MurphyA/hacker-news huggingface dataset:
by sherdil2022 | 2025-06-05 03:12:51+00:00
There are many reasons and there is a long way to go for these interviews to be inclusive and logical. I have been trying my best to change the culture around interviews and mention this to all hiring managers and interviewers to be more inclusive and use points from the following articles (not a complete list):

Don’t Do Interviews, Do Discussions! https://thinkingthrough.substack.com/p/dont-do-interviews-do...

Tech Sector Job Interviews Assess Anxiety, Not Software Skills https://news.ncsu.edu/2020/07/tech-job-interviews-anxiety/

Developer Interviews, and how you are doing them wrong. https://www.coscreen.co/blog/you-are-interviewing-developers...

Ten years of experience, still failing phone screens https://kevin.burke.dev/kevin/phone-screens-broken/

Stop Interviewing With Leet Code https://fev.al/posts/leet-code/

I'm a very slow thinker https://sive.rs/slow

Screen In to diversify your workforce https://www.linkedin.com/pulse/screen-diversify-your-workfor...

Interview accommodations for NeuroDivergent people is a right - but not all know these rights. And some companies may not care - and many hiring managers don't even have awareness!

It's a long way to go to make interviews more inclusive - but don't go down without fighting for your rights!
by JdeBP | 2025-06-05 03:13:16+00:00
Many years ago, before it was dropped, IP version 6 had a concept of "site local" addresses, which (if it had applied to version 4) would have encompassed the corporate intranet addresses that you are talking about. Routed within the corporate intranet; but not routed over corporate borders.

Think of this proposal's definition of "local" (always a tricky adjective in networking, and reportedly the proposers here have bikeshedded it extensively) as encompassing both Local Area Network addresses and non-LAN "site local" addresses.
by emushack | 2025-06-05 03:13:20+00:00
They define it the explainer this was originally based on: (https://github.com/WICG/private-network-access/blob/main/exp...)

Quote: We extend the RFC 1918 concept of private IP addresses to build a model of network privacy.

Concretely, there are 3 kinds of private network requests:

public -> private public -> local private -> local
by veqq | 2025-06-05 03:14:29+00:00
> Once you switch to a phonetic respelling this is no longer a frequent problem

Oh, but it does. It's just the standard is held as the official form of the language and dialects are killed off through standardized education etc. To do this in English would e.g. force all Australians, Englishmen etc. to speak like an American (when in the UK different cities and social classes have quite divergent usage!) This clearly would not work and would cause the system to break apart. English exhibits very minor diaglossia, as if all Turkic peoples used the same archaic spelling but pronounced it their own ways, e.g. tāg, kök, quruq, yultur etc. which Turks would pronounce as dāg, gök, yıldız etc. but other Turks today say gurt for kurt, isderik, giderim okula... You just say they're "wrong" because the government chose a standard and (Turkic people's outside of Turkey weren't forced to use it.)

As a native English speaker, I'm not even sure how to pronounce "either" (how it should be done in my dialect) and seemingly randomly reduce sounds. We'd have to change a lot of things before being able to agree on a single right version and slowly making everyone speak like that.
by AStonesThrow | 2025-06-05 03:15:28+00:00
Cross-site requests have been built in to the design of the WWW since the beginning. The whole idea of hyperlinking from one place to another, and amalgamating media from multiple sites into a single page, is the essence of the World Wide Web that Tim Berners-Lee conceived at CERN, based on the HyperCard stacks and Gopher and Wais services that had preceded it.

Of course it was only later that cookies and scripting and low-trust networks were introduced.

The WWW was conceived as more of a "desktop publishing" metaphor, where pages could be formatted and multimedia presentations could be made and served to the public. It was later that the browser was harnessed as a cross-platform application delivery front-end.

Also, many sites do carefully try to guard against "linking out" or letting the user escape their walled gardens without a warning or disclaimer. As much as they may rely on third-party analytics and ad servers, most web masters want the users to remain on their site, interacting with the same site, without following an external link that would end their engagement or web session.
by tiahura | 2025-06-05 03:15:30+00:00
> In order to have self-motivated employees you need to reward loyalty and build incentives where employees do their best because that ends up being what's best for them. Companies, pretty much all of them, decided this was both too much work and too expensive. So they gave up.

