MurphyA/hacker-news huggingface dataset:
by blub | 2025-07-25 10:51:06+00:00
This comment highlights a very important philosophical difference between the Rust community and the communities of other languages:

- in other languages, it’s understood that perhaps the language is vulnerable to certain errors and one should attempt to mitigate them. But more importantly, those errors are one class of bug and bugs can happen. Set up infra to detect and recover.

- in Rust the code must be safe, must be written in a certain way, must be proven correct to the largest extent possible at compile time.

This leads to the very serious, solemn attitude typical of Rust developers. But the reality is that most people just don’t care that much about a particular type of error as opposed to other errors.
by debugnik | 2025-07-25 10:51:28+00:00
Note that C#'s Memory<T> (a slice) isn't boxed either, but it stays memory-safe under tearing: the resulting slice might have unintended bounds, but it will either be in-bounds or will throw an exception.

This of course has some overhead, which is why you usually turn it into the cheaper, data race free Span<T>. Go could have the same safety and fix some of the overhead with compiler optimizations, they just don't want to take the trade-off.
by bernoufakis | 2025-07-25 10:51:44+00:00
> But that would be incorrect. It's not possible for anyone from the GrapheneOS project to target a GrapheneOS user that way. Look into how updates and the update servers work.

My point is that from Rossmann's perspective, being target of the lead GOS software dev hostile behavior as per his "Why I deleted Graphene OS" induces Rossmann's --> perception <-- that the GOS could go after him if he really wanted to. First, everyone is busy and has their life, suggesting that his spend hours going through code and documentation he is not familiar with to make sure he is not target is moot. Most people don't read TOS, and same goes for Licences and docs of OSS. Between doing that and stop using it as it's main device OS, the easier choice is the latter. As a software dev myself, your expectation of layman being able to navigate something like a code review, or even an investigating an exploit is hardly reasonable.

So it is not "incorrect". I am not even saying Rossmann could be targeted. I cannot even make this claim as I have not gone through the docs nor understand the build and update pipeline, which is kind of my point: I can't be bothered neither for GOS, nor for the most of the FOSS software I use. The majority of OSS user rely on the vague concept that motivated and honest people audit the code, but hardly anyone is going deep dive into how an arbitrary piece of software works.

The main issue is the attitude of that GOS developer, whether they like it or not, taints the confidence in the project. it does not matter if Rossmann can or cannot be targeted technically.

The issue here is not technical but a reputation issue.

> The updater app is pretty easy to read through. I think a software developer would be able to understand it. The update servers' setups are also very easy to understand. It doesn't take a software developer genius to figure these things out.

Even then, it could be argued that the rules in place could be changed to introduce malicious exploit if the lead dev(s) were motivated enough. Especially given GOS relatively top-down structure, relying essentially on a benevolent dictator. Even if I made the effort, then ascertain there was no vector attack, now I have to stay on alert every commit / release version and spend as much time looking for a targeted exploit ? etc... Update server setup might be clean, but an admin could SSH or gain access in some way or another and do rogue changes, were they determined enough. The probability is not zero.

Again, the problem is eroding the trust of the specific user (Rossmann in this case).
by pxeger1 | 2025-07-25 10:52:19+00:00
I think you'd be surprised how many people are actually in favour of this bill. Mainstream press totally fell for the "think of the children" angle pushed by a mixture of legitimate children's safety organisations, anti-porn activists, and intelligence apparatus. Meanwhile the privacy argument got little to no lobbying or public discourse.

E.g.:

https://www.theguardian.com/technology/2023/aug/15/digital-g...

https://www.telegraph.co.uk/news/2023/09/19/online-safety-ac...

It's how the (previous) government was able to look like it was doing something about the mental health crisis caused by social media, even though this bill won't fix that at all.
by detourdog | 2025-07-25 10:52:50+00:00
I consistently get the same phishing emails. From the headers I assume they are coming from a google service. I have been reporting them using google's reporting page for over a year.

https://support.google.com/mail/contact/abuse

Only in the last couple of weeks have a seen a decrease in one particular source. I always thought they were using a gmail mailing list service.
by underdeserver | 2025-07-25 10:53:50+00:00
This is a good place to mention profile-guided optimization.

