MurphyA/hacker-news huggingface dataset:
by tabbott | 2025-07-09 18:15:17+00:00
I think this is a dangerous view. As we've seen with the libxz attack, skilled developers are very capable of hiding backdoors/vulnerabilities in security software, even when it is open source. So it's very important whether the developers building the software are trustworthy.

Authoritarian jurisdictions with a modus operandi of compelling their businesses and citizens by force are thus much riskier than Western democracies, even flawed ones. I at least expect it's a lot harder to say no to demands to break your promises that come with credible threats of torturing your family.

I'll also say that it's quite hard to make a messaging app without the servers that run the service having a great deal of power in the protocol. Many types of flaws or bugs in a client or protocol go from "theoretical problem" to "major issue" in the presence of a malicious server.

So if end-to-end security is a goal, you must pay attention to not only the protocol/algorithms and client codebase. The software publisher's risks are important (E.g., Zoom has a lot of risk from a China-centric development team). As are those of the hosting provider (if different from the publisher).

And also less obvious risks, like the mobile OS, mobile keyboard app, or AI assistant that are processing your communications even though they're sent between clients with E2EE.

Reflections on Trusting Trust is still a great read for folks curious about these issues.
by toomuchtodo | 2025-07-09 18:15:26+00:00
LFP stationary battery storage appears to be at ~$52/kWh in China [1] (compare to $181 in 2018 per Our World in Data). California buys a lot of stationary storage from Tesla though, which is preparing to start production at the new Sparks, NV LFP cell production facility [2]. Ford is building their own facility in Michigan [3], with 35 GWh of capacity.

[1] https://reneweconomy.com.au/watershed-moment-big-battery-sto...

[2] https://electrek.co/2025/07/01/tesla-unveils-lfp-battery-fac...

[3] https://electrek.co/2025/06/25/ford-stands-by-controversial-...
by SahAssar | 2025-07-09 18:16:05+00:00
> Considering that it the db isn't public and the disclosures are listed at the bottom, before the publication, this is mostly white hat and helps the company they target

The never disclosed to the target company (not that I think they should have), this is definitely not white hat. This is essentially the grey-hat version of vigilantism.

They disclosed it to a journalist and now on their blog.
by Irongirl1 | 2025-07-09 18:16:05+00:00
I think it was 30 years ago now, but I could be off by a few. My mother "insisted" on me signing up for an infomercial product for her...I offered to buy it outright (it was in stores for less than the deal they were offering and deliver it personally) she declined and kept insisting. I did so and signed up for 1 shipment. They charged me for months afterwards and put my checking account, to which the card was tied into overdraft and refused to refund. I was lucky because I was at a small bank which still had personal bankers and she was kind and reasonable. She reversed the charges for me and got me my money back. That company stole my grocery money and didn't blink an eye.

Again: this was at least 30 years ago. Nothing was changed. The companies that take advantage are still taking advantage and the government is facilitating theft, fraud and tons of stress on those who can ill afford it. It is a major issue also for seniors who constantly get trapped in this crap. They tie people up with confusing forms and jargon and make it impossible. They have no shame. Check Rip-off Reports, if they are still allowed to exist, or webarchive...the stories are awful. It's past time for people to be able to stop this thru their cards or tactical action. The cost to pay a lawyer to fight this kind of crap also falls on the person who files-think travel if they are out of state...most of these companies are based miles away and know that people can't afford to fight them.
by turtlebits | 2025-07-09 18:16:35+00:00
I have several Aqara temp/humidity sensors that intermittently lose connection. They don't affect the operation/stability of the rest of the HA platform and is not a problem with HA, as my other zigbee devices that report the same data work fine.

I should probably just remove them, but I don't have any automations that depend on them.
by cameronh90 | 2025-07-09 18:16:45+00:00
Some USB zigbee dongles can be flashed to be "multi-PAN", but my experience is it's currently buggy and I would let them bake that for a bit longer.

Alternatively, both Sonoff and Home Assistant do a thread dongle for about $30 that you can use simultaneously with a zigbee one. Plus if you have any of the following, they can be used as a Thread border router: Apple TV, HomePod, Echo G4, Eero 6/7, Nest Hub, Nest Wifi, Google TV Streamer. There's also the OpenThread Border Router which can be used on certain ESP32 hardware (ESP32-S3 for $10 or ESP32-H2 for $6?) but that obviously requires more work.
by wstrange | 2025-07-09 18:17:52+00:00
> Clients can be almost automatic with a HATEOS implementation, because it is a self describing protocol.

