MurphyA/hacker-news huggingface dataset:
by PaulHoule | 2025-07-09 18:38:52+00:00
Somewhat random but if you post things people find interesting you'll get better results.

If you look at your profile and turn on "showdead" you will get some more insights. It is a classic mistake that people post articles from their blog and nothing but articles from their blog and everything they post winds up [dead].

It is fine to post articles from your blog so long as you also post articles from other sites but a lot of people never figure that out.
by flufluflufluffy | 2025-07-09 18:38:53+00:00
The phrase “Frozen String Literals” is kind of weird to me. When I assign a string literal to a variable, I do not think of the variable itself as a “string literal.” That phrase is for the literal characters in between quotes in the code, which by definition are already “frozen.” They’re a static part of the code itself. This change makes it so that you cannot mutate a variable which was initialized using a string literal. (if I understand correctly!)
Show HN: Reverse-engineering 100 devtool landing pages
by vicamelnikova | 2025-07-09 18:39:39+00:00
Evil Martians went full detective mode on Recraft, Sameday, Plane, Koyeb, Dynaboard (acq. Figma), Dust, Cline, Linear, Mintlify, Circle, Vercel, Supabase and dozens of other devtools that developers love and VCs fund.

We found patterns that work and wrote a comprehensive article breaking it all down. All landing pages are carefully screenshotted and organized into a single folder. Take it and use it.

We built a free open-source landing page template based on these winning patterns. Deploy it in minutes, then get back to building features that matter.
by handfuloflight | 2025-07-09 18:39:55+00:00
I never said the app's issues should be absolved, the security problems are obviously serious. But the author claims he did responsible disclosure and got no response, yet somehow skipped the obvious next step of contacting Apple directly. Instead he chose to publish a detailed technical writeup that essentially creates a how-to guide for exploiting these vulnerabilities.

Now because of this post, these children are arguably at greater risk than before, since anyone can follow his step-by-step instructions. If he actually cared about user safety over HN karma, he would have escalated to Apple's App Store channel rather than publishing exploitation details.

The smugness isn't the only problem, it's the irresponsible disclosure wrapped in performative outrage.

You can criticize terrible security practices without creating a ready to replay tutorial for bad actors.
by 9rx | 2025-07-09 18:39:56+00:00
Is it? "Statement", defined by the dictionary as "the expression of an idea or opinion through something other than words.", seems quite apt. Symbols may end up resembling words, which perhaps is your contention, but technically they are only symbols.

Best I can tell, all usable definitions surrounding "Command" seem to suggest an associated action, which isn't true of all statements in imperative programming.
by toast0 | 2025-07-09 18:40:08+00:00
> What REST has given us is an industry-wide lingua franca. At the basic level, it's a basic understanding of how to map nouns/verbs to HTTP verbs and URLs. Users get to use the basic HTTP response codes. There's still a ton of design and subtlety to all this. Do you really get to do things that are technically allowed, but might break at a typical load balancer (returning bodies with certain error codes)? Is your returning 500 retriable in all cases, with what preferred backoff behavior?

What was wrong with all nouns and verbs map to POST (maybe sometimes GET), and HTTP response codes other than 200 mean your request failed somewhere between the client code and the application server code. HTTP 200 means the application server processed the request and you can check the payload for an application indicator of success, failure, and/or partial success. If you work with enough systems, you end up going back to this, because least common denominator works everywhere.

Either way, anything that isn't ***** SOAP is a good start.
by snickerdoodle12 | 2025-07-09 18:40:13+00:00
Well, there appears to be some link. I'm not clear on what it is, but here are the Home Assistant docs for using a Matter dev board: https://www.home-assistant.io/integrations/matter/#experimen...

> NOTE for Android users: You need to follow the instructions at the bottom of the page to add the test device to the Google developer console, otherwise commissioning will fail.