In PGO you profile your application running in the real world (via automatic instrumentation) and the compiler uses the output to make optimization decisions.

I'm not sure what exactly they use it for, but I imagine it could be used for loop unrolling, switch case ordering, branch prediction optimization, memory ordering and more.
by SkiFire13 | 2025-07-25 10:54:11+00:00
> You are essentially asking what is safer than running arbitrary code from the internet

No, I'm asking what is a safer method when I want to install some code from the internet.

> The OS usually has guardrails and logging and audits for what is installed but this bypasses it all.

Not everything is packaged or up-to-date in the OS

> My mom recently got fooled by a scammer that convinced her to install remote access software.

Remote access software are packaged in distros too.
by jamessb | 2025-07-25 10:57:10+00:00
Nor have I; I think it is just what the developer of tree has chosen to call file descriptor 3, rather than being a wider convention or standard thing provided by the environment.

> As of version 2.0.0, in Linux, tree will attempt to automatically output a compact JSON tree on file descriptor 3 (what I call stddata,) if present

https://github.com/Old-Man-Programmer/tree/blob/d501b58ff9cb...
by hadley | 2025-07-25 10:58:16+00:00
We do discount heavily for academia: get 50% off for research and 100% off (i.e. free) for teaching. But I do get that our pro products largely solve problems that folks encounter in larger enterprises, and you may not see the value inside an academic department. I'm also always happy to learn how we could do better, please feel free to reach out to hadley@posit.co.
by _shadi | 2025-07-25 10:58:50+00:00
One theory that I saw earlier was that the industry is bloated, big tech companies executives knew that but they continued to hire anyway to make sure that the people they don't hire don't start competitors when there was funding, there is less funding now so that risk is no longer there so companies can reduce their size to their actual needs, but maybe that does not apply to intel since they seem to be really in a bad situation now.
by tlamponi | 2025-07-25 11:00:06+00:00
> now how do I log in to rewrite the ifcfg file when the interface wasn't brought up with the correct config because it has a different name?

Unlike most desktops, basically all servers got out-of-band management (e.g. IPMI) and a NIC swap is something that needs a tech physically near the server, so even a simple serial console is easily plugged in. Or how will that new NIC work with the whole network, like any basic networking setup or firewall won't allow traffic from arbitrary MACs, so normally this needs to be coordinated already anyway in an enterprise setting, e.g. through a change management process.

And why would one optimize the whole design for network naming for the edge case and not the much more common one like simple software updates.

And the design is not even being able to guarantee it for the edge case. Plugin that NIC in a different PCI slot, or let the firmware to a blip and report it differently–all things that happened!–and you still got no network with net naming scheme. Worse, you reboot after a systemd update, and you can have no network either. Or the kernel learns that your NIC supports virtual functions, guess what, no network because the (seemingly just-in-time) predictable naming scheme now sees that information changing its previous prediction.

I never will be able to understand how one can argue for breaking the common use case, nobody argues that there isn't a real problem or that there is the One True Way™ to solve it (at least I do not intend so), but arguing for using a certainly not ideal default that optimized for an edge case feels a bit like some sunk cost fallacy to me.

Sorry for my wall of text, I would really like to care less, but at $work I am exposed to this mess directly, not only for our infra but for all users of our projects, can all be done and managed, sure, but the churn and hours I have to put in thanks to this feels unnecessary and could be used for much more useful things.
Ask HN: Are you guys also observing Cursor deleting files without confirming?
by Mehuleo | 2025-07-25 11:00:56+00:00
https://arstechnica.com/information-technology/2025/07/ai-coding-assistants-chase-phantoms-destroy-real-user-data/

Nothing at this scale, in last two three days I am observing that Cursor feels a need to delete file which did not happen before. If this is a trend then I think they are retraining the user data and if users are not objecting some misbehavior then it becomes habit.

