MurphyA/hacker-news huggingface dataset:
by atlasunshrugged | 2025-07-16 21:42:13+00:00
Wow, I have to say it's a bit crazy that you have to go through all this effort in what I think of as quite a safe city. I was recently in London for a week of meetings and someone said be careful about having your phone out in case someone snatches it but I thought they were being hyperbolic.

Why isn't there a bigger crackdown on such petty crime? I guess people think they can get away with it, but it feels like one of those creeping issues that might seem small at first but deters important activity (tourism, business relocation, etc.) longterm if not addressed.
by 762236 | 2025-07-16 21:42:19+00:00
I won't touch Python either, but because I've been burned debugging large Python programs. Something that would have taken a minute in a statically typed language took hours of tracing data through the program to understand what was supposed to be in a dict. There are alternative languages that are pithy, statically typed, can write programs quickly, and can grow into large code bases that are maintainable; so there is never a reason to start a new project with Python today.
by em-bee | 2025-07-16 21:43:34+00:00
how does a cop verify the veracity of someone random claiming to have lost all forms of identifications

they don't. but if the police is not willing to help you get your stuff back then whats the point? but even if they can't do anything, one point is to create a paper trail. i mean, even if you lost your passports, or, say they got accidentally destroyed, you would still file a police report just to document that fact. i am not trying to pick on your memory, but that they didn't let you file a report is highly unusual, and it can't be your fault.
by BeetleB | 2025-07-16 21:43:44+00:00
If you're an expert in make and already have a Makefile, I would not recommend switching to just for that project.

The benefit of just is that it's designed to be a command runner, whereas make is designed to be a build tool. justfile syntax is much simpler and more ergonomic. It also has nice features: Private recipes, submodules, recipes that you can specify to run only in a particular OS (we use the same justfile for both Windows and Linux), writing your recipes in a language other than your shell language, and many many other niceties.

A new user can start doing "advanced" stuff in just in a couple of hours. They'll take a lot longer if trying to do it via make.
by _DeadFred_ | 2025-07-16 21:44:22+00:00
I thought we were talking about CURRENT CEOs. My story was the norm for my generation with boomer parents, not atypical, and you know...the generation that typically make up CEOs currently.

Wasn't meant to be gaslighting but instead my observation from growing up in the bay area and seeing mine and my friends trajectories. We anglos has a lot handed to us, a lot. But the lack of support lead to a lot of setbacks/starting over that others more quickly overcame because of family/support networks, allowing them to ultimately rise higher. Fun fact, if you restart mid race, you oftentimes lose the race. That's not a sob story, just how it goes.
by GuB-42 | 2025-07-16 21:45:12+00:00
> I don't think I've written any production code in years where I gave up because it was intrinsically not possible.

What I meant by "not possible" is writing both sides of the API at the same time. For example, you write a library for overlaying maps on video feeds, it is good if you are also writing the application that uses it. For example a drone controller. So in the early phase, you write the library specifically for your drone controller, changing the API as needed.

But sometimes, the drone controller will be made by another company, or it may be a project too big not to split up, that's the "not possible" part. And without a clear, in control use case, you have to make guesses, and writing tests can help make good guesses.
by jowea | 2025-07-16 21:45:34+00:00
I've contributed some packages to NixOS, I didn't do code review and as far as I can tell nothing told me I had to. I assume that if I had said the code was hosted at mispeledwebsite.co.cc/foo in the derivation instead of github.com/foo/foo or done something obviously malicious like that the maintainers would have sanity checked and stopped me, but I don't think anyone does code review for a random apparently useful package. And if github.com/foo/foo is malicious code then it's going to go right through.

And isn't the Debian mentoring and reviewing merely about checking if the package is properly packaged into the Debian format and properly installs and includes dependencies etc?

I don't think there is anything actually stopping some apparently safe code from ending up in Linux distros, except the vague sense of "given enough eyeballs, all bugs are shallow", i.e. that with everyone using the same package, someone is going to notice something, somehow.
by ajross | 2025-07-16 21:45:36+00:00
> I don't think the majority of my code was actually reviewed for malware.

