MurphyA/hacker-news huggingface dataset:
by neilv | 2025-06-26 10:28:09+00:00
If you skim past the less-interesting project history, there's interesting description of some dynamics that apply to a lot of open source projects, including:

> Even if it is a valid security flaw, it is clear why it might rankle a maintainer. The report is not coming from a user of the project, and it comes with no attempt at a patch to fix the vulnerability. It is another demand on an unpaid maintainer's time so that, apparently, a security research company can brag about the discovery to promote its services.

> If Wellnhofer follows the script expected of a maintainer, he will spend hours fixing the bugs, corresponding with the researcher, and releasing a new version of libxml2. Sveshnikov and Positive Technologies will put another notch in their CVE belts, but what does Wellnhofer get out of the arrangement? Extra work, an unwanted CVE, and negligible real-world benefit for users of libxml2.

> So, rather than honoring embargoes and dealing with deadlines for security fixes, Wellnhofer would rather treat security issues like any other bug; the issues would be made public as soon as they were reported and fixed whenever maintainers had time. Wellnhofer also announced that he was stepping down as the libxslt maintainer and said it was unlikely that it would ever be maintained again. It was even more unlikely, he said, with security researchers ""breathing down the necks of volunteers.""

> [...] He agreed that ""wealthy corporations"" with a stake in libxml2 security issues should help by becoming maintainers. If not, ""then the consequence is security issues will surely reach the disclosure deadline (whatever it is set to) and become public before they are fixed"".
by seec | 2025-06-26 10:28:50+00:00
Maybe that's not the case anymore or it's not everywhere in Germany, but when I was there in my youth, there was a mandatory religion "course" in gymnasium that was solely about Christianity. If that's not a form of indoctrination we need to re-define the word.

I didn't say it was only about rich people and we seem to agree on what alternative people mean. The disagreement is that you think it's bad that those people have their freedom and come up with choices that may be sub-optimal (at least in the short run). Yet diversity of behavior and opinions is not only desirable, it is necessary to challenge the status quo and allow an evolution.

Germany in general has a big problem with liberty and this is just one more example of it. Then people get shocked when authoritarian ideals take over in Germany (currently happening by the way).

This is clearly a culture problem, something that needs to be changed, yet when I describe the problem, you act as if you are in the right and it's everyone else that wants freedom that are in the wrong...
by DonHopkins | 2025-06-26 10:29:11+00:00
The problem is that each LLM behaves totally differently in response to the exact same prompts. You can't just tell them all to be RIGHT and expect the same or even correct results everywhere everytime.

For example, Grok will interpret "BE RIGHT" as an imperative command to inject White Supremacist Ideology and Holocaust Denial into dialogs about quantum physics and children's bedtime stories.
by graemep | 2025-06-26 10:29:28+00:00
I am not convinced by the argument about cost, particularly "You’d still have to be more efficient than Microsoft though - that’s a challenge"

1. Most, even quite big organisations, do not have the complexities of operating at the scale of MS services.

2. I have no idea how efficient MS are. maybe they are highly efficient, but I know enough big businesses are inefficient that it is not a given.
by berkes | 2025-06-26 10:30:03+00:00
Not even "cargo install" is needed.

Just `wget -O ~/.local/bin/gemini-cli https://ci.example.com/assets/latest/gemini-cli` (Or the CURL version thereof) It can pick the file off github, some CI's assets, a package repo, a simple FTP server, an HTTP fileserver, over SSH, from a local cache, etc. It's so simple that one doesn't need a package manager. So there commonly is no package manager.

Yet in this tread people are complaining that "a single binary" is hard to manage/update/install because there's no package manager to do that with. It's not there, because the manage/update/install is so simple, that you don't need a package manager!
by fgasking | 2025-06-26 10:30:13+00:00
Sorry to hear that. I suspect that you've been asked that question a lot too about still having it by the Atari community! :) . Hopefully something will surface in the future via other means.

