MurphyA/hacker-news huggingface dataset:
by danieltanfh95 | 2025-06-24 04:39:25+00:00
Are you referring to phishing attacks?

How would they enumerate users through the random salt? Also, are you suggesting that they try to recreate the private key and enumerate through all possible values of the private key…?

Edit: I get what you mean, you are suggesting that since the salt is returned the attacker can still attempt password replay by enumerating through simple values like 0000. That is true. This approach does not improve on that area. That being said, using derived salt would more or less make it much difficult for offline attacks, whereas API attacks can be mitigated with rate limiting, captchas and proof of work.
by musicale | 2025-06-24 04:41:48+00:00
Social media seems to be engineered to push people to extremes, and civil discourse seems almost impossible in many instances.

Facebook's original feed was kind of OK when it was just a chronological list of posts from your friends (though that still has some issues). But of course that doesn't make as much money as an algorithmic feed that pushes advertisements and outrage-driven "engagement".

Yellow journalism has been around forever, but now we have outrage media that is optimized for each person with an addictive feedback loop.

Somehow I don't think AI is going to improve the situation.
by amluto | 2025-06-24 04:45:06+00:00
> There is also the reluctance of grid operators to use the capacity available in renewable energy generators. The majority of wind turbines are capable of active and reactive power control but most grid operators either don't use this capacity or use it minimally.

I wonder how much is the near-complete inability for grid operators to communicate with smaller systems. My little solar inverter is capable of reactive power control over a respectable range of phase angles, and the grid operator has absolutely no ability to invoke this ability short of whatever formula the combination of PG&E, the various regulators, and the UL stuck into some standard for how small inverters are supposed to behave under various voltage and frequency conditions.

Never mind that inverters could also be fooled into thinking they’re islanded and therefore disconnect themselves if the grid frequency is too far out of range. This is usually designed to occur at above-nominal frequency, which is at least mostly not what happened in this event.
by jimbob45 | 2025-06-24 04:45:29+00:00
1. Fountain pen and a nice notebook with nice paper (Mnemosyne, or Rhodia)

Spending money is overrated. The pen at the back of your junk drawer from a hotel you don’t remember staying at will do just fine. There’s a notebook in there too that’s as good as new if you just rip out the first page.
by jval43 | 2025-06-24 04:45:44+00:00
100% agreed. Save your money. That's also my opinion after spending several thousand on a couple of these devices over the years, only to find that they don't solve my problems.

E-ink is slow and is hard to read because of the low contrast. And contrary to all the marketing it actually increased eyestrain for me because it's so dark.

Not to mention the software on all the tablets I had was severely lacking, slow and buggy, and the subscriptions tacked on top felt outright offensive to me.

1. I'd go one further and say the nice paper notebooks and pens haven't worked for me either. Instead I just use a free A5 paper notepad and pen I have laying around.

2. Agreed with iPad + keyboard as an actual alternative. The retina 120Hz screens of the Pro models really help. Reading PDFs is a joy, even when compared to a large A4 e-ink device I had. It's just so much faster on the iPad.

Although I use it with Wifi on, I don't have many apps installed on it and basically all notifications disabled. I'm in the iOS ecosystem so everything just syncs, which means less work and mental overhead organizing my notes and reminders.

I'd recommend the iPad Pro Magic Keyboard though, it's expensive but snaps in place and feels great.
by bitwize | 2025-06-24 04:46:52+00:00
Back in the day, there used to be professionals known as systems analysts whose job it was to determine the business logic. The information system went through several phases of stepwise refinement. First the requirements were determined: WHO needs WHAT information, WHERE, WHEN, and WHY. (And from WHOM do they get it?) Then, a series of procedures were developed to be implemented either manually or by computer (The "Playscript" format by Les Matthies was particularly useful for the former; standard flowcharts for the latter). Each piece of data, its type, and its purpose was also identified and registered in a standard vocabulary. The programmers only got in on it towards the end: once the major decisions had been made, they wrote the code instructing the computer on HOW to do it. Their focus was on the HOW; the WHAT was not in their job description, and was usually beyond their capability. It takes holistic, big-picture thinking and great social skills to develop an understanding of an entire business division and come up with a plan to implement an information system for that division. The programmers' work entailed about 15% of the total work, and was mainly concerned with the technical details of getting the procedures to be automated running on a computer. These days, with AI, that 15% figure could be reduced even further, perhaps by a factor of five or ten. In the big-iron era, programming was really that simple. The hard decisions had already been made before the first line of code was written. You may think it stodgy and inflexible to develop software this way, but that's how grown-ups did it, and studies showed that it was significantly cheaper than the scattershot, agile-like approach where the programmers where in the lead in terms of systems design.

