MurphyA/hacker-news huggingface dataset:
by k310 | 2025-06-24 03:35:51+00:00
SLUM: The Shadow Library Uptime Monitor, tells you which sites are up or down. [0]

Working now: (I bookmarked these)

https://z-lib.gd/

https://1lib.sk/

https://z-lib.fm/

Oldies:

https://idoc.pub/

https://www.pdfdrive.com/

How to configure DNS over https: Cloudflare, YMMV [1]

EDIT TO ADD:

Info on libgen: [2]

Info on Zlibrary [3]

Library Genesis Guide Updated June 3, 2025 [4]

I did not see an onion address anywhere.

The zlibrary onion addresses check out.

> Current TOR Z-Library URL addresses. You must download the TOR browser to access these links. [5]

http://zlibrary24tuxziyiyfr7zd46ytefdqbqd2axkmxm4o5374ptpc52...

http://loginzlib2vrak5zzpcocc3ouizykn6k5qecgj2tzlnab5wcbqhem...

> TOR links change often.

[0] https://open-slum.org/

[1] https://developers.cloudflare.com/1.1.1.1/encryption/dns-ove...

[2] https://libgen.onl/

[3] https://libgen.onl/z-library/

[4] https://librarygenesis.net/

[5] https://zlibrary.st/
by strken | 2025-06-24 03:37:14+00:00
Wanting to be beautiful to others isn't the same as being sexually attracted to yourself, or to the idea of yourself plus some modifications, at all.

I trim my beard in the morning because I want to look good to other people, as do most men. Would you agree that the male population doesn't do this because they all have have a paraphilia for a specific style of facial hair? And that women don't shave their legs because of a similar paraphilia?
by Duanemclemore | 2025-06-24 03:37:14+00:00
For some reason FringeWare Review [0] has kept coming back up for me in the past few weeks. In sharing it here I have started trying to express why you should care about it so many different ways - what it was about, why it was important, who was involved, or what it meant to me. But I can't. It's like an early cyberculture version of Borges' Aleph [1], containing all of that world in it at once. Or at least it bundled together important threads that led off to every other wild corner of the early web, 90's counterculture, and beyond. So I thought maybe I'd just roll the mention of this sacred, insane corner of the internet into the hall like a golden apple (Hail Eris!) and let anyone else who remembers it join the tussle.

I also just found out that... in some fashion their website is still active [2] 25+ years since their physical shop shuttered.

So whether you're an old timer and this is a trip down memory lane or you're not and this is online archaeology for you, enjoy!

[0] https://en.wikipedia.org/wiki/FringeWare_Review

[1] http://www.phinnweb.org/links/literature/borges/aleph.html

[2] http://fringeware.com/
by jraby3 | 2025-06-24 03:38:20+00:00
I personally think that it's not ok that Iran has sewed so much discord in the Middle East by arming Hez, Hamas and the Houthis.

I'm very happy the US got involved and destroyed their enrichment sites. I'm also happy Israel didn't wait around for Iran to destroy them, which they've actively been trying to do in this war.
by Vic-Bhatia | 2025-06-24 03:38:21+00:00
Former Head of Security GRC at Meta FinTech, and ex-CISO at Motorola. Now, Technical Founder at a compliance remediation engineering startup.

Some minor nits. One can't be SOC 2 "certified". You can only receive an attestation that the controls are designed (for the Type 1) and operating effectively (for the Type 2). So, the correct phrase would be that Excalidraw+ has received its "SOC 2 Type 1 attestation" for the x,y,z Trust Services Criteria (usually Security, Availability, and Confidentiality. Companies rarely select the other two - Privacy, and Processing Integrity - unless there's overlap with other compliance frameworks like HIPAA, etc.)Reason this is important is because phrasing matters, and the incorrect wording indicates lack of maturity.

Also, as others have said, no one "fails" a SOC 2 audit. You can only get one of four auditor opinions - Unmodified, Qualified, Adverse, and Disclaimer (you want to shoot for Unmodified).