That's not the model though. Your packages weren't included ab initio, were they? They were included once a Debian packager or whoever decided they were worth including. And how did that happen? Because people were asking for it, already having consumed and contributed and "reviewed" it. Or if they didn't, an upstream dependency of theirs did.

The point is that the process of a bunch of experts pulling stuff directly from github in source form and arguing over implementation details and dependency alternatives constitutes review. And quite frankly really good review relative to what you'd get if you asked a "security expert" to look at the code in isolation.

It's not that it's impossible to pull one over on the global community of python developers in toto. But it's really fucking hard.
by PaulHoule | 2025-07-16 21:46:00+00:00
My Uni has site licenses for many products such as Snagit 2025 and if I want a license for that the skids are greased. You did everything right from the viewpoint of an early adopter, in the future I guess your sales people could talk to our Central IT and negotiate something, if you send me an email I could try to find out how you would talk to.
by tartoran | 2025-07-16 21:46:30+00:00
I think Russia would be able to project far much more power had they not attacked Ukraine and entered this long war. At this point the russian bear appears to be made of cardboard, low grade cheap cardboard. Not sure how long they'll be able to sustain this but the more they do the weaker they'll become. They've been losing a lot of ground in the Middle East and Asia as well.
by legitster | 2025-07-16 21:46:35+00:00
I'm kinda with you that in most situations corporations would probably be better off hiring slower and then riding out downturns on cash.

But big picture I disagree. We kind of need creative destruction in an economy - we need to be able to lay off people in horse buggey industries so that they can be hired to make Model T's. We're better off focusing on our social safety network and having a job market that encourages some amount of transit between careers.
by delusional | 2025-07-16 21:47:10+00:00
Even better would be to only check each once and buffer the decision:

valid = True if not API_KEY: print("Missing YOUTUBE_API_KEY.") valid = False if not CHANNEL_ID: print("Missing YOUTUBE_CHANNEL_ID.") valid = False if not valid: exit(1)

This way you only check each value once (because your logic might be more complicated than just checking it's not set, maybe it can be wrongly formatted) and you still get to do whatever logic you want. It also removed the combinatorial problems.

This is a pretty general principle of separating decision from action.
by readthenotes1 | 2025-07-16 21:47:18+00:00
"And nobody seems to think about the period of history they fetishize (the 1950s) had the highest marginal tax rate of 91%."

Don't forget that it also had the highest level of tax dodging available through various mechanisms.

If you think the lengths people go to now are extreme to avoid taxes-- think about what they did were willing to do then.
by pbson639 | 2025-07-16 21:48:10+00:00
Hi HN! I've built Cardamon, a simple command-line tool that measures the carbon footprint and energy consumption of web pages during development.

Why I built this: - The web accounts for ~4% of global carbon emissions - Most developers have no visibility into their site's environmental impact - Existing tools only work for site already in production, not during development.

I'd love feedback on: - What metrics would be most useful for your workflow? - Integration ideas (CI/CD, build tools, etc.) - How to make sustainability metrics more actionable for developers
by ivan_gammel | 2025-07-16 21:48:37+00:00
I think you are exaggerating Russian problems quite a bit. It’s certainly more stable than in 1990s or early 2000s. The peace deal will very likely force Ukraine and consequently its allies to recognize acquisitions at least de facto (Crimea may get formal recognition). Even if they won’t, there’s no plausible scenario in which Russia will lose this territory. Demographics — yes, but immigration may solve it for a while. 1 million people „brain drain“ wasn’t the right number anyway and there’s ongoing correction: many continued to work for Russian companies, some are returning back now disillusioned by the West,
by dlivingston | 2025-07-16 21:48:52+00:00
To correct some misconceptions for readers:

Operating systems do not implement graphics APIs for GPUs. These are created by the GPU manufacturer themselves (AMD, Nvidia, etc.). This includes DirectX drivers, both user-space and kernel-space drivers.