What's happened since the 1970s is, programming has undergone prestige inflation to the point where programmers are looked to for decisions regarding the actual business procedures, and usually they just don't have the business knowledge or wherewithal to do that. The systems analyst has faded into memory. And as Milt Bryce said, "If this country built bridges the way it builds systems, we'd be a nation run by ferry-boats."
by mulmen | 2025-06-24 04:47:27+00:00
> In a hazard investigation you don’t want the investigators to have teeth.

Did I say I want the NTSB to have teeth?

> Without official investigations, companies can assert their own interpretations of events.

They can do this with investigations too. Just as Boeing did. NTSB can't do anything about it. The "punishment" was a referral to DOJ who can.
by temp0826 | 2025-06-24 04:51:55+00:00
> (As the mum of a 5 yr old and 3 yr old, I feel obligated to become an expert on all things dinosaur.)

As an uncle to an obsessed 3 year old I concur! My jaw dropped when he rattled off "pachycephalosaurus" and I had to look it up to confirm (he might have added a syllable or two but that's ok)
by riffraff | 2025-06-24 04:52:43+00:00
I would argue when you're passing around stringy JSON-like thingies is when typing is most useful :)

You're not going to misuse an API that takes a Person or Cart, but mixing up two hashes cause you used two different strings as keys can happen easily.

(I do think dynamic typing is mostly fine, but I do wish ruby had optional static typing with some nice syntax instead of RBS)
by musicale | 2025-06-24 04:54:14+00:00
Reminiscent of the push to make kindergarten more like upper grades or workplaces, rather than vice-versa.

The push to transform learning, or any form of productive activity, into drudgery, and humans into joyless (and often sedentary) robots, is regrettable. And the irony is that in the long run robots will be better robots than roboticized humans anyway.
by zdc1 | 2025-06-24 04:54:43+00:00
Similarly, I've had many instances where an auditor would ask for X and instead of trying to show them X I would instead ask them what control / Common Criteria item they were trying to get assurance on. So much of the process is about educating the auditors about how your systems operate and how you manage risks, rather than just trying to provide or build anything and everything they ask for.

*X = password expiry configuration, server antivirus, approval emails, etc.
by eviks | 2025-06-24 04:55:37+00:00
You're just describing different capacities.

But this complexity likely works against your claim that there are reliable estimates, meaning that it's easier for everyone else to A) inflate their own capacities and argue that B) CF shouldn't be trusted in their assessment as it's inflated.

And I've already addressed your last point, so alternatively: if the biggest attacks are 1 bps of traffic, it doesn't matter that you have a ton of infrastructure because anyone can handle a byte. The lie has to exceed "capacities" of others for it to matter.
by bamboozled | 2025-06-24 04:57:09+00:00
It’s a great place but what’s on the surface is a total illusion to the complexity and rules Japanese people have to deal with to make it seem this way. I’ve always believed that the beauty of Japanese society comes at the cost of the Japanese themselves. They have to sacrifice a lot to make it what it is.

Conformity is huge, there was even a row a few years ago when a school demanded to inspect girls underwear and make sure they're wearing the correct colored panties. Asking children to dye their hair black or straighten it is also not unheard of.

Shukumōkyosei literally means “to shrink and correct hair”. It’s a permanent straightening treatment that removes 70 to 90% of curls, volume, and frizz by chemically restructuring hair bonds.

My theory is, the level of rules, bureaucracy, and society pressure is why innovation and having children is just too hard. It's very hard to find the space live, but the rules based high pressure society is all they know since the end of WW2.

If you're interested, have a read about the Zen period, and the way it sort of liberated society. It's faced challenges since the Kamakura period (it's golden age) but it was a fascinating period of brilliant art, innovation and reform.

I hope what I said doesn't come across as negative either. Like I said, it's a wonderful place and fascinating culture, it truly is, but it's as I said, not free nor is it at all simple.
by mlyle | 2025-06-24 04:57:48+00:00
> Demand rises because that's how people have their system set up. That cooling load can be shifted earlier in the day by using a slightly smarter thermostat to precook your house when the electricity is plentiful.

You can do this a bit, but the insides of houses don't have that much thermal mass and the best insulated houses add a pretty large phase delay that makes the quickest rise in internal temperatures during the late afternoon as framing in the attic heats up.

I don't have a lot of luck in accomplishing meaningful precooling in my house. My best plan is to suffer until the late afternoon, turning on the AC at the end of the peak demand period when at least outside temperatures are lower, my AC units are shaded, and the cooling is more efficient.
by unshavedyak | 2025-06-24 04:57:53+00:00
> because they never delete code. Never.

That's not true in my experience. Several times now i've given Claude Code a too-challenging task and after trying repeatedly it eventually gave up, removing all the previous work on that subject and choosing an easier solution instead.

