MurphyA/hacker-news huggingface dataset:
by 0xbadcafebee | 2025-06-18 23:33:00+00:00
I hesitate to call it an anti-pattern but it kind of is. It leads you down some bad paths.

- In the best possible scenario: 1) you're spending time to duplicate configuration between dev, test, and prod, any time the environments change, 2) you hope your testing in one environment is actually borne out in prod, 3) you are shutting down dev & test when they're not in use (to save money), 4) you rebuild it all regularly to ensure it's still actually repeatable to repair or rebuild it, 5) you do maintenance on all 3 regularly to stay up to date on security patches and dependencies, 6) you still do trunk-based development that just deploys to each environment successively with automated functional tests, which makes one of the environments (either dev or test) unnecessary, and the other inaccurate

- In the more likely scenario: 1) your "duplication" of configuration is inaccurate or literally not the same, leading to differences which cause bugs, 2) your results in prod don't mimic those in test, 3) you aren't shutting down dev/test when not in use, leading to not only unnecessary charges, but potential security issues if they get compromised (because who secures dev/test?), 4) you never rebuild it, so when there's an issue and you need to repair or replace it, you have no idea how to do it again, or the automation doesn't work, so you spend more time fixing it while your stuff is down, 5) you never do maintenance, leading to failed disks, out of date software, and general maintenance headaches, 6) you are probably not doing trunk based development, but cherry-picking changes from a "dev", "test", and "prod" branch, ending up with diverging codebases which don't match each other, and is a nightmare to debug and maintain

That's the very short version of it, anyway. Thankfully there is a modern method which solves all those problems.

Only use ephemeral environments, and production. The ephemeral environment is built from scratch whenever you want to test, and is shut down automatically after idleness. This ensures trunk-based development, allows multiple independent test deployments with specific feature-branch changes to exist simultaneously, re-tests all your automation constantly, uses the latest updates to avoid dependency stagnation, is versioned, saves money and resources, and eliminates security concerns.

Faster development, fewer bugs, less money, less maintenance toil, less downtime, more security. But it's not popular on HN so nobody does it.
by 9rx | 2025-06-18 23:34:36+00:00
> How many people actually write exhaustive tests for everything that could possibly be null?

Of those who are concerned about type theory? 99%. With a delusional 1% thinking that a gimped type system (read: insufficient for formal proofs) is some kind of magic that negates the need to write tests, somehow not noticing that many of the lessons on how to write good tests come from those language ecosystems (e.g. Haskell).

> I can confirm that at least 30% of the prod alerts I've seen come from NullReferenceExceptions.

I don't think I've ever seen a null exception (or closest language analog) occur in production, and I spent a lot of years involved in projects that used dynamically typed languages even. I'd still love for someone to show actual code and associated tests to see how they ended up in that situation. The other commenter, despite being adamant, has become avoidant when it comes down to it.
by nixosbestos | 2025-06-18 23:35:39+00:00
Yeah my strong opinion is that I have better hidpi support than any other platform, no tearing, ever, a better security model, the x devs have abandoned x11. They have accessibility (which I am completely sympathetic to, but is rarely the actual point) and a bunch of hand waving neck beard bullshit.

I have worked on DEs, I have committed to compositors. I know which side has more merit.
by jbs789 | 2025-06-18 23:35:53+00:00
My mind went to a different order but virtually identical reasoning: “Customer” focus - selecting a worthwhile problem, however you define that personally. Curious - natural curiosity provides the energy to solve the problem. Collaborative - the confidence to acknowledge what you don’t know, and desire/ability to seek out experts to help get to the best outcome.

This all comes back to a bigger tendency as organisations mature - they tend towards hiring for the role rather the person, in my experience because the company/product/etc becomes more defined over time. But really, there’s often room for different types to varying degrees, just a question of being thoughtful, and I like how this post is basically calling out thoughtful organisational design.
by denkmoon | 2025-06-18 23:36:14+00:00
Entirely anecdotal and just personal experience but I get eye strain and headaches from "flickery" LEDs. Cheap shitty room lights. Replace them with good bulbs (Philips Hue) which strobe at a much faster rate and hey less eye strain and less headaches.