As fyi, the technical areas that auditors highly scrutinize are access management (human and service accounts), change management (supply chain security and artifact security), and threat and vulnerability management (includes patch management, incident response, etc). Hope this information helps someone as they get ready for their SOC 2 attestation :-)

Similarly, the report areas you want to be very careful about are Section 3: System Description (make sure you don't take on compliance jeopardy by signing up for an overly broad system scope), and Section 4: Testing Matrices (push back on controls that don't apply to you, or the audit test plan doesn't make sense - auditors are still stuck in the early 00's / "client server legacy data center" mode and don't really understand modern cloud environments).

Finally, if you're using Vanta/Drata or something similar - please take time to read the security policy templates and don't accept it blindly for your organization - because once you do, then it gets set in stone and that's what you are audited against (example - most modern operating systems have anti-malware built in, you don't need to waste money for purchasing a separate software, at least for year one - so make sure your policy doesn't say you have a separate end point protection solution running. Another one, if you have an office that you're using as a WeWork co-working space model only, most of the physical security controls like cameras, badge systems etc either don't apply or are the landlord's responsibility, so out of scope for you).

Hope this comment helps someone! SOC 2 is made out to be way more complicated (and expensive) than it actually needs to be.
by somenameforme | 2025-06-24 03:39:39+00:00
They began enriching to 60% as a response to Israeli attacks on the country in 2021. Before that it was never higher than 20%. 60% is just below weapons grade and was meant to send a message. Similarly, the reasons their nuclear program is completely underground should be completely obvious at this point. Israel has been trying to get somebody to invade them for decades, has been assassinating anybody they can find, and so on.

Before this there was every reason to doubt Israel's claims, which they've been making for 30 years, about Iran imminently having a nuclear weapon. But at this point there's a practically 100% certainty that they will be aiming to create nuclear weapons as quickly as possible.
by jmye | 2025-06-24 03:39:57+00:00
This, for sure. I pump up good people doing good things. No one cares that I think our new time tracking sucks, or that an HR policy sent me over the edge, and they definitely don’t care that I think an SVP in a different department is going to tank the company because their metric strategy is all about finding fractions of fractions that make them look good.

But they’ll, even subconsciously, remember that I said Joe and Jane were absolute rock stars.
by ChrisMarshallNY | 2025-06-24 03:41:16+00:00
Well, in my case, I’m dealing with recovering drug addicts.

With addicts, the formula is pretty simple. You relapse into using (including alcohol), you crash and burn. Often, in spectacular fashion.

When recovering, the organization I work with, has tools that give an unfair advantage in the Game of Life. Keep on the path, and things can go amazingly well. Stray off, though, and there’s hell to pay.

I’m not especially comfortable, saying much more, in public. It’s a very sensitive and controversial topic, and folks tend to get a bit … extreme … when discussing it.
by tptacek | 2025-06-24 03:42:20+00:00
Cosign all of this wholeheartedly. Push back!

The ratcheting back system scope thing is super good advice I always forget to give, too. You can get your entire software security program wrapped up in your SOC2 --- but why would you ever want to do that. The security of your software is very relevant to your customers, but it is not and should not be relevant to SOC2.
by ehnto | 2025-06-24 03:43:13+00:00
I can see espresso cafe culture spreading a bit through Japan, with australian style cafes offering great espresso and mixed cuisine on the menu. I think japan/australian cafe culture colliding has been an incredible thing. It's happening in Australia too, where the Japenese aspects of small inexpensive foods are mixing into Japan influenced cafes here.

I think Australia and Japan have a surprisingly symbiotic cafe culture that's betting blurred together.
by eredengrin | 2025-06-24 03:43:59+00:00
> and my reply was "if you don't mind side scanners, which allow you to do the thing you miss (unlocking the phone while taking it out of your pocket), they still make those".

This isn't quite what you said, you asked a question

> why does it have to specifically be the back?

and then got an answer to the question

> Where does your index finger sit?

This answer was presumably meant to imply that your index finger naturally sits at the perfect spot for unlocking the phone if the sensor is on the back. At least for me (and I always assumed everyone else, but you are showing to be an exception), my index finger is on the back of the phone both when taking it out of the pocket and when holding it, so it's the perfect spot for a sensor.