.. unfortunately that was not at all what i wanted lol. I had told it "implement X feature with Y library", ie specifically the implementation i wanted to make progress towards, and then after a while it just decided that was difficult and to do it differently.
by Maxion | 2025-06-24 04:58:01+00:00
> We need to remove the existing subsidies on renewables which made sense in the early days, but not now. Let the generation sources play at the even field.

This is also factually incorrect (unless Spain are now doing some country level subsidies on renewables). Fact is, new solar and new wind offer the lowes average power generation costs of any method. Regular market forces (without susidies) will favor renewables over anything else. Hydro being the most profitable.
by zxexz | 2025-06-24 04:58:48+00:00
I prefer SOM, or better yet a good SBC.

In all seriousness, as annoying as it is, I’ve been through it so many times now (not as the guy managing the process! That is some serious work I thankfully have not yet had to lead). At this point, a lot of it does feel like a pretty good guideline for enforcing some best practices, if you set up your initial controls right. Basic access management, SSO, branch protection, traceability, is actually really useful, and getting it right early on has saved some serious headaches. That being said, it does seem a little over the top sometimes. Especially some of the standard compliance vendor defaults. But it’s really not that hard with a good CISO (but again, whenever I see the documentation required, I’m so thankful it’s not me).
by skydhash | 2025-06-24 05:00:15+00:00
> I've seen it written that the main reason managers tend to want to get rid of SWEs is because they don't understand how to interface with them

That’s because software is nebulous enough that you can get away with promising the moon to customers/boss, but in the next meeting, you’re given a reality check by the SWEs. And then you realize the mess you’re thrown everyone in.

Managers knows how to interface with SWEs well (people interface with professionals all the time). Most just hates going back to the engineers to get real answers when they fancy themselves as products owners.
by throwaway2037 | 2025-06-24 05:02:35+00:00
I am not here to nit pick about this post, but this made me think:

> owning a lot of houses is not a good business

Generally, I agree. What do you think makes commercial (office) buildings different? Probably 90% are owned by insurance companies, private equity, and pension funds. My guess: Scale matters. Also, maybe I am blinded by big cities, but second tier cities and below might have lots of small fry landlords that own one or two small commercial buildings
by chjj | 2025-06-24 05:03:21+00:00
> In case of the Tor browser, they use the user agent to blend in, so they are not a good candidate to do anything about how stupid the user agent is.

No. They don't use it to blend in. If they wanted to blend in they would be modifying every platform's user agent string to look like Windows x86_64 or something. They don't do that because there's no way they could possibly get away with it.

Instead, they're resigned to simply censoring the minor version number of the browser to reduce entropy.

> Fun fact, non-browsers actually have much nicer user strings. I run an internet radio, and there is a lot of clients like

And those tools will get blocked by various CDNs for not having a browser user agent string, not having a browser-like TLS handshake, etc. This is why projects like curl-impersonate and golang's utls had to be created.
by monkeyelite | 2025-06-24 05:04:15+00:00
> Don't you think that economics biased you toward egoism?

Yes. Economists and critics often do not recognize intangible rewards and incentives.

> Altruism is very real thing, with very real examples of behavior influenced by altruism.

Now do second order reasoning. I didn’t say nobody ever does anything for anybody else. I said organizations do not generally act and support information which is not in their interests.
by Maxion | 2025-06-24 05:04:30+00:00
> Because the only reason that solar is still generating power at negative prices is because they are getting subsidies to do it.

This massively simplifies reality.

E.g. in Finland where I live we also have issues with negative power prices. A few years ago we had some really low prices. It turns out, a fair bit of wind power producers never opted to add to their windmills any remote shutdown possibility, nor did they have the ability to monitor prices and react to them automatically. I.e. they just kept generating no matter the price, and had offers in at the network level at the lowest permissable price.

Since then, when they lost a non-insignifcant amount of money by running at negative prices, they've started installing control electronics in windmills and building IT systems and prediction algorithms to be able to react to this.

In the EU it is not as simple as "turning off when the prices are negative" since producers offer a certain capacity to the grid in an auction system the day before. You have to predict the weather + overall demand and set your offer accordingly.
by RainyDayTmrw | 2025-06-24 05:06:19+00:00
I'm pretty sad about this all-around.

For whatever it's worth, I actually think this dev is understating the impact of their security issues. They had 2 token leaks - albeit conditional and with prerequisites. Given the sorts of tokens that a user has to supply to use this sort of generic app builder, this is pretty serious.

That said, I think inconsistent enforcement, when it favors them, is a really bad look on Discord. It totally looks like they're doing cover-their-ass, whack-a-mole, public relations-driven enforcement.
by grumpy-de-sre | 2025-06-24 05:06:43+00:00
I always liked the bit where they often compensate folks not directly financially but rather with a generous share in what they are building. Eg. the building containing your one bedroom apartment gets torn down by developers and as compensation they offer you a three bedroom apartment in the new building.

