MurphyA/hacker-news huggingface dataset:
by maxwellg | 2025-07-22 23:11:42+00:00
You're right that signing the token doesn't prevent login CSRF. Signatures protect against the second attack you mentioned. PKCE my favorite OAuth extension for preventing login CSRF as described.

> In that case, the signature doesn't solve that attack, because since everything happens in the attacker's browser, the attacker can modify the js locally to disable signature verification.

The frontend doesn't need to verify the ID Token - the backend of the relying part does. The backend can never trust the frontend. The signature is needed so the backend can verify that the ID Token credential was issued by the IDP.

> Just from reading the spec, a reader can wonder, "why is there all this unexplained complexity for no apparent reason?"

Yeah, this is true. Oftentimes the attacks are enumerated at the end of a spec, so it isn't clear when reading an earlier section. For example, the attack we've been discussing is described here: https://openid.net/specs/openid-connect-core-1_0.html#TokenM...
by rkhassen9 | 2025-07-22 23:12:19+00:00
>”How bad I find the search in Outlook and Teams is one of the reasons I refuse to trust Bing. I know they are completely separate divisions, but still…”

I wonder if you are referring to the online version of Outlook which is awful. And agreed regarding Teams…!

For clarity It’s the desktop imap version of Outlook with a local downloaded db that searches so well for us.
by UltraLutra | 2025-07-22 23:13:49+00:00
From CS folks I’ve talked to, the experience isn’t better than getting a human on the other end immediately. It’s better than not being able to reach a human (e.g. outside support hours). Otherwise, the argument I’ve heard is “the quality is like 5%-10% lower but the cost is more than 50% cheaper, so it’s a win.”

Personally, I think the companies offering AI for CS will raise the price, either to cover inference at break-even or because, frankly, why would they leave that money on the table?
by robswc | 2025-07-22 23:14:37+00:00
I don't know if I can ever buy a non-Tesla car again (unless its a truck).

I'll check out Rivian next time though, as those look pretty damn good. Like you, I don't know of any other brands that are competitive enough for me. I want to like other car UX's but once you have a smooth UX its hard to go back to sluggish ones.
by BeetleB | 2025-07-22 23:14:45+00:00
Just FYI: The person you're responding to wrote a very popular tutorial on jj. He's been using git since the early days, and as he puts it:

> Now I am not one of those "the git CLI is too complex and git is too hard to learn" people, but I do acknowledge that puts me in the minority. But let's reframe that: if we can make something more powerful and easier? Sign me up!
by jorlow | 2025-07-22 23:15:00+00:00
I had a horrible experience with my XC90 plug in hybrid. It took months of back and forth with the dealership and thousands of dollars to find out that it's dangerous behavior (refusing to stop without flooring the break with all my might) was due to a wire harness a critter had chewed on. Very similar response from Volvo in my case. No accountability and very low competence. Avoid Volvo.
by LorenPechtel | 2025-07-22 23:15:06+00:00
I have a headlamp for hiking with a slightly different take on this.

It will take 3x ordinary or rechargeable cells, or it will take it's Li-Ion pack that is the same size as the 3 cells side by side. Designed in from the start so there are no dangerous bits. Hiking headlamps are something where you do *not* want to be left with a dead battery!
by onelli | 2025-07-22 23:16:25+00:00
Love the pain point here: the “bring your own SMTP” + low infra cost really stands out. We see tons of SaaS/AI founders struggling with email infra. Any plans to open up built-in templates for onboarding, product updates, investor comms? Or is the focus strictly on newsletter flows? (Curious if you’re seeing more demand from SaaS or content businesses?)
by fc417fc802 | 2025-07-22 23:16:58+00:00
Largely agree but I want to challenge this bit at the end.

> probably be much cheaper than building and maintaining an air-gapped licence solution

I think this is an unwise attitude to take. There's something to be said for a simple picket fence. Even though someone could easily hop it if they wanted to, they lose plausible deniability and in most cases that's all that really matters at the end of the day.
by BeetleB | 2025-07-22 23:17:00+00:00
> That said, I want all teams to squash merge their feature into master after tests pass. One commit at the end, and one commit to remove in case of an issue affecting customers related to the release.

This is the one thing I always point to when I say "Mercurial is better" (and now, jj).