That sounds very interesting about Trashman and would love to learn more sometime if you were up for talking about the game? If so, please feel free to contact me via the contact form link on the website.
by entuno | 2025-06-26 10:32:12+00:00
Well yeah, that's what a NAS is. What you're talking about is just self-hosting a all-in-one server, like people used do with Windows Small Business Server, and all the problems and limitations that comes with.

And plenty of small businesses and hobbyists do that, and then after they "setup and forget" it they get compromised or lose their data a few years down the line.
I am excited about this Startup, and I am sure you would be too
by Divyansh_13 | 2025-06-26 10:32:48+00:00
Hey HN,

I’ve just launched the landing page for a startup I’m building called Property Partners — a real estate co-investment platform that connects landowners (or builders) with small investors to jointly fund land development projects.

The problem:

Landowners often struggle to raise capital for construction or JV projects.

Small investors want to invest in real estate but can’t afford large commercial deals or don't trust existing options.

What Property Partners does:

Landowners can list their land/project.

Investors browse verified listings and contact owners directly.

No tokenization, no middlemen — just direct deals and co-investment potential.

Right now, the product is at the waitlist stage, and I’m gathering early interest from both builders and investors. I’d love your feedback on the idea, or even better — brutal honesty on what seems risky or unclear.

Would you use something like this? Why or why not? All thoughts welcome

— Divyansh
by graemep | 2025-06-26 10:32:50+00:00
> The only thing I've found with a close value proposition (still slightly more expensive even if I limit to just a few gb of space per user) is self-hosted Nextcloud, which is about the same level of janky and requires a tech person or team to set up.

I would not imagine storage to be a major cost with something like Nextcloud. They major cost is going to be the tech person to set it up, and you do not need that many hours to do it. Mostly an initially one off cost will be high, and big upgrades might be a lot of work, but maintenance should not be
by easyThrowaway | 2025-06-26 10:34:25+00:00
It's definitely game-dependent. In a few cases I've found it was easier to rebuy a game on GOG, like Dino Crisis or '98 Resident Evil 2 (whose re-releases indeed run on win11 flawlessly while they're quite problematic on Proton) rather than messing with their original cd/dvds.

On the other hand the Sega arcade ports from the same time period (Sega Rally 1&2, Daytona USA Deluxe, Manx TT Superbike Virtua Striker, etc.) are definitely less problematic on Wine/Proton rather than Win11.
by graemep | 2025-06-26 10:36:51+00:00
> That is infinitely better than using a 2 person startup that runs out of a garage.

The big advantages with the 2 person startup are

1. A small business a customer who matters to them, and you will get better service

2. You can get terms such as having control of backups, hosting of your choice, and access to systems so you can get someone else to maintain things

> Contracts come with strict terms of service, SLAs, service expectations and such.

How close do these come to covering the consequential losses of an extended outage?
by reliablereason | 2025-06-26 10:37:58+00:00
Operant conditioning https://en.wikipedia.org/wiki/Operant_conditioning

There are also lots of studies indicating that the speed of action of a drug is important for addiction. Which essentially boils down to the fact that the brain (beeing effected by operant conditioning) needs a drug response that is sufficiently noticeable to be connected to the action of taking the drug.
by dspillett | 2025-06-26 10:38:28+00:00
> Microsoft, for all their warts, has the absolute best documentation for every public API in Windows.

That is true in some areas of MS's output, but far from all. Some of their documentation is concise but understandable, complete, and up-to-date. Some of it is auto-generated garbage that is only of use if you already know what you are doing and looking for a remainder of a detail.

Some of it is absolutely awful, I've run into numerous issues with Azure related documentation. This is in part because that side of things is rapidly evolving, but sometimes the new information isn't even there, and sometimes it is faff to identify it from information about the previous couple of iterations that are now deprecated. One recent example: installing some of their SQL Server and Azure storage access tooling on the latest Ubuntu LTS release (24.04, now over a year old). The repos are there, maintained, and supported, but the documentation doesn't mention anything beyond 22.04. Yes it is easy to work out what to change, mostly just substitute 24.04 for 22.04, but the docs should be updated. Also, instructions from different documents, all from MS, put their public keys for package signing in different places, which can cause confusion (not an issue for someone like me familiar with apt & related tooling, but I can imagine it being very frustrating to someone less experienced with those parts).
by xeeeeeeeeeeenu | 2025-06-26 10:38:59+00:00
>It's the first non opioid painkiller applicable for situations like post operative use.