Agreed. In the end, the public’s revealed preference for “cheap” made it hard for companies to justify the cost of investing in employee motivation.
by tocs3 | 2025-06-05 03:15:58+00:00
I quit a job I grew to hate. Advice from me is to think more about what you are going to do once you are not employed there. Try not to think as much why you do not want to be there. After all you have made a decision to go.

Save some money for the time between jobs (if there is another in your future) and for a little extra for a short break (a vacation maybe). Enjoy a little planning for the future and I wish you well.
by esperent | 2025-06-05 03:15:58+00:00
Next.js:

- so many rendering modes - SSG, SSR, ISR, streaming SSR, PPR, client and server components.

- de facto Vercel lock in: edge runtime, middleware, image optimization, ISR, and lots more are massively complex to set up or less performant off Vercel.

- fragmented ecosystem between app and page router.

- so much boilerplate with the app router: layout.js, loading.js, error.js, page.js

Not everything here is bad - in fact some parts are excellent. There's just so much of it, so many ways of doing any single thing and already so much legacy code in a system that's only a few years old, and it's growing in complexity with every release.
by 90s_dev | 2025-06-05 03:16:01+00:00
Defs is also how the arrows work in this WebGL2 diagram[2], and in fact, I don't think they're possible without defs, because of `marker-end` which seems to require a marker present in defs.

[2] https://webgl2fundamentals.org/webgl/lessons/resources/webgl...
by DidYaWipe | 2025-06-05 03:16:51+00:00
Except of course that almost nobody makes a READER for Markdown. WTF? It's mystifying.

You find readme documents in Markdown in every open-source repo, but why? What are you supposed to read them with?

After much searching I finally ended up with Marked, on the Mac. A paid app. But that's about it for options. And no, I'm not talking about text editors that offer a "preview" pane that you can optionally invoke. I'm talking about a simple reader for Markdown that renders it, so you're not reading a shitty text file with a bunch of formatting codes in it. Why bother putting them in, if nothing parses and acts on them?
by jameslk | 2025-06-05 03:17:51+00:00
Cursor wishlist item for any PM listening:

When reviewing the changes made from agent mode, I don’t know why the model made the change or whether the model even made the change versus a tool call making the change. It’s a pain to go fish out the reason from a long response the model gives in the chat.

Example: I recently asked a model to set up shadcn for a project, but while trying to debug why things looked pretty broken, I had sift through a bunch of changes that looked like nasty hallucinations and separate those from actual command line changes that came from shadcn's CLI the model called. Ended up having to just do things the old fashioned way to set things up, reading the fine manual and using my brain (I almost forgot I had one)

It would be nice if above every line of code, there’s a clear indication of whether it came from a model and why the model made the change. Like a code comment, but without littering the code with actual comments
by fernmyth | 2025-06-05 03:17:52+00:00
Windfall, for those who want it.

LLMs were fantastic for writing a project[0] in a new, niche language[1]. They help write any missing libraries. They help iterate when I get stuck on language aspects. They explain concepts as well as the median SO post, and much better than the posts that don't exist.

[0] https://github.com/TedSinger/chatfile/

[1] https://crystal-lang.org/ - quite pleasant
by 3eb7988a1663 | 2025-06-05 03:18:28+00:00
I am still holding out hope that eventually at least Apple will offer fake permission grants to applications. Oh, app XYZ "needs" to see my contact list to proceed? Well it gets a randomized fake list, indistinguishable from the real one. Similar with GPS.

I have been told that WhatsApp does not let you name contacts without sharing your address book back to Facebook.
by gchamonlive | 2025-06-05 03:18:55+00:00
> That internal loop is what there is to "fix".

Brilliant!

