MurphyA/hacker-news huggingface dataset:
by cess11 | 2025-07-09 06:54:36+00:00
I've tried to use gemma3:4b which comes up better in that benchmark and found it to be quite disappointing. It breaks a lot, sucks even worse than qwen2.5-coder:7b and incept5/llama3.1-claude:7b at code, needs to be tricked or threatened into saying stuff about many everyday topics. It also commonly chugs away for minutes exercising the GPU fans before responding, at which point I'm already ahead because I figured out another way to solve my problem or get at some information.

My experience with phi4-mini and granite3.3 was about the same, and they annoy me even more when I hook them into code editors and try to get them to contribute to my work. For one because they're slow, and at best they suggest adding unnecessary error handling in the style of null checks everywhere, at worst they just start mixing or hallucinating programming languages. Where they would be useful as leverage if they worked, i.e. close to the edge of where I can debug and refactor without getting stuck, they just go into straight nonsense mode, especially on terse first-pass code.

Sometimes I've tried to query these things for descriptions of recent history in foreign countries, Wikipedia trivia basically, and they're very often wrong in subtle ways. For example, a politician might have been at it for half a century or so in a troubled country and because they've been ousted in a coup once in the eighties the model is absolutely sure they can't have been in office since.

If a person acted like these things do I'd wish for them to get immediate institutional care. Maybe the problem is somehow with me, but I have a deep suspicion it's not.
by mrtksn | 2025-07-09 06:54:37+00:00
The bad blood doesn't make sense, it was an age of the Empires and it was all business and Ottomans didn't do anything particularly different than everyone else did so I don't think that it is fair to say that Ottomans were evil. If anything, under Ottoman rule despite the atrocities minorities kept their language and culture unlike the people subjected to Western imperialism in Africa or Americas. One can even argue that Ottomans were relatively gentle.

Let's hope that we never go back to these days. Imperialism is evil and I'm sorry that Erdogan and other autocrats are trying to revive those days. I also agree that it was very offensive for the christians to turn Hagia Sofia into a mosque again(was a museum till recently) and I would love to see it becoming a church again.

Also, let's stop renaming stuff. If you like Istanbul you can move to Istanbul, if you want to own istanbul you can purchase a property in Istanbul.
by Irongirl1 | 2025-07-09 06:54:50+00:00
Ok, I want to do this..it's past time for me to have a web home, but I am leery because I'm so non-techie. I've made note of most of the stuff I want to use, but I am hoping you can answer a really stupid question about size. How big does the mini pc have to be to simply run a static site and newsletter?

I know I'm going to get all-sorts of comments and recently had a terrible experience with a tech bro, so please go easy on me...

And if you answer, thanks in advance..
by lutusp | 2025-07-09 06:54:53+00:00
This alludes to a longstanding debate with no meaningful resolution.

I can see and appreciate Michelangelo's "David", in one of its two best-known Italian renderings (not counting the one in Las Vegas), even though the sculpture's human model, and the artist, are long dead.

I think Banksy has the right idea, even though people do what they can to undermine his works -- by, among other things, chain-sawing them out of the walls the artist chose to make his point, then offering them for sale.

A copy of a book isn't a travesty, so why should a copy of a painting be one?
by TheDong | 2025-07-09 06:54:56+00:00
That description seems really unclear, like how can `Chart.lock` be a symlink to a `.bashrc`?

Is the vulnerability that you ship a chart with `Chart.lock -> ../.bashrc`, and then helm writes to `Chart.lock`?

Why is the fix specific to Chart.lock (https://github.com/helm/helm/commit/76fdba4c8c2a4829a6b7abb4...), wouldn't the fix be instead that "A chart cannot contain any symlinks outside of its root"?
by perching_aix | 2025-07-09 06:55:33+00:00
But it really isn't that inconvenient at all, and some of the caps are outright better now than the crap that preceded them. Bit like how the toilet water use regulations turned out.

I even find myself vaguely annoyed now whenever I drink from glass bottles, that those caps are loose.

