MurphyA/hacker-news huggingface dataset:
by mk89 | 2025-06-21 12:24:35+00:00
In mid sized companies, creating/using/maintaining AWS resources requires nevertheless one or more teams of devops/sre.

Out of experience, in the long run, this "managed aws saved us because we didn't need people" feels always like the typical argument made by saas sales people. In reality, many services/saas are really expensive, and you probably will only need a few features which sometimes you can rollout yourself.

The initial investment might be higher, but in the long run I think it's worth it. It's a lot like Heroku vs AWS. Superexpensive, but it allows you with little knowledge to push a POC in production. In this case, it's AWS vs self hosted or whatever.

Finally, can we quantify the cost of data/information? This company seems to be really "using" this strategy (= everything home made, you're safe with us) for sales purposes. And it might work, although for the final consumer this might have a higher price, which finally pays the additional devops to maintain the system. So who cares?

How important is for companies to not be subject to CLOUD act or funny stuff like that?
by yusina | 2025-06-21 12:24:47+00:00
> Signal's privacy terms were last updated in 2018. We are in 2025 now. It is unimaginable for any operational organization not to update their terms for 7 years.

As a privacy-concious user, I always get suspicious abouy privacy policy changes. They always become more loose instead of doing anything to my advantage. Typically because company has found a new way to use my data to make money and their lawyers realized that this requires relaxing the privacy policy. It's a good thing Signal is not playing that game.
by tekchip | 2025-06-21 12:26:09+00:00
>I've been running my own mail services for close to 30 years now...

There's the rub. 30 years ago this was true. Old systems have been grandfathered in.

A combination of rising spam and things like fraud via email have caused especially large services to be so much more aggressive in blocking. If your email has been around forever it's generally trusted.

The company I work for has been around for 15 years and we spent the first 5 or so getting yahoo and live/hotmail/outlook to accept our mail reliably despite proper dns/dkim/spf.

Self hosted on residential IP today is near impossible. Your only hope is pay to not be on a residential IP and even then strap in for years of struggle to get the biggest free providers to accept you as legitimate. Exacerbated by their thorough lack of actual support contacts.
by joshstrange | 2025-06-21 12:26:56+00:00
Every time I use Clickhouse I want blow my brains out, especially knowing that Postgres exists. I’m not saying Clickhouse doesn’t have its place or that Postgres can do everything that Clickhouse can.

What I am saying is that I really dislike working in Clickhouse with all of the weird foot guns. Unless you are using it in a very specific, and in my opinion, limited way, it feels worse than Postgres in every way.
by _1tem | 2025-06-21 12:27:23+00:00
I feel like Trump and the United States are in a damned-if-you-do and damned-if-you-don’t situation. If the US doesn’t protect its ally Israel, then that’s a huge loss in credibility to American hard power and possibly the beginning of the end of the State of Israel, because Iran’s ballistic missile program is dangerously effective. If the US goes ahead with all-out war in Iran, this risks becoming another trillion dollar boondoggle like Afghanistan, except worse because Trump’s base is about less foreign involvement, low gas prices, and ending wars. A war with Iran could also go very badly because it’s not clear how to stop a ballistic missile program in a country the size of Iran (years of bombing even failed to stop the Houthis from lobbing missiles). And if war creates more instability in the Middle East - Israel will have much bigger problems if the Saudi Arabian monarchy for example collapses. No good options, and the Middle East is being completely reshaped regardless.

Meanwhile China quietly supports Iran: https://www.scmp.com/opinion/china-opinion/article/3314468/i...
by TeMPOraL | 2025-06-21 12:27:34+00:00
> also (and maybe more so) from a simplicity one. If you have a library for shoving data into a struct mechanistically, but you then take the data from that struct and shove it into an additional struct, what's the point of the library? You're writing the code move the data anyway.

Super annoying if you need to do it by hand, and wastes compute and memory if you actually need to do copies of copies, but this is the mapping part of "object relational mapping", the M in ORM. Skipping it is a bad idea.

