MurphyA/hacker-news huggingface dataset:
by 0xbadcafebee | 2025-06-01 22:02:31+00:00
Forget the study, let's just do a simple thought experiment. Your developer gets paid $140k/yr (let's round up to ~$70/hr). Let's say a given bug found in testing takes 1 hour to fix; that's $70 (not counting the costs of ci/cd etc). If they miss it in test, and it hits production, would it cost $7,000 to fix? Depends what you mean by "bug", what it affects, and what you mean by "fix in production".

- Did you screw up the font size on some text you just published? Ok, you can fix that in about 5 seconds, and it affects pretty much nothing. Doesn't cost 100x.

- Did your sql migration just delete all records in the production database? Ok, that's going to take longer than 5 seconds to fix. People's data is gone, apps stop working, the lack of or bad data fed to other systems causes larger downstream issues, there's the reputational harm, the money you'll have to pay back to advertisers for their ads / your content being down, and all of that multiplied by however long it takes you to restore the database from backup (um... you do test restoring your backups... right?). That's closer to 100x more expensive to fix in production.

- Did you release a car, airplane, satellite, etc with a bug? We're looking at potentially millions in losses. Way more than 1000x.

And those are just the easy ones. What about a bug you release, that then is adopted (and depended on) by downstream api consumers, and that you then spend decades to patch over and engineer around? How about when production bugs cause your product team to lose confidence in deployments, so they spend weeks and weeks to "get ready" for a single deploy, afraid of it failing and not being able to respond quickly? That fear will dramatically slow down the pace of development/shipping.

The "long tail" of fixing bugs in production involves a lot more complexity than in non-production; that's where the extra cost comes from. These costs could end up costing 10,000x over the long term, when all is said and done. Security bugs, reliability bugs, performance bugs, user interface bugs, etc. There's a universe of bugs which are much harder/costlier to fix in production.

But you know what is certain? It always costs more to fix in production. 1.2x, 10x, 1000x, that's not the point; the point is, fix your bugs before it goes to production. ("Shift Left" is how we refer to this in the DevOps space, but it applies to everything in the world that has to do with quality. Improve quality before it gets shipped to customers, and you save money in the long run.)
by dlcarrier | 2025-06-01 22:03:17+00:00
In film, they say "we'll fix it in post" as a joke. In software development, they treat it as a reality, except they never get around to it.

This is how software development compares to other fields: https://xkcd.com/2030/

Software development really has gone off the deep end. In any other field, people actually document what they do, and verify that it works, before releasing anything. Restaurants have recipes and food handling requirements, manufacturers have tolerances and verification, architects have building code, warehouses have inventory management, and so on and so forth. Because non-software development relies on products that actually work, and are not built around the meta game of abusing arbitrary metrics, workers can rely on other departments to make sensible choices.

Fun fact: Waterfall development never existed; it's a straw man argument against the common sense idea of finishing what your working on, before starting something new.

AI is going to pop the bubble of software development, not because it's good at it, but because because the entire field is too broken to compete against it.
by ElectricalUnion | 2025-06-01 22:03:59+00:00
Your bank holds the public key of the "a certain credit card".

Your thing in the shape of a credit card is a HSM that holds the private key of the "a certain credit card".

A public key (your bank) can verify if a given digital signature generated by a private key (yor card) is valid or not.

The "CC Terminal" is a device that given the inputs (timestamp+value_of_transaction+password), asks the "CC HSM" to generate the signature of said values. "CC HSM" is smart and will ON PURPOSE refuse to generate valid signatures if you're being funny and inputing wrong passwords. Bank can further check if the signature makes sense or not.

Merchant doesn't need to know the public key, the private key, or your password.
by SebastianKra | 2025-06-01 22:04:26+00:00
There's an issue when integrating Signals (or Stores) directly into templates. TypeScript becomes unable to track how bindings relate to each other.

This is described in the Solid documentation: https://docs.solidjs.com/configuration/typescript#control-fl...

