MurphyA/hacker-news huggingface dataset:
by baobun | 2025-06-25 22:47:11+00:00
> Where did I imply causality?

> > The certificate code referenced here shows why

So what's the implication here, then?

> This is bad code.

Without justifying further I think we're on equal footing on the snottiness here (:

What's bad? Why not use regex here? It's not like they're using it to parse user-controlled HTML. Simple string transormations like this is a great use-case where the manual character iteration easily becomes inefficient and messy. And you may introduce bugs in the process (unicode length bugs are common).

Do you also avoid grep and sed without the -F flag in shell?
by 6510 | 2025-06-25 22:47:16+00:00
I often have a mental picture of the thing I need, I start writing it, get a bit "stuck" on architecture and think I could be using a ready made library for this. I find one or a few of them, look at the code (which is obviously more generic) and realize it's many times as large as I thought the entire project should be. With few exceptions the train of thought doesn't even reach the "Do I want to carry this around and baby sit it?" stage. Some how this continues to surprise me every time.

These 5 lines are probably my favorite example.

https://jsfiddle.net/gaby_de_wilde/c8bhcatj/7/
by busymom0 | 2025-06-25 22:47:26+00:00
> and I haven't seen any spam on the places that I frequent like HN, stackexchange, wikipedia, mastodon, signal, github, etc.

Could that just be because the modern LLM generated spam doesn't look like old-school spam? Just recently we learnt that a university conducted a study on Reddit changemyview subreddit using LLM generated comments without getting caught.
by ProgramMax | 2025-06-25 22:48:35+00:00
Strangely, I was familiar with AIFF and RIFF files but never made the connection that they're both IFF. I hadn't known about IFF before your post. Thank you :)

W3C requires that we do not break old, conformant specs. Meaning if the next PNG spec would invalidate prior specs, they won't approve it. By extension, an old, conformant program will not suddenly become non-conformant.

I could see a group of people formalizing IFFv2, and adapting PNG to it. But that would effectively be PNGIFF, not PNG. It would be a new spec. Because we cannot break the old one.

That might be fine. But it comes with a new set of problems, like adoption.

Soooo I like the idea but it would probably be a separate thing. FWIW, it would actually be nice to make a formal IFF spec. If there was no governing body that owns it, we can find an org and gather interest.

I doubt W3C would be the right org for it. ISO subgroup??
by reply-comment | 2025-06-25 22:49:11+00:00
Oh because I don't have an account! I only remember my professor talking about it. One can see critical theory as a productive meaning exercise running against the crust of status quo epistemologies via an unavoidable discomfort, which ultimately lands us in a more truthful because more just world. The social relation hermeneutic demystifies systems which center and benefit from perceived technological complexity. It reminds me that at the root we're all living in fractured relationship with each other, which we'll try anything to heal. Some authors from the syllabus:

Chinua Achebe, Arturo Escobar, Ashis Nandy, Dipesh Chakrabarty, Edward W. Said, Frantz Fanon, Gloria E. Anzaldúa, Jasbir K. Puar, Jodi A. Byrd, Michel-Rolph Trouillot, Ngũgĩ wa Thiong'o, Robin D. G. Kelley, Silvia Federici, Sundhya Pahuja, Leanne Betasamosake Simpson
by LionEgo | 2025-06-25 22:49:31+00:00
> First of all, I disagree with this comment.

You can disagree all you want. It is simply the truth. I've contracted in the UK and Europe. Most devs don't even know you can tab complete most commands in modern shells (IIRC cmd.exe supports this). This is both Microsoft Shops and shops that use opensource stacks e.g. LAMP and similar.

I was in a large company in the NW and I knew two developers in a team of 30 that knew basic bash and vim.

There is a reason why "how I exit from vim" is a meme. Most people have no idea how to do it.

> If that is the case, it proves my point EVEN MORE that Micrsofot missed out creating a Microsoft Linux Distro... designed to have Powershell, Visual Studio Code, Edit, and potentially Edge, SQL Server, etc.