Your business/domain model should not be tied directly to your persistence model. It's a common mistake that's responsible for like half of the bad rep ORMs get. Data structures may look superficially similar, but they represent different concepts with different semantics and expectations. If you skip on that, you'll end up with tons of stupid mistakes like 'masklinn mentions, and more subtle bugs when the concepts being squashed together start pulling in opposite directions over time.
by bee_rider | 2025-06-21 12:28:26+00:00
Touch typing is not super useful. I picked it up naturally over time, but it was just an accident. In general, the desire to type fast is a symptom of insufficient automation.

It is sort of nice to turning your laptop screen red and dim, and code on a dark porch at night (OLED screen required to get real darkness). Just you, the vim, and some fireflies. Your eyes will adjust to the darkness, and maybe you’ll see some animals that you don’t normally see.
by 9rx | 2025-06-21 12:28:43+00:00
> And I'm honestly not that willing to put that much effort into an internet discussion just to teach someone

How conservative of you, being unwilling to teach yourself something new. Learning shouldn't come with that much difficulty, though. What is at the heart of your struggle?

> why individuals / communities may not be able to achieve it "on their own accord"

This "the government is made up of magical fairies" idea that you keep presenting simply doesn't work. Government is not of magical fairies at all, just people. If people can't do things on their own accord, government can't either, fundamentally. People and government are the exact same thing!
by yusina | 2025-06-21 12:29:01+00:00
Perfect is the main enemy of good. I rather use Signal to escape the big tech clown show than wait for another decade for the perfect tech to come along, meanwhile either not communicating with anybody or using the exact services I really want to avoid.

I'm still waiting for the "other issues" to be explained that Signal supposedly has. I'm ok with my contacts knowing my phone number, and I opened the Signal account ages ago. Anything else to be concerned about?
by bombcar | 2025-06-21 12:29:33+00:00
Just because the rules aren’t set fully in stone, or can be bent or broken, doesn’t mean they don’t “exist” - perhaps not the way mathematical truths exist, but there’s something there.

Even these few posts follow innumerable “rules” which make it easier to (try) to communicate.

Perhaps what you’re angling against is where rules of language get set it stone and fossilized until the “Official” language is so diverged from the “vulgar tongue” that it’s incomprehensibly different.

Like church/legal Latin compared to Italian, perhaps. (Fun fact - the Vulgate translation of the Bible was INTO the vulgar tongue at the time: Latin).
by munchbunny | 2025-06-21 12:29:51+00:00
> Can you search log data in this volume?

(Context: I work at this scale)

Yes. However, as you can imagine, the processing costs can be potentially enormous. If your indexing/ordering/clustering strategy isn't set up well, a single query can easily end up costing you on the order of $1-$10 to do something as simple as "look for records containing this string".

My experiences line up with theirs: at the scale where you are moving petabytes of data, the best optimizations are, unsurprisingly, "touch as little data as few times as possible" and "move as little data as possible". Every time you have to serialize/de-serialize, and every time you have to perform disk/network I/O, you introduce a lot of performance cost and therefore overall cost to your wallet.

Naturally, this can put OTel directly at odds with efficiency because the OTel collector is an extra I/O and serialization hop. But then again, if you operate at the petabyte scale, the amount of money you save by throwing away a single hop can more than pay for an engineer whose only job is to write serializer/deserializer logic.
by derangedHorse | 2025-06-21 12:31:11+00:00
Using YouTube enough for ads to bother someone does not imply it’s “enough” to pay for. There’s nothing paradoxical about it.

Humans don’t value things as a binary decision between it either being worth it as free or equal to the cost it’s being sold at. Everyone has a price point for a service they think is fair, for which they’ll start seeking alternatives when exceeded. This is how markets work.

Time spent does not correlate with cost-independent value. This is doubly true with social media platforms.
by rs186 | 2025-06-21 12:32:34+00:00
I can assure you that they do the same thing with flagship phones, especially carrier versions of the phones -- speaking from first hand experience. I have seen notifications from apps I have never heard of multiple times.