Why can't we have our cake and eat it? Mercurial lets you have lots of individual commits, but they're hidden, and you'll see only the squashed commit. Why do we have to lose all those individual commits to get that squashed commit? The answer: You don't need to.
by vel0city | 2025-07-22 23:17:45+00:00
> And you think people walking have more agency over a car coming and crushing them?

And you think you have more stuck with a car in front of you and beside you? Or active cars going through the intersection while you're supposed to be stopped? Or merging into you when you have cars in front of you and behind you and beside you? You have the same agency, probably less in that car stuck in traffic.

But if you were in a bus, you'd have a much larger vehicle and have far less energy imparted to you as a passenger, or if you were on a light rail you wouldn't even be in the intersection in the first place. Better yet, that drunk would be on the bus instead of being forced to drive and cause the accident in the first place!

Every statistic shows transit is far safer than cars.

You're clearly not thinking through the scenarios through to actually analyze which leads to more agency and outcomes which is what you really care about. Spend some time reflecting before you reply and give actual concrete examples please.
by ethagnawl | 2025-07-22 23:17:49+00:00
My mother has had two of them and they are very fun to drive -- even completely stock. The first was a 91 (how I learned to drive a manual transmission) and the second/current is a 2005. The newer one is more powerful (not sure how many HP but it seems significant) but I still prefer the older one. The design was peak 80s Japanese functional minimalism and there was no magic behind any of its features.

However, as it applies to the parent comment, I can't actually say too much about reliability, as both of them were driven primarily on weekends and _maybe_ 2K miles per year.
by mc32 | 2025-07-22 23:18:34+00:00
I dunno. Without cultural appropriation, the word would be poorer. The Romans took from the Greeks, renaissance Europeans took from the Romans, America took from the Europeans and Romans... Japan took from Europe and America, etc.. etc.

The irony to me is that something that was started as a local community in-thing for friends was coopted by "people" including its founder to become its own antithesis. It's not like someone came along and stole the idea and repurposed it. No, the community itself went along for the ride and took it to where it is today --post civilizational who-knows-what for mostly rich folks and some hangers-on. I mean, $60MM -what in hell?
by igor47 | 2025-07-22 23:19:33+00:00
Rivian software is pretty meh. I've never had a safety critical failure while driving, but have had multiple other issues including being trapped in the car unable to exit until after a reboot. Worse -- rivian has no mechanism for reporting software issues. If you don't want a service appointment (which is available in 3 months!) then don't bother reporting it.
by bigyabai | 2025-07-22 23:20:27+00:00
Then we have to transition into looking at it as a system of tradeoffs. As long as America has a second-strike capability, ICBM attacks aren't really desirable even from rogue nations. AEGIS and AEGIS Ashore are both already deployed by America's armed forces. THAADs and Patriot systems protect our most vulnerable assets abroad and the naval forces can be redirected if a certain theater goes hot. We bought these systems at great expense and they function roughly as intended to save American lives.

It isn't likely that a Golden Dome would stop rogue nations from attacking America with ICBMs, nor would it stop an all-out attack. It encourages new developments in space-based weaponry, ratchets up the fragile tension that enables satellite weaponry, and ultimately becomes a net-threat to Americans. Even if it was free, the sentiment that you project deploying such a system turns you into the abhorrent imperial power of space. You are naturally now the enemy of free spacefaring nations.
by pyman | 2025-07-22 23:20:30+00:00
I don’t think building autonomous cars is on the same level as writing CSS.

We're entering a phase where natural language becomes the main interface for html and css development. Companies like Vercel, Wix, and Framer are integrating AI to turn design prompts into working UI components.

This is only the beginning. Within 2 to 3 years, domain-specific language models, trained specifically on frontend code, are expected to become common.

Regarding Adobe, they never really understood developers.
by analognoise | 2025-07-22 23:20:55+00:00
"Lack of innovation" - yeah that whole space program thing wasn't super innovative. The stuff that invented the internet. What shortages, are you talking about communism? And we have computers AND helicopters - I think we can handle some tax evaders.

If anything doesn't work, it's the system WE HAVE NOW.