Graphics APIs like DirectX and Vulkan are better thought of as (1) a formal specification for GPU behavior, combined with (2) a small runtime. The actual DX/VK drivers are thin shims around a GPU manufacturer's own driver API.

For AMD, the DirectX / Vulkan / OpenGL graphics drivers share a common layer called "PAL" which AMD has open sourced: <https://github.com/GPUOpen-Drivers/pal>

Apple really isn't that different here: they leave the graphics manufacturers to implement their own drivers. Unfortunately, Apple is the sole graphics manufacturer for their OS, and they've chosen to only implement Metal drivers for their GPUs (and a legacy OpenGL driver too).

It's not that big of a deal though, because Vulkan is supported on macOS through the MetalVK project, which wrap the Vulkan API around the Metal API. And projects like vkd3d wrap the DirectX 12 API around the Vulkan API, which is then wrapped around the Metal API. This is how you're able to run Windows games on Mac via the Game Porting Toolkit or CrossOver, btw.
by zizee | 2025-07-16 21:49:02+00:00
I personally don't think we'll all die due to climate change, but i could easily see it set off massive problems like wars over resource shortages.

The pandemic demonstrated that the global economy is a finely tuned machine. It doesn't take much to upset the operation of such a beast, and a big interruption could have massive unforseen consequences.

Think about it like a complex, mission critical software system. Are you going to make big changes in many key areas and rush them out to prod? Or do you want to release them individually over time.
by handoflixue | 2025-07-16 21:49:11+00:00
Do you hate AI enough to nuke China when they refuse to stop building their own AI?

Once it exists, anywhere, the job market is toast - banning it in the US just means outsourcing all the economic benefits to China. We have a long history of technological revolutions to demonstrate this: the un-industrialized nations fared a lot worse than the ones at the frontier of technology.
by Tainnor | 2025-07-16 21:49:22+00:00
My main problem with Maven is that it's dog slow and incremental compilation doesn't really work, especially on CI. For huge repos that's a real issue.

In a sense I feel that part of the microservice craze is due to the fact that many of our build systems are not good enough to allow us to work with huge monoliths efficiently. Gradle is a bit better (definitely faster), but comes with additional complexity. Haven't tried Mill.
by navi-desu | 2025-07-16 21:49:33+00:00
and how is that any different from system services doing `ExecStartPre=/usr/libexec/my_setup_script.sh`? or worse, 20 different `ExecStartPre` lines that basically build a shell script in the ini file, one line at a time

services are not simply a set of knobs to start a single process, often they don't even have processes (e.g. wg-quick)

and even when they do, it often involves setup, and sometimes cleanup.

systemd has to provide the exact same functionality, even if they put a .ini-paint of coat in it -- the difference is that openrc doesn't make services install N helpers scripts for that. Really, "Not being turing complete" is a useless metric for "stopping complexity in init setups"

the way you stop complexity is by giving pre-configured functionality that is easy to use. systemd did that very well, openrc does do that for a lot of things already, and we're adding more as we see the common need of init scripts for said features
by ibejoeb | 2025-07-16 21:49:38+00:00
"Last year we upleveled our Private Browsing mode."

Hah, perfect. I recently got a contract to "upskill" a team. I mean, I kinda get it: training, right? But I was not confident that I really did understand it, specifically. I asked what the hell that meant and was met with a lot contorted phrases to describe it. Sure enough, training.

We're inventing work...
by strcat | 2025-07-16 21:50:16+00:00
> I don't think GrapheneOS supports it, but back in the day I dual-booted my Oneplus One at some point. That solution worked on Windows with DRM and anti-cheat, so it may be a partial solution on Android too.

It's not compatible with the hardware-based security features and atomic A/B update system.

> I imagine at some point a ROM might use pKVM to boot a copy of Android that passes Play Integrity checks through the necessary spoofs without altering the host OS.

Spoofing is not going to pass the Play Integrity API strong integrity level and the device integrity level will keep moving closer to enforcing hardware attestation too.

> The Play Integrity API is working. Banking apps rejecting GrapheneOS' hashes has nothing to do with Google Android vs AOSP and everything to do with what the banks decide is an acceptable risk.