Just a hunch — and a bit of privacy concern.
by AngryData | 2025-07-25 11:01:39+00:00
I mean the people here are largely from the US. And while some politicians and the media likes to pretend gun ownership is something only deeply conservative rednecks hold to, it simply isn't true, gun ownership and the support of gun owner rights in the US crosses all political and social boundaries. And it makes perfect sense when you realize how few people in the US trust the cops, military, courts, or politicians to protect them from others, and they have seen the very real threats of many groups and organizations that have repeatedly put forth ideals of wanting to kill others for petty ideological bullshit.

On top of that you have to add in the important historical contexts weapons are involved in which garners peoples interest. And then there is the engineering ingenuity and craft involved in all the mechanics of how they operate and the {hopefully) fine machining and techniques used in creating them, the same way someone might marvel at the internals of different clocks or watches.
by bernoufakis | 2025-07-25 11:01:48+00:00
> Is it really a strawman? At some point, the code would need to identify rossmann. Please elaborate on the techniques required to do it and how it could be obfuscated.

I don't have to elaborate techniques. If a determined (and potentially mentally unstable) developer decides to leverage their full control over the OS to make it happen can. I don't have to elaborate on the techniques which might or might not exist yet. Stuxnet only targeted specific Iranian systems, a needle in a hay stack, was spread did not harm random devices across the globe, and stayed mostly undetected. And this was done without "developer access" to the software itself. Is it hard ? Yes. Is it likely (especially given the knowledge of how GOS works) ? Perhaps not. Is it impossible ? Definitely not.

When the lead dev of the OS you use daily threatens to "publicly expose you" as a user, I won't blame said user to stop using the software. And even less, to provide such data point regarding the behavior of that developer.
by ddtaylor | 2025-07-25 11:01:52+00:00
I actually have had the FBI seize all of my Google account materials before when I was convicted of computer hacking. The search took place in 2016 and 2018 as they came back and took everything a second time.

Anyhow, they don't do it at all like this. I would have to check my discovery for some details and it's in cold storage, but they basically just send an e-mail to a specific department at Google and have that communication. They go through a decent amount of trouble to try to NOT tip you off.
by bre1010 | 2025-07-25 11:01:53+00:00
Completely agree. People lament the death of the RTS genre for all kinds of reasons but I think the biggest one was the early-2000s switch to 3D. Performance considerations meant you have way fewer units. The only exception was that Supreme Commander was somehow able to get around this, but suffered heavily from the second big problem with 3D RTSes: the tiny unit models are so much harder to tell apart in 3D compared to 2D.

The RTS switch to 3D was a mistake and I think RTSes will continue to fail until their developers realize what actually makes them fun is actively hindered by this technology.
by nilslindemann | 2025-07-25 11:02:30+00:00
I have just tried this with a fresh Firefox and `privacy.resistFingerprinting` set to True, still this site detects me, and coveryourtracks.eff.org tells me "Your browser has a unique fingerprint". Speak, I can not reproduce the results of this article. Can you?

Edit: Have also set all other `fingerprinting` bools to False. uBlock, uMatrix, Privacy Badger installed.

Under Settings → Privacy and security: Enhanced Tracking Protection = strict. Tell websites not to sell or share my data. Delete cookies and site data when Firefox is closed. Enable HTTPS-Only Mode in all windows. Enable DNS over HTTPS using: Max Protection – I still can be detected.

Edit 2: Just tried with Brave, strictest settings. No effect, I am detected.

Edit 3: Tor works.
by SkiFire13 | 2025-07-25 11:02:48+00:00
> Actually, my memory is that while the language had syntax to declare garbage collected pointers, it wasn't actually hooked up to a proper garbage collector. It was always more of a "we are reserving the syntax and we will hook it up when needed", and it turns out the ownership system was powerful enough that it was never needed.

