MurphyA/hacker-news huggingface dataset:
by pu_pu | 2025-06-21 13:49:03+00:00
So, I have not tried it on a very complex database myself so I can't comment how well it will work in production systems I have tried this approach with a single Big Query table and it worked pretty well for my toy example.

If by 3.5 you mean ChatGPT 3.5 you should absolutely try it with newer models, there is a huge difference in capabilities.
by candiddevmike | 2025-06-21 13:49:41+00:00
Having been through both, I much prefer the "rigid" ISO 27001 as the SOC2 audits seem to be based on how well you vibed with the auditor and the auditors competency more than anything. The things they are auditing seem overly broad and open to interpretation, and the auditors descriptions of your controls can easily be twisted.
by tialaramex | 2025-06-21 13:49:50+00:00
BeOS only actually had a "database like filesystem" in very early versions, so most likely you're thinking of BeFS, the filesystem used in BeOS R5 (which was given away free) and in Haiku.

But all BeFS has in the way of being "database like" is arbitrary named & typed btree indices, chosen by the owner. You can have a btree of filenames, a btree of "sent by" email addresses, maybe one of file types for example. If enabled (which is the default) you pay for this feature with a significant perf overhead on operations because those tree indices must be updated, but if it's disabled (common for disks with lots of small files) you lose the facilities enabled by having such an index.

Compared to full text indexing, which was also popular on some systems at about the same time, this doesn't produce very impressive results, yet you're paying for it everywhere. No surprise then that even the text indexing remains a niche feature, I know people who care about it a lot and others who've never been interested.

It's probably one of those niche features like wall switches for floor lamps (a socket is run off the lighting circuit and switched just like ceiling lights, but a floor lamp is plugged into that socket). A few people love it, most people aren't bothered, so, it's usually not done.
by uncircle | 2025-06-21 13:50:16+00:00
It is not demonstrably false. You operate under the assumption that more knowledge and the more you know about things, the better. So from your point of view spending 12 hours watching philosophy essays and history videos can only be a good thing.

Well, I strongly disagree with this (widespread) premise. It is still marketing-driven consumption and another form of pervasive distraction which plagues the modern world, whether you spend 6 hours watching reality TV or essays on the conquests of Genghis Khan. What matters is how much time you spend in a stupor passively receiving useless information, to detach yourself from a reality you have no control over; the content itself is just a matter of taste.

I want to stress there is of course a difference between decompressing with a nice and well-written YouTube video after dinner and wasting your life watching memes. But it is still a form of distraction, and YouTube does its utmost to make the experience as exciting and addictive as possible, just like McDonalds.
by alt227 | 2025-06-21 13:50:38+00:00
Sorry but I think your analogy is just wrong.

In football anybody in the world who has legs and can walk can perform the main goal of football which is to get a ball into a very large net. It doesnt take any skill to perform the feat whatsoever. The skill only comes with who you choose to play against. From that angle, it is just 20 people chasing a ball around, it just depends on the skill level of the players as to whether that is interesting to you or not.

With programming, not everybody with fingers can achieve the end goal which is to write working software. It takes years of learning and practice to be able to make even the most basic piece of software, whereas my 2 year old child can reliably kick a ball into a net.

The difference between the two is that football, and sport in general, creates enjoyment by intense moments of tension and excitement in a small space of time. Programming is an intellectual activity, where its payoff is in solving mathematical and logical puzzles to achieve a goal. Its not far fetched to see that people who get enjoyment from one type thing might not enjoy the other.

Why does everybody have to enjoy everything?
by steveBK123 | 2025-06-21 13:51:02+00:00
I think the unsaid part is the downside of failing in the HS->College->Pro sports pipeline is worse than in the VC backed startup pipeline.

If your startup fails, you probably have technical skills to either try again (and again and again) or take a good paying SWE job somewhere else.

If you fail in the sports pipeline, you kind of have one shot (you can't play college ball at 25), you may end up with some non-transferable skills (throwing a ball) and may end without a good education to get a good job.