Respectfully you seem to have never worked with the people I describe. You listed PowerShell as if they would use it. A former colleague of mine was quizzed why he would use PowerShell to write a script that would run on a Windows Server. They had expected him to write a C# program.
by __MatrixMan__ | 2025-06-25 22:50:41+00:00
> They're the only solution to the growing spam and abuse problem on the web

They're the only solution that doesn't require a pre-existing trust relationship, but the web is more of a dark forest every day and captchas cannot save us from that. Eventually we're going to have to buckle down and maintain a web of trust.

If you notice abuse, you see which common node caused you to trust the abusers, and you revoke trust in that node (and, transitively, everything that it previously caused you to trust).
by frollogaston | 2025-06-25 22:52:42+00:00
I don't think that's the main reason. Just installed this and peaked in node_nodules. There are a lot of random deps, probably for the various local capabilities, and it was probably easier to find those libs in the Node ecosystem than elsewhere.

Also, react-reconciler caught my eye. Apparently that's a dependency of ink, which lets you write text-based UIs in React.

That and opentelemetry, whatever the heck that is
by const_cast | 2025-06-25 22:53:01+00:00
I don't think this is what makes Apple jump ahead of the competition. M-series is a low-wattage SOC.

I recently bought a lunar lake laptop, which is a similar design but x86. I'm easily getting 12+ hours on Linux and performance is superb. Turns out all it takes is putting everything on the chip and then running it at 15 watts. Which, I think, also proves you do NOT need ARM for such low wattage with acceptable performance. You just need really new production lines and the right chip design.
by sitkack | 2025-06-25 22:53:20+00:00
Given that Windows games run faster via Proton on SteamOS, developers should prioritize targeting SteamOS APIs—not Windows. This ensures compatibility with Windows while maximizing performance. Game engines like Unity and Unreal must adopt SteamOS as the primary target, with CI systems rigorously testing both platforms. SteamOS, not Windows, should be the baseline for optimization.

Does Valve run a SteamOS CI/CD farm? I could see a Rust based template and library for calling into this set of APIs that you could upload your well structured project and it would build and test for all platforms. Rust would just be the skeleton, your game logic could be in anything Rust could link to.
by HenriNext | 2025-06-25 22:55:06+00:00
Thanks, one more clarification please. The heading of point #3 seems to mention Google Workspace: "3. Login with Google (for Workspace or Licensed Code Assist users)". But the text content only talks about Code Assist: "For users of Standard or Enterprise edition of Gemini Code Assist" ... Could you clarify whether point #3 applies with login via Google Workspace Business accounts?
by gerdesj | 2025-06-25 22:55:19+00:00
"I think you misunderstand- game engines are complex beasts and visual studio and/or .Net (in any of its incarnations) have the best debugging workflow I've seen."

I think you misunderstand: the market, ie the number of people who actually care about developing game engines, is tiny.

How many games developers do you know as a subset of the people you know of?

OP only managed to find a niche product area for MS to shine in and maintain traction - the moat thing. Nothing else apparently.

I for one would not miss MS one jot. I wasted so much time with things like autoexec.bat and config.sys back in the day. I got good at it - Novell gave me a T shirt on Cool Solutions for a boot floppy image that managed to try several popular NIC drivers (3c595, 3c905, 3c509, ne1000 and a few others) and get you to a network connection for imaging or whatever. Later on I get to ignore SFC /SCANNOW answers to searches. Do you remember WINS? What about the horror of time sync? The PDC emulator FSMO role is basically a NT domain controller. AD was a bodge from day one, tacked onto ...

Sorry, got carried away there.

Again, Typescript is cared about by whom and what on earth is ONNX?
by bironran | 2025-06-25 22:55:36+00:00
One of my best commits was removing about 60K lines of code, a whole "server" (it was early 2000's) with that had to hold all of its state in memory and replacing them with about 5k of logic that was lightweight enough to piggyback into another service and had no in-memory state at all. That was pure a algorithmic win - figuring out that a specific guided subgraph isomorphism where the target was a tree (directed, non cyclic graph with a single root) was possible by a single walk through the origin (general) directed bi-graph while emitting vertices and edges to the output graph (tree) and maintaining only a small in-process peek-able stack of steps taken from the root that can affect the current generation step (not necessarily just parent path).