That was the theory, but it was never true in practice.

The oft comparisons to the browser really missed the mark. The browser was driven by advanced AI wetware.

Given the advancements in LLMs, it's not even clear that RESTish interfaces would be easier for them to consume (say vs. gRPC, etc.)
by bell-cot | 2025-07-09 18:18:26+00:00
For those unfamiliar - that's one "D" judge, out of 17 judges on this court. And that one "D" wasn't one of the three judges hearing this case.

And yet the three "R" judges who were (hearing this case) chose to editorialize in their opinion ( https://storage.courtlistener.com/recap/gov.uscourts.ca8.110... ) about how the FTC was the Good Guys here...just hopelessly incompetent Good Guys.

(Yeah, it seems trivial to argue that the Dem's are also hopelessly incompetent - at getting "D" judges onto Federal Court benches.)
by michaelsbradley | 2025-07-09 18:18:59+00:00
If you're doing well-formed RPC over POST, as opposed to ad hoc RPC (which, let's be honest, is the accurate description for many "REST" APIs in the wild), then requests and responses should have something like an `id` field, e.g. in JSON-RPC:

https://www.jsonrpc.org/specification#request_object

Commonly, servers shouldn't accept duplicate request IDs outside of unambiguous do-over conditions. The details will be in the implementations of server and client, as they should be, i.e. not in the specification of the RPC protocol.
by ajross | 2025-07-09 18:19:18+00:00
HTML as a mail format is a horrifying mess. What you want is a rich text format for displaying static text and maybe some images and links and stuff. What we got is the entirety of the modern web application development environment stuffed into our mail clients, with maybe 1/100th the attention to standards compliance and bug fixing that real browsers get, and a metric ton of "Oh Wait Not That" workarounds to plug the obvious security gaps inherent in the "run web apps from any attacker who has your email address" metaphor.

This is one of the big reasons why email has pretty much died for casual use. Even in work environments almost everyone uses chat clients these days.
by turtlebits | 2025-07-09 18:19:23+00:00
For my flaky devices, it it not a manufacturer integration, but over Zigbee. It's definitely the device as my other Zigbee devices are solid. Others have reported issues with the device in question (Aqara Temperature and Humidity Sensor)

I ran the docker version on a QNAP for a long time, now on a Home Assistant Green.
by olalonde | 2025-07-09 18:19:41+00:00
You have a distorted view or reality. Elon seems pretty happy to me and is undeniably successful in business - arguably the most successful entrepreneur of our time. I don't know much about his personal life but I suspect that him having babies with multiple women is due to personal choices rather than a sign of misfortune. He certainly doesn't seem "off the rails" to me. That said, I can understand that his lifestyle is not for everyone.
by aroojjaved | 2025-07-09 18:20:07+00:00
I wrote this piece to share hands-on, no-code JIRA automation examples that helped real teams reduce manual work, speed up ticket handling, and stay on top of SLAs — without writing a single line of code.

If you’re in tech support, product, or project management, you might find these examples useful to streamline repetitive workflows using native JIRA rules.

Feedback welcome — and happy to hear how others are automating with JIRA!
by jakeydus | 2025-07-09 18:20:14+00:00
That's what I thought too, but from the ruling in the article, it seemed like the justification came from calculating the cost to implement (emphasis on 'compliance costs'.

> But an administrative law judge later found that the rule's impact surpassed the threshold, observing that compliance costs would exceed $100 million "unless each business used fewer than twenty-three hours of professional services at the lowest end of the spectrum of estimated hourly rates," the 8th Circuit ruling said.
by akarlsten | 2025-07-09 18:20:24+00:00
Poorly made slop aside, your framing of this just makes it look and sound like you're extremely bitter over losing a hackathon (?) to this guy. I think you should've focused on the company solely and dropped the snide and sarcastic references calling the CEO/dev a "hero" or "mastermind". It's not particularly mature or productive.
by fusslo | 2025-07-09 18:20:24+00:00
I grew up in Connecticut. I always thought we had to travel to Boston, Philadelphia, or NYC to see great art.

