MurphyA/hacker-news huggingface dataset:
by wahern | 2025-07-28 12:59:31+00:00
> This is a horrifically bad take

I took it as a take on the face of the proposal: "hackers should have strong legal protections so long as they report any security vulnerabilities that they find."

As stated, it's ripe for abuse. Perhaps they could have been more charitable and assumed some additional implicit qualifiers. But defining those qualifiers is precisely the difficult part, perhaps intractably difficult.

In the US private investigators often require a license to work, but AFAIU that license doesn't actually exempt them from any substantive laws. Rather, it's more a mechanism to make it easier for authorities and citizens to excuse (outside the legal process) otherwise suspicious behavior.

Rather than give special protections to a certain class of people, why not define the crimes to not encompass normal investigative behaviors typical in the industry. In particular, return to stronger mens rea elements rather than creeping in the direction of strict liability. Adding technical carveouts could end up making for a harsher system; for example, failing to report in an acceptable manner (when, what, where, how?) might end up sealing the fate of an otherwise innocent tech-adept person poking around.
by rendaw | 2025-07-28 13:00:28+00:00
Okay, I'm inclined to agree here, but what I don't see addressed is: If you set up an account with a username and password, then write it down on a slip of paper, and then drop that in a cafe, and someone else logs in as you and drains your account, is the bank liable for that too? Are all services with logons? But that looks identical to identity theft in a lot of ways.

If bank mandated security controls are breached, or they don't provide adequate controls, I feel like that that's on them. But if they've done their part and you've been irresponsible then that's on you. But where's the dividing line? And saying the banks have more responsibility can also justify more biometrics and surveillance.

Is the differentiating factor here that the bank (or whatever) is allowing access with insecure credentials (name, date of birth, phone number) instead of the primary credentials?
by phtrivier | 2025-07-28 13:00:32+00:00
I don't understand how the poster of the message goes from the disclaimer tet:

> The current release provides only basic functionality, with several key features to be introduced in future versions, including:

> - App and device verification based on Google Play Integrity API and Apple App Attestation

> - Additional issuance methods beyond the currently implemented eID based method.

> These planned features align with the requirements and methods described in the Age Verification Profile.

to the "In the case of Android, genuine means"...

I don't see the word "genuine" in the disclaimer. Is that a necessary part of using the "Google Play Integrity API" ?

(I'm genuinely asking, I feel like I'm missing some implicit context here.)
by woadwarrior01 | 2025-07-28 13:00:38+00:00
I'm currently polishing up an on-device app that I wrote for myself a few months ago to safely expand shortened links and to get rid of tracking parameters from URLs and QR codes for release as a free app (https://cleanlinks.app).

My other app (https://slopornot.app , an on-device AI generated text and image detector) has been stuck in App Store review limbo for almost a month now. Probably because it's an on-device ML app and not another OpenAI API wrapper, which seem to get approved by Apple, really fast. ¯\_(ツ)_/¯
by vulkoingim | 2025-07-28 13:00:49+00:00
I got tired of Spotify recommending me, or creating playlists with the same songs over and over again, so I built something to make varied, targeted playlists from my library.

I've been using it for months now, and the playlists generated are my top listened to playlists - I'm literally listening to them every day. Personally I'm super happy with it, and a few friends have also been using it quite successfully.

https://riffradar.org/
by griffzhowl | 2025-07-28 13:00:59+00:00
Most of the land in question isn't a mature ecosystem in equilibrium, and if it is there are other arguments against turning that into cornfields. But let's say the worst case is that it's carbon neutral.

The point is that biofuel production isn't carbon neutral. Maybe it could be theoretically, but in practice it takes energy inputs in the production process like in the fertilizers, processing of crop into fuel, and transport/distribution, which makes it net positive for atmospheric carbon.
by azath92 | 2025-07-28 13:01:05+00:00
Continuing to work on https://www.hackernews.coffee/ to rerank the HN frontpage based on my interests, not just what's trending.

It does this by building a profile out of a small number of selected past articles, and we make the profile and how it produces recs from the profile transparent and editable. Especially after feedback on HN (https://news.ycombinator.com/item?id=44454305), Im trying to get to grips with why people seem to care as much about seeing how their recommendations work as they do about the actual quality of recommendations themselves.