That is - the downside of your first startup failing is not working at McDonalds, but failing as a ball player can be.
by GuB-42 | 2025-06-21 13:51:57+00:00
If you saw a giant, attention grabbing billboard for something you are looking for, you wouldn't hate it. In the context of roads, these are businesses putting their signs on the side of the road. For example I usually find billboards/signs pointing to the nearest supermarket, restaurant or gas station to be useful, because that's the kind of thing I may want do do when I am driving, and I am getting useful information out of them.

Driving-related products like tires are annoying on a billboard on the side of the road because I am obviously not going to look at my tires while I am driving, and it is usually not something you have an urgent need for. They are however relevant (and therefore less annoying) in a gas station, where you can check your tires as you are filling up your tank. It may even give you the idea of checking tire pressure, which is a good thing. One of the most clever driving-related ad was a letter I received from the garage I did car maintenance with, reminding me a couple of weeks before the next scheduled maintenance that it was to be done (with, of course, an offer on their part). It was useful, yet 100% an ad.

And yeah, we usually call things "ads" when they are annoying and by some other word when they are not, and advertisers tend to avoid the word for this reason. Calling it "sponsored" for instance. But it doesn't change that fact.
by 1970-01-01 | 2025-06-21 13:52:00+00:00
I would love YouTube to include comments in their ads as they do with all other videos. To borrow a current phrase, they chicken out on actual critical feedback and keep pushing their money making agenda with an iron fist. If YouTube actually cared to make their users happy, public comments in ads would filter out all the garbage ads in hours and the entire platform would be forced to accept a minimum yet independent and user driving bar for advertising.
by regularfry | 2025-06-21 13:52:02+00:00
Nit: just writing Torch/TF isn't what made the difference. Having them adopted by a huge audience outside those orgs is, and that's bottlenecked on the hardware platform choice.

AMD has demonstrably not even acknowledged that they needed to play catch-up for a significant chunk of the last 20 years. The mistake isn't a recent one.
by jerf | 2025-06-21 13:52:07+00:00
Actually it's even easier in Go with struct embedding:

type SmallerThing struct { Id int Login string IsAdmin bool } type UserController struct { SmallerThing OtherField Whatever OtherField2 SomethingElse }

In principle this could break down if you need super, super complicated non-overlapping mappings, in practice I have yet to need that.
by sksjvsla | 2025-06-21 13:52:09+00:00
> Techincal

I'm trying to share as much technical across this thread as for your two examples:

System upgrades:

Keep in mind that as per the ISO specification, system upgrades should be applied but in a controlled manner. This lends itself perfectly to the following case that is manually triggered.

Since we take steps to make applications stateless, and Ansible scripts are immutable:

We spin up a new machine with the latest packages and once ready it join the Cloudflare load balancer. The old machines are drained and deprovisioned.

we spin up a new machine We have a playbook that iterates through our machines and does it per machine before proceeding. Since we have redundancy on components, this creates no downtime. The redundancy in the web application is easy to achieve using the load balancer in Cloudflare. For the Postgres database, it does require that we switch the read-only replica to become the main database.

DB failover:

The database is only written and read from by our web applications. We have a second VM on a different cloud that has a streaming replication of the Postgres database. It is a hot standby that can be promoted. You can use something like PG Bouncer or HAProxy to route traffic from your apps. But our web framework allows for changing the database at runtime.

> Business

Before migration (AWS): We had about 0.1 FTE on infra — most of the time went into deployment pipelines and occasional fine-tuning (the usual AWS dance). After migration (Hetzner + OVHCloud + DIY stack): After stabilizing it is still 0.1 FTE (but I was 0.5 FTE for 3-4 months), but now it rests with one person. We didn’t hire a dedicated ops person. On scaling — if we grew 5-10×: * For stateless services, we’re confident we’d stay DIY — Hetzner + OVHCloud + automation scales beautifully. * For stateful services, especially the Postgres database, I think we'd investigate servicing clients out of their own DBs in a multi-tenant setup, and if too cumbersome (we would need tenant-specific disaster recovery playbooks), we'd go back to a managed solution quickly.