Anyway, you absolutely should care about Google Home support if you want to sell a device. It'd be ridiculous to sell something that only works with Home Assistant even if I'd personally be perfectly happy with that.
by snickerdoodle12 | 2025-07-09 18:40:46+00:00
I do, but it's especially grating here because Zigbee didn't have this restriction, and none of your examples actually enforce it technically. I have some Chinese USB devices that are very useful but use an incorrect VendorID. But I don't care, they work great.

And besides, so far I've been able to use 100% of my Zigbee devices with Zigbee2MQTT and it's been wonderful.
by dzaima | 2025-07-09 18:42:19+00:00
Rust's aliasing rules are very different from C's.

In C you have a nuclear `restrict` that in my experience does anything only when applied to function arguments across clang & gcc, and type-based aliasing which is both not a generally-usable thing (don't have infinite different copies of the int64_t type (and probably wouldn't want such either)), and annoying (forces using memcpy if you want to reinterpret to a different type).

Whereas with Rust references you have finely-bounded lifetimes and spans and mutability, and it doesn't actually care about the "physical" types, so it is possible to reinterpret memory as both `&mut i32`/`&i32` and `&mut i64`/`&i64` and switch between the two for the same memory, writing/reading halves of/multiple values by the most bog standard Rust safe reads & writes, as long as the unsafe abstraction never gives you overlapping `&mut` references at the same time, or split a `&mut` into multiple non-overlapping `&mut`s.
by umbra07 | 2025-07-09 18:42:21+00:00
> This is one of the big reasons why email has pretty much died for casual use. Even in work environments almost everyone uses chat clients these days.

I don't see how this follows. Yes, HTML email fucking sucks. But most people are using Gmail, Outlook, Apple Mail, etc, all of which do a pretty good job at handling HTML emails - especially between each other. How do you go from "html emails are bad" to "html emails led to IM replacing email"?
by anonymars | 2025-07-09 18:43:49+00:00
Gotcha. I guess another episode of "both participants think the other is crazy"

My read wasn't that the "inept" was specifically her, but rather the leadership of the company at the time in general (for which, regardless, she is being thanked on Twitter). In other words, either

(1) she was a figurehead that didn't do anything and thanking her is stupid

(2) she wasn't a figurehead and actually was in charge, in which case thanking her is still stupid because such leadership was inept (suing their advertisers, etc.)
by Night_Thastus | 2025-07-09 18:44:16+00:00
I'm not saying I would ever use it. I'm saying that for casual non-power users, it's good enough. They work with it and if it breaks once in a blue moon they don't care. They just want it to open the files they get and give them a way to send files compressed.

That is enough to bite into 7-Zip's share of users.
by necovek | 2025-07-09 18:46:17+00:00
I remember getting my hands on a CORBA specification back as a wide-eyed teen thinking there is this magical world of programming purity somewhere: all 1200 pages of it, IIRC (not sure what version).

And then you don't really need most of it, and one thing you need is so utterly complicated, that it is stupid (no RoI) to even bother being compliant.

And truly, less is more.
by bri3d | 2025-07-09 18:46:27+00:00
The design is both better and worse:

* The list of officially trusted companies and root certificates is stored on a blockchain, for whatever reason, but at least this way it's a fairly open list and it's supposed to be shared equally across all vendors.

* It's a lot easier to get an official key provisioned / device certified. It's not like UEFI where there's some murky trusted set of root keys belonging to a major manufacturer (Microsoft) who blesses things at a whim.

Importantly:

Even if the "vendor" (in this case, it's Google/Apple) stopped supporting test keys in their Commissioner, one could still run a "fully private" Matter fabric with their own Commissioner. Of course, if this happened, a user couldn't commission their devices onto the walled garden Google Home / Apple Home ecosystems, but, they could still make their own Matter fabric with their own Controller. It's not done this way normally: even with HomeAssistant, which can run its own Matter Controller, the Commissioner role is typically delegated to Apple/Google SDKs through the Home Assistant app. But this is because it's a huge pain to develop a working Commissioner (due to Bluetooth, mostly), not because it's not possible. There's no "lock-out" that causes Matter devices to only provision to approved Controllers/Fabrics - the lock only goes the opposite direction, to prevent end users from buying insecure/spyware devices with the Matter label.