You're saying "socialism doesn't work" - we're the only country without single payer healthcare. We don't live as long. We pay 2x what other countries do. It just doesn't work... here. It's absolutely a lie that it doesn't work.

Socialism works just fine, and it's high time we get there and tax the living crap out of these useless lizard people.
by zamadatix | 2025-07-22 23:20:58+00:00
For 93% of people the only cost is the $15 test kit to verify "yep, don't need to even think about it".

For the other 7% that then need to really do a cost-benefit the data is out there but you do need to go through your specific circumstances to get a meaningful number. The risk levels vary vastly (orders of magnitudes) between both the radon level and your life choices/situation, so it's relatively meaningless to share individual cost-benefit analyses.
by Levitating | 2025-07-22 23:21:17+00:00
Does a note taking app need such an animation if apparently it's that easy to accidentally drain the users battery?

The UI of this app literally only has a piece of text, a button and this animated indicator. To render this it needs an entire chromium browser loaded into memory, and still it has performance issues.

I will always prefer software written in native graphics toolkits. I understand the benefits of using electron but the only electron based software I've ever liked was vscode.
by simonw | 2025-07-22 23:22:05+00:00
There's a 4bit version here that uses around 272GB of RAM on a 512GB M3 Mac Studio: https://huggingface.co/mlx-community/Qwen3-Coder-480B-A35B-I... - see video: https://x.com/awnihannun/status/1947771502058672219

That machine will set you back around $10,000.
by mfkp | 2025-07-22 23:22:55+00:00
Also the Volvo C40 (same platform). I've been driving it since January and other than the software being slow to start up when it goes into sleep mode, it's been stable.

They did recently issue a software recall for the backup camera, so now when the backup camera crashes it goes into 360 camera mode instead of just a black screen.

Overall I'm happy with this car though and would recommend it.
by BeetleB | 2025-07-22 23:23:02+00:00
Ha! Good example!

Once I started using jj, I realized how poor/annoying git's stash is. You don't need a concept called stash in jj. You have some work done and want to stash it? Just leave it alone as a leaf node (or split your commit into a leaf node). Then branch off the parent to work on whatever you want.

And with jj, my "stashed" node is version controlled in itself. I can make changes to it, undo it, all while still being stashed. (Maybe you can do this in git - I don't know).

Other niceties of jj:

Why do I need to come up with a commit message only when committing? Why couple the two? With jj, you can just decide to work on X, write your commit message "Adding cat photos to Easter Egg", and then work on the feature. Or you can just start working, and in the middle of it all, add the commit message, and continue working. You can change the commit message at any point.

Why do I need to fix merge conflicts immediately? Just the other day in jj, I made a change, which resulted in a merge conflict in several nodes. Whatever - I just branched off a clean node and worked on what I needed to. Only the following day did I go and fix the merge conflict.

Why can I only merge two branches? And why do I need to think of from/to when merging? A merge is basically creating a new node that is the child of multiple nodes. It's symmetric - there's no from/to. And you should be able to specify 10 parents if you want to.
by constantcrying | 2025-07-22 23:23:09+00:00
>"European" cars are not really a category. /Spanish cars are very different from German/Volvo

VWAG owns the largest Spanish car maker, Seat/Cupra. 100% of cars Seat/Cupra sells are VW derivatives. Whatever you imagine the difference between Spanish cars and German cars to be, it is not real.

>French/Italian

Renault is a very different company then Stellantis (Fiat, Citroen, Peugeot).

What you should compare is the parent company making these cars.

>Plus you have some luxury British cars, which are again veery different.

Lotus is a Geely brand, just like Volvo is a Geely brand, some of their cars are on the same platform. Fiat, Citroen, Peugeot are Stellantis brands.
by corranh | 2025-07-22 23:23:20+00:00
Yes, anecdata from me as well, but the larger issue seems to be cars that run critical functions through the media or entertainment system only. My neighbor had a hybrid Volvo that was towed to the dealership multiple times because the car wouldn’t start when the media center froze. It was always fixed for free but ultimately they decided to sell it as it wasn’t worth the hassle.
by ZYbCRq22HbJ2y7 | 2025-07-22 23:23:44+00:00
Eh, I have done way less ethically challenging things in my life and already consider it. Honestly, I can't imagine the amount of exploiting you'd have to do to accumulate a billion dollars.