Play Integrity API does not allow anything other than Google Mobile Services devices with the stock OS to pass the device or strong integrity levels. Passing any of basic, device or strong requires being logged into a Google account now too. GrapheneOS provides full support for hardware-based attestation which apps can use to permit both any stock OS and also GrapheneOS or other alternate operating systems. Most apps choose to simply do what Google recommends of not allowing anything not licensing Google Mobile Services with no check for minimum patch level, etc. It's not really a security feature.

> GrapheneOS implements everything the Play Integrity API needs and is completely honest about doing so.

We do, but Google chooses not to allow GrapheneOS. They may be forced to change that soon due to EU regulation. Several apps in the EU have chosen to permit GrapheneOS via using the hardware attestation API themselves but what's really needed is Google being forced to do it.

> That's unlike many custom ROMs that lie to Google and spoof a device that doesn't support hardware attestation, which makes many banking apps work.

That only passes the device integrity level and many banking apps are moving to the strong integrity level. It's also getting harder to do it and Google has detection for it which is being used for an extremely slow moving crackdown on it. They're likely doing it so slowly to avoid making too many people angry at once leading to serious pushback against it. They're mostly fine with people passing it for now, which they can detect is happening via their fingerprinting system. They're choosing to allow it when it's not for wide scale abuse. They would prevent it if an OS like GrapheneOS with 350k+ users deployed it with perhaps around half of the users were using it due to using sandboxed Google Play. If we made it a toggle, it would still likely be too large scale to get away with it.
by testing1235 | 2025-07-16 21:50:43+00:00
I'm currently a senior in university (Dual CS and Computer Engineering), and I can say that it looks unbelievably grim in the Computer Science side of things.

In my classes there is hardly anyone that has been able to get their hands on an internship, and even the professors have started their classes with monologues about "I don't even know why you show up, none of you will have jobs after graduation, good luck out there." (quote from my DS professor) A lot of my peers are looking to move out of the US and look for jobs elsewhere, or perhaps jump straight into graduate school to ride it out.

On the Computer Engineering side, the faculty seems a lot happier, and the students also seem to be better off. But I don't think this will last however, I have noticed a steady decline in the businesses that have been searching for Computer Engineering in our career fairs. When I enrolled there were about two dozen "Computer Engineering Wanted" posters at the fair, and the last one in Feb 2025 I only counted one.

I'm honestly thinking that if this continues I'll be looking at the military, right now I'm trying to work on side projects in the meantime.
by cadamsdotcom | 2025-07-16 21:52:33+00:00
AI buttons are a fad, they’ll be gone soon. Just like Clippy (an assistant for Microsoft Word in the 90s). https://m.youtube.com/watch?v=3G_uCbKoG5A&pp=ygUGQ2xpcHB5

The real uses of AI will be far more subtle.
by chaosharmonic | 2025-07-16 21:52:42+00:00
Can confirm, I myself was a one person support desk (for a restaurant chain) and just never officially had a title. The internal moniker of "the IT guru" was fine for an email signature, but certainly not for a resume. (I've since made other retroactive edits to that, both for something more sensible and to better represent years of scope creep.)
by kassah | 2025-07-16 21:52:44+00:00
The simplicity of Git is awesome. Great article! I had looked at what it would take to find a single file in a remote git repo. I decided against talking the git protocol directly and just checking out the entire repo to get a single file. Reading through this makes me think I may have given up too easily.

I asked a few git hosting providers, and they all said they had private APIs developed internally for the purpose.
by hnlmorg | 2025-07-16 21:53:09+00:00
For some reason, this part of my message didn't get sent

> Almost nobody takes part in skiing, it's niche.

You are aware that there are hundreds of ski resorts? Particularly in Europe. It's a massive pastime in the mountains around here.

In fact it's actually a rather mainstream hobby.

> So does track & field but most of those sports are incredibly niche.

It's on TV multiple times a year in the UK. And I'm talking about the main terrestrial TV channels (of which we only have 5). Not satellite nor cable.