In my experience with data-binding, these instances of disabling the typesystem accumulated, and became a frequent source of bugs.

So even though I hope for Signals to catch on, I believe the best way of connection to them will still be React:

function Output({ userSignal }) { const user = useSignal(userSignal) if (!user) return <span>No user found</span> return <span>{user.firstName} {user.lastName}</span> /* TypeScript knows that user must be defined */ }
by skydhash | 2025-06-01 22:04:39+00:00
The approach that always works for me is iteration and recursion. Just like drawing, where you do a loose sketch and refine it until you're happy. You're either stepping back and work on the whole, or focus on a small part to detail it[0].

So for a software project, I break it into parts recursively. Sometimes for a module, I can build some scaffolding even when I'm not sure about the full implementation. I can go up and down that tree of problems and I always have something to break away from my current thinking track. So there's always a lot of placeholder code, stubs, and various TODO comments around my codebase. And I rely heavily on refactoring (which is why I learned Vim, then Emacs as they helped me with the kind of quick navigation I need for that approach). Also REPL and/or some test frameworks.

[0]: https://www.youtube.com/watch?v=prQH5V5inbA
by LorenPechtel | 2025-06-01 22:04:54+00:00
Whether or not they succeeded (and their claims generally do not prove to be exaggerated, so I suspect they did) they just shook up the world's militaries. I doubt there's a base in the world that's truly secure against this sort of attack.

And I don't see any reason to suggest AI being involved here. GPS to an initial point, follow a specified bearing and do image recognition. Note the angle at which you are seeing the image, if it doesn't change as you move you're looking at an image, ignore it. This would fall for any reasonably fancy decoy, but that's not going to be enough to protect the facility.

I've been saying this for years: with pretty much everything military a bunch of cheap units will give you far more bang for your buck than the same value of expensive units. It used to be that since units required operators you would have a big problem with personnel (although we did see the Kamikazes in Japan), but now that it's a microchip running it that's no longer a factor.
by fullstackchris | 2025-06-01 22:06:54+00:00
also, i will say, (if we can trust the findings in these notes are relatively accurate of the real implementation) is a PERFECT example of the real level of complexity used in cutting edge configuration of using LLM... its not just some complex fancy prompt you give to a model in a chat window... there is so much important stuff happening behind the scenes... though i suppose the people who complain about LLMs hallucinating / screwing up havent tried claude code or any agentic work flows - or, it could be their architecture / code is so poorly written and poorly organized that even the LLM itself struggles to modify it properly
by rchaud | 2025-06-01 22:07:38+00:00
If you've been to SaaS product conferences, they are ALL doing the Steve Jobs thing of presenting slide decks that are basically advertisements of new features. All fluff and stock images, very little substance. The implementation details and all their asterisks are provided by your account manager/sales engineer.

Try doing that when presenting a proposal or project results to senior leadership at your company, and see how quickly you get placed into PIP.
by keybored | 2025-06-01 22:07:41+00:00
> At least in the US, "home ownership" largely implies owning a single-family house with a yard. That's the (perhaps unsustainable) "American Dream".

scoffs At least in my canton, "home ownership" largely implies a three-story house in the hillside overlooking the Alps with the nearest 200K+ city within 15m travel distance. I'm sorry to say that what you present is more comparable to being unhoused.
by smackeyacky | 2025-06-01 22:07:43+00:00
An amazing idea: Drive a truck full of drones deep into enemy territory and let them loose. In the process, manage to poke serious holes into Russia's nuclear deterrent.

Hard to know whether to be seriously impressed or seriously concerned - if Europe decided that enough was enough and started helping Ukraine with troops if they decided the Russian nuclear threat was a paper tiger we're in for some very interesting times.
by modeless | 2025-06-01 22:08:39+00:00
The booster failure was just a result of intentionally pushing to the limit. Doesn't say anything about the broader program. The ship failures are concerning, but SpaceX can afford the retries given the runaway revenue of Starlink. The failures have different root causes, so progress is being made.