Then, after I moved halfway across the country I learned about The Hill-Stead museum, the Wadsworth, Florence Griswold museum, New Britain Museum of art, Yale, and even Uconn

Now, I'm kinda melancholy about missing out on these experiences
by jcalvinowens | 2025-07-09 18:21:04+00:00
> On the one hand, compilers would like to exploit the strong guarantees of the type system—particularly those pertaining to aliasing of pointers—in order to unlock powerful intraprocedural optimizations.

How true is this really?

Torvalds has argued for a long time that strict aliasing rules in C are more trouble than they're worth, I find his arguments compelling. Here's one of many examples: https://lore.kernel.org/all/CAHk-=wgq1DvgNVoodk7JKc6BuU1m9Un... (the entire thread worth reading if you find this sort of thing interesting)

Is Rust somehow fundamentally different? Based on limited experience, it seems not (at least, when unsafe is involved...).
by SahAssar | 2025-07-09 18:21:14+00:00
> You could certainly do a reverse proxy and use HTTP instead of FastCGI as the protocol between the client facing httpd and the application server

That's what I meant. Things like X-Sendfile (or X-Accel-Redirect in nginx) works with http backends. Why involve a different protocol to transfer a HTTP request to a backend instead of... HTTP? I really don't get the point of FastCGI over plain HTTP when a reverse proxy is talking to a upstream backend server.
by cameronh90 | 2025-07-09 18:21:38+00:00
It is still somewhat annoying for those of us with solid walls.

I can't just add a new Thread device at the other side of my house as the walls attenuate the signal between it and the border router. Equally I can't start replacing Zigbee devices willy-nilly in case I create Zigbee dead zones.

Not the biggest problem in the world but it does mean I'll likely need to get some pointless Thread smart plugs as temporary network extenders when I add my first Thread device.
by vinhatson | 2025-07-09 18:21:44+00:00
This comprehensive security report investigates unpatchable vulnerabilities in Windows 10 and 11, focusing on systemic flaws that resist traditional patching due to their deep integration into the operating system’s architecture, hardware dependencies, and legacy compatibility require ments. These vulnerabilities, rooted in fundamental design choices and ecosystem constraints, pose significant challenges to securing millions of Windows devices worldwide. The report ex amines three critical vulnerabilities: legacy BIOS/UEFI firmware weaknesses, kernel memory management flaws, and backward compatibility with legacy protocols. It provides a detailed technical analysis, exploitation vectors, detection challenges, and comprehensive mitigation strategies. With Windows 10 approaching its end-of-support deadline in October 2025, these flaws pose heightened risks, necessitating proactive defenses. This report adheres to responsi ble disclosure principles and aims to support Microsoft’s efforts to strengthen Windows security in 2025.
by cosmic_cheese | 2025-07-09 18:22:17+00:00
Something that I believe is dragging down “mass audience” sorts of distros like Zorin is that they’re only Windows-like in a vague sense, leaving them in an “uncanny valley” of sorts. One of these distros really needs to commit to the bit of Windows-like-ness so it’s a seamless drop-in to the greatest degree possible.
by PaulHoule | 2025-07-09 18:22:19+00:00
SOAP, CORBA and such have a theory for everything (say authentication) It's hard to learn that theory, you have to learn a lot of it to be able to accomplish anything at all, you have to deal with build and tooling issues, but if you look closely there will be all sorts of WTFs. Developers of standards like that are always implementing things like distributed garbage collection and distributed transactions which are invariably problematic.

Circa 2006 I was working on a site that needed to calculate sales tax and we were looking for an API that could help with that. One vendor uses SOAP which would have worked if we were running ASP.NET but we were running PHP. In two days I figured out enough to reverse engineer the authentication system (docs weren't quite enough to make something that worked) but then I had more problems to debug. A competitive vendor used a much simpler system and we had it working in 45 min -- auth is always a chokepoint because if you can't get it working 100% you get 0% of the functionality.