Your assumption of using the thumb to unlock the phone is apparently so strong that maybe you didn't realize others in this thread are assuming index finger is the most natural to unlock, and I guess that is where the confusion comes from. Since I have a sensor on the back of my phone and unlock it with my index finger while taking it out of my pocket, this statement is very odd to me:

> The original topic was about unlocking your phone while taking it out of your pocket, which is done with the thumb.

First, it's not true for me, since I use my index finger, and second, I'm not even sure how I would have to contort my hand to have the fingers and thumbs on the side of the phone while taking it out of my pocket such that the thumb could unlock via a side sensor. Even putting my hand in at a 90 degree angle is tough because pockets are usually too tight for that. But I suppose if you have always unlocked your phone with your thumb while taking it out of your pocket, I can see why you might think they're pulling your leg.
by b0a04gl | 2025-06-24 03:44:37+00:00
we had to go through this at my current place. getting SOC2 type 1 wasn't easy, it forced us to clean up years of infra mess. audit trails that never existed, access logs that were half broken, no changelog discipline. suddenly had to make all of it real.

and since we're also running an open core setup with paid SaaS, same pain. had to clearly draw lines - what parts stay public, what goes behind login, what actions need tracking. OSS gives you velocity but hides the surface area until compliance hits. things/processes no one cared about when we were shipping fast suddenly became blockers.

it just checks if you said you'd do something and whether there's proof you actually did. forces you to grow up, in a way that isn't very founder friendly
by tptacek | 2025-06-24 03:44:37+00:00
Yes, and yes. No matter how good your auditors are, unless you're accepting a shrink-wrapped set of controls from a tool provider like Vanta, you need to be pushing back on things they demand; you just have to have a clear idea of what the Common Criteria control they're looking for is (you'll see this clearly from the DRL they give you at the start of the engagement), and then when they ask for stuff that doesn't matter or isn't relevant for your org, you explain how what they're asking for has nothing to do with the actual control you're working on.

So far as I can tell there is almost nothing that is a firm requirement in a standard SOC2 Security TSC audit. We even got "background checks" rolled back.

Our audit firm is a SOC2 practice that informally spun of out of a Big 4 firm. When people get audits after using GRC tools like Drata, they often get matchmade to auditors who bid down the cost of the audit. It's possible that one of the things you get when you pay low-mid 5 figures for an audit instead of low-mid 4 figures for an audit is a lot more flexibility and back/forth with the auditors; I don't know. If that's the case: pay for the better auditors. These are rounding error expenses compared to doing extra engineering work just for SOC2.
by WorldMaker | 2025-06-24 03:46:36+00:00
Of course you don't "need" to introduce category theory for that, which is why I saved it for fun at the end. I just think it is neat. It's also one of those bridges to "category theory is simpler than it sounds", which is also why I disagree with it being "overkill" in general in part because that keeps category theory in the "too complex for real needs" box, which I think is the wrong box. Which, case in point:

> […] abstract algebra seems sufficient to categorize both boolean logic and integer operations as having the common structure of a ring.

I don't think Ring Theory is any easier than Category Theory to learn/teach, I rather think that Category Theory is a subset of some of best parts of abstract algebra, especially Group Theory, boiled down to the sufficient parts to describe (among other things) practical function composition tools for computing.
by pamelafox | 2025-06-24 03:50:11+00:00
So much keeps getting discovered about dinosaurs! If you want to catch up on the last 20 years of research, particularly on the feathered front, I recommend this book: https://www.goodreads.com/book/show/23394100-flying-dinosaur...