Definitely plays an interesting role in combating/moderating NIMBYism.
by NBJack | 2025-06-24 05:07:06+00:00
I admit the general aesthetic was off-putting and was a bit hard to get excited for in the previews.

Looking at the producer's prior work, I can see why it wouldn't appeal to me: I wasn't a fan of Coco, The Good Dinosaur, or Brave either.

It didn't help that Brad Garrett's voice just didn't seem to ..fit?.. their character, despite the rest of the cast.
by yashvrma | 2025-06-24 05:08:36+00:00
Hey HN, I'm Yashraj a 20y/o developer and I building Breeze from last 3months.

I'm huge fan of cursor, so 3months ago I got this idea of building this app which is like a cursor but for google docs.

Also, creating doc manually is way harder and boring at the same time. So i thought why not integrate a LLM into it and let AI handle all the research and docs generation for us.

This was the main idea of building this, I hope this will be helpful and would love your feedback on this pls
by monkeyelite | 2025-06-24 05:09:29+00:00
> It is just metaphysics

I would call it having a baseline understanding of organizations and media.

> Can you find examples of a biased reports on CSB's youtube channel?

Yes? Can you not?

The top video in this thread, “safety pays off“ highlights their successes and does not discuss their failures or costs. So yes that video was designed to make their organization appear in the best light possible.
by zxexz | 2025-06-24 05:10:53+00:00
I’m sure the Lattice open source situation is driving sales in a more than substantial way. I’ve definitely spent >2k in the past five years on lattice boards and chips (not counting used or otherwise aftermarket). Most people I’ve met with any disposable income and an interest in hardware or DSP have done similar. I know 2k USD is nothing compared to even a single high end chip from another vendor, but it sticks. I’ve known more amazing devs than I can count on two hands that ended up actually using Lattice FPGAs in their job (several times changing industries to do so!). I honestly feel that if Lattice embraced open source further, they could be a leading player in the space. Hell, I’m sure they could do that and still find a way to make money on software. Something, something, enterprise.
by conductr | 2025-06-24 05:11:04+00:00
I have this problem all the time and I can usually run the calcs in a simple multithreaded process pool/queues. While each calc may still take 15s, I run a dozen or more at a time. This helps me refresh the cache in a reasonable amount of time, doesn’t really focus on improving calc speed of the underlying service which is obviously another potential opportunity
by skydhash | 2025-06-24 05:13:04+00:00
Check the whole ecosystem around editors, grep tools, debuggers, linting and build tools. One common thing about all of this is line (and column) number so you can integrate them together if you want to automate stuff. Like jumping to errors (quickfix in vim,…), search all files and jump to the occurrences (grep mode in emacs,…), etc…
by jaza | 2025-06-24 05:13:22+00:00
Switched all my python stuff to poetry several years ago. Still kinda tired and shagged out from that endeavour. Yeah yeah, ok ok, if y'all keep raving THIS much about uv, I guess it must be pretty good ... still, sigh, yet another One True (tm) python package management solution. It's on my todo list, I'll get around to it, I reckon within the next 12 months, currently I have no pressing need to move away from poetry.
by CoolCold | 2025-06-24 05:13:37+00:00
> While FreeBSD team fights really hard to keep ABI and kernel interfaces stable across ‘point’ releases – its sometimes not possible due to the nature of Linux DRM

yaw, didn't know Linux influence is so high on FreeBSD.

though, it may be a good sign - as it sorta base system becoming split in packages, may be on day LTS version FreeBSD will be born and it'll become usable

TIL: "as with broken ABI the drm-kmod related kernel modules just panic and reboot each such system instantly … and this problem persists for whole 3 months...I have spoken about that problem for years"

Indeed, stable and solid system, I wouldn't be part of CorpIT team who needs to support such setups.
by jandrewrogers | 2025-06-24 05:13:38+00:00
Magnolia used to be an island in Puget Sound. They dumped fill into the area of Seattle we now call Interbay to connect it to the mainland where Queen Anne is.

It doesn’t make sense for Queen Anne to be an island, it is connected by a ridge to the rest of the mainland. The topography doesn’t support that notion.
by tsimionescu | 2025-06-24 05:14:29+00:00
Maybe, but what you CAN'T do is let your car drive itself, or take a nap while it drives itself. It is 100% your responsability to monitor the car constantly and be ready to jump in with 0 notice. Ergo, you're the one driving the car.

In actual self driving systems, you either aren't even in the driver's seat (Waymo) or you can at least take your hands off the wheel and take a quick nap (Mercedes).