My biggest problem with the Starship program is the heat shield. It isn't proven that a fully reusable heat shield is feasible without refurbishment after each flight, and they have barely been able to test it at all thus far. These ship failures are temporary (albeit very expensive) setbacks and will be worked through, but heat shield issues are what could cause the whole program to miss its performance targets.

> Nearly all of Starship’s paid contracts are for human spaceflight

This is misleading, because Starship neither launches nor lands humans on Earth for Artemis. Starship can fulfill the Artemis contract even if it is not safe enough to put humans on during Earth launch or reentry. And Dear Moon was canceled, so I don't think there's any human spaceflight planning to launch from Earth on Starship right now besides Elon's Mars aspirations. Starlink is the customer that will actually fund Starship. SpaceX becoming their own customer was brilliant.
by kenhwang | 2025-06-01 22:09:29+00:00
I echo the sound/dialog complaint for Andor as well. I think it's one of the few high production budget shows in recent memory that sounded like it was mixed for 2.0 audio.

Watching on my 7.1 setup was actually more annoying than watching on my computer with 2.0. There's a very obvious bass-boost as if they assumed there isn't subwoofer in the setup, and dialog didn't get any clearer with a dedicated center, it was still kinda floaty across the front. Surround channels just sounded like they echo'd the L/R channels.
by chromaton | 2025-06-01 22:10:25+00:00
Generating the problems: I just thought up a few simple things that the computer might be able to do. In the future, I hope to expand to more complex problems, based upon common business situations: reading CSVs, parsing data, etc. I'll probably add new tests once I get multi-shot and reliability working correctly.

New base programming languages would be great, but what would be even better is some sort of meta-language where many features can be turned on or off, rather than just scrambling the keywords like I do now.

I did some vibe testing with a current frontier model, and it gets quite confused and keeps insisting that there's a control structure that definitely doesn't exist in the TiānshūBench language with seed=1.
by samber | 2025-06-01 22:10:58+00:00
I wrote my own error wrapper: github.com/samber/oops

Example:

err := oops. Code("iam_missing_permission"). In("authz"). Tags("authz"). Time(time.Now()). With("user_id", 1234). With("permission", "post.create"). Hint("Runbook: https://doc.acme.org/doc/abcd.md"). User("user-123", "firstname", "john", "lastname", "doe"). Errorf("permission denied")

For easier debugging, the error contains the full stacktrace.
by adverbly | 2025-06-01 22:12:12+00:00
> People also like stability

People liking something isn't how we should determine our incentive structure. People like gambling and smoking, but that doesn't mean they're good!

If something is a drain on productivity, we want less of it. In fact, this very argument is why LVT is so awesome! You can tax land without reducing its supply meaning it has zero deadweight loss! This is why economists love LVT, and why many call it the "least bad tax".
by rchaud | 2025-06-01 22:12:40+00:00
Presentations were a solved problem 40 years ago with Hypercard. Regardless of what you use today (PPT, Keynote, LibreOffice Impress), they all do the exact same thing.

Figma is following the Dropbox blueprint of building vendor lock-in (who is using Dropbox Paper??), and part of that involves creating senseless roadblocks (can save to local file, can't present locally!) to keep users inside their "ecosystem".
by paulryanrogers | 2025-06-01 22:13:22+00:00
Yes?

At least in my experience as a service provider.

With cloud I can easily plug in a compliance vendor like Drata, add connectors to my other vendors, and get a significant amount of evidence quickly.

Bespoke on-prem solutions bring plenty of their own challenges that are just N/A or handled by cloud vendors, like physical security.

Maybe as a payment processor things shake out differently. Though having read far more of PCI v4 than I'd like, I doubt it.
by __MatrixMan__ | 2025-06-01 22:13:54+00:00
If this terminal is anything like the ones I've worked with, the device he had a root shell on was only the "same device" as whatever handles the card details in the sense that it lives in the same housing and on the same PCB. They are otherwise two separate computers.