That's what I have been thinking recently -- given that Samsung is quietly doing these shady things with my phone, and other annoyances like Samsung forcing Galaxy AI on me (try selecting some texts in a browser or webview) which cannot be uninstalled and the terrible Samsung Pay interface, I am questioning my device choice every day.
by imchillyb | 2025-06-21 12:32:38+00:00
“There are several sample applications included which demonstrate what it is capable of.”

This was the mantra of BeOs. Here’s a technology preview. Watch videos on a cube, now a sphere!

The OS was sold as a technology preview that was easy and accessible and the users only needed to wait for developers…

…that never showed up.

Similar occurrence with Microsoft phones and lack of developers. Pebble watch and lack of developers…

What these projects all lack are meaningful engagement instead of a few ‘oh wow’ moments.
by rsynnott | 2025-06-21 12:32:50+00:00
Okay, I mean, if you want to give poor ol’ Putin the benefit of the doubt, something that looks like a state actor but might theoretically not be Russia is doing a lot of minor to moderate economic sabotage in Europe.

Personally I think the amount of special pleading required to imagine that it is _not_ Russia is a bit much (particularly around the deep sea cable cuts; at that point you’re really claiming that Russia is deniably pretending that it is them, but really it’s someone else), but you do you. It doesn’t change the overarching point; both Hetzner and OVH would be obvious targets for, ah, whoever it is.
by johnisgood | 2025-06-21 12:32:54+00:00
> People really did adapt by bringing their own bags.

Maybe it is just my family, but in Eastern Europe, my family and some people do the same. We have re-usable bags that are not made out of plastic, but fabric, and we re-use them every time we shop. The reason for this is that bags are too expensive for what they are, so we do not continue re-buying them due to their high costs. No ban in place from what I know.
by xg15 | 2025-06-21 12:33:50+00:00
> Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not.

Another thought on that point: Why of all things is manufacturer approval so important? We know manufacturers often don't work for - or even work against - the interests of their end users. Manufacturer approval is not an indicator for security - as evidenced by the OP article.

If anything, we need independent third parties that can vet manufacturer and third party software and can attach their own cryptographic signatures as approval.
by jeroenhd | 2025-06-21 12:35:27+00:00
When a security analysis was done of Chinese parts of the Dutch mobile network, that was pretty much the conclusion: Chinese vendors deliver software and components full of vulnerabilities, but none of them seem to be intentional.

Since then there has been a movement to reduce Chinese vendors in general our if security concerns, as well as to improve the security posture of the mobile networks by doing things like "encrypting connections" and "switching away from telnet".

On the other hand, the Chinese managed to break into the US wiretapping system, so it's not like other networks aren't vulnerable either.
by squishington | 2025-06-21 12:36:07+00:00
The scariest aspect to me is trumps unpredictability. He acts based on his psychological needs in the moment, I.e. need for narcissistic supply. He isn't ideological in the way that netanyahu and Putin are, so he is going to react based on how others are reacting to him. He clearly has learning difficulties and isn't able to grasp history and politics. He also isn't someone who asks for advice. It challenges his need for a sense of total competence.
by Out_of_Characte | 2025-06-21 12:36:30+00:00
That's where correlations of random events and placebo end and where discovery begins.

There are 'gods' that are 'better' than others. Even if the principle of what you/people believe goes against what you find scientifically relevent, or factual, or sensible. There still is something to be said about a group of people following a strange set of rules that could be demonstrably better than other sets of rules and beliefs. May it be enviromental, genetic, placebo or a tiny edge over what gives life meaning. We ended up with the gods we have today, not by coincidence, but because all the other ones failed their followers.
by ACCount36 | 2025-06-21 12:37:35+00:00
And?