I'm increasingly convinced its due to how many opaque LLM-powered everything and black-box recommendation algorithms there are. People want personal content systems (they are useful for sure!), but theres a lack of ones where they stay in control of what 'personal' actually looks like.
by fluidcruft | 2025-07-28 13:01:13+00:00
Well you should understand that trusting media is not part of how modern encryption works. Having access to USB isn't any different from having access to a network switch or the airwaves. Things like yubikeys and smartcards are designed to work when using untrusted devices.

The question is how do you convince other people to trust your phone to store their secrets--not how do you yourself come to trust your own device to store your own secrets. And if you can't convince others your device is secure (i.e. "why the hell would I trust you and your phone to store my password?"), then just use something they can trust instead. I'm not saying EU is going to allow whatever, I'm just saying it's not a huge technical or usability problem to rely on something the EU should be able to trust (like a yubikey) if the EU can't trust your phone.
by andrepd | 2025-07-28 13:01:29+00:00
It's already close to impossible. Banking apps and government apps are close to mandatory to function in today's society, yet they plain do not work on Lineage, even with microg, or they work but need ridiculous workarounds. Never mind other "soft mandatory" things like messaging apps or whatever.

I'm dedicated and I have a literal PhD in computer science, yet I'm fucking exhausted fighting this battle all the time. 0.1% chance someone has the capability to, and willingly goes through all this bother.

Then tfa is just a nail in the coffin.
by bobmcnamara | 2025-07-28 13:02:08+00:00
This is the first notable, semi-reputable Google result for each "${COMPANY_NAME} data breach". Some of these are examples of an API being leveraged to exfiltrate database records rather than direct database breaches like getting the admin password to postgres.

If you want to see more for the same company, try appending "-{YEAR_OF_KNOWN_DATA_BREACH}" to skip the ones you've already read, though this will tend to exclude companies who have multiple data breaches in one year.

https://en.m.wikipedia.org/wiki/2018_Google_data_breach

https://www.npr.org/2021/04/09/986005820/after-data-breach-e...

https://support.microsoft.com/en-us/topic/national-public-da...
by JKCalhoun | 2025-07-28 13:02:31+00:00
I went into the article assuming we were talking about the (illegal) Mobile Infrared Transmitters (MIRTs?) that were something like the phreaker "boxes" (somehow I thought they were called "Chrome boxes" but I can't find a reference now). (I'm pretty sure the U.S. emergency vehicles still have those — for which of course they are legal.)
by ethbr1 | 2025-07-28 13:02:50+00:00
The key result from talking to the relevant parties pre-publication is that it usually enriches the story.

Even if someone is blatantly trying to deny or turn the story, they may give you information you didn’t have before (and that they were unlikely to give you absent publication pressure).

It’s a superpower to be able to say ‘I have words written. Now what would you like to tell me?’
by bluGill | 2025-07-28 13:03:04+00:00
There is a lot of great music written before the classical period that used unorthodox keyboards. Quarter comma mean tone with 15 notes per octave instead of today's 12 was fairly popular and a lot of music from then doesn't sound right on modern keyboards. For that matter much modern music sounds bad but we are used to it. (and 15 notes per octave is a compromise itself, but they didn't know how to build micro tonal keyboards)
by hajile | 2025-07-28 13:03:40+00:00
Jscript was the most evil of all the JS implementations. It's the reason why MOST of the thing people hate about JS are still in the language.

They wanted to remove a bunch of the badly-designed stuff from the language, but MicroSoft had just finished implementing Jscript complete with all those issues at great expense. They would rather have a language with issues than change their implementation, so the world got stuck with the issues and there's now too much code on the web to change without something drastic.
by Neurrone | 2025-07-28 13:03:43+00:00
Oh boy, don't get me started on emails. HTML emails are such a pain because of the hacks needed to get it to render properly across multiple devices. So I hear a lot of information about the tables being used for layout purposes, which is a pain because the tables are not semantically meaningful at all. And then there are emails that just have one or more images.