I can't speak for cloud FTE toll vs a series of VPS servers in the big boys league ($ million in monthly consumption) and in the tiny league but at our league it turns out that it is the same FTE requirement.

Anyone want to see my scripts, hit me up at jk@datapult.dk. I'm not sure it'd be great security posture to hand it out on a public forum.
by hilbert42 | 2025-06-21 13:52:33+00:00
"Manufactured consent requires media complicity to achieve acceptance of Hobson's choice Accept or Don't"

Right, I've never fully understood why the media was (and still is) so complicit. There's a long history of the media, especially the tech media, mags etc. ass-licking the likes of Microsoft, Google et al. It's been horrible sight to watch over the decades. Perhaps it's because of kickbacks, fear of exclusion from events, press releases, or handouts—free software etc., or that many had/have shares in such entities—or the belief that those who run such entities are only one step removed from the gods—hero worshiping.

We users would now be in a damn side better prosition if the media had done its job professionally.

"technical vocations are still frowned upon in socially most of America."

Right again, and America is not the only place, such thought is endemic across the anglosphere.
by diggan | 2025-06-21 13:52:39+00:00
Yeah, kind of makes sense, LLMs are really bad at that sort of recall unless provided tool and a loop to go over the results.

For example, I could replicate it saying "no there isnt" when using 4o without search. But with search it gets the answer right.

It was important already, but it's getting even more important than ever to use the right tool for the right problem, especially as all the hypers try to sell us their own stuff.
by b112 | 2025-06-21 13:52:54+00:00
Saying that a culture is poor at security dev, such as Chinese business culture, is not even remotely rasist.

There are many ethnicities in China, people of all genetic backgrounds. It is the culture that is the problem, not the race.

For example, there are many ethnically Chinese people who grew up in the West, working in businesses, in countries where there is a culture of security.

Now, you could label it 'culturalist', and maybe it is, but there are definitely inferior and superior cultures. Especially, there are parts of cultures which are quite comparable this way.
by joshstrange | 2025-06-21 13:53:14+00:00
Yes, ChatGPT 3.5, this testing was a while back. I’m sure it has improved but I doubt it’s solid enough for me to trust.

Example/clean/demo datasets it does very well on. Incredibly impressive even. But on real world schema/data for an app developed over many years, it struggled. Even when I could finally prompt my way into getting it to work for 1 type of query, my others would randomly break.

It would have been easier to just provide tools for hard-coded queries if I wanted to expose a chat interface to the data.
by nec4b | 2025-06-21 13:53:20+00:00
>> The problem with nuclear reactors isn't that their pollution couldn't disposed of with ideal methods but that when they run by for-profit corporations, you will always have the company skirting the edge of what's safe 'cause corporations just go bankrupt with catastrophic events and so their risk-reward behavior isn't the risk-reward optima for humanity.

Chernobyl was state run.
by bostik | 2025-06-21 13:54:18+00:00
> 30 milligrams of high explosive is enough to open your daughter's skull, or, more relevantly, your commanding officer's daughter's skull, and there are a thousand ways to deliver it

While we are talking about flying drones, we are not far off from Slaughterbots becoming reality.[0] Why bother with surgical assassinations if you can blanket entire regions with with swarms of autonomous seek-and-destroy explosives?

After all, as last two years have so amply demonstrated: people are fine with genocide.

0: https://www.youtube.com/watch?v=O-2tpwW0kmU
by hedora | 2025-06-21 13:54:35+00:00
The study finds that plastic bags as a fraction of the waste on beaches increased in all areas, so that’s bad.

A more concerning issue is the nature of the bags being thrown away. California banned “single use” plastic bags (which we used to reuse as trash bags for the bathroom or whatever) but lets you buy “reusable” ones for a few cents at the checkout counter. The reusable ones are much heavier and contain 10-100x more plastic, and take even longer to biodegrade.

The study counts “items”, not weight, and reports a 25-47% decrease.

Assuming California is the region that hit 47% (call it 50%), and the reusable bags are better than the best available (only 10x worse than pre-ban) that translates to a 5x increase in microplastics on the beach. I’d consider this a disaster, not a win.