However, unfortunately:

* You don't really enroll your own key or root certificate with most of the "standard" (Apple/Google) Commissioners to use them with development devices - rather, you use a fixed set of vendor or device IDs which signify them as test devices (in the extra easy path, you even use a fixed device certificate for a Test Device). This makes sense from the constraint that users can still build and develop their own devices while protecting the ecosystem from "rogue vendors," but it's not like UEFI Secure Boot in this case where the end user can enroll their own keys and truly control the system end to end.

Now again, there's nothing stopping the end user from building a Commissioner which would trust their own self-signed certificate, besides it being a pain in the butt, but that's not how it works by default - it's truly a development mode, not a bring-your-own-keys.
by meatmanek | 2025-07-09 18:46:41+00:00
I think you're being overly (and incorrectly) pedantic about the meaning of "non-deterministic" -- you're applying the fairly niche definition of the term as used on finite automata, when the people you're refuting are using it in the sense of https://en.wikipedia.org/wiki/Nondeterministic_algorithm: "In computer science and computer programming, a nondeterministic algorithm is an algorithm that, even for the same input, can exhibit different behaviors on different runs, as opposed to a deterministic algorithm." I think this usage of the term is more common than the finite automata sense. Dictionary.com doesn't have non-deterministic, but its (relevant) definition of deterministic is "of or relating to a process or model in which the output is determined solely by the input and initial conditions, thereby always returning the same results": https://www.dictionary.com/browse/deterministic

Under that definition of (non-)deterministic, ironically, an NFA is deterministic, because it always produces the same result for the same input.
by dylan604 | 2025-07-09 18:47:45+00:00
As these are prints themselves, are we gaining anything by seeing these prints vs other prints? It's not like viewing an original Monet or anything where the thing being viewed was the work created by the artist's hands. While these prints might have been made by the artist, they are still not the originals.

When visiting DC, do we really think the Constitution under all of that glass is the actual Constitution? POTUS seems to think he has the actual, so there's conflict right there. For a document as beloved as the Constitution, why would you ever risk the original?
by riknos314 | 2025-07-09 18:47:46+00:00
This could easily have as much to do with support costs as anything with the technical side of the protocols.

A member of my family works in customer support for a company making devices using both zigbee and thread, and claims that support calls for debugging zigbee are often among the longest (and thus most expensive) calls they handle.

Unsure what IKEA's tech support looks like, but I assume that most issues not solved by support turn into returns, which are also bad for the bottom line.
by larve | 2025-07-09 18:47:47+00:00
right, do you think this article is going to be very productive in that regard? If the author of the blog approached the author of the software in that manner (hey, you have kids on the app, btw I spammed them with porn humor), do you think they would wave it away?

As for the human code thing, it's not bait. I don't know if you were around in the php or early node days, but beginners were... not writing that kind of code.

I agree that the ease of vibecoding things that turn out to be useful that people do immediately want to pay money for it means that tackling security issues is a priority.

Saying that certain people shouldn't be allowed on the internet, based on your decades of experience _being_ on the internet, is just going to cause you to wither away and drown in cynicism.
by Buttons840 | 2025-07-09 18:47:51+00:00
While the courts, supposedly, focus on what the law actually says, remember that Wickard v Filburn (1942) established that growing a plant on your own property for your own personal use is "interstate commerce".

I don't know a lot about law, but I at least know that ruling on what the "actual law is" is selective, and usually selective in a way that is beneficial for the rich and powerful.
by CharlesW | 2025-07-09 18:48:38+00:00
Matter has a small but growing hobbyist community. A recent project I saw via https://www.reddit.com/r/MatterProtocol/:

(1) https://tomasmcguinness.com/2025/06/27/matter-building-a-tin... (2) https://tomasmcguinness.com/2025/06/30/matter-tiny-dishwashe...