Track and Field athletes are big name celebrities here too. Which does not happen with niche sports.

And that literally every school from infants to secondary school teaches T&F and even devotes an entire day each year for track and field events. They call it "Sports Day".

In fact almost all UK schools, even small village primary schools/kindergartens, also have facilities for T&F.

It's not niche.

---

If you want to talk about niche sports, then talk about handball, polo, croquet, shuffleboard, bar billiards, etc. Not stuff that is on TV regularly and taught at every school.

This might be a cultural thing and you just don't see much of these sports where you are. But you could at least research these sports before claiming they're niche.
by woodruffw | 2025-07-16 21:53:30+00:00
> did someone else from the distribution do the work?

Someone else.

To be clear: I find the Debian maintainers trustworthy. But I don't think they're equipped to adequately review the existing volume of a packages to the degree that I would believe an assertion of security/non-maliciousness, much less the volume that would come with re-packaging all of PyPI.

(I think the xz incident demonstrated this tidily: the backdoor wasn't caught by distro code review, but by a performance regression.)
by HarHarVeryFunny | 2025-07-16 21:53:49+00:00
LLMs are just trying to mimic (predict) human output, and can obviously do a great job, which is why they are useful.

I was just referring to when LLMs fail, which can be in non-human ways, not only the way in which they hallucinate, but also when they generate output that has the "shape" of something in the training set, but is nonsense.
by floren | 2025-07-16 21:54:11+00:00
Highly, highly, highly recommend you enable 911 calls by default on all plans -- let parents disable it if they want. Cell phones do this, even without a SIM card. Don't gate safety for $9.99/mo.

Edit: "The FCC requires that providers of interconnected VoIP telephone services using the Public Switched Telephone Network (PSTN) meet Enhanced 911 (E911) obligations." https://www.fcc.gov/consumers/guides/voip-and-911-service

Also "911 Services: Providers of "interconnected" VoIP services – which allow users generally to make calls to and receive calls from the regular telephone network – do have 911 service obligations" https://www.fcc.gov/consumers/guides/voice-over-internet-pro...
by sevensor | 2025-07-16 21:54:49+00:00
It’s really not hard; the person you’re replying to put a lot of details in. I’ve lost track of how many times I’ve built a Python interpreter. Virtual envs used to work badly with some tools and dependencies, so I had to do it a lot. It’s gotten better and now I only compile Python to get a version that’s not provided by my Linux distribution.
by chaosharmonic | 2025-07-16 21:54:57+00:00
Lots of things are anti-American behavior.

Most of those things aren't joining up with a foreign adversary with whom we're officially at war.

Even things that are treasonous in a colloquial sense are still pretty narrow, and tend to refer to other specific forms of betraying your country, that just happen to be other crimes -- like espionage, or insurrection.
by Expurple | 2025-07-16 21:55:03+00:00
> In practice, I never had a problem with "restrict".

That's exactly because it's too dangerous and the developers quickly learn to avoid it instead of using it where appropriate! Same with multithreading. C leaves a lot of optimization on the table by making the available tools too dangerous and forcing people to avoid them altogether.

That's how you get stuff like memory-safe Rust PNG decoders being 1.5x faster than established C alternatives that had much more effort put into them (https://www.reddit.com/r/rust/comments/1ha7uyi/memorysafe_pn...). Or the first parallel CSS engine being written in Rust after numerous failed attempts in C++ (https://www.reddit.com/r/rust/comments/7dczj9/can_stylo_be_i...). Read those threads in full, there are some good explanations there.

> you need to exaggerate the practical problems in C

I thought, the famous "70% of vulnerabilities" report settled this once and for all.
by jauntywundrkind | 2025-07-16 21:55:23+00:00
There's so many nice usable bits of hardware out there for video doorbells. Ezviz, Amcrest, Aqara, Reolink.

There's Frigate, which is incredible for webcams. Amazing. But I don't think it deals with the bell itself. But I suspect many have a separate chime unit that would at least work ok, of you aren't trying to also bring and bodge Home-Assistant or whatnot into the mix too.