I still remember the behemoth of a commit that was "-60,000 (or similar) lines of code". Best commit I ever pushed.

Those were fun times. Hadn't done anything algorithmically impressive since.
by anyfoo | 2025-06-25 22:55:59+00:00
That’s interesting. Because I genuinely feel I’m much better cut out to be a parent now. Is it different for you? I have so much patience and understanding, and I see that lacking in many of the younger parents around me. I see them and I remember myself.

And the life I have would just not have been possible if I had a child back then. Not even if I completely sacrificed family time and attention back then, which I never would have wanted.

But I guess we have to agree to disagree. For you, being a younger parent worked out better. For me, I’m certain I got my child at the right time. In any case, I find OPs general recommendation that if you want children, you should have them by 30, to be ill-advised to the point of being harmful. Many people would benefit from waiting until later.
by th0ma5 | 2025-06-25 22:56:12+00:00
I have a lot of respect for organizations that get a lot done with Microsoft technologies. I think your perspective could be thought of as the benefits of vertical integration and vendor lock in. These do help people get things done!

In the academic and open source world those things are fought against because you don't want to be at the mercy of the software developer in the context of certain rights.

I think for every negative you mention on either side a positive could be found on either side. And like many things on the net, you're not wrong but not necessarily talking about the same kinds of things.

My remaining complaints about Microsoft are the inflexibility of their solutions that command abstractions that just don't work for many organizations, and the general viral nature of software sales in general of which they are one of many with similar issues, however Oracle is the worst of course.
by LionEgo | 2025-06-25 22:56:17+00:00
Your snark at my comments is completely unwarranted.

I really shouldn't have to explain what follows. But I will.

Installing any dev tooling that is third party is done on the command line. Look up the instructions for installing Node LTS on Debian, or .NET, or Golang. You need to use the command line. Even on easier to use Distros they have the same procedure. Depending on the tooling you may need to set additional environment variables which are normally done in your .bashrc or similar.

What normally happens is people blindly copy and paste things into the terminal and don't read the documentation. This has been a problem on Linux since before Ubuntu was released. This isn't just limited to newbies either.

The state of GUIs BTW isn't great. Many of them look nice, and work reasonably well most of the time, *until they don't* e.g. If I double click a deb to install it, sometimes it will install. Other times it won't. So I don't even bother anymore and just use dpkg/apt. BTW it isn't any better with other distros. So I have to drop to the command line to fix the issue anyway.

So at some point you will need to learn bash, learn to read the man pages, and manually edit configuration file. It is unavoidable on Linux.
by SchemaLoad | 2025-06-25 22:56:36+00:00
The model I have says to replace the filter once a year, and it's $170 AUD. I imagine you could probably get away with using it longer than the OEM recommendation though.

I had the same thought about demineralised water, you can get more expensive models which remineralise the water after, but it looks like it's not actually that important health wise because you get the absolute vast majority of your minerals through food, not water. And remineralisation is mostly for taste rather than health. Though I don't find the demineralised water tastes bad, but if you're used to drinking hard water it might be different.
by Swizec | 2025-06-25 22:57:36+00:00
> In the bay area, most of the mothers I've met were around that age, and my friends are having their kids at the same age

San Francisco has the highest rate of geriatric pregnancies in USA. We are in a statistical bubble where having kids late is normal (because careers and hcol).

https://www.sfchronicle.com/bayarea/article/mother-birth-age...
by benced | 2025-06-25 22:58:44+00:00
Do we need a more profound solution than what the maintainer is doing here? Any given bug is either:

a) nonsense in which case nobody should spend any time fixing this (I'm thinking things like the frontend DDOS CVEs that are common) b) an actual problem in which case a compliance person at one of these mega tech companies will tell the engineers it needs to be fixed. If the maintainer refuses to be the person fixing it (a reasonable choice), the mega tech company will eventually just do it.