I also just hate hate hate seeing the flicker in my peripheral vision.
by nullc | 2025-06-18 23:37:48+00:00
Quite the opposite. Wayland&Gnome are designed for tablets, phones, and barely laptops. Any usability on Desktop/Workstations is pure accident. Consider even the login screen-- it does nothing unless you do a completely inexplicable (on a mouse) click and swipe up.

As your theoretical "*nix geek" who mostly uses terminal windows, wayland and gnome provide an inferior experience to the daily driver software of 20 years ago.
by testfoobar | 2025-06-18 23:38:00+00:00
Outside of just wanting privacy for its own sake, there are many, many reasons to keep social media profiles private: health privacy, sexual orientation privacy, relationship privacy, location privacy, financial privacy, etc.

“To facilitate this vetting, all applicants for F, M and J non-immigrant visas will be asked to adjust the privacy settings on all their social media profiles to ‘public’”, the official said.
by ztetranz | 2025-06-18 23:40:30+00:00
As an aside, we just spent a couple of weeks camping in our RV with a cellular router connected to a VPN at home. Now that we're back home, Google maps (on a non-GPS equipped device) and Roku still think we're at the campground several states away. I guess my GPS equipped tablet reported the new location of our home IP address. On past experience, it takes about a week to reset.
by hocuspocus | 2025-06-18 23:41:26+00:00
RCS should have been that, but WhatsApp came out in 2009 and by 2010/2011 it was already game over in most of the world once cheaper Android smartphones became broadly available. At this point carriers' focus had shifted to data and the most pressing issue was starting the 4G rollout.

No wonder Google eventually took the RCS matter in their own hands, there was way too little incentive otherwise.
by superkuh | 2025-06-18 23:41:28+00:00
Luckily most of this is done by web devs using their normal tools which means if you just turn javascript off that gets rid of 99%. Sure, there are ad companies and related out there using actual webserver logs but more and more it's relying on you the user blindly executing their code on your machine. After all, everyone does it. Anyone not running javascript is weird, probably not monetizable, and therefore is a bot and doesn't exist.
Show HN: Agentic Trust – Enterprise MCP Server Platform for Secure AI Agents
by subramanya1997 | 2025-06-18 23:42:00+00:00
Hey HN! We're building Agentic Trust, a unified platform that turns your code into production-ready MCP (Model Context Protocol) servers with built-in authentication, security, and observability.

*The Problem:* As AI agents become more capable, they need secure ways to access tools and data. MCP (Anthropic's open protocol) is great for standardizing agent-to-tool communication, but deploying MCP servers in production is complex. You need authentication, rate limiting, audit logs, multi-tenancy, and more—all while ensuring your agents can't be exploited through prompt injection or other attacks.

*Our Solution:* One endpoint (agentictrust.com) that handles all your MCP servers. You write the tool logic, we handle everything else: - OAuth 2.0 authentication with scoped permissions - Rate limiting and usage analytics - Audit trails for compliance - Automatic versioning and routing - Protection against prompt injection attacks

*Technical Details:* We've also been working on OIDC-A (OpenID Connect for Agents), a proposal to extend OIDC for agent identity. It adds claims for agent attestation, delegation chains, and capabilities. This was recently featured by WorkOS's CEO at Identiverse.

The idea is that agents should have verifiable identities just like users do. When an agent acts on behalf of a user, you need to track that delegation chain for security and compliance.

*Why Now:* With Microsoft announcing MCP support in Windows 11 and OpenAI adopting the protocol, we're seeing explosive growth in MCP usage. But most implementations are insecure—exposed endpoints, no auth, vulnerable to attacks. We're fixing that.