For a line of dashes like "-------", most screen readers can recognize repeating characters, so that string gets read for me as "7 dash". If using an <hr> element, then there is no ambiguity about what it means.
by monkey_monkey | 2025-07-28 13:04:55+00:00
> But this perspective that it's infallible is beyond all reality

Very very very few people think the NHS is infallible. What are you even talking about? We all understand the NHS has many many problems, and those of us that have used the NHS understand this even more.

However, we still think it's a lot better than the private healthcare model.

Not sure what you're getting out of this weird strawman argument you're putting forward.
by bayindirh | 2025-07-28 13:05:32+00:00
> Doesn't it mean that they can still access your data while the server is running?

If you use "at rest" encryption, they might get the key from memory, yes. But if you use E2E (or client to client as Nextcloud says), nothing on the server would be readable, so using cryptomator/restic becomes unnecessary [0].

> You mean e2ee?

Unfortunately no, pCloud doesn't use E2EE. It's at rest AFAIK. Technical details are at [1].

> Sure, but what I was saying is that either you do it at home and it makes it harder...

If you want to expose your NextCloud to the world, 80/443 is enough for everything, plus Nextcloud comes with layered defenses by default (like brute force detection, etc.), and they can do your security audit, against their best practices [2].

If you don't want it to be completely visible, you can always tuck it behind a VPN.

If you want to host it on a VPN, then you can enable E2EE in NextCloud, but web part becomes unusable. Instead, you can use Syncthing with untrusted folders in that case.

[0]: https://nextcloud.com/encryption/

[1]: https://www.pcloud.com/features/encryption.html

[2]: https://scan.nextcloud.com/
by nchmy | 2025-07-28 13:05:39+00:00
It's peculiar that you singled-out that specific sentence from my entire comment. I sense a trap being laid, but I'll bite anyway.

Luddites were skilled craftspeople who are afraid of technology/progress supplanting them, which is largely what is happening when people reject jj in favour of arcane git incantations as part of a vastly more laborious git workflow.

The biggest way in which this label does not apply here, is that luddites were also primarily fighting for their economic positions, which were of course completely threatened by new technology. Whereas jj doesn't cost anyone anything - its just a toolbox and way of operating that just makes you more efficient. My point still stands, regardless of how fitting the label was.

Luddite would more directly apply to (probably the same set of people) those who are completely against ai/llms for any degree of coding, as it clearly has the potential to eliminate jobs. Though, of course, the most experienced and skilled people are well-positioned to leverage llms as cheap junior devs who can be instructed, guided, corrected etc to produce what is needed. It new, less-skilled devs/apprentices who would be most justified in fighting against LLMs, under the Luddite banner. Though we tend to see that they embrace llms most
by Eisenstein | 2025-07-28 13:06:03+00:00
"Zoom into this image so that the width of each vertical line is 1 mm or the whole image is 3.2 inches wide."

Is it possible to pick one system? Also, "3.2 inches" is difficult to measure. Rulers that measure in less than an inch use fractions, not decimals. It usually goes by 1/8ths, then 1/4 and 1/2, but some rulers have 1/16ths. 3/16" is .187 inches which is pretty close I guess.
by azath92 | 2025-07-28 13:06:07+00:00
see my separate comment for more on hackernews.coffee in particular, we (same team, different experiment) are thinking a lot about personal content, and how you have maximum visibility and control.

Keeping these projects separate allows us to test ideas that orbit around a theme (not 100 % sure what the theme is yet, but it features personal, anti-slop content, while still using llms.)
by Const-me | 2025-07-28 13:06:20+00:00
Great idea.

BTW, when I implementing similar logic in C#, I place expressions like ((xored - 0x01010101U) & ~xored & 0x80808080U) inside unchecked blocks. Because when I compile my C#, I set <CheckForOverflowUnderflow>true</CheckForOverflowUnderflow> compiler option.

On modern computers the performance impact of that option is negligible. I’ve encountered several cases where OverflowException produced by integer arithmetic exposed bugs which were trivial to fix, but would have been insanely hard to detect and debug without that compiler option.
by ralferoo | 2025-07-28 13:06:27+00:00
> On the other hand I'm still puzzled why there are no homebrew projects for a dumb dumping device that simply reads all the data on a cdrom, error correction, subchannels completely raw.