In my case, the "outer" system was Android, so we could use ADB to control it however we liked--with relatively lax security. The "secure board" only took over for the part where it had to handle payment details. In order to test the payment flows we ended up revamping a bunch of 3D printers to hold a stylus instead because the inbuilt android tools couldn't see or touch anything that secure board was doing except for a relatively narrow set of actions like "start payment flow for $X" and "user canceled" and "payment for $X complete".
by brewtide | 2025-06-01 22:15:08+00:00
Semi-related, I've found this one of the primary reasons I wear a smartwatch. My phone now generally remains on silent 99% of the time, as does the watch. It's pretty easy to miss a vibration when a phone is in a pocket or on a table somewhere, but having a vibration on my wrist is almost always noticeable.

The few times I do not notice a notification, I'll pick up up when just keeping an eye on the time.

Not having bings , boops, and rings surround my life has been a huge nicety -- Far more than I'd have expected. Highly recommend if someone wants to be 'notified reliably' but has the modern day sounds also drive them a bit nuts...
by TeMPOraL | 2025-06-01 22:15:19+00:00
I believe in a soft form of that too (i.e. no specific numbers); the severity really depends on the type of project.

In few industrial and enterprise projects I worked on, once you cross past "testing", fixing a bug involved coordinating with another team, which was doing a test deployment or evaluation at customer site; at that point, extra process would kick in, and if it was severe enough (or you were unlucky enough) the customer side got wind of it, you could expect some extra e-mail rounds and possibly a meeting.

Now, if your bug didn't get noticed then, and failed in actual production... the time and cost multiplier was effectively unbounded. A fix for a simple and low-impact bug could take a week to get from commit to being ready to release, and then wait a month in limbo, because there are schedules to these kinds of projects (can't really do continuous delivery if each release triggers a validation and sign-off process on customer's end, that engages a team of people for a day or more). A fix for a more complex or impactful bug could become... the last thing you release, if the customer gives up on your product over it. Etc.

People like to focus on technical aspects (restoring databases, hard-to-reach hardware, etc.) when discussing this concept, but there are whole classes of projects where the driving aspect is bureaucracy - coordinating business side, altering long-term project plans, getting sign-off on testing, re-evaluating regulatory compliance, etc. That can quickly get arbitrarily expensive.
by sushid | 2025-06-01 22:15:30+00:00
Windsurf was acquired for $3B by OAI and it's clearly the worse of the two. Cursor is trying to raise at a $10B valuation and has $300MM in ARR in less than two years.

So in short, yes, companies do appear to be showing some willingness to send Cursor their code, even with all the headache associated with getting a new vendor.
by gregors | 2025-06-01 22:15:40+00:00
I think it depends a bit on perception. If you're coming from C, Go is a step up in my opinion. Everything surrounding Go's type system and lack luster error handling seems worse to me coming from almost any other language - except C.

Concurrency is also something they got more or less right. The most important thing is that they invented their (Google) language that they could exert complete control over. From a business perspective specifically, that was much better than Java.
by 3cats-in-a-coat | 2025-06-01 22:16:01+00:00
Autocracy is one way to organize towards a goal, but since it's very narrow in its field of view, eventually it falls apart from the inside, because it can't balance the interests of the whole with the interests of its constituents individually.

A stable system has fractal stability as you go deeper. You can't make a car go faster than its parts can withstand before they fall apart. Even if you press the pedal really strongly.

Democracy is indeed a compromise - we cripple synchronization at a macro level, so that we get to enjoy some individual freedoms. But it also results in hidden structures of control, like corporations growing so large within a "free market" that they start buying power, and this feeds a cycle of autocracy that is even more toxic than the ideological kind, as it's entirely driven by the profit motive.

So essentially, we first need to escape the false dichotomy of autocracy vs democracy and think what transcendent paradigm includes positive elements of both, and some novel ones, but it includes less drawbacks from each. And I think we can mine nature and software architectures for inspiration, as they're rich with working models we haven't even tried yet at a social level.