You can definitely add uncertified accessories (using CSA test Vendor ID 0xFFF1) to HomeKit via an "Add Anyway" confirmation. Because Apple tends to be extremely conservative about this kind of stuff, I'd expect that all systems that support Matter would allow this.
by lowsong | 2025-07-09 18:49:10+00:00
I'd hope it was obvious I wasn't referring to the user. You shouldn't prosecute a person using a tool that wasn't intended for that function on themselves, in the same way you can't prosecute a person for performing 'surgery' on themselves without medical knowledge or the right tools.

I mean we should prosecute companies or individuals positioning LLMs as therapy tools, suggesting that they can be replacements for therapy, or are appropriate for medical use at all. It's medical malpractice and misrepresentation, pure and simple.
by ImPostingOnHN | 2025-07-09 18:49:47+00:00
Thank you. I think my confusion on concern stemmed from some opinions I held:

- Any key of mine should be copyable by me.

- Any key of mine (or copy thereof) should be usable as I see fit*.

- If someone had physical access to a device, we can assume they control it and have all information and communications on it, potentially forever due to the layered architecture of modern hardware systems.

- If someone compromised a network provider, we can assume they control all configuration and communication, potentially forever on the existing devices, for the same reasons.

* - though I obviously wouldn't want to use them in a way that illegally hurts people, like driving drunk and getting into an accident
by p_ing | 2025-07-09 18:50:08+00:00
Interesting that the report calls out SMBv1 which is disabled by default in Windows 11. I suppose you could have an exploit that triggered SMBv1 optional feature install, but you already have local admin rights at that point.

SMBv1 has effectively been removed for modern clients and thus is not 'unpatchable'.

Encryption is on-by-default with SMBv3, I believe.

So some of these mitigations are already in place. I'm sure the UEFI issues will always persist, that's not a Microsoft issue per se, and I assume the kernel memory management potential vulnerabilities are still present, though the author doesn't offer any concrete proof in the report that these are exploitable as of today.
by pornel | 2025-07-09 18:50:47+00:00
Rust already supports switching between borrow checker implementations.

It has migrated from a scope-based borrow checker to non-lexical borrow checker, and has next experimental Polonius implementation as an option. However, once the new implementation becomes production-ready, the old one gets discarded, because there's no reason to choose it. Borrow checking is fast, and the newer ones accept strictly more (correct) programs.

You also have Rc and RefCell types which give you greater flexibility at cost of some runtime checks.
by dustincoates | 2025-07-09 18:51:34+00:00
It depends how you define meaningful.

I built a daily newsletter with myself as the only recipient using v0. It hits the Gemini API and returns a short story based on a historical event from that day in the language(s) that I'm learning, along with a translation, transliteration where applicable, vocabulary list from the story, and grammar tips.

I've had work in the past where I spent way too long building email templates, so having that all done for me, along with the script for sending the mail, was useful. It took an afternoon project that I probably would have abandoned, into an hour project.

With that said, I'm pretty bearish on these platforms, because I think you can't build anything beyond a toy like that. And for toys or short scripts, Claude, Gemini, ChatGPT are usually good enough.
by scubakid | 2025-07-09 18:51:40+00:00
thanks! consistently putting in those hours wasn't easy. it became the only time in life I've had elevated blood pressure. but you're right that I probably wouldn't have gotten here without burning the candle at both ends like that.

at the time, I was too risk-averse to go all-in right away, and this was the best de-risking strategy I came up with. luckily, my schedule is now more balanced again. (a little lol)
by ChadNauseam | 2025-07-09 18:51:42+00:00
> affine types (what Rust uses)

I'd just like to interject for a moment. What you’re referring to as "affine types", is in fact, Uniqueness Types. The difference has to do with how they interact with unrestricted types. In Rust, these "unrestricted types" are references (which can be used multiple times due to implementing Copy).