"Sure, we have a rogue AI that managed to steal millions from the company, backdoor all of our infrastructure, escape into who-knows-what compute cluster when it got caught, and is now waging guerilla warfare against our company over our so-called mistreatment of tiger shrimps. But hey, at least we know the name of the guy who gave that AI a prompt that lead to all of this!"
by homebrewer | 2025-06-21 12:40:50+00:00
I don't know about Go, but in Java and .NET world this is trivially solvable with libraries like MapStruct. If you have a model with 20 fields and need to create a tiny slice of it (with let's say three fields), you need a few lines of boilerplate: create a record with those fields (1-3 LOC):

record Profile(int id, String login, boolean isAdmin) {}

create a mapper for it:

interface UserMapper { // arrays are just one example, plain models and plenty // of other data structures are supported Profile[] usersToProfiles(User[] user); // other mappers... }

and then use it:

class UserController { // @GET("/profiles") Profile[] getUserProfiles() { var users = userRepo.getUsers(); return userMapper.usersToProfiles(users); } }

As long as fields' names match, everything will be handled for you. Adding another "view" of your users requires creating that "view" (as a record or as a plain class) and adding just one line to the mapper interface, even if that class contains all User's fields but one. So no need to write and maintain 19+ lines of copying data around.

It also handles nested/recursive entities, nulls, etc. It's also using codegen, not reflection, so performance is exactly the same as if you had written it by hand, and the code is easy to read.

https://mapstruct.org

Go developers usually "don't need these complications", so this is just another self-inflicted problem. Or maybe it's solved, look around.
by perching_aix | 2025-06-21 12:41:56+00:00
This should not be a surprise. Mechanistically enforced trust (like in trusted computing), and even better, mechanistically assured trust (like in verifiable computing), will be relied upon by anyone seeking trust. This means both consumers and producers, and anyone else in-between.

If I want my device to be secure, I want this trust. If I want to sell a copy of my virtual asset to only be used in ways I approve of, I want this trust. You can't have only one of these at the same time, either your device can provide this trust or it cannot. That's not the battle in my view. The battle is to implement this appropriately, such that e.g. if we're representing access control, identity, and ownership, then that representation should match reality. So if I'm said to own a device, the device can and will attest so, and behave accordingly. It's just that instead of that, I'm always somehow just being loaned these things, only have some specified amount of control over these things, and am just a temporary user somehow. That's the issue. And that these systems are not reimplementable, and as such entitlements do not carry around.
by JKCalhoun | 2025-06-21 12:42:13+00:00
At some point though, kind of like bad movie sequels, you start to think that Corporate has run out of ideas.

Of course someone there is looking at the balance sheet and noticing that recycling is actually profitable so who can blame them if we want to keep repurchasing the shinier version of the thing we liked before?

Then I suppose we have ourselves to blame — or not.

I suspect the OP though is bemoaning the lack of new, original ideas that this kind of commerce workflow eschews. (Myself, I'm not into first person shooters and so essentially walked away from mainstream gaming decades ago.)
by kgeist | 2025-06-21 12:42:56+00:00
1. As shown in the article, exposing the internal model to APIs directly is a security footgun. I've seen sites get hacked because the developer serialized internal objects without any oversight just like in the article and accidentally exposed secrets.

2. Exposing internal models to APIs directly also makes it hard to refactor code because refactoring would change APIs, which would require updating the clients (especially problematic when the clients are owned by other teams). I've seen this firsthand too in a large legacy project, people were afraid to refactor the code because whenever they tried, it broke the clients downstream. So instead of refactoring, they just added various complex hacks to avoid touching the old core code (and of course, their models also mapped directly to the UI).

In the end, codebases like that, with no layer separation, become really hard to maintain and full of security problems.

All because they thought it was "simpler" to skip writing ~10 lines of extra boilerplate per model to map models to DTOs.

Lack of layer separation becomes a problem in the long term. When you're just starting out, it may seem like overengineering, but it isn't
by scott_w | 2025-06-21 12:43:19+00:00
Sadly I suspect they are. There’s an entire culture of denigrating anything fun by absurdly reducing it to its basic components. I’ve seen a lot of people denigrate football by calling it “kickball” and “just 20 men running around chasing a ball on a field.” I guess we could say our job is just hitting a keyboard thousands of times a day, no idea how anyone would enjoy that! /sarcasm
by Lio | 2025-06-21 12:43:20+00:00
It's not stealing; no one is deprived of anything except rent.