I suppose the risk is the mega tech company only fixes it for their internal fork.
by gnabgib | 2025-06-25 22:59:07+00:00
We've detected the rotation speeding up since 2019: https://en.wikipedia.org/wiki/DUT1#/media/File:Leapsecond.ut...

Related in 2022: We lost 1.59 milliseconds June 29 when the Earth spun a little faster https://www.npr.org/2022/08/07/1116218384/we-lost-1-59-milli...
by cogman10 | 2025-06-25 22:59:11+00:00
Well, that's sort of the problem.

It's true that once upon a time, libxml was a critical path for a lot of applications. Those days are over. Protocols like SOAP are almost dead and there's not really a whole lot of new networking applications using XML in any sort of manor.

The context where these issues could be security bugs is an ever-vanishing usecase.

Now, find a similar bug in zlib or zstd and we could talk about it being an actual security bug.
by SchemaLoad | 2025-06-25 22:59:44+00:00
Pretty much all the photos in Apple/Google photos are going to be JPEG and HEIF which do support EXIF. But both services basically will not touch what came out of the camera at all. If you add a description or date, it gets stored externally to the image so when you export your data, those changes are lost. Or they get dumped in a JSON file requiring you to use some custom script to handle it.
by msgodel | 2025-06-25 22:59:56+00:00
>Is everything documented and public for this modem?

LMAO I've found typos in the manufacturers documentation. It's actually terrible. It's one of those situations where so many people use it though you can usually find what you need on a wiki.

>I wonder if the 4G/5G PPP commands are well "standard".

Absolutely not but modem manager and network manager is pretty good at figuring a lot of it out these days.
by nicce | 2025-06-25 23:00:08+00:00
> Many of these issues are not the type of issues that will bring down an entire platform; most are of the "if I send wrong data, the server will return with a 500 for that request" or "my browser runs out of memory if I use a maliciously crafted regexp". Well, whoopdeedoo.

I wouldn't personally classify these as denial of service. They are just bugs. 500 status code does not mean that server uses more resources to process it than it typically does. OOMing your browser has no impact to others. These should be labeled correctly instead of downplaying the significance of denial of service.

Like I said in my other comment, there are two entities - the end-user and the service provider. The service provider/business loses money too when customers cannot make transactions (maybe they had promise to keep specific uptime and now they need to pay compensations). Or they simple get bankrupted because they lost their users.

Even customers may lose money or something else when they can't make transactions. Or maybe identification is based on bank credentials on some other service. The list goes on.
by risyachka | 2025-06-25 23:00:12+00:00
Yeah it’s not difficult if you know all the specs.

The issue is 99% don’t know them and are not very good at following them. And the cost of error is very high.

I’ve seen a lot of startups that failed to implement even google oauth securely.

So yeah it’s a far cry from fud and you really should not do it unless you are actually good.
by djoldman | 2025-06-25 23:01:05+00:00
I really don’t understand solo unpaid maintainers who feel “pressure” from users. My response would always be: it’s my repo, my code, if you don’t like how I’m doing things, fork the code megashrug.

You owe them nothing. That fact doesn’t mean maintainers or users should be a*holes to each other, it just means that as a user, you should be grateful and you get what you get, unless you want to contribute.

Or, to put it another way: you owe them exactly what they’ve paid for!
by sunrunner | 2025-06-25 23:02:32+00:00
I learnt to program (in a very basic way) before doing the whole paper qualification thing. Am I self taught? Is that some kind of signifying badge one loses once one gets a 'proper' education? I also know many people _with_ the paper qualification I wouldn't necessarily trust

Rhetorical questions of course as we all know it's a clickbait title, but perhaps it would be nice for this label to stop being thrown around like it has any real consistent meaning or significance?
by jiggawatts | 2025-06-25 23:02:32+00:00
Unless you found yourself in some bizarre dark corner of a huge ecosystem of products, that's just not true.