I think you'd have to write a custom firmware for one specific drive for that. That information is simply not exposed outside the device itself on standard drives, which is what makes it effective for copy protection.
by Alifatisk | 2025-07-28 13:06:51+00:00
This reminds me a lot of the holepunch.to (previously hypercore-protocol)

What I wonder is this, is there a clever and simple way to share the secret phrase between two devices? The example is pretty long to manually enter "nodeecsxraxjtqtneathgplh6d5nb2rsnxpfulmkec2rvhwv3hh6m4rdgaibamaeqwjaegplgayaycueiom6wmbqcjqaibavg5hiaaaaaaaaaaabaau7wmbq"
by kotaKat | 2025-07-28 13:07:05+00:00
Orion is a struggle on iOS. Despite it claiming to block ads, I find its ad-blocking capabilities heavily overstated - they barely work at all on many sites, even with all the filters enabled, and extension support doesn’t work with adblocking extensions making it a moot point. Right now Old Reddit is flooded with Samsung and other crap ads, even with all the lists turned on and updated.
by agentcoops | 2025-07-28 13:07:12+00:00
I moved to the UK with my family just before the Brexit vote and left last year. I love the country, but the changes I saw over that time period were so stark -- and, similarly, so many of the friends I made in that time had already left the country.

That I could have multiple negative NHS experiences relating to missed cancer diagnoses of friends in that relatively short span of time is suggestive of a real problem. The institution seemed to have less of an issue with elder care (in the US, the phantom menace posed by Obamacare or any governmental involvement in healthcare was meant to be "death panels" deciding the fate of grandparents) than with avoiding at all costs detecting potential long-term problems in the young. It's a 'rational' fear in the sense, as you note, that such cases put tremendous pressure on services, but there's no world where the best health outcome is refusing to screen your working age population.
by cmdr2 | 2025-07-28 13:07:19+00:00
People do use VR for modeling/animation in Blender - https://freebirdxr.com (disclaimer: I'm the author of this plugin)

Freebird is still quite basic, but it's under active development and more modeling and posing features are being added.

So a core set of people definitely use VR in Blender for creation/editing, but I agree the number is quite small.
by Imustaskforhelp | 2025-07-28 13:07:48+00:00
I can be extremely wrong and so pardon me but I have only ever felt as if China/Iraq/Russia blocks vpn which are extremely authoritarian

if Britain does block vpn, it would look extremely authoritarian but yeah tbh, its looking the same right now too...

I do think that there is some level of bottom tech that needs to go unsupervised/unrestricted otherwise vpn's can fail (china?)

If however they restrict that level of tech too using (packet filtering?) etc., I don't really know, maybe there could be some side consequences too,like maybe some websites can stop working (like how china is cut off from the world from the outside websites primarily)

And honestly, the vpn providers can just change their techniques to be more sneaky and hope that UK govt. doesn't catch them and the UK govt. can try the vpn and find its techniques and then block them too

Its a cat and mouse game really.. The one where there is money incentive on big vpn players to play this game forever, so I wouldn't be too worried I guess.

What I am more worried about is that UK users might download free vpns or bad premium vpns which might make their phones botnets etc., so I would recommend proton vpn or mullvad but I don't want to recommend them too much because I don't want to imagine these products turning bad if a lot of people use it. (enshittenification)
Remote-Only Job Boards
by thejons | 2025-07-28 13:08:22+00:00
Remote Rocketship https://remoterocketship.com/

Remote Army https://remotearmy.io/

Brenxor https://brenxor.com/

4DayWeek.io https://4dayweek.io/

Remotive https://remotive.com/

Working Nomads https://www.workingnomads.co/

Jobspresso https://jobspresso.co

HR Jobs Remote https://www.hrjobsremote.com/

Remote Nursing Jobs https://remotenursingjobs.com/

listofremotejobs https://listofremotejobs.com/

We Sell Remotely https://wesellremotely.com/

Remote100k https://remote100k.com/

Skip: Remote Edtech Jobs https://edskip.com/

Inclusively Remote https://inclusivelyremote.com/

Remote.io https://www.remote.io/

Ruby On Remote https://rubyonremote.com/

Remote and Talent https://remoteandtalent.com/

We Work Remotely https://weworkremotely.com/

Outer Join https://outerjoin.us/

JustRemote https://justremote.co/

Zuhausejobs https://zuhausejobs.com/

via https://www.jobsearchdb.com/job-board-categories/remote-only
by attackula | 2025-07-28 13:08:35+00:00
I'd agree with this assessment overall. It's got flavors of an age-old debate that comes up any time a new efficiency arises between the people who value the efficiency and those who value the process (eat a nutrition bar vs. cook a meal, drive instead of walk, etc.)