AFAIK it was just an `Rc`/`Arc` with the possibility of upgrading it to an actual GC in the future.
by grumbelbart2 | 2025-07-25 11:04:52+00:00
Just wondering how SQLite would ever work if it had zero control over this. Surely there must be some "flush" operation that guarantees that everthing so far is written to disk? Otherwise, any "old" block that contains data might have not been written. SQLite says:

> Local devices also have a characteristic which is critical for enabling database management software to be designed to ensure ACID behavior: When all process writes to the device have completed, (when POSIX fsync() or Windows FlushFileBuffers() calls return), the filesystem then either has stored the "written" data or will do so before storing any subsequently written data.
by criley2 | 2025-07-25 11:05:25+00:00
I highly doubt it. Taiwan would destroy their own fabs before someone else did. But that's likely unnecessary, China would be unable to operate the fabs anyway and they've already stolen the relevant information and are trying to recreate it. TSMC would get their experts out of the country and their trade partners would simply stop supplying the vital materials.

And mututally assured destruction has nothing to do with the US destroying an industry in Taiwan. MAD specifically refers to the idea that superpowers cannot engage in nuclear war against one another without also being destroyed themselves, because of a Nuclear Triad.

For "Mutually Assured Destruction" to be in anyway applicable, you'd have to say that the second that the US destroyed "Chinese" fabs (Taiwan), China would destroy American fabs. Thus, the US would not attack China without risking itself. The US making targeted strikes on Taiwan is one sided destruction. But to be clear: MAD doctrine is specifically about fullscale thermonuclear war.
by phoronixrly | 2025-07-25 11:05:30+00:00
Oh, I see. I disagree that the original HZD had a pretense of realism though. The remastered version does and well illustrates the uncanny-ness https://www.youtube.com/watch?v=IlWK_ELBW08 . The outrageous god rays, bloom and lens flare in the remaster compensate for that because you can't actually see anything due to them blinding you...
by jcul | 2025-07-25 11:06:55+00:00
Revolut works perfectly for me.

What kind of issues did you have? I think it does require google play services (which can be installed easily).

I have used GOS on a pixel 6 for the past two years with no issues. The phone finally died on me last weekend, so I'm in the market for a new pixel which will be getting GOS right away.
by keybored | 2025-07-25 11:07:07+00:00
The West lives under semi-democracy (partial oligarchy) and exports autocracy.[1] It’s fine for us to prefer to live here (I do; well it’s what I know) but we can’t claim the moral highground (not that anyone in this thread has done that necessarily).

[1]: Why are these countries “autocracies”? To better resist foreign intervention.
by middayc | 2025-07-25 11:07:58+00:00
But didn't LLMs read all the math books and can't really do arithmetics (they need special modes / hacks / python to do it I think)?

So why would they be able to "read" the docs and use that knowledge except up to pattern matching level. That's why I also assume, that tons of examples with results would do better than lang docs, but I haven't tested it yet.
by oktoberpaard | 2025-07-25 11:08:41+00:00
It gives weird results for me. I’m using Qwen3-32B with 32K context length at Q4_K_M, with 8 bit KV cache fully offloaded to 24GB VRAM. According to this calculator this should be impossible by a large margin, yet it’s working for me.

Edit: this might be because I’ve got flash attention enabled in Ollama.
by amterp | 2025-07-25 11:08:44+00:00
Modern cmd line scripting is an interesting area and I like seeing people's different approaches to improving it. Personally, I want to get as far away from writing control flow, loops, etc in Bash as I can. I'm working on https://github.com/amterp/rad which is a CLI scripting language that takes a more Python-like approach, which people here might find interesting, though it serves slightly different cases than Modernish.
by raxxorraxor | 2025-07-25 11:09:00+00:00
This information can be relevant for a site that needs to know your capabilities. No need to render some canvas if your client is a text browser.

It isn't trivial to craft legislation to separate these use cases, but it also is far from impossible if there would be political will to do it.

I think the latter is far more interested in surveillance of users where tracking is one building block.

And of course legislation is needed to criminalize tracking without user consent. It would just be an internet stalking law being applied.
by mschuster91 | 2025-07-25 11:09:14+00:00
A "flush" command does indeed exist... but disk and controller vendors are like patients in Dr. House [1] - everybody lies. Especially if there are benchmarks to be "optimized". Other people here have written up that better than I ever could [2].