And this is why there is nothing to fix, because it doesn't change anything external. If it doesn't change anything external, if it's only an internal loop, it's the same as the ascetic attitude that Nietzsche describes. You can beat yourself until you're in line with your expectations for your ego, or you change your whole relationship with yourself, more accepting of your flaws and more trusting that you are able to overcome this internal loop eventually, but not today.
by MatthiasPortzel | 2025-06-05 03:19:20+00:00
I occasionally use ChatGTP and I strongly object to the court forcing the collection of my data, in a lawsuit I am not named in, due merely to the possibility of copyright infringement. If I’m interested in petitioning the court to keep my data private, as you say is possible, how would I go about that?

Of course I haven’t sent anything actually sensitive to ChatGTP, but the use of copyright law in order to enforce a stricter surveillance regime is giving very strong “Right to Read” vibes.

> each book had a copyright monitor that reported when and where it was read, and by whom, to Central Licensing. (They used this information to catch reading pirates, but also to sell personal interest profiles to retailers.)

> It didn’t matter whether you did anything harmful—the offense was making it hard for the administrators to check on you. They assumed this meant you were doing something else forbidden, and they did not need to know what it was.

=> https://www.gnu.org/philosophy/right-to-read.en.html
by NoahZuniga | 2025-06-05 03:20:53+00:00
> Taxpayers' answers are then translated into standard tax forms and transmitted to the IRS's Modernized e-File (MeF) API, which is available for authorized public use

The interoperability with the revenue system is provided by a different project, and this API is also used by turbotax and the like. It won't be going away.

The interoperability is not the hard part.
by maxglute | 2025-06-05 03:23:36+00:00
There's nothing biased/narrow to note that if one evaluates Chinese history, CCP/modern PRC is experiencing unprecedented domestic serenity and is likely amidst the rising/reunifying era post chaotic Qing interregnum/collapse. Given timeline, and procedurally, ROC/TW isn't indicator of start of balkanization but last piece to reunify now that frontiers like Tibet/XJ has been thoroughly incorporated. Between eminent rise and eminent collapse, it's pretty obvious to me which way PRC comprehensive power is trending towards.

There's zero value in pretending just because things are burning in US means things are also similarly burning in degree/scale in PRC. That's cope/projection. Of course eventually "China" can break up again, but the way things has/are trending, there's still a lot of rising to do. Like it would be one thing if PRC was stagnant or relatively declining throughout last 30 years of China collapse narrative (i.e. USSR vs US), and one can argue it's a matter of slowly then suddenly. But most lines are going up, in the opposite direction of collapse, sometimes at absurd slopes, despite best effort of hegemonic US trying to contain.

Not everything is hunky dory, but let's not pretend it's threading a needle with collapse. That narrative hasn't/doesn't reconcile with reality and history. And historically, authoritarian Chinese governments can grow very powerful for a very long time. To acknowledge your concern, the state can be strong at the expense of the people, both chinese and outside "barbarians", hegemonically strong. If CCP/PRC is just average performing dynasty, they'll likely still be around and powerful in 100+ years, i.e. all of our life times.
by csense | 2025-06-05 03:24:12+00:00
By the letter of the contract, it's an open-and-shut case in the team's favor: "Indecent, offensive or immoral behaviour" is a bannable offense. The article doesn't mention how spicy his OnlyFans account is, but I'm assuming his OF content is such that it would be hard to argue it doesn't qualify as "indecent" or "immoral." [1] [2]

If the player has a case, I'd think it would stem from legal limits on the extent to which an organization's people are allowed to contractually sign away their rights to engage in "immoral" behavior when "off the clock."

Under what circumstances is an organization allowed to impose its notions of "morality" on its people when they're "off the clock"?

To me, part of the question is whether you're using the organization's resources or branding. If the OnlyFans channel mentions the Olympics or his team by name, or uses its logos, or he makes videos during the times he's officially "on the clock" for training, my instinct is that they have every right to object.

But if he's using his own name, or a pseudonym, staying "off the clock" and not displaying any Olympics or team branding, it's less clear.

(Thought experiment: If LeBron James started an OF side hustle, would / should the NBA be allowed to come down on him? If your answer's different from this case, what makes the situations different?)