> People are upset because it shows Brussels disfunction

Reminds me to that meme where the debated point is what OS is better, and the conclusion is that normal people don't talk about operating systems. The only people I ever hear mention Brussels unprompted are rightwing grifters.
by bentocorp | 2025-07-09 06:55:50+00:00
Author of the article here, re:

> You have Apple dragging you by the b-... nose and you say thank you more. That's why everyone dislikes Apple and anyone who uses it.

Perhaps continuing to develop an app on Apple's platforms is asking for more, but a couple of items of consideration for perspective:

1. In my opinion, over the last 10 years, Apple's behaviour has gotten a lot worse as they strive for continual profit growth – with services being their only answer and tightening the screws on developers via the App Store their chosen solution.

2. Having used Apple as my primary computing platforms for almost 40 years (yes I'm old), and developing on it for many of those years, it can be hard to walk away to another ecosystem. For many users & developers, the knowledge etc is a sunk cost that can be hard to overcome.

The article was written both as a way to vent and also to hopefully shine further light on the issues in the hope that it could add to the impetus for change.

What would you think would be a solution in this situation?
by alicemaz | 2025-07-09 06:55:59+00:00
the idea that the state is purely a construct of laws enforced by threat of violence is closer to legalism and not something xunzi favors. he sees law and punishment as a last resort for eliminating the minority of people who can't be handled any other way, but trying to rule principally on the basis of coercion is doomed to failure. one of his essays is an extended lecture on why the qin state (to become the qin dynasty) will be overthrown unless they stop trying to govern this way

for xunzi the main tool to run the state is that nebulous word "ritual." roughly this means the government should behave virtuously to inspire civic duty and pride, encourage people to cultivate themselves and behave properly in the context of their personal relationships, and use the tools of civic religion (in his time sacrifical rites, sumptuary laws, military ceremonies) to impress people with majesty rather than instill fear. on the mundane end it should make punishments light, lower taxes, handle natural disasters, and maintain a military that mostly fights defensive or just wars. through this he believes people will mostly act virtuously through a felt sense of obligation to and appreciation for each other, ie social trust and social responsibility

there are legitimate points of criticism though, I think the main ones from a western individualist democratic perspective would be that he considers a hierarchical (albeit strictly meritocratic) social structure to be absolutely essential, and that the confucian social network style behavior regulation may depend inherently on social shame, which tends to be smothering

xunzi's dim view of human nature is superficially similar to hobbes (and both came from similar times of brutal civil war) but while hobbes says "and the people have to agree to give absolute power to a dictator" xunzi says "and the people need a model for how to be better"

any confucian system is necessarily grounded in virtue, so you still have the classic problem of "what if the ruler isn't virtuous." I do think this is fundamentally unsolvable though. at the end of the day no clever government structure can work around the fact that whoever holds the final say is ultimately sovereign. checks and balances evaporate in times of crisis and we've just been lucky most of the presidents so far who got that supreme authority (lincoln and fdr being the most notable) were relatively virtuous
by anovikov | 2025-07-09 06:57:26+00:00
This. Carmaking is not viable on small scale the way carriage making is. If they all pivoted, perhaps 10 instead of 1 would have survived through 1929, the fate of all others would be the same - except staying carriage makers till the end they at least continued to extract profits, trying to all become carmakers they'd waste that money into retooling and retraining and whatnot and never made it back.
by EnPissant | 2025-07-09 07:00:33+00:00
I think the entire story was made up, but certainly the author admits much of it was made up.

> 4. If you are not 100% sure of the details, then why are there so many details in the story?

> Because with the details, the story looks much better. Do you really think that if I started each sentence with the words “I don’t remember exactly, but it seems to be ...”, then something would have changed? In the end, at the very beginning, I warned that some minor details were changed, and some were intentionally omitted - just to make the story better.

> The second important point is the site where the story was first published. I sent this story to the SAGE (System Administrators Guild) mailing list in the "incredible challenges" section. These were just stories about the most incredible tasks that management sometimes puts to system administrators.

And let's not forget the the post ends with:

> I'm looking for work. If you need a SAGE Level IV with 10 years Perl, tool development, training, and architecture experience, please email me at trey@sage.org. I'm willing to relocate for the right opportunity.