Perhaps the first approved by FDA, I don't know. In many countries, metamizole is the first-line drug for postoperative pain.

(It should be noted that metamizole may very rarely cause agranulocytosis. It is suspected that the risk varies depending on the genetic makeup of the population, which would explain why it is banned in some countries but available OTC in others.)
by bheadmaster | 2025-06-26 10:39:35+00:00
> even the "pain relief" provided by sticking a knife through your skin to the bone is addictive

> the side effect of addiction isn't going to go away

While I agree with your conclusion itself, I disagree that the premise implies the conclusion. The main difference between suzetrigine and opioids, as explained in the article:

Crucially, opioids don’t just kill pain: they also incite pleasure. When the mu opioid receptors present in the reward center of the brain are activated, this reduces the secretion of a neurotransmitter called GABA, which works to inhibit dopamine-producing neurons. As GABA release declines, dopamine spikes, lighting up the reward center and inducing pleasure.

The "pain relief" provided by sticking a knife though your skin to the bone is caused by endorphine, which functions similarly to opioids, and that's why it's addictive.

Since suzetrigine doesn't affect mu receptors in the brain, this mechanism doesn't apply.

But I'm almost sure it will have some other unintended side effects. Morphine had them, heroin had them, methadon had them... And each time the inventors were sure they didn't.
by reptilian | 2025-06-26 10:39:46+00:00
Reddit has been a bot nightmare for a decade. And let's not forget the role of US military at Eglin AFB and 8200 Influence operations on that platform; Ghislaine Maxwell's u/maxwellhill is still one of the top accounts on that platform, and moderator of its no prominent subs like r/worldnews, r/politics and r/technology almost a decade after her arrest as part of the Epstein investigation.

Influence operations are Reddit bread and butter. The issue here is only if they're dumb bots, smart bots, or compromised humans.
by dang | 2025-06-26 10:40:32+00:00
Could you please stop creating accounts for every few comments you post? We ban accounts that do that. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html.

You needn't use your real name, of course, but for HN to be a community, users need some identity for other users to relate to. Otherwise we may as well have no usernames and no community, and that would be a different kind of forum. https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
by smusamashah | 2025-06-26 10:40:47+00:00
Someone once shared link here on HN of a collaborative code golf demo of a simple scene with sun, ocean and moving god rays of alternating color. You could see the code shortening while demo looking the same. At one point it changed from colorful demo to ascii of the same scene with even shorter code. I remember bookmarking it somewhere to see how it evolves further but lost where I saved it.
by somewhereoutth | 2025-06-26 10:42:04+00:00
Because when people use LLMs, they are getting the tool to do the work for them, not using the tool to do the work. LLMs are not calculators, nor are they the internet.

A good rule of thumb is to simply reject any work that has had involvement of an LLM, and ignore any communication written by an LLM (even for EFL speakers, I'd much rather have your "bad" English than whatever ChatGPT says for you).

I suspect that as the serious problems with LLMs become ever more apparent, this will become standard policy across the board. Certainly I hope so.
by chmod775 | 2025-06-26 10:42:11+00:00
You can minimize that to some degree (Valorant does this), but due to movement prediction/network latency you do have to overshare a little bit.

I imagine that most game devs just look at the incredible amount of work this takes to implement and complexity it adds, and decide to not bother. Valorant can do it because the game itself is low complexity, the developer has deep pockets, and also the added competitive integrity is valuable.
by IshKebab | 2025-06-26 10:42:21+00:00
We tried to use this on our compute cluster for silicon design/verification. We gave up in the end and just went with the traditional TCL (now Lua) modules.

The problems are:

1. You can't have apptainers that use each other. The most common case was things like Make, GCC, Git etc. If Make is in a different apptainer to GCC then it won't work because as soon as you go into Make then it can't see GCC any more.

