand, accord­ing to data from Wood Mack­en­zie.

> This has sparked alleg­a­tions from Wash­ing­ton and Brus­sels that Beijing has viol­ated inter­na­tional trade rules through years of unfair state sup­port.

> Immense sup­ply gluts in solar, for example, have led to ware­houses over­flow­ing and low-grade Chinese-made pan­els being used for fen­cing in Europe.

The number of weird ways western journalists have tried to make China (aka the workshop of the world, the largest exporter of goods since 2009) manufacturing and exporting stuff sound like a problem for the Chinese is just crazy.

What next? Saudi Arabia is pumping far more oil than it needs for domestic demand?
by Verdex | 2025-05-15 15:13:00+00:00
My thought was that you handle meetings wasting everyone's time by releasing huntsman spiders (of clock spider meme fame) into the room periodically.

If things are running over because of something important like the financial future or your org or the health and safety of your clients then people will deal with the spiders roaming at terrifying speeds. But if everyone is just bikeshedding then the room will empty out pretty quick.
by kordlessagain | 2025-05-15 15:13:15+00:00
Covered California, the state’s health insurance marketplace, leaked deeply sensitive health information and pregnancy status, domestic abuse disclosures, and prescription drug use to LinkedIn via embedded ad trackers.

It’s a pattern we’ve seen across government and private sectors: infrastructure designed for care is being exploited for behavioral targeting through advertising motions. The public doesn’t expect their health decisions to be fed into social ad networks, but the platforms already assume ownership of that data trail.

And of course, it’s all connected. The same companies monetizing behavioral profiling at scale are now running the most powerful generative AI systems. Microsoft, which owns LinkedIn, is also the key infrastructure partner of OpenAI. Meta's ad tools were present on these health sites too. Google’s trackers are everywhere else.

When you strip away the techno-mystique, what’s driving the AI and data arms race isn’t wisdom. It’s ego, power consolidation, and a pathological fear of being second.

And Sam Altman? He’s not stupid. But brilliance without wisdom is just charisma in a predator suit. Why do you think all these services tie directly into AI?
by franciscop | 2025-05-15 15:14:01+00:00
> I’ll collect some money and retire in a couple years. Hopefully the open source world stays the same until then.

This was my feeling few years back. But after some years working at companies, it doesn't feel the same to take my keyboard on my personal time and hack away. Sure it's still fun, but maybe there's more to life than that. Thinking that my energy for hacking away all night will return would be naive, though who knows, it'll be a new future. Maybe I will pick up woodworking, which seems to be the cemetery for devs, or renovate some Akiya, which is the equivalent here in Japan.
by techpineapple | 2025-05-15 15:14:07+00:00
With AI being hallucinating citations, and being powerful enough to plausibly create sources for those citations, seems like there's going to be a bigger focus on sort of supply-chain management in research and law. I could easily see someone setting up a plausible looking law research site, putting a plausible law paper there, and having a less technically sophisticated viewer take it for granted. Particularly maybe moreso for other research oriented fields.
by wvh | 2025-05-15 15:14:07+00:00
Two days ago, I'd have said the same. Yesterday, big box went down, and because it was so stable, it was a joint less oiled and the spare chickened out at the wrong time and apparently even managed to mess up the database timeline. Today was the post-mortem, and it was rough.

I'm just saying, simple is nice and fast when it works, until it doesn't. I'm not saying to make everything complex, just to remember life is a survivor's game.
by mplanchard | 2025-05-15 15:14:23+00:00
You can see this in the article here, where they are just using whatever garbage queries Prisma spits out.

I’ve contended for a long time that ORMs and their ilk automatically building queries is an antipattern for anything but small data scale. At any reasonable size of db, you’re going to need to know sql well enough to write optimized queries anyway. There’s essential complexity in the DB queries, which ORMs can only hide for so long.
by n0ot | 2025-05-15 15:14:34+00:00
I use a custom domain with iCloud+. That works for me because I'm very much in the Apple ecosystem, but I can easily move somewhere else whenever it's no longer the best option for me, and I did just that when I moved from Proton to iCloud. I've set this up for my wife as well. It can be as simple or as hard as you want it to be, but above all, I'd strongly encourage you to use a domain you own. Email has become our de facto identity, and we should be in control of it.