Deployments are just "file copy". You don't even need Docker, because Windows isn't Linux, it has stable user-land APIs so apps are portable.

Not to mention that the dotnet sdk can create container images directly without even needing Docker installed: https://learn.microsoft.com/en-us/dotnet/core/containers/sdk...

There are pre-built Linux and Windows ASP.NET base docker images: https://learn.microsoft.com/en-us/aspnet/core/host-and-deplo...

Visual Studio's ASP.NET templates all have a literal checkbox for "Docker support" which is all it takes to have a hot-reload debugging/editing experience.

The dotnet runtime has very good Docker support, including automatic memory usage tuning to prevent it getting killed by Kubernetes or whatever.

The underlying "App Host" below ASP.NET has fantastic support for layered configuration, which by default supports environment variables, command line parameters, named environment configuration files, and "user secrets" in IDEs. All of it is strongly typed and supports runtime refresh instead of Linux style "restart the process and interrupt user file uploads to get a new config". There's plugins for Key Vault, AWS KMS, App Configuration, feature flags, and on-and-on.

Open Telemetry is fully supported and now the default: https://learn.microsoft.com/en-us/dotnet/core/diagnostics/ob...

Everything in ASP.NET uses the standard built-in ILogger interface, so wiring up any kind of audit logging or custom observability is a piece of cake: https://learn.microsoft.com/en-us/dotnet/api/microsoft.exten...

The really fancy logging uses the high-performance ActivitySource APIs, which are used for lower-level tracing of dependencies and the like. Again, these are standardised throughout not just Microsoft libraries but most third-party packages too: https://learn.microsoft.com/en-us/dotnet/api/system.diagnost...

Aspire.NET can orchestrate multiple cloud emulators, multiple apps, Node.js front-end apps, and wire up the whole thing with Open Telemetry and a free local trace viewer (with span support) with zero config: https://learn.microsoft.com/en-us/dotnet/aspire/fundamentals...

Windows GUI App deployments use standardised installer packages (MSI) that have simple devops pipeline tooling: https://github.com/wixtoolset Now... name the one package format that you can use to distribute client apps to all Linux distros!

When you run "dotnet build", the result is built, unlike Node.js where you end up with 150K tiny little files that need to be rebuilt again "in production" because oh-my-god it's a scripting language with C code blended in randomly, so it doesn't... actually... build. I just had the fun of trying to figure out why PM2 doesn't like musl or running under non-root user accounts, why starting a Node.js app takes frigging minutes whereas ASP.NET starts in milliseconds, and on and on.
by hilbert42 | 2025-06-25 23:03:56+00:00
I still find it hard to believe that so many people and companies are prepared to use Microsoft's online/cloud services.

Not ony is this a single point of failure but it's one they've no control over whatsoever. Same goes for Google/Youtube etc. It's as risky as flying a passenger jet with only one engine.

What are they thinking, why are they prepared to risk everything?

It boggles my mind.
by hobofan | 2025-06-25 23:04:07+00:00
What? No!

There are plethora of mistakes one can make in implementing AuthN/AuthZ, and many of them almost immediately will lead to either the direct leak of PII or can form the start of a chain of exploits.

Storing password hashes in an inappropriate manner -> BOOM, all your user's passwords are reversible and can be used on other websites

Not validating a nonce correctly -> BOOM, your user's auth tokens can be re-used/hijacked

Not validating a session timestamps correctly -> BOOM, your outdated tokens can be used to gain the users PII
by socketcluster | 2025-06-25 23:04:27+00:00
What this article touches on is why I focused only on the serverless part with my project https://saasufy.com/ and why didn't implement any frontend UI for it (besides the control panel which is only concerned with backend concepts like schema definitions, auth, access control...). Now Claude is allowing generation and hosting of UI apps directly from their chat interface so it would be reinventing the wheel to build a UI.

AI companies are going to be working really hard to ensure that users do not bypass their chat interface because AI APIs don't provide much lock-in factor for them.