He's a sympathetic character -- they tell people "You need a ton of money to compete here" [3] so he says "Well that sucks, my family isn't rich, I don't really have the skills or free time to get a job at FAANG, but I guess I can hustle the money on OF" and then they suspend him for doing it -- but he's only doing it trying to get through the obstacles they created.

(OTOH, if a bunch of skilled but poor athletes started taking the same path, would it damage the Olympics brand if people started to think "The Olympics? You mean those sports teams where the players all sell their bodies online to pay their team dues?")

[1] This seems super vague. If you and I sign a contract that has a clause saying you won't engage in offensive behavior, if I want out of the contract I can always trap you by, say, walking through a doorway at the same time as you do. If you don't hold the door for me, that's offensive behavior -- you let it slam into my face, you impolite uncultured swine! If you do hold the door for me, that's offensive behavior -- it's clearly a form of gendered violence and sexual harrassment, you sick perverted swine! No matter what you do I can always claim your actions were "offensive" or "immoral," so I can get out of the contract, and hit you for breach-of-contract penalties to boot.

[2] If a contract forbids you from "indecent" behavior, does that mean you can't engage in any form of sexual activity whatsoever for the duration of the contract?

[3] To me, this seems counter to the spirit of the Games. I always thought the Olympics were supposed to be a contest for amateur competitors -- but most of the teams seem to be professionalized outfits with very expensive training. (I know very little about sports.)
by Aziell | 2025-06-05 03:25:35+00:00
This technological breakthrough is truly amazing, especially the fact that the drone can fly on an actual race track independently, without relying on human control. It's really cool. But honestly, as AI gets better at doing what we can do, even better in some cases, it makes me a little uneasy. Will there come a day when we truly become redundant, with AI taking over the work?
by crq-yml | 2025-06-05 03:25:36+00:00
There's an aspect to Waymo's plan that means that they never really have to solve highway driving to capture market share. Highways are appealing to car manufacturers because they incentivize speed, acceleration, braking, and more nefariously, to be the bigger vehicle and more capable of surviving accidents. When automobiles were a new, growing market, manufacturers lobbied for fast streets, wide highways, and ample parking.

A viable self-driving business plan, on the other hand, has to accommodate taking final responsibility in an accident. That was what got manufacturers into the lobbying game to begin with - they needed to create a public that saw themselves as responsible owners while everyone else on the road was a meanace, and worked towards that reality through both consumer marketing and the financing and regulation systems around autos. Self-drive means that the goal changes to "every ride we provide is a safe one, and we do not serve customers that ask for danger".

And that means that some markets like regional airports and particularly sprawling, car-dependent metros may go unserved for some time, depending on how the strategists feel about their chances, but then the aspect of courting the public shifts towards strongarming governments into more intensive road safety measures, and then to only professional human drivers, and then perhaps to mandated self-drive in urban areas. Having tons of capital to throw around lets you dream very big.

In this way the problem gets redefined incrementally towards something that meets with where the engineering actually is and allows Waymo to compete while retaining its excellent record.
by jandrewrogers | 2025-06-05 03:27:39+00:00
> As an engineer, I find it neat that figuring out how to delete data is often a more complicated problem than figuring out how to create it.

Unfortunately, this is a deeply hard problem in theory. It is not as though it has not been thoroughly studied in computer science. When GDPR first came out I was actually doing core research on “delete-optimized” databases. It is a problem in other domains. Regulations don’t have the power to dictate mathematics.

I know of several examples in multiple countries where data deletion laws are flatly ignored by the government because it is literally impossible to comply even though they want to. Often this data supports a critical public good, so simply not collecting it would have adverse consequences to their citizens.

tl;dr: delete-optimized architectures are so profoundly pathological to query performance, and a lesser extent insert performance, that no one can use them for most practical applications. It is fundamental to the computer science of the problem. Denial of this reality leads to issues like the above where non-compliance is required because the law didn’t concern itself with the physics of computation.

If the database is too slow to load the data then it doesn’t matter how fast your deterministic hard deletion is because there is no data to delete in the system.