But I don't think we're moving towards that. We just wobble between anarchy and fascism and somewhere in the middle is what we call "normal" (but ain't).
by cameronh90 | 2025-06-01 22:16:02+00:00
It really comes down to the Go and Rust ecosystems being easy to work with. A decade or two ago, writing a native app meant setting up an automake/autoconf Rube Goldberg machine - especially difficult if you needed to build for multiple architectures.

I'd argue Rust and Go are even easier to work with than Python/JS/TS. The package management is better, and static linked native binaries eliminate so many deployment headaches.
by curiousObject | 2025-06-01 22:17:07+00:00
No. It seems much too early to draw this conclusion. SpaceX’s Falcon program also looked like a guaranteed fail. But it has been the most astonishing success in affordable orbital launch tech in human history.

The essay’s comparison to the deliberately disposable throwaway Saturn V (which had massive additional costs being buried in various agency budgets for congressional pork games and international prestige) - this sounds like a very weak argument.

(Edit - Nobody can deny that Saturn V/IVb and Apollo were heroic achievements in their time, and that SpaceX succeeds because it stands on the shoulders of giants, but we have moved on).

>“weight. Starship weighs far too much”

Now, that is a pertinent observation. The crazy number of missions that are needed just to refuel the most basic mission out of GEO orbit with Starship! But the SpaceX excuse for that would be that their launch cadence and cost is designed to make this manageable and economical. (But not yet, obviously).

Let’s talk again after 20 more failed Starship tests. Then this essay could have greater credence.

(Edited)

I wonder if it would have been safer for SpaceX to just keep building on the Falcon technology? Instead of being mad ambitious with Starship.
by jmyeet | 2025-06-01 22:17:11+00:00
It's a shame posts like this get a negative reception here because there's a valid case to be made that Starship is in the very least troubled or possibly even a doomed boondoggle.

We've had 9 flights and are still pretty far from entering commercial usage. This is expensive too. I've seen estimates that each launch is costing ~$500 million.

One can make the case that Starship is a classic second system effect [1]. Just like IPv6, which decided it was making breaking changes anyway so why not break all the things (all while not solving the one real problem but that's another story). We see this all the time.

The question is: what problem is Starship solving? Yes it has a larger LEO and geostationary payload but this seems to be a pretty limited market thus far as demonstrated by there only being 11 Falcon Heavy launches total thus far. Launching multiple satellites at once only works for launching on the same or very similar orbit for the same constellation like Starlink. As soon as you drastically change the required orbit, you're talking about a separate launch.

Is it to go to the Moon or Mars? Notably, Elon called the Moon "a distraction" [2]. That doesn't bode well. After all, if your launch system was suited for that, wouldn't you want NASA to pay for it to prove it, basically? Fundamentally, it doesn't make sense to have a vehicle like this to land on the Moon (or Mars) and have your astronauts be 40 meters in the air, having to get down and back up.

And going to Mars I don't htink will happen for decades, if ever commercially. With the right political circumstances we may get Apollo like flights to demonstrate superiority but I think colonization is a joke. Mars is actually a terrible place to colonize. It's like the moon but worse in every single way.

And to even get there SpaceX needs to perfect in-orbit refueling, which is technically challenging and not something they've even started yet since they haven't even got to stable orbit yet.

Oh I disagree with the author about NASA doing this earlier, talking about Saturn rockets. Saturn was an expensive low-yield bespoke rocket not suited for mass production. Every Saturn V was essentially a one-off.

The industry workhorse here is the Falcon 9. It's reliable and high volume (>100 launches a year). Starship may yet sink SpaceX.

[1]: https://en.wikipedia.org/wiki/Second-system_effect

[2]: https://x.com/elonmusk/status/1875023335891026324
by kadoban | 2025-06-01 22:18:45+00:00
Science Madness forums may be an okay place to find better references than I'd know about. If you just want to see some fun chemistry and not necessarily take it that seriously or learn to do it yourself, there's some good people on youtube. Some of my favorites are Extractions&Ire (and his sister channel), NileRed and Stryopyro. Some people in some of those communities can probably point you in the right direction for whatever you're looking for.