2. It doesn't work if any of your output artefacts depend on things inside the container. For example you use your GCC apptainer to compile a program. It appears to work, but when you run it you find it actually linked to something in the apptainer that isn't visible any more. This is also a problem for C headers.

3. We had constant issues with PATH getting messed up so you can't see things outside the apptainer that should have been available.

All in all it was a nice idea but ended up causing way more hassle than it was worth. It was much easier just to use an old OS (RHEL8) and get everything to work directly on that.
by Fluorescence | 2025-06-26 10:43:04+00:00
Shame you have been downvoted. That's a reasonable question no matter where you stand. Motion is important too, not just static screen-shots.

I am 100% team Linux but cross-platform benchmarking is rife with problems. Differences are often from not testing the exactly same thing or different defaults that trade-off safety/quality/perf and can in theory be changed. No point measuring only one side of a triangle whose ratios are a matter of taste.

A responsible benchmark would try and prove fidelity.
by gpderetta | 2025-06-26 10:43:38+00:00
> Considering that it's Undefined Behavior, quite possibly.

Is it thought? Certainly it is according the C and C++ standards, but POSIX adds:

> References to unmapped addresses shall result in a SIGSEGV signal

While time-traveling-UB is a theoretical possibility, practically POSIX compliant compilers won't reorder around potentially trapping operations (they will do the reverse, they might remove a null check if made redundant by a prior potentially trapping dereference) .

A real concern is if a null pointer is dereferenced with a large attacker-controlled offset that can avoid the trap, but that's more of an issue of failing to bound check.
by olejorgenb | 2025-06-26 10:43:59+00:00
"1. Is my code, including prompts and answers, used to train Google's models?

This depends entirely on the type of auth method you use.

Auth method 1: Yes. When you use your personal Google account, the Gemini Code Assist Privacy Notice for Individuals applies. Under this notice, your prompts, answers, and related code are collected and may be used to improve Google's products, which includes model training."

The opt out appear to be about other type of stats, no?
by miningape | 2025-06-26 10:46:24+00:00
I just want to add on to your reply to justify why it's correct to call the ANC a socialist party that is causing the cultural and economic collapse of South Africa.

You could look towards their policies inspired by socialist thought a.k.a. "social justice" (BEE and expropriation). These policies are actively harmful to development while also turning off any potential investors, and are deeply rooted in socialist ideology.

You can look towards their roots being funded and directly aided by the Soviets, China, Cuba, and several others. Especially their military (terrorist) and propaganda training which was heavily influenced by Soviet foreign policy.

You can look towards their re-alignment of the country's economic and foreign policy to engage with the 2nd world, while turning off 1st world investors. This has given us strong economic ties with Russia, China, and Iran. While most of these relationships are useless, the Chinese relationship has been especially damaging to the development, maintenance, and sovereignty of our national physical infrastructure.

But the most damning evidence is the insane socialist parties that have spawned out of the fracturing of the ANC such as the MK and EFF parties (both militant socialist parties, formed by ex ANC leaders). While their socialist rhetoric had to be contained while apart of the ANC (so as to not further turn off investors), the ANC's weakening grip has allowed these nutjobs to become serious contenders in the political race. If you were wondering what the "kill the boer" chants were about they were at political rallies held by the EFF (Julius Malema) - part of the EFF's kit is a red beret (I wonder where they got that from?).

Voetsek to any champagne socialist that wants to ruin yet another country because it makes them feel good to support people and ideologies they do not understand.
by kreetx | 2025-06-26 10:47:06+00:00
I'm with you on the confusion, it makes no sense at all to call it a host. MCP host should host the MCP server (yes, I know - that is yet a separate term).

The MCP standard seems a mess, e.g take this paragraph from here[1]

> In the Streamable HTTP transport, the server operates as an independent process that can handle multiple client connections.

Yes, obviously, that is what servers do. Also, what is "Streamable HTTP"? Comet, HTTP2, or even websockets? SSE could be a candidate, but it isn't as it says "Streamable HTTP" replaces SSE.