This matches older studies, which measured total plastic content of landfill waste before and after plastic bag bans like California’s.

Those showed sharp increases in plastic waste too. The studies in question were in places that did not allow the reusable plastic ones that California forced the stores to switch to. Instead, the authors found that people switched from using the disposable bags as trash bags to using kitchen trash bags, which are ~100x worse. If only 1% of households were using disposable shopping bags for trash, and no one reused the new style bags, then the policies ended up breaking even. In practice, the policies increased total plastic waste, despite being better thought out than California’s newer ban.

I’m all for banning plastic bags, but the current bans target the most efficient use of plastic, increasing overall plastic production and waste. The bans should only target things that have plastic-free alternatives, or at least that have less plastic intensive alternatives.
by liampulles | 2025-06-21 13:55:08+00:00
Part of what I expect to get when I pay AWS is that it reduces my operational burden, and this has been true in my experience. I've almost forgotten about all the prep, the stress, etc. that comes from upgrading deprecated mysql clusters now that I've gotten used to using the AWS managed equivalents.

That is not to say that this aspect alone justifies huge fees, but it does have significant value.
by techpineapple | 2025-06-21 13:56:26+00:00
Also, right now, tech CEO’s are actively talking about the end of work, while governments are trying to reduce the social safety net. There are a non-zero number of tech CEO’s who think that if we replace meat-intelligence with artificial-intelligence to “extend the light of consciousness” that would be a reasonable trade-off.

Like, who is promoting a really optimistic vision of progress that doesn’t have a huge fucking asterix adjacent?
by maypok86 | 2025-06-21 13:57:02+00:00
Today I'm excited to announce the release of Otter v2 - a high-performance caching library for Go.

Otter v2 has been almost completely reworked since its first release to provide a richer API and new features while maintaining high performance.

Key Improvements:

- Completely rethought API for greater flexibility.

- Added the ability to create a cache with any combination of features.

- Added loading and refreshing features.

- Added entry pinning.

- Replaced eviction policy with adaptive W-TinyLFU, enabling Otter to achieve one of the highest hit rates across all workloads.

- Added HashDoS protection against potential attacks.

- The task scheduling mechanism has been completely reworked, allowing users to manage it themselves when needed.

- Added more efficient write buffer.

- Added auto-configurable lossy read buffer.

- Optimized hash table.

- Test coverage increased to 97%

I hope this library will prove useful to some of you! :)
by strken | 2025-06-21 13:57:33+00:00
It's not irrelevance, it's lack of trust.

I could see an ad for the exact thing I need and I still wouldn't click it. Either it's a scam, or it's technically not a scam because offering 90% off in the first month of a 12 month contract is legal, or it's the worst product on the market and the only way it can get users is blowing VC cash on ads, or there's something else that will surely disappoint me.
by sksjvsla | 2025-06-21 13:57:45+00:00
Here you go. Write me at jk@datapult.dk, if you need more.

A.5.25 Security in development and support processes:

Safe rolling deploy, rollback mechanisms, NGINX health checks, code versioning, Prometheus alerting for deployment issues

A.6.1.2 Segregation of duties:

Separate roles for database, monitoring, web apps; distinct system users

A.8.1.1 Inventory of assets:

Inventory management through Ansible inventory.ini and groups

A.8.2.3 Handling of assets:

Backup management with OVH S3 storage; retention policy for backups

A.8.16 Monitoring activities (audit logging, monitoring):

auditd installed with specific rule sets; Prometheus + Grafana Agent + Loki for system/application/audit log monitoring

A.9.2.1 User registration and de-registration:

ansible_user, restricted SSH access (no root login, pubkey auth), AllowUsers, DenyUsers enforced

A.9.2.3 Management of privileged access rights:

Controlled sudo, audit rules track use of sudo/su; no direct root access

A.9.4.2 Secure log-on procedures:

SSH hardening (no password login, no root, key-based access)

A.9.4.3 Password management system:

Uses Ansible Vault and variables;