You are talking like 23,000 years of labor at median wage in the US to have a billion dollars. If you are Elon Musk, you are talking like 10 million years.

If you are okay walking through the world like that, I think you have some problems.
by alwillis | 2025-07-22 23:23:51+00:00
But my understanding is Claude Code is closed source and only support Clade API endpoint. How do they make it work?

You set the environment variable ANTHROPIC_BASE_URL to an OpenAI-compatible endpoint and ANTHROPIC_AUTH_TOKEN to the API token for the service.

I used Kimi-K2 on Moonshot [1] with Claude Code with no issues.

There's also Claude Code Router and similar apps for routing CC to a bunch of different models [2].

[1]: https://platform.moonshot.ai/

[2]: https://github.com/musistudio/claude-code-router
by ai-christianson | 2025-07-22 23:24:32+00:00
We shipped RA.Aid, an agentic evolution of what aider started, back in late '24, well before CC shipped.

Our main focuses were to be 1) CLI-first and 2) truly an open source community. We have 5 independent maintainers with full commit access --they aren't from the same org or entity (disclaimer: one has joined me at my startup Gobii where we're working on web browsing agents.)

I'd love someone to do a comparison with CC, but IME we hold our own against Cursor, Windsurf, and other agentic coding solutions.

But yes, there really needs to be a canonical FOSS solution that is not tied to any specific large company or model.
by isaacremuant | 2025-07-22 23:24:46+00:00
Yet another skimmable post from someone very aligned to one corporate/US party centric set of views that believes everyone else is "simply manipulated" and therefore they'll just try to "reach them" via more manipulation.

Or maybe you're just wrong in peddling government/corporate bullshit as is? Maybe others have lived through things and don't align themselves to corporate or political power A or B and therefore will seem contrarian against the drowning flow of "good propaganda"?

Many of us still remember how "believe in science" was used to shut people up about simple corruption and hygiene theater.

If you weren't in the right side of history (anti authoritarian) then, your complains ring hollow.

The whole "<X country> bad" is also such a tired narrative from the Anglo countries that can't stop invading countries for oil and supporting genocide every chance they get.
by j-pb | 2025-07-22 23:25:15+00:00
- https://mistral.ai/news/our-contribution-to-a-global-environmental-standard-for-ai - https://www.statista.com/statistics/1201677/greenhouse-gas-emissions-of-major-food-products/ - https://www.statista.com/chart/9483/how-thirsty-is-our-food/ - https://blog.samaltman.com/the-gentle-singularity - https://x.com/sama/status/1890820962993533232

You got to do the calculations yourself though.
by constantcrying | 2025-07-22 23:26:01+00:00
>German companies don't seem to understand the growing importance of software

VWAG is now on attempt number two of fixing their Software problems.

They tried Cariad, the result was your experience. The next attempt is giving billions to Rivian.

If you believe that these companies do not understand how important software is you are totally delusional. Literally Billions worth of money have they spent trying to fix that.
by mindslight | 2025-07-22 23:26:02+00:00
> Trying to treat it as capital is how you get all these bizarre (and, to many, horrible) outcomes.

Yes, it seems like you're trying to deny that this is exactly what capitalism has become. It started off as a descriptive model for real scarcity. Then once that stopped being exciting, capital owners and their intellectual supplicants came up with rationalizations to create new forms of capital to be owned and controlled. For every person trying to no true Scotsman like you're doing, there's another arguing how imaginary property, or water rights, or Chicago parking meters, or hyperfinancialization in general makes sense under a whole host of assumptions like the efficient market fallacy. The side of entrenching interests inevitably wins, and we get the perverse outcomes everybody hates from late stage capitalism. The only sensible thing to do is regroup at a different metric/term besides capitalism.
by yunusabd | 2025-07-22 23:26:08+00:00
I tried it on a M1 Pro MBP using Docker. It's quite slow (no MPS) and there are no timestamps in the resulting transcript. But the basics are there. Truncated output:

Fetching video metadata... Downloading from YouTube... Generating transcript using medium model... === System Information === CPU Cores: 10 CPU Threads: 10 Memory: 15.8GB PyTorch version: 2.7.1+cpu PyTorch CUDA available: False MPS available: False MPS built: False Falling back to CPU only Model stored in: /home/app/.cache/whisper Loading medium model into CPU... 100%|| 1.42G/1.42G [02:05<00:00, 12.2MiB/s] Model loaded, transcribing... Model size: 1457.2MB Transcription completed in 468.70 seconds === Video Metadata === Title: 厨师长教你：“酱油炒饭”的家常做法，里面满满的小技巧，包你学会炒饭的最香做法，粒粒分明！ Channel: Chef Wang 美食作家王刚 Upload Date: 20190918 Duration: 5:41 URL: https://www.youtube.com/watch?v=1Q-5eIBfBDQ === Transcript === 哈喽大家好我是王刚本期视频我跟大家分享...
by corimaith | 2025-07-22 23:26:26+00:00
>The current US administration's weird argument is that the USD values exchanged in inter-national trades must be symmetrical,

In Econ 101 going back to Keynes, if you run a persistent current account surplus, the increased demand for your currency to pay for your exports will strengthen your currency, thus reducing the competiveness of your exports, thus reducing your trade surplus. Vice versa for a deficit. Hence persistent trade imabalances should not exist due to self-balancing FX-effects.

This isn't happening in reality for a variety of reasons, but it's common knowledge that it's government policies that directly try to prevent that from occuring. Capital Controls, Protectionist Policies, etc, the most explicit mechanism is the controversial currency manipulation, whereby many central banks manage capital inflows by buying US assets to keep their currency stable.

But the aggregate result of this is that we have a strange situation today whereby the US dollar is simultaneously strong yet running a massive deficit, while surplus countries have weak currencies. And these imbalances are growing rather than shrinking. Many mainstream economists don't think the situtation is sustainable, but their proposals to fix it are differing.

I'd agree that Trump's method of "forcing" other countries to buy more American stuff is just a short-term fix that won't solve the underlying issues, but the real solutions of tariffs, currency revaluations or introducing capital controls will be hard to stomach for everyone, albeit necessary. Although the "correct" solutions like the Bancor will all be much more harmful to surplus countries than the USA.
by protimewaster | 2025-07-22 23:26:56+00:00
I remember, some years back, the warranty period was actually almost inversely correlated with reliability. It seemed like the companies that were making unreliable cars were just hoping to get people onboard with long warranties. There's a great story on Reddit from years ago about the lifetime Kia warranty, and a car that went through something like 7 engines in 10 years.
by dlubarov | 2025-07-22 23:27:22+00:00
Israel’s disengagement plan was a huge topic of internal debate before being approved by the Knesset. Arguments for it were about demographics and security. I don’t recall any proponents of the plan saying that it was a temporary measure (though some argued Israel could easily regain control if required, as a backup), so that seems like a farfetched explanation.
by RumourRider | 2025-07-22 23:28:08+00:00
You need to think about what the browser is actually doing when it displays a web page. You need to think about what happens when you type the URL in and what the browser is doing conceptually.

If you have any experience programming 2D graphics with SDL this will help you to understand what is happening as well.

There is an old school talk by Nikolas Zakas on JavaScript Performance from 2009 which while some of it is out of date now due to improvements in Browser engines, the fundamental ideas are still the same.

https://www.youtube.com/watch?v=mHtdZgou0qU

If you skip to the 35 minute mark he speaks about reflow specifically. Generally I still use many of these techniques when writing vanilla JS (which is unfortunately rare these days). There are other talks where he talks about many other performance specific topics.

Obviously none of this is as good as real world experience of dealing with a thorny issue.
by aprilthird2021 | 2025-07-22 23:28:38+00:00
So we want to shoot ourselves in the knees, for fun? It's clearly about Israel, otherwise we wouldn't be giving a country billions that we can't trust with our military secrets (because they sell them to our adversaries), that has a track record of killing American citizens and never prosecuting anyone responsible, and who constantly defies us despite relying on us to even exist
by Levitating | 2025-07-22 23:30:18+00:00
> In my opinion, most things shouldn't bother to make an "app," and certainly shouldn't try to push their apps on me, unless they want to make an actual native app for their target platforms.

It's as people have just forgotten that software used to integrate with the rest of the computer. I know people who install things like Netflix as apps just to have an icon on the taskbar.