*Links:* - Platform: https://agentictrust.com - OIDC-A Proposal: https://subramanya.ai/2025/04/28/oidc-a-proposal/ - WorkOS article on our work: https://workos.com/blog/identity-for-ai-agents

We're in early access and would love feedback from the HN community. What security concerns do you have about AI agents? How are you handling agent authentication today?
by theendisney | 2025-06-18 23:42:54+00:00
Ohh thats a whole new dystopian formula! We all thought instagram was optional but soon it Will be required to show off your beach body. While drinking the correct drink. Enhance with the right ai and catefully edit out your chinese Mexican and african friends.

The gaming quality on yt and twitch can be measured with ai to check if you are not pretending. The immigration interview full of questions about grand theft auto.

HN born as a place for founders to pretend to be civilized and knowledgable can extend to cover everyone. I mean, I wouldnt give a visum to the guy writing this comment.
by vincenthwt | 2025-06-18 23:43:11+00:00
You claim that 'most people' will be upset—are you their appointed spokesperson, or is this just your personal assumption? What I find strange is that I complimented and thanked you for your thoughts on machine vision, yet you responded with hostility. Is this how you communicate in real life too?

If 'most people' are upset about others using LLMs to improve their written communication, maybe they should reflect on why they hold such outdated views—or consider that the person replying might not be a native English speaker. Are platforms like Hacker News meant only for native English speakers?

Warning: The statement above was written by an LLM, so don’t be surprised—I’m letting you know in advance.
by antonok | 2025-06-18 23:43:15+00:00
As someone who's been building an adblocker for the last 6 years: yes, there's plenty of proof in the devtools console on more websites than you'd think.

Fingerprintjs [1] is a well known one that gets a lot of use. And if you check EasyPrivacy, you'll see the rules to block it [2] have been in place for a long time.

[1] https://github.com/fingerprintjs/fingerprintjs [2] https://github.com/easylist/easylist/blob/132813613d04b7228c...
by 0xbadcafebee | 2025-06-18 23:44:13+00:00
I have seen tiny teams fail to replicate their single-host prod environment in dev and test.

I have seen tiny teams with 3 release branches cause outage after outage of their tiny SaaS product as they couldn't keep track of what changes they merged where.

I have seen days of downtime when nobody could re-create their old-ass environments that nobody ever documented or updated, their code dependent on systems that didn't even have an active repository anymore.

I have seen C-beams glitter in the dark by the tanhauser gate.

All these moments, lost in time, like ssh keystrokes in a container.
by mlsu | 2025-06-18 23:44:58+00:00
It's very different. When a cop "thought he smelled weed," he still has to:

- detain you and tell you why he detained you

- get a prosecutor to press charges promptly, charges which have to be articulated in terms of specific statutes that your elected representatives wrote

- give you defense counsel to argue your case in court

- set a prompt court date to argue your case

- tell the public that you were put in jail, why, and the circumstances

- release those court docs to the public

- follow rules of evidence when presenting their case

There are abuses, but there are also a robust set of protections in place. If the cops thought they smelled weed in your car, and there was no weed in your car, you argue that in court, and it's really very likely that you will walk free. That outcome, for the most part, is why cops don't immediately put everyone with tattoos in jail.

This is very very different from the alternative, which is where a cop says he thinks your tattoo might look like MS-13, so you go to an offshore prison forever, with no visitation rights and no trial.

Those two outcomes are VERY different! For that reason, yes, the problem is ICE.
Looking for: Internship in data engineering, streaming systems, or infra
by pirimi | 2025-06-18 23:48:34+00:00
Location: Remote

Skills: Apache Flink, Kafka,Spark, Hadoop, Spring Boot, AWS, C++, FastAPI, ML, DL, Java, MongoDB , Postgres, Pricing options

I’ve built a real-time portfolio optimization system that streams stock and index data (from the Casablanca exchange) through Kafka into Flink, calculates log returns, and dynamically updates portfolio weights using Markowitz/APT models.

I handle deduplication, state management with RocksDB, and deploy components across local + cloud setups (including a hybrid Hadoop cluster).

Also built a chatbot for the Moroccan government using RAG + FAISS + CamemBERT + FastAPI, deployed on Ubuntu with frontend Drupal integration.