[1] https://house.fandom.com/wiki/Everybody_lies

[2] https://news.ycombinator.com/item?id=30371403
by gerikson | 2025-07-25 11:09:56+00:00
> Okay, apparently the stddata addition is causing havoc (who knew how many scripts just haphazardly hand programs random file descriptors, that's surely not a problem.)

I knew, and I've known since reading the "C shell considered harmful" paper, which offhandedly mentioned that sh-based shells can use an arbitrary number of file descriptors (maybe they have to be one-digit integers though). csh can't, of course.

It's discussed in the first section here

https://harmful.cat-v.org/software/csh
by TechRecruiting | 2025-07-25 11:10:04+00:00
We are currently looking for a skilled & passionate Senior Fullstack Engineer (m/f/d) with the focus on the backend) to support our ABOUT YOU Partner Portal onsite in Hamburg or Berlin.

Our ABOUT YOU Partner Portal is part of the Supply Tech Unit and is a single point of contact for the entire partner journey across operating models incl. several features and dashboards that enable partners to monitor and manage their business easily.

What you will do - Build high-traffic web applications with Vue.js and PHP (Laravel)

- Working autonomously and taking ownership of the ABOUT YOU Partner Portal

- Engage in decisions ranging from UI/UX Design to Backend architecture together with the Head of Engineering and explore new technologies

- Build internal & external RESTful API as well as beautiful user interfaces

- Work with agile processes that are adapted to the team’s needs

- Exchange your knowledge with other developers and be part of our ABOUT YOU TECH community

- Lots of space for your own ideas and creations, flat hierarchies and very short decision-making process

Who you are

- Proficient & MVP-focused coding skills in Laravel

- Practical & recent experience with Vue.js

- Good technical understanding of RESTful APIs

- Experience with translating business requirements in functional and beautiful user interfaces

- Passionate about writing well-structured, efficient and maintainable code, actively keeping the quality of the code base in check

- Used to work in an English-speaking environment

YOU ARE THE CORE OF ABOUT YOU. We take responsibility for creating an inclusive and exceptional environment where all genders, nationalities and ethnicities feel welcomed and accepted exactly as they are. We believe that a diverse workforce essentially contributes to the ABOUT YOU culture. In order to maintain talent and diversity, we emphasize the care for physical health, mental health and overall well-being. Our values and work ethics essentially contribute to our brand mission: empower acceptance and shape an inclusive, fair and circular fashion culture.

We are looking forward to receiving your application – preferably via our online application portal! Thus, we can ensure a faster process and for you it is very easy to upload your application documents.
by bernoufakis | 2025-07-25 11:10:15+00:00
> This isn't even possible given how updates on GrapheneOS work. The update client doesn't send identifiers to the update server, and the update server only hosts static files.

> Rossmann either doesn't understand this, or he made it up to get more views, or possibly to entertain fellow Kiwi Farms members.

Expecting a layman to know that is not reasonable. The argument is not about the GOS updates work in practice. It is about the "perpection", from Rossmann's perspective that the lead dev of the OS is hostile against him. Humans are not purely rational machines, and given the choice of either 1) spend hours auditing source code and updates pipelines (every release ?) and 2) stop using it for critical purpose, the latter is the easier choice, especially for a busy person like him.

> To be honest, I don't think that he didn't understand that he couldn't be targeted. He continued using GrapheneOS for months after the video. As I understand it, it was clear in a few videos months after the initial video was published.

For all we know, he is using it on his secondary device where he has removed what he deems critical. Again, Rossmann NEVER said "don't use Graphene OS", or "Graphene OS lack security" or anything of the sort. If anything, even after that video, he kept recommending GOS whenever he talked about privacy.

His argument is that he did not feel safe knowing using software from a hostile developer; and that he can't be bothered / not qualified to audit the code well enough to make it worth it (which is reasonable if you ask me, and I dare say most people).

Edit: > Rossmann either doesn't understand this Again, I agree with you here. He does not understand. He trusted the developer(s) to know what they are doing, but they broke that trust by being unreasonable, to say the least. He is under no obligation to understand. As for what you stated after that, I won't comment on it as I don't read minds, and pretty sure neither do you.