HTTP never had an official authentication story that made sense. According to the docs there are basic, digest, etc. Have you ever seen a site that uses them? The world quietly adopted cookie-based auth that was an ad-hoc version of JSON Web Tokens, once we got an intellectually coherent spec snake oil vendors could spam HN with posts about how bad JWT is because... It had a name and numerous specifics to complain about.

Look at various modern HTTP APIs and you see auth is all across the board. There was the time I did a "shootout" of roughly 10 visual recognition APIs, I got all of them working in 20-30 mins except for Google where I had to install a lot of software on my machine, trashed my Python, and struggled mightily because... they had a complex theory of authentication which was a barrier to doing anything at all.

Worse is better.
by andoando | 2025-07-09 18:23:13+00:00
The defined behaviors are not so well defined for more complex APIs.

You may have an API for example that updates one object and inserts another one, or even deletes an old resource and inserts a new one

The verbs are only very clear for very simple CRUD operations. There is a lot of nuance otherwise that you need documentation for and having to deal with these verbs both as the developer or user of an API is a nuisance with no real benefit
by larve | 2025-07-09 18:23:30+00:00
This take is toxic. You could write the same article in 2001 and lament all the newcomers writing insecure applications in php3, or in 2009 with all the newcomers writing insecure applications with node.js.

The solution is not to aggressively shame people into doing things the way you learned to do them, but to provide not just education and support, but better tools and frameworks to build applications such as these securely.

What are we doing?
by some_furry | 2025-07-09 18:24:45+00:00
> I think this is a dangerous view.

I think you misinterpreted the most important nuance in this post. The rest of your comment is about jurisdiction in the context of who develops the client software.

The blog post is talking about jurisdiction in the context of where ciphertext is stored, and only calls that mostly irrelevant. The outro even acknowledges that when jurisdiction does matter at all, it's about the security of the software running on the end machine. (The topic at hand is end to end encryption, after all!)

So, no, this isn't a dangerous view. I don't think we even disagree at all.
by testfrequency | 2025-07-09 18:25:24+00:00
Between my network ad blocker and VPN, I’m lucky for an email that is anything beyond formatted text to render properly anymore.

I’ve practically given up on clicking any sort of links from marketing emails as they are full of multiple redirect trackers. Which, is a shame, as these are obviously from companies I care to keep up with and support.

Email will always have its place, but I agree the default email experience we all know shouldn’t default to essentially a viewport.
by zukee | 2025-07-09 18:25:26+00:00
Clerq | Senior/Staff Engineer | onsite (NYC) | https://clerq.io

Clerq is a NYC based fintech startup building the next generation platform payments platform delivers a seamless checkout experience for high-ticket transactions. By leveraging modern bank rails, the platform offers the conversion and UX benefits of cards with risk and money movement infrastructure purpose-built for large purchases. Clerq replaces outdated manual payment methods like cash, checks and wires and expensive card surcharges with a smooth, integrated solution that helps merchants convert more customers without sacrificing margins.

We have started with the $1T+ U.S. auto vertical, where our platform is already powering payments for several of the most recognized brands in the industry. With proven traction, the company has expanded into high-growth adjacencies including high-ticket e-commerce, private travel and powersports.

We are a lean team right now of 3 engineers so are looking for a senior or staff level engineer who is excited by big opportunities and eager to ship.

Stack: Python/Django, React, Nodejs, AWS Comp: $180-210k + Equity

Email me at nick@clerq.io if you are interested in hearing more!
by throwaway150 | 2025-07-09 18:25:54+00:00
This maybe an unpopular take but I think there's a place for kindness, and there's a place for naming-and-shaming, and I think this is the case for the latter! Unless we name-and-shame utter and wilful negligence like this, our industry is headed for rock bottom.

Any service making money by collecting user data owe it to themselves and to their users to to conduct at least a basic security audit of its product. Anything less borders on criminal negligence. I don't think such a blatant failure to uphold users' trust deserves kindness.
by happytoexplain | 2025-07-09 18:26:05+00:00
This is unrealistic and dangerous. The "lacking critical thinking skills" is the liberal version of the conservative's "lazy" accusation. I.e. it's used as a scapegoat that downplays human nature by characterizing a problem as a personal fault that needs not be respected because either: 1. It's your fault, so why should I care (the conservative opinion); or 2. Should simply be fixed, with education (the liberal opinion). Both are un-pragmatic and harm society by implying we can simply alter or ignore the average person, who is the victim of the problem, rather than address the problem directly. As a reminder, the average person is what civilization is composed of.
by an0malous | 2025-07-09 18:26:12+00:00
The dolls in that article were confiscated in the mail and are made for tourists. The creator of those dolls has explained this already, and they are unrelated to the bodies discovered near Ica.