Looking to contribute to serious teams working on infra, trading systems, or scalable backend problems.
by stephen_g | 2025-06-18 23:48:45+00:00
I'm not going to say it's truly impossible, but it's practically just-about impossible.

There's no straightforward way of getting old hosts to be able to address anything in the new expanded space, or older routers to be able to route to it.

So you have to basically dual-stack it, and, oops, you've created the exact same situation with IPv6...
by diggan | 2025-06-18 23:50:55+00:00
At one point, Firefox (3.5 specifically) was #1, for a brief moment:

> Between mid-December 2009 and February 2010, Firefox 3.5 was the most popular browser (when counting individual browser versions) according to StatCounter, and as of February 2010 was one of the top 3 browser versions according to Net Applications. Both milestones involved passing Internet Explorer 7, which previously held the No. 1 and No. 3 spots in popularity according to StatCounter and Net Applications, respectively - https://en.wikipedia.org/wiki/Firefox_3.5

Then Chrome appeared and flattened both IE and Firefox.
by Rapzid | 2025-06-18 23:51:07+00:00
5x5 and 3x5 are out of vogue for lots of reasons but it largely boils down to:

* Not enough volume

* Non-periodized

That first bit means different things at different phases of a lifting "career". But generally speaking "time under tension" and research into effective rep ranges has changed modern thinking on set sizes and volume.

These days people, including World's Strongest Men, tend to recommend higher rep ranges for beginners and those coming back to the gym to build work capacity and reduce risk of injury.
by bee_rider | 2025-06-18 23:51:19+00:00
In single player games it is just another way to have fun. I mean, Minecraft creative mode is essentially equivalent to turning on all the cheats. It removes all the built-in challenge and then you come up with your own game.

It doesn’t seem very appealing to me, but I don’t think there’s any particularly interesting psychology behind it. Rather one could say I lack creativity and need monsters to motivate me to build anything.

Cheating in real competitive games is rude, though, for sure. But most people don’t play top-level competitive games.

Cheating in pseudo-competitive games like Overwatch or Dota is both rude and stupid. Because the game can just find people to match your cheat-augmented skill level anyway.
by glaucon | 2025-06-18 23:51:45+00:00
>As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days

I've just looked at my fingerprint and I'm told I'm unique (my mum always said that ;-) ).

Unfortunately it's impossible, using https://www.amiunique.org/fingerprint, to determine what elements of the fingerprint, if changed, would make me significantly non-unique but when I look down the list 16/58 javascript attributes are red (the lowest category of similarity ratio) and only two of those are overtly dependent on a version number, another six refer to screen size/resolution. It seems to me that leaves quite a lot of information which isn't going to change all the quickly.

While the precise value may change with time I feel like saying "has a half-life of only a few days" tends to understate the effectiveness of this technique.
by nntwozz | 2025-06-18 23:51:58+00:00
iPhone 16 Pro Screen flickering / PWM detected 239 Hz Amplitude: 15 %

https://www.notebookcheck.net/Apple-iPhone-16-Pro-smartphone...

The frequency of 239 Hz is relatively low, so sensitive users will likely notice flickering and experience eyestrain at the stated brightness setting and below.

There are reports that some users are still sensitive to PWM at 500 Hz and above, so be aware.

I always check notebookcheck.net for PWM stats.

For reference, the regular iPhone 16:

Screen flickering / PWM detected 60 Hz Amplitude: 25.75 % Secondary Frequency: 487 Hz
by rsingel | 2025-06-18 23:52:52+00:00
Lol. The Biden administration who simply asked platforms to enforce their own terms of service?

Maybe you're better example is the Trump administration saying it's going to withhold transportation funding from cities because citizens their dared to protest him, issued presidential orders against law firms that represented people suing him, pulled the security clearances of people who dared to say that the 2020 election was not stolen, and threatened trees and charges against a former DHS official who wrote an unflattering op-ed in the Washington Post.