Which I think was the true purpose of the (to me) made up story.
by qalmakka | 2025-07-09 07:00:58+00:00
Exactly this. When I was younger they did an exhibit of the Great Wave and Ukiyo-e next to where I lived, so I saved the date when the ticket office opened on my calendar. I then found friends interested in coming with me and grabbed some tickets before they ran out. If you just put it on display every day it will just fade away while being yet another print in a museum full of paintings. You're denying future generations the chance love this print and cherish the opportunity to see one in person. Art is not just taking a photo and passing by, it's about appreciating the fact some human made some very special thing we can now enjoy
by klausa | 2025-07-09 07:01:08+00:00
That's fascinating response! Mona Lisa is, to me, _the_ example of an artwork that is actually better viewed online instead of in person.

The painting is way smaller than you expect, it's always crowded with folks who want to take selfies, it's behind so many layers of glass/plastic that distort the colors — it's really, really hard to actually have any chance to appreciate it person.
by donatzsky | 2025-07-09 07:03:09+00:00
While certainly an impressive effort, it's not even close to competitive yet. As is pointed out in a comment on [1] and as can be seen from the rat piss yellow in the sky, the algorithms are very much on the naive/simple side of things.

[1] https://youtube.com/watch?v=7QymsCRNRHE
by yelirekim | 2025-07-09 07:03:52+00:00
The original vulnerability description is not worded very well, here's my understanding of what's going on:

1. Attacker crafts a malicious Chart.yaml containing arbitrary code

2. Replaces Chart.lock with a symlink pointing to a sensitive file (like .bashrc or other startup scripts)

3. When you run helm dependency update, Helm processes the malicious Chart.yaml and writes the payload to whatever file the symlink targets

4. Code executes when the targeted file is next used (e.g., opening a new shell)

Why This Works: Helm follows the symlink during the dependency update process without validating the target, allowing arbitrary file writes outside the intended chart directory.
by dan_can_code | 2025-07-09 07:04:15+00:00
Climate change.

Why?

Because it's already killing people every day. And is slowly but surely making our environment entirely unstable. But as a typical consumer we don't have much power to stop it.

Do you need unlimited money? Not necessarily, but there are so many different possibilities when it comes to dealing with it. Carbon capture, green energy, (fusion?!), energy storage, planting more millions of trees, phasing out fossil fuels, holding companies accountable for their use of fossil fuels, the list goes on.

Looking at any one of these would be an expensive endeavour. Hopefully we can find small but very impactful methods in dealing with our climate troubles. Because as someone who turns 30 this year, it isn't looking promising for the next 30 years.
by lelanthran | 2025-07-09 07:04:25+00:00
> "Parse, don't validate" is a lot easier to stick to when you're coding in a language designed with a precept like that in mind vs a language designed to be only slightly more abstract than machine code

"Parse, don't validate" is easily doable in plain C and almost always has been. See https://www.lelanthran.com/chap13/content.html
by NitpickLawyer | 2025-07-09 07:05:20+00:00
I think it's a bit deeper than RBAC. At the core, the problem is that LLMs use the same channel for commands and data, and that's a tough model to solve for security. I don't know if there's a solution yet, but I know there are people looking into it, trying to solve it at lower levels. The "prompts to discourage..." is, like the OP said, just a temporary "mitigation". Better than nothing, but not good at its core.
Show HN: I rewrote an outdated React Native map clustering library
by hadat | 2025-07-09 07:07:44+00:00
Hey Hacker News,

I'm a long-time lurker and wanted to share a project I just finished building.

Like many React Native developers, I needed to add marker clustering to a map in my app. The most popular library for this, react-native-maps-clustering, was fantastic in its day but has become outdated and no longer works with modern versions of Expo, React Native, and their dependencies.

After hitting a wall of compatibility issues, I decided to take on the challenge of rewriting it from the ground up, focusing on a modern toolchain and a better developer experience.