Here’s an X-ray comparison between the two where it’s very obvious that there’s a difference between the modern dolls and the archaeological discoveries:

https://x.com/_stranger357/status/1805272924640682036

Even if you’re incredulous that these bodies were living creatures, no one disputes their carbon dating of 500-1500 years old and this has been confirmed by multiple labs. It’s not possible to construct bodies from biological material that is that old, so if they were constructed it would have to have been done by ancient Peruvians. This begs the question of why ancient Peruvians were making constructions of beings that look remarkably similar to modern aliens as described by UFO experiencers:

https://x.com/_stranger357/status/1804973689567326435

The archaeological discoveries are being studied by the University of Ica and other South American scientists across many disciplines. The South American cultures also have a long history of depicting tridactyl beings in their artworks, there are hundreds of examples but here’s one:

https://x.com/_stranger357/status/1789875845542076808

So it’s really quite ridiculous to suggest this is disrespectful to Peruvians. Their own culture describes these creatures, and their scientists are the ones promoting the authenticity of the bodies. You’re just propagating ignorance.

Skepticism has turned into a religion, the rational perspective here is that we have a genuine mystery that needs further investigation.
by MetaWhirledPeas | 2025-07-09 18:26:30+00:00
> Funny how ChatGPT is vanilla and grok somehow has a new racist thing to say every other week

To be fair, 'exposing' ChatGPT, Claude, and Gemini as racist will get you a lot fewer clicks.

Musk claims Grok to be less filtered in general than other LLMs. This is what less filtered looks like. LLMs are not human; if you get one to say racist things it's probably because you were trying to make it say racist things. If you want this so-called problem solved by putting bowling bumpers on the bot, by all means go use ChatGPT.
by cyberax | 2025-07-09 18:26:32+00:00
Just use gRPC or ConnectRPC (which is basically gRPC but over regular HTTP). It's simple and rigid.

REST is just too "floppy", there are too many ways to do things. You can transfer data as a part of the path, as query parameters, as POST fields (in multiple encodings!), as multipart forms, as streaming data, etc.
by overfeed | 2025-07-09 18:26:34+00:00
> I think the popularity dropped after the takeover in Europe

It wasn't the takeover, it was splitting SUSE linux into a paid stable/supported distro and a testing/community distro, like Red Hat had just done with RHEL/Fedora. Unlike Red Hat, SUSE didn't have the critical mass to force the community to be guinea pigs for paid customers, and it withered as folk switched to other distros, including the hot new entrant: ubuntu.
by yjftsjthsd-h | 2025-07-09 18:26:36+00:00
> It's "closed" in the same way that all open wireless standards (Wi-Fi, Bluetooth, etc.) are closed. You can read the spec, use the open source SDK, and build devices without paying a cent.

My understanding - correct me if I'm wrong - is that it's not quite the same; I'm pretty sure you can make a wifi card on your own (maybe modulo FCC approval, but that's true of any radio) and you might not be allowed to put an official wifi logo on it without a license but it'll work without needing to see an officially signed cert or the user having to touch developer settings.
by jauntywundrkind | 2025-07-09 18:26:55+00:00
I've been quite happy with -boot, -networkd, -resolved. -logind too, what a powerful upshift in routing input.

I forget what but timesync is missing a lot of nice to haves. But ditching grub for something much much much more manageable & a joy to use. Networkd and resolved have both had a lot of nice clear straightforward options, and I love how systemd unit files snap together for these networking concerns.

Journald has been ok for me, and I use it a lot, but not intensively. Having adequate performance is definitely a huge concern.
by mikestew | 2025-07-09 18:27:07+00:00
I believe the headline to be inaccurate, and the real problem is that “A. I. is making sure you pay for dings that don’t exist”.

Or IOW, AI is making shit up again, and you’re going to pay for it as part of the agreement that you didn’t read because you just want to get your car and get to your hotel.