One of these is not like the other
by xyzzy123 | 2025-06-18 23:53:46+00:00
Now we write graphql adapters over dozens of microservices to get back the capability to express queries and lessen the burden of hardcoding every possible query for frontend. N+1 is just more fun at the party and with a bit of effort you can make basic queries depend on the health of almost every service in your infrastructure.

If you squint at it wrong, it looks like some kind of bizarre and inhumane jobs program.

Meanwhile, transactions remain forgotten lore. Simply not achievable at our current tech level.
by impossiblefork | 2025-06-18 23:54:02+00:00
Rights always apply, always. This is the thing about human rights enshrined in human rights laws in places like the EU, or about your constitutional rights (although the latter only applies to US citizens and to people physically present in the US).

However, countries may, depending on their laws, choose to not let certain people in on conditions that would otherwise violate guarantees on freedom of speech etc.

However, you do have your constitutional rights at the border etc. There is an exception concerning searches.
by Mountain_Skies | 2025-06-18 23:54:02+00:00
Much of the world is against LBGTQ+ rights. If an immigrant has social media posts expressing open hatred and even calls for violence against people with sexual orientations not approved of in their home culture, will you still have an open mind about welcoming them in the US with open arms?

This isn't theoretical. Both China and India, the two countries that supply the most students to the US, prohibit marriage equality. Both have extensive discrimination throughout their societies, both at the government and cultural levels.
by JadeNB | 2025-06-18 23:55:03+00:00
> Poetry is literally defined by its characteristics when spoken. That's what "poetry" means.

Wiktionary (https://en.wiktionary.org/wiki/poetry) tells me that its etymology is through "poet," which in turn means "author" or "maker," and that its meaning is "Literature composed in verse or language exhibiting conscious attention to patterns and rhythm." Neither of those things uniquely privileges its spoken experience. But it doesn't really matter what the etymology or meaning of the word is when discussing the best way to enjoy it, and it's at best useless to try to tell someone else that they're enjoying it wrong.
by hansvm | 2025-06-18 23:56:01+00:00
> most of the time the LLM has written correct code [...dumb bugs]

What domain do you work in?

I hope I'm just misusing the tool, but I don't think so (math+ML+AI background, able to make LLMs perform in other domains, able to make LLMs sing and dance for certain coding tasks, have seen other people struggle in the same ways I do trying to use LLMs for most coding tasks, haven't seen evidence of anyone doing better yet). On almost any problem where I'd be faster letting an LLM attempt it rather than just banging out a solution myself, it only comes close to being correct with intensive, lengthy prompting -- after much more effort than just typing the right thing in the first place. When it's wrong, the bugs often take more work to spot than to just write the right thing since you have to carefully scrutinize each line anyway while simultaneously reverse engineering the rationale for each decision (the API is structured and named such that you expect pagination to be handled automatically, but that's actually an additional requirement the caller must handle, leading to incomplete reads which look correct in prod ... till they aren't; when moving code from point A to point B it removes a critical safety check but the git diff is next to useless and you have to hand-review that sort of tedium and have to actually analyze every line instead of trusting the author when they say that a certain passage is a copy-paste job; it can't automatically pick up on the local style (even when explicitly prompted as to that style's purpose) and requires a hand-curated set of examples to figure out what a given comptime template should actually be doing, violating all sorts of invariants in the generated code, like running blocking syscalls inside an event loop implementation but using APIs which make doing so _look_ innocuous).

I've shipped a lot of (curated, modified) LLM code to prod, but I haven't yet seen a single model or wrapper around such models capable of generating nearly-correct code "most" of the time.

I don't doubt that's what you've actually observed though, so I'm passionately curious where the disconnect lies.
by drawsome | 2025-06-18 23:56:24+00:00
Resiliency and adaptability is awesome.

The phone is connected to the car on Bluetooth. The user shuts off the car. The call continues without delay.

While there are so many more features that the phone could provide, staying connected during the call seems essential. However, I’m sure this wasn’t part of the first release of the app. But, once they get it to work, it is fucking magic.