Any improvements in the situation are solving minor problems in narrow cases. The core theory problems are what they are. No amount of wishful thinking will change this situation.
by mattl | 2025-06-05 03:27:40+00:00
Everyone I know who uses Jira hates it. I don’t think there’s a lack of people ready to point out the things they hate about it.

I have one:

I hate that browsers (except Firefox) won’t let me copy a column of data from a table on a webpage. It’s 2025, most tables are going to be data these days, not layout.
by Goofy_Coyote | 2025-06-05 03:27:43+00:00
> HttpOnly Attribute: Prevents client-side JavaScript from accessing the cookie, neutralizing XSS attacks

Just a note that ‘HttpOnly’ doesn’t neutralize XSS.(although this is not the main point of this blog)

This is dangerously misleading. HttpOnly prevents cookie theft, but it absolutely doesn't "neutralize" XSS.

First, even with HttpOnly cookies, malicious JS can still make requests on behalf of the user - the browser happily attaches all cookies (including HttpOnly ones) to XHR/fetch requests. So an attacker can still

`fetch('/api/admin/add-user', {method: 'POST', body: JSON.stringify({email: 'attacker@evil.com', role: 'admin'})})`

or delete data, transfer funds, whatever the victim is authorized to do. They don't need to read the cookie, they just need the browser to send it.

This is why many apps ask for your password to change your email or reauthenticate you/trigger an MFA workflow when doing certain things.

Second, tons of XSS attacks don't even care about your cookies. They can rewrite the DOM with a fake login page and harvest credentials directly. They can keylog everything you type. They can steal data that's already on the page, redirect you to phishing sites, or mine crypto with your CPU.

HttpOnly is a good defense-in-depth measure, but calling it a neutralizer for XSS is like saying a seatbelt neutralizes car accidents. You still need proper input validation, (contextual) output encoding, CSP etc.
by 90s_dev | 2025-06-05 03:28:07+00:00
When I write code, I always start with the platform, which drives and limits the language choices. I don't say I want to write in C++, I say I want to write for web, or for iOS, or Windows, or whatever. If I'm writing for web, I'll reach for TypeScript. If iOS, then ObjC. If Windows, maybe C# if I'm being threatened. Using Rust to build a web app is like pulling teeth.

If many people think the same way, then yeah, there's no good reason to reach for Swift unless you're writing an iOS or Mac app and don't want it to be cross platform for some reason that I almost can't imagine in 2025.
by AStonesThrow | 2025-06-05 03:29:19+00:00
People believe that "my computer" or "my smartphone" has an Internet address, but this is a simplification of how it's really working.

The reality is that each network interface has at least one Internet address, and these should usually all be different.

An ordinary computer at home could be plugged into Ethernet and active on WiFi at the same time. The Ethernet interface may have an IPv4 address and a set of IPv6 addresses, and belong to their home LAN. The WiFi adapter and interface may have a different IPv4 address, and belongs to the same network, or some other network. The latter is called "multi-homing".

If you visit a site that reveals your "public" IP address(es), you may find that your public, routable IPv4 and/or IPv6 addresses differ from the ones actually assigned to your interfaces.

In order to be compliant with TCP/IP standards, your device always needs to respond on a "loopback" address in 127.0.0.0/8, and typically this is assigned to a "loopback" interface.

A network router does not identify with a singular IP address, but could answer to dozens, when many interface cards are installed. Linux will gladly add "alias" IPv4 addresses to most interface devices, and you'll see SLAAC or DHCPv6 working when there's a link-local and perhaps multiple routable IPv6 addresses on each interface.

The GP says that their work computer has a [public] routable IP address. But the same computer could have another interface, or even the same interface has additional addresses assigned to it, making it a member of that private 10.0.0.0/8 intranet. This detail may or may not be relevant to the services they're connecting to, in terms of authorization or presentation. It may be relevant to the network operators, but not to the end-user.

So as a rule of thumb: your device needs at least one IP address to connect to the Internet, but that address is associated with an interface rather than your device itself, and in a functional system, there are multiple addresses being used for different purposes, or held in reserve, and multiple interfaces that grant the device membership on at least one network.