(As the mum of a 5 yr old and 3 yr old, I feel obligated to become an expert on all things dinosaur.)
by b0a04gl | 2025-06-24 03:50:43+00:00
how much of modern set theory is reverse engineered from axioms rather than discovered. we're always building highways through a forest we haven't mapped, assuming every tree will fall in line. and suddenly these new large cardinals show up that don't even sit neatly in the ladder. it's maynot be failure of math,but failure of narrative. we thought the infinite was climbable, now it's folding sideways. maybe the math we're building is just a subset of what's possible, shaped by what's provable under our current tools. lot of deep shit probably hiding in the unprovable.
by jandrewrogers | 2025-06-24 03:51:16+00:00
To be honest, I’d never heard of them until now. Industry runs on Material Safety Data Sheets (MSDS), which are privately produced. The thing is, the hazards for chemicals at least are highly standardized. The nature of e.g. ammonium perchlorate doesn’t change much depending on where it comes from. No one needs to write their own MSDS.

Safety operationally is regulated by OSHA, based on the MSDS among other things. It isn’t entirely clear where the CSB fits in. There aren’t many surprises in chemistry and OSHA is aggressive.

The safety protocols are pretty straightforward forward and strict, there isn’t much novelty in chemical disasters. Chemical disasters are virtually always for stupid reasons covered by other regulatory organizations.
by 3eb7988a1663 | 2025-06-24 03:51:42+00:00
Ignoring outright save-file manipulation, this style does tweak the strategy of the game.

You have to assume the fog of war does not exist. The enemy knows exactly what you are constructing, no secretly rushing a wonder. It also means you could have a much better feel for the probabilities of winning a military engagement. You could locally run through several turns, pitting their army against yours to see the most likely outcome. The moment the odds tilt in your favor, you would be incentivized to seize the victory, knowing the enemy is running the same calculus.
by NHQ | 2025-06-24 03:52:33+00:00
They built large-masonry structures without laying down roads, or apparently sewers either. Some of the structures are sitting atop raised foundations, higher than the others, yet apparently without stairs or ramps.

Many of the roofs in the background appear to be masonry, compared to the modern tile roofing seen in the foreground, and the masonry roofs are very weathered. All of the masonry looks like it has a 200 year old patina impervious to power washing. Behind it all and only slightly taller than all of the structures, a hill that looks distinctly dug out, and which exposed dirt is the same coloras the patina on the old roofs.
by ehnto | 2025-06-24 03:52:47+00:00
The split between essential and incidental complexity is a really key insight for thinking about how far AI can be pushed into software development. I think it's likely the detail many developers are feeling intuitively but not able to articulate, in regards to why they won't be replaced just yet.

It's certainly how actually using AI in earnest feels, I have been doing my best to get agents like Claude to work through problems in a complex codebase defined by enormous amounts of outside business logic. This lack of ability to truly intuit the business requirements and deep context requirements means it cannot make business related code changes. But it can help with very small context code changes, ie incidental complexity unrelated to the core role of a good developer, which is translating real world requirements into a system.

But I will add that it shouldn't be underestimated how many of us are actually solving the distribution problem, not technical problems. I still would not feel confident replacing a junior with AI, the core issue being lack of self-correction. But certainly people will try, and businesses built around AI development will be real and undercut established businesses. Whether that's net good or bad will probably not matter to those who lose their jobs in the scuffle.
by kerakaali | 2025-06-24 03:53:30+00:00
>> on the vibrant business and street culture in Japanese cities and the seemingly very, very low barriers to entry for regular people to participate.

> An astute observation that allowing markets to operate without onerous licensing schemes and regulations often has wonderful upsides

I suspect you are reading too much into this line from the article. Japan is a country full of bureaucratic regulations to the extent that it's often stifling -- especially compared to the US.

The overall lowered barrier to entry is largely a result of zoning laws differences between Japan and the US. In the US, zoning laws are largely permissive (you CAN build this here) where zoning laws in Japan are restrictive (you CANNOT build this here). This leads to huge differences in urban planning where Japan favours mixed-used development whereas the US has huge swaths of contiguous blocks separating residential and commercial zones.

Add to that, the cost of visibility is higher in the US because transportation is already car-centric. Small shops thrive on pedestrian traffic, which there is little of in the US outside core urban environments. NIMBY culture has killed much of urban diversity in America.
by mnky9800n | 2025-06-24 03:54:01+00:00
I don’t understand the point of a distraction free writing device. I am constantly flipping out of what I’m writing to go look at codes, chat with ai, read papers or tutorials, and then back to what I am writing. I realise I may not be the target audience. I guess if I was writing fiction then I wouldn’t want a distraction.
by akerl_ | 2025-06-24 03:54:17+00:00
In my experience, it's more likely it was the approach of the folks at your company that made your controls.