If anything the cost of making the video is sunk by the creator just once and then rapidily payed off.

Once that happens it's just hosting costs and Moore's, Kryder's and Koomey's Laws are brining that down exponetially.

Funnily enough though you never see the amount of avertising shown getting shorter to represent the lower costs involved eh?
by ravdeepchawla | 2025-06-21 12:43:27+00:00
You can design your way around it

1. Manually screen who can send you messages like Hey[^1] and Apple[^2]

2. Basic filtering to ensure the promotional stuff gets blocked or put in a separate list [^3]

3. Rate-limit senders who are showing robot like behaviour

---

[^1]: https://www.hey.com/features/spam-corps/

[^2]: https://support.apple.com/en-il/guide/iphone/iph203ab0be4/io...

[^3]: https://f-droid.org/en/packages/spam.blocker/
by jchw | 2025-06-21 12:43:33+00:00
Okay. But in practice you do still need basic keyboard control and screen reader support. If Windows XP didn't have robust support for that I suspect it would be a very different story, but it did.

Edit: Of all the comments to disagree with, I am blown away that this is today's. You guys desperately need to explain what you're disagreeing with here. Seriously, leave a reply.
by hkt | 2025-06-21 12:44:32+00:00
Used it for years, it is great. Webxdc apps work in both android and desktop clients (not sure about iOS) so I can play chess, share calendars and to do lists, and even collaboratively edit documents, all by email, all privately.

Anyone who hasn't tried it really ought to.

To the haters talking about PGP: giving your entire social graph to Meta or even Signal is considerably worse.
by phoe-krk | 2025-06-21 12:45:37+00:00
At this point we're already using different definitions of grammar and vocabulary - are they discrete (as in a rule system, vide Harper) or continuous (as in a probability, vide LLMs). LLMs, like humans, can learn them on the fly, and, like humans, they'll have problems and disagreements judging whether something should be highlighted as an error or not.

Or, in other words: if you "just" want a utility that can learn speech on the fly, you don't need a rigid grammar checker, just a good enough approximator. If you want to check if a document contains errors, you need to define what an error is, and then if you want to define it in a strict manner, at that point you need a rule engine of some sort instead of something probabilistic.
by em-bee | 2025-06-21 12:45:46+00:00
i am not aware of any parser that does that differently, but i would also argue that this is not the job of parsers. after parsing (or before exporting) there should be a data validation step based on whitelists.

so the user can send in unknown fields all they want, the code will only accept the username and firstname strings, and ignore the other ones.

same with fetching data and sending it to the user. i fetch only the fields i want and create the correct datastructures before invoking the marshaling step.

there are no footguns. if you expect your parser to protect you you are using it wrong. they were not designed for that.

input -> parse -> extract the fields we want, which are valid -> create a data-structure with those fields.

data -> get fields i want -> create datastructures with only wanted fields -> write to output format
by nottorp | 2025-06-21 12:46:05+00:00
I know what it is, i read the reviews and decided to skip based on QTEs [1] :)

I still don't understand how "addictive" is a positive term.

[1] To preempt some complaining, I haven't touched an Ubisoft or EA title in at least 10 years. So it's not like I'm an AAA "consumer" that skips the darling indies.
Show HN: Simple gitignore generator on the web – GUItignore
by 0x00cl | 2025-06-21 12:46:17+00:00
I created a simple gitignore generator for the repository mantained by Github (https://github.com/github/gitignore/), though I know there is an alternative solution by toptal, the source looks like it hasn't been updated since Jun 2023 (About 2 years ago). My solution is sort of just a frontend to the github repository.

It takes the list of .gitignore files from the repository and makes it easily available for search and concatenates multiple gitignore files into one. This can be specially useful when starting a new project.

Its kept up to date with the Github repository (in the footer you can see the commit hash that its using).

Source code: https://codeberg.org/0x00cl/guitignore (Its just an HTML file with the gitignore submodule)