People quickly divide into camps, but I think the healthiest (albeit boring) view is that the tech is good for certain efficiencies, and you have to choose if you prefer the speed you gain over joy of the activity, which probably varies day-to-day. I love the walk to my local grocery store in the mornings because I enjoy the sunshine and exercise. I'm getting in my car the second I'm in a rush though. In the same way I love programming and software engineering, so if I've got the time I'm going to dig into coding. Under deadline to do an annoying legacy migration from an obscure language? Hello Claude Code :)
by richardlblair | 2025-07-28 13:08:51+00:00
I don't think people in CS should be giving broad overly simplistic mental health advice. Let's leave that to the pros. I'm grateful of DHH's contributions to society but his hot takes are marketing ploys. Mental health should not be leveraged as a marketing ploy.

Fwiw, I struggled with anxiety and depression for nearly 20 years. Commitment to therapy and my modalities brought me out of that. My _therapist_ guided me, including finding purpose and building meaningful relationships.
by jalapenos | 2025-07-28 13:08:52+00:00
That's some top tier clown economics.

Do you think the labor and resources that went into creating that materiel would vanish if it wasn't created? Like a missile is magic and conjures engineers and metal into existence just to fulfil its creation?

Oh and in fact leaves a little left over, the "profit", because thankyou for giving it some schools to obliterate?

What would we do if we weren't blowing people to bits huh, building theme parks or something instead - oh the waste! Think of the ~slaughter~... ahem, I mean the "economy"!
by kiliancs | 2025-07-28 13:08:57+00:00
I like Ecto's approach in Elixir. Bring SQL to the language to handle security, and then build opt-in solutions to real problems in app-land like schema structs and changesets. Underneath, everything is simple (e.g. queries are structs, remain composable), and at the driver layer it taks full advantage of the BEAM.

It's hard to find similarly mature and complete solutions. In the JS/TS world, I like where Drizzle is going, but there is an unavoidable baseline complexity level from the runtime and the type system (not to criticize type systems, but TS was not initially built with this level of sophistication in mind, and it shows in complexity, even if it is capable).
by dcre | 2025-07-28 13:09:07+00:00
Great article. I was of course surprised to learn that it's possible to learn to understand the super-fast TTS, since videos and podcasts start to get very tough to follow around 2.5x and higher. I've been wondering: surely better algorithms for generating high-speed speech are possible, especially as we have more and more compute around to throw at it. It's not easy to search for, since "speed" for most tools is about speed of generation rather than wpm. As normal-speed neural net TTS models get incredibly good, I am hoping to see more attention paid to the high-speed use case.
by lelanthran | 2025-07-28 13:09:07+00:00
> On one hand I agree, one should approach issues as they come, but there's solutions that are hard to ignore such as the need for reusable fragments/components on different pages which already make a cry for dependencies.

I side-stepped that completely, even on actual production web apps for clients, with this: https://github.com/lelanthran/ZjsComponent

Now, you may argue that that is a dependency, but it doesn't have any of its own, you can make a copy of it, serve it from your primary domain, and you're done.
by bluGill | 2025-07-28 13:09:24+00:00
Probably not much difference - learning the different keys is a easy to talk about task, but you will spend a lot more time repeatedly practicing all the other things. If you were to teach someone to a high level but only the key of C, and someone else to a similar high level but all keys, and the end only a few weeks longer would be spent for the person learning all keys - and that person gets a lot more versatility.

Isomorphic is more logical and so easier to explain, but you still should be teaching the circle of 5ths to students. Once someone understands the circle of 5ths the layout of the conventional keyboard makes logical sense as well (it won't be as intuitive but the logic makes sense).