A.10.1.1 Cryptographic controls policy:

SSL/TLS certificate generation with Cloudflare DNS-01 challenge, enforced TLS on Loki, Prometheus

A.12.1.1 Security requirements analysis and specification:

Tasks assert required variables and configurations before proceeding

A.12.4.1 Event logging:

auditd, Prometheus metrics, Grafana Agent shipping logs to Loki

A.12.4.2 Protection of log information:

Logs shipped securely via TLS to Loki, audit logs with controlled permissions

A.12.4.3 Administrator and operator logs:

auditd rules monitor privileged command usage, config changes, login records

A.12.4.4 Clock synchronization:

chrony installed and enforced on all hosts

A.12.6.1 Technical vulnerability management:

Lynis, Wazuh, vulnerability scans for Prometheus metrics

A.13.1.1 Network controls:

UFW with strict defaults, Cloudflare whitelisting, inter-server TCP port controls

A.13.1.2 Security of network services:

SSH hardening, NGINX SSL, Prometheus/Alertmanager access control

A.13.2.1 Information transfer policies and procedures:

Secure database backups to OVH S3 (HTTPS/S3 API)

A.14.2.1 Secure development policy:

Playbooks enforce strict hardening as part of deploy processes

A.15.1.1 Information security policy for supplier relationships:

OVH S3, Cloudflare services usage with access key/secret controls; external endpoint defined

A.16.1.4 Assessment of and decision on information security events:

Prometheus alert rules (e.g., high CPU, low disk, instance down, SSL expiry, failed backups)

A.16.1.5 Response to information security incidents:

Alertmanager routes critical/security alerts to email/webhook; plans for security incident log webhook

A.17.1.2 Implementing information security continuity:

Automated DB backups, Prometheus backup job monitoring, retention enforcement

A.18.1.3 Protection of records:

Loki retention policy, S3 bucket storage with rotation; audit logs secured on disk
by eadmund | 2025-06-21 13:58:35+00:00
> In my dayjob I see this tendency constantly to have a lot of different very narrow structs that somehow integrate into some library, and then a TON of supporting code to copy between those structs. Only to then do very little actually useful work with any of the data at the end.

Don’t think of it as doing a little useful work at the end; think of it as doing all the useful work in the centre. Your core logic should be as close to a pure implementation without external libraries as possible (ideally zero, but that is often not easily achievable), but call out to external libraries and services to get its work done as appropriate. That does mean a fair amount of data copying, but IMHO it’s worth it. Testing copies is easy and localised, whereas understand the implications of a JSON (or Protobuf, or Django, or whatever) object carried deep into one’s core logic and passed into other services and libraries is very very difficult.

There’s a common theme with the ORM trap here. The cost of a little bit of magic is often higher than the cost of a little bit of copying.
by ptero | 2025-06-21 14:00:16+00:00
We don’t complain not because road signs, in addition to being an eye sore, are relevant to our current activity, but because they provide significant value.

While relevance has some correlation to value, that correlation is pretty weak; it is easy to find examples of high relevance and very negative value. We should not conflate those.

Your opponent (with whom I agree) argued that the problem with most YT ads and billboards is negative value. Which will stay even if google makes them relevant. My 2c.
by ericalexander0 | 2025-06-21 14:00:35+00:00
Most people and by extension, most businesses don’t think from first principles. They copy what others do because it’s easier. It reduces cognitive load. But that kind of thinking leads to cargo cults. People doing things that look right but make no sense when you break them down. Business schools teach unit economics and first-principles logic (like in The Goal), but most companies still optimize for quarterly performance. It’s backwards. You end up with systems that reward short-term hacks instead of long-term efficiency.

In the real world, business moves fast. Too fast for most people to stop and think. If you don’t build in ways to slow down and reason from fundamentals, you’ll just react your way into mediocrity. The companies that win long term (Amazon, Toyota, SpaceX) they go back to physics-level thinking. They understand the real constraints and design around them. That’s the cheat code. First-principles thinking isn’t optional—it’s the only way to build something that actually works and lasts.