SOC2 (and a bunch of similar regimes) basically boil down to "have you documented enough of your company's approach to things that would be damaging to business continuity, and can you demonstrate with evidence to auditors with low-to-medium technical expertise that you are doing what you've said you'd do". Some compliance regimes and some auditors care to differing degrees about whether you can demonstrate that what you've said you'd do is actually a viable and complete way to accomplish the goal you're addressing.

So the good path is that the compliance regime has some baseline expectation like "Audit logs exist for privileged access", and whoever at your company is writing the controls writes "All the logs get sent to our SIEM, and the SIEM tracks what time it received the logs, and the SIEM is only administered by the SIEM administration team" and makes a nice diagram and once a year they show somebody that logs make it to the SIEM.

One of the bad paths is that whoever is writing the controls writes "We have a custom set of k8s helm charts which coordinate using Raft consensus to capture and replicate log data". This gets you to the bad path where now you've got to prove to several non-technical people how all that works.

Another bad path is that whoever writes the control says "well shit, I guess technically if Jimbo on the IT team went nuts, he could push a malicious update to the SIEM and then log in and delete all the data", and so they invent some Rube Goldberg machine to make that not possible, making the infrastructure insanely more complex when they could have just said "Only the SIEM admins can admin the SIEM" and leaned on the fact that auditors expect management to make risk assessments.

The other bad path is that whoever is writing the controls doesn't realize they have agency in the matter, and so they just ask the auditors what the controls should be, and the auditors hand them some boilerplate about how all the servers in the server farm should run NTP and they should uninstall telnet and make sure that their LAMP stack is patched and whatever else, because the auditors are not generally highly technical. And the control author just runs with that and you end up with a control that was just "whatever junk the auditors have amalgamated from past audits" instead of being driven by your company's stack or needs.
Ask HN: How is a company like Astral viable, financially?
by ashwinsundar | 2025-06-24 03:54:34+00:00
First of all, let me start by saying that I love uv and have changed all my Python projects to use it. It simplifies dependency management in a transparent and easy-to-use way.

However, after reading this thread (https://news.ycombinator.com/item?id=44357411), I began to wonder - who is this company 'Astral' behind all this?

https://astral.sh/about

I read their about, and it sounds great and I'm all for it. But they are still a company, and I presume they want to make money somehow. Otherwise they'll stop being a company, and I don't want that to happen because I really like uv.

But I also want to know if there is some plan to eventually get money out of me, an innocent uv-user. Is it a mistake to become too reliant on uv/Astral? Or can I hope the relationship will be more like GitHub's (pretty happy overall, it's an industry standard, I toss a few bucks their way for various services, although it is becoming less usable...)
by scarface_74 | 2025-06-24 03:56:30+00:00
Yes because American public transit is so great and now you have to get up hours earlier and come home later - not great if you have kids or you actually want to spend time with your significant other.

Also what happens when that cheap old car doesn’t start in the morning when you need to get to work or pick your kids up from day care/school or need to be home when they get off the bus?

Where are you going to get the money to fix that old car?
by dgfitz | 2025-06-24 03:57:43+00:00
My biggest beef with it by far was the lack of additional storytelling of the infection.

Gameplay was fun, graphics on PS5 were excellent. The infection is a character all by itself and it was basically completely neglected. This bothered me because it was such a central part of the first game.

Another game that actually did this well, Days Gone, will sadly never get a sequel.
by sebtron | 2025-06-24 03:58:40+00:00
I guess this is highly subjective, I was just talking with my girlfriend last night about how much I dislike when the fingerprint reader is not on the front. Specifically because only if it is on the front I can easily use it when my phone is lying on the table.

Also, my current phone phone has it on the back and I can only configure one fingerprint, so if for some reason I am holding it in my left hand I am out of luck.