> This transport uses HTTP POST and GET requests.

Guys, POST and GET are verbs for HTTP protocol, TCP is the transport. I guess they could say that they use HTTP protocol, which only uses POST and GET verbs (if that is the case).

> Server can optionally make use of Server-Sent Events (SSE) to stream multiple server messages.

This would make sense if there weren't the note "This replaces the HTTP+SSE transport" right below the title.

> This permits basic MCP servers, as well as more feature-rich servers supporting streaming and server-to-client notifications and requests.

Again, how is streaming implemented (what is "Streaming HTTP")?. Also, "server-to-client .. requests"? SSE is unidirectional, so those requests are happening over secondary HTTP requests?

--

And then the 2.0.1 Security Warning seems like a blob of words on security, no reference to maybe same-origin. Also, "for local servers bind to localhost and then implement proper authentication" - are both of those together ever required? Is it worth it to even say that servers should implement proper authentication?

Anyway, reading the entire documentation one might be able to put a charitable version of the MCP puzzle together that might actually make sense. But it does seem that it isn't written by engineers, in which case I don't understand why or to whom is this written for.

[1] https://modelcontextprotocol.io/specification/draft/basic/tr...
by garte | 2025-06-26 10:48:40+00:00
Yeah. No.

“The vaccine side effects from COVID-19 vaccines are generally the same as with other vaccines except for the rare episodes of myocarditis in young men which can be circumvented by increasing the duration between doses,” said Dr. Monica Gandhi, an infectious disease doctor and professor of medicine at the University of California, San Francisco. https://www.salon.com/2022/12/11/do-19-vaccines-really-have-...

It's stupid to think that something that triggers an immune response is not going to have side effects.
by miningape | 2025-06-26 10:49:25+00:00
> which is definitely not caused by socialism

Currently, in western countries, socialist policies to import the 3rd world and open borders are directly responsible for the lowering social trust.

> “immigrant rights are workers rights” is not mere rhetoric, and that the defense of migrants and refugees – the vast majority of whom are poor workers – is pivotal to the struggle of the entire global working class regardless of national origin. [1]

[1] https://sfarchive.dsausa.org/issues/fall-2019/editorial-note...
Ask HN: What still frustrates you about today's e-book → audiobook converters?
by orencoda | 2025-06-26 10:50:29+00:00
If you’ve tried tools like Speechify, Eleven Labs, Google Play Books TTS, or DIY scripts:

Which specific moments made you quit or request a refund?

What worked that you’d hate to lose?

Are you really listening to TTS ebooks or rather paying for Audible / human-narrated audiobooks?

Which pricing model would work for you better than the existing ones?
by arethuza | 2025-06-26 10:50:42+00:00
I broke a tooth because of kidney stones...

I had kidney stones last year, by far the most painful thing I have experienced, and got opioid based painkillers which made me constipated. To try and fix that I was eating some stoned prunes and it turns out one of them wasn't stoned and I damaged a tooth (it was weak anyway and needed replacement with an implant).
by lrvick | 2025-06-26 10:51:08+00:00
We implemented Nitro attestation first while I was at Turnkey for QuorumOS as that is an AWS stack however IMO TPM2 is the way to go today for the most universal support now that the big 3 cloud providers all offer endorsement key APIs. You could then support CPU-unique attestations where possible on top provided you have an out of band source of truth for expected CPU certificates.

One of our projects at Distrust is to handle all of the above in a universal library/spec we are working on called Bootproof, which will ship with EnclaveOS for broad hardware/software attestation support out of the box via a tiny rust daemon and client.
by FlorinLazar | 2025-06-26 10:53:07+00:00
Thanks! Well, that's a good question. What we are looking for is to correlate quantitative data from our databases with qualitative data by understanding users' behaviors, and with feedback.

So, feedback itself is valuable, but it needs to be linked with the other input sources to be prioritised. Otherwise, we thank users for their feedback, but if it's not smth that we receive enough times, we don't act on it.