The journey was a lot more challenging than I anticipated. It turned into a deep dive into solving dependency hell with different versions of @types/react, wrestling with build tool configurations for pnpm, bob, and ESLint, and ensuring everything was strictly typed with TypeScript. It felt like a classic case of yak shaving, but I was determined to create a solution that "just works" for developers today.

The result is RN Super Cluster, a performant, fully-typed, and easy-to-use clustering library for react-native-maps.

What it does: It provides a <ClusteredMapView /> component that you can use as a drop-in replacement for the standard <MapView />. Any <Marker /> components you place inside will be automatically clustered.

Key Features:

Modern & Maintained: Built with a modern toolchain and designed to be actively maintained. Fully-Typed: Written entirely in TypeScript to prevent common errors and improve autocompletion. High-Performance: Uses supercluster under the hood for extremely fast geospatial clustering. Spiderfier: At the maximum zoom level, overlapping markers automatically "spiderfy" (spread out on a spiral) so they can be individually tapped. Customizable: You can provide your own custom components for rendering clusters, and callbacks for handling press events.

This was a passion project born out of necessity, and I hope it can save other React Native developers the headaches I went through.

I would love to get your feedback, and contributions are more than welcome!

GitHub: https://github.com/suwi-lanji/rn-maps-clustering NPM: https://www.npmjs.com/package/rn-maps-clustering

Thanks for checking it out!
by skort | 2025-07-09 07:07:56+00:00
It's interesting that businesses can build an obviously toxic subscription model that robs consumers of both money and time, but when asked to change it now we have to consider their costs.

I understand the idea behind the threshold for changing rules but this still feels very broken. There is a constant struggle of having to do everything perfectly to make any positive progress, but bad actors can operate however they like with seemingly little repercussions.
by vladvasiliu | 2025-07-09 07:09:09+00:00
This isn't my experience, so I think people should pay attention to their specific situation.

Granted, I haven't recently been to any EU country without the Euro, but my main bank charges extortionate conversion fees, 2.sth%, with a ridiculous minimum per transaction.

A few months ago, I've ordered something off Amazon UK (while in the UK) and the conversion they offered was very close to the official GBP / EUR exchange rate, way below my bank's minimum. The price wasn't high, either, on the order of 10 €.
by chithanh | 2025-07-09 07:10:49+00:00
VLIW is maybe cool, but people will be relieving themselves on EPIC's grave for the pain that it inflicted on them.

Like if you tried to debug a software crash on Itanium. The customer provided core dump was useless as you could not see what was going on. Intel added a debug mode to their compilers which disabled all that EPIC so hopefully you could reproduce the crash there, or on other CPU architectures. Otherwise you were basically screwed.
by higeorge13 | 2025-07-09 07:10:51+00:00
I am not commenting on the interview effort-salary ratio, but the fact that credentials and experience mean nothing to the tech industry, also comparing to the rest of professions. I mean working in Google/Meta/Netflix, is like working on the best hospital if you are a doctor, in the best construction industry if you are an engineer, to best law firm if you are a lawyer, etc. Imagine having to pass a leetcode or iq test everytime you want to move to the next one. I definitely know that my cousin, who is an exceptional doctor in Greece with only 10 years of experience, laughs about it.
by Svip | 2025-07-09 07:12:09+00:00
That's because the powers that be want the euro, but the people didn't. They were asked in 1992, 1993 and 2000; and effectively they said no to the euro every time (yes, I know; in 1993, the euro was specifically opted out, but the fact that it was approved when the year before a referendum with the euro was rejected suggests – at least partially – that it was a rejection of the euro (among other things)). Denmark thus came into the EU with 4 opt-outs (one of which has since been rescinded (defence) and one which turned out not to matter (union citizenship)), and they can only be removed with referendum (see for instance the euro one in 2000).

Prior to the adoption of the euro, the Danish crown was pegged to the D-mark (since about the mid-1980s), because Germany was the biggest export market for Denmark (still is), and thus having a currency that's stable towards what the Germans are using has been good for Danish exports (less sure how relevant that still is). (Sidebar; had the original motivation of Alternative für Deutschland been successful and abandoned the Euro for a return to the D-mark (neumark?), it would have put Denmark in an awkward position.)
by dwattttt | 2025-07-09 07:12:14+00:00
The linked Processor Group documentation also says:

> Applications that do not call any functions that use processor affinity masks or processor numbers will operate correctly on all systems, regardless of the number of processors.