Uniqueness types allow functions to place a constraint on the caller ("this argument cannot be aliased when you pass it to me"), but places no restriction on the callee. This is useful for Rust, because (among other reasons) if a value is not aliased you can free it and be sure that you're not leaving behind references to freed data.

Affine types are the opposite - they allow the caller to place a restriction on the callee ("I'm passing you this value, but you may use it at most once"), which is not something possible to express in Rust's type system, because the callee is always free to create a reference from its argument and pass that reference to multiple functions..
by FirmwareBurner | 2025-07-09 18:52:00+00:00
>You can’t just buy the machine and print chips

Exactly this, as otherwise there would be nothing stopping ASML opening up its own competing fabs next door with their cutting edge machines 12 months before they sell them to their customers for maximum profits, the same way Bitcoin ASMIC mining companies did with their chips.

Or at least some Dutch/EU company in the area doing it, but nobody else can do what TSMC does at the cutting edge. For context, EU's most cutting edge fabs will be the Dresden TSMC one at 12nm.
by larve | 2025-07-09 18:52:34+00:00
I feel like it is. What should happen? Everybody born after 2015 is forbidden to use a computer? Or should only be allowed under strict supervision to be typing in code by hand? When people told me that in the nineties, with my linux, putting up shoddy cgi-bins, I just gave them the finger and said "whatever man".

The people who made an influence in my life and taught me how to do things properly were those that took me seriously as someone building software. And this person built software, the same way I now build software without having to think about every byte and malloc, and knowing that I don't really have to gaf about how much memory i allocate. It's fine, because we have good GCs and a lot of resources to learn about memory management when things hit the limit. The solution wasn't to say that everybody not programming C or assembly would not be allowed near a computer.
Show HN: ReviLearn – Remember what you read online
by ganeshsp1 | 2025-07-09 18:52:47+00:00
A few years ago, I took the popular "Learning How to Learn" course, which introduced me to spaced repetition and active recall. It completely changed how I approached mastering technical concepts and coding problems.

But I struggled to apply it consistently: I could save LeetCode problems, articles, and docs in bookmarks, but I rarely reviewed them at the right time — and ended up forgetting most of them.

So I built ReviLearn, a free Chrome extension that lets you:

- Save any web page or coding problem - Rate its difficulty (1–4), so it knows when to remind you - See a calendar of upcoming revisions - View an analytics dashboard with streaks and mastery breakdown - Get daily notifications to keep up your routine - Categorize topics (e.g., "DP", "System Design", "JavaScript") - Export everything to CSV if needed

I just redesigned the UI to make it much more modern and motivating. I kept it completely free — no paywalls.

I’d love feedback from the HN community: What features would help you actually stick to reviewing? How do you currently manage your learning revisions?

Link: [https://chromewebstore.google.com/detail/revilearn/dnmbfpofk...]

Thanks!
by georgemcbay | 2025-07-09 18:53:12+00:00
> because almost all YouTube sponsors are scams

Anything advertising on youtube or podcasts is a negative indicator for me as these platforms have followed the path of talk radio in having a very high ratio of the products that advertise on them being dodgy if not outright scams.

I'm sure there are exceptions that are totally fine, but the pattern follows often enough that if I don't have a pre-existing relationship with a brand before seeing/hearing a youtube or podcast ad for it, it goes into the scam bucket in my head just through the negative advertising platform connection.
by necovek | 2025-07-09 18:53:33+00:00
To me, the most important nuance really is that just like "hypermedia links" (encoded as different link types, either with Link HTTP header or within the returned results) are "generic" (think that "activate" link), so is REST as done today: if you messed up and the proper action should not be "activate" but "enable", you are in no better position than having to change from /api/v1/account/ID/activate to /api/v2/account/ID/enable.

You still have to "hard code" somewhere what action anything needs to do over an API (and there is more missing metadata, like icons, translations for action description...).

Mostly to say that any thought of this approach being more general is only marginal, and really an illusion!