I suspect the limitation 7zip encountered was in how it checked how many logical processors a system has, to determine how many threads to spawn. GetActiveProcessorCount can tell you how many logical processors are on the system if you pass ALL_PROCESSOR_GROUPS, but that API was only added in Windows 7 (that said, that was more than 15 years ago, they probably could've found a moment to add and test a conditional call to it).
Ask HN: Bug Bounty Dilemma – Take the $$ and Sign an NDA or Go Public?
by deep_thinker26 | 2025-07-09 07:13:50+00:00
Hi everyone,

I recently found a high-criticality vulnerability in a listed consumer company in the UK. It allows unauthorized access to users’ private messages and even lets you impersonate other users on the platform.

They’ve offered a €1,000 bounty, but only if I sign an NDA that prevents any public write-up—even after the issue is patched.

I feel the bounty is too low for the impact, and asking to sign an NDA that prevents any public disclosure even post-fix feels like a big red flag.

I’m leaning towards declining the offer and doing a public write-up once the issue is fixed—but I’d really welcome opinions from others on what the right thing to do here is.

Thanks!
by inferiorhuman | 2025-07-09 07:14:48+00:00
There's no inherent usability issue with shooting RAW. My experience has been that none of the open source tools can hold a candle to the proprietary ones.

RawTherapee I uninstalled almost immediately because it crashed a few times and the UI didn't seem to jive with what I wanted to do.

Despite DarkTable's horrific interface and hostile developers I keep it around because I can often beat it into submission (but what a chore that is). And that's the thing. Even if I were shooting JPEGs DT's interface would still be a problem.
by lloeki | 2025-07-09 07:14:53+00:00
> I actually thought about patching the RSpec gem to remove the features I didn't like

Hmm it all sounds like you'd end up bastardising Rspec into being Minitest::Spec?

If you really like things like `expect().to` it's much easier to add it to Minitest::Spec (I did it back then, since there's `_().should` it's like 5-10 lines) than removing all those features and suffering the rspec weight.
by antonvs | 2025-07-09 07:15:25+00:00
New Scientist used to be a pretty respectable popular science magazine - it was founded in the 1950s. It had a more technical slant than something like Popular Science, and was a bit more accessible and news-oriented than Scientific American.

Once the internet started eating magazines, like many other magazines, New Scientist turned into a clickbaity, ad-heavy rag.

It's possible it's improved recently, but many people wrote it off a long time ago, which is probably why you don't hear much about it.
by Animats | 2025-07-09 07:16:56+00:00
Ideas that worked but didn't catch on:

- Virtual worlds / metaverses

You can replicate real life, but it's kind of boring.

- 3D printing

Became a useful industrial tool, but home 3D printing never went mainstream. At one point Office Depot offered 3D printing. No longer.

- Self-driving minibuses

Several startups built these, and some were deployed. Never really caught on. You'd think that airport parking shuttles and such would use these, but they don't.

- Small gas turbines

Power for cars, buses, trucks, backup power, and other things where you need tens to hundreds of kilowatts in a small package. All those things were built and worked. But the technology never became cheap. Aircraft APUs for large aircraft and the US Army's M1 tank variants remain one of the few deployed applications. The frustration of turbine engines is that below bizjet size, smaller units are not much cheaper.

- 3D TV

That got far enough that 3D TV sets were in stores. But they didn't sell.

- Nuclear power

Works, mostly, but isn't really cost-effective. Failures are very expensive and require evacuating sizable areas.

- Proof of correctness for programs

After forty years, it's still a clunky process.

- Maglev trains

Works, but insanely expensive.

- The Segway

Works, but scooters do the same job with less expense.

- 3D input devices

They used to be seen at trade shows, but it turns out that they don't make 3D input easier.

It's quite possible to guess wrong.