MurphyA/hacker-news huggingface dataset:
by xyzzy123 | 2025-07-25 08:12:18+00:00
That is authorising the transaction and it makes sense for the card issuer to handle that. It's proving that it's "you" using the card and you really intended to pay for that thing. Maybe they SMS 2FA you, maybe they have a biometric check, etc. All cool.

The case where you have a dispute with the merchant (i.e transaction is authorised but problem is 1 layer up - you feel that reality doesn't match up with the payment record!) is different. You paid as intended but the thing you wanted didn't happen. Right now things are bundled together.

Sometimes this is handled by marketplace (think amazon, vs paypal/ebay and their different balances of favouring merchant vs consumer) but overall (e.g. consider shopify who are basically uncontactable in case of merchant disputes) I don't think the whole payments system makes this very clear. In practice it is sort of a shifting balance between various parties.

There are actually big questions of who eats risk between consumer, platform, merchant and various payment processors for a given transaction and things are a bit obscured. In practice all the parties EXCEPT the consumer know what is really going on.

It could be made much more clear who has the responsibility for resolving merchant disputes and their records could be made public, and this could be a more explicit point of difference in payment / marketplace offerings.

I think lots of people would make different decisions about where and how they bought things if they could see statistics about how disputes are handled.

I am not arguing for any specific method of solving disputes or more government intervention in general, I just think that if things were more transparent (mandatory reporting) fewer people would feel ripped off, people could make more informed decisions, and marketplaces / processors who are adept at resolving disputes would be rewarded as they deserve. Basically, the market would work better.
by rfoo | 2025-07-25 08:12:35+00:00
> Calyx would be better than nothing.

Depends on your threat model. If Google, low-effort scam apps or being profiled by apps are your only adversary, then that's true. If random threats on Internet or APTs pwning your phone, or being forensic-proof are part of your threat model, then Calyx is strictly worse than stock.
by JumpCrisscross | 2025-07-25 08:13:18+00:00
Within the context, we’re talking about someone who can be trusted to be mature with a firearm. That’s more true for an average Air Force servicemember than the average American. I’d reflect OP’e scepticism if we were talking about the average Army, Marine or Navy servicemember, in large part because young men are stupid and the folks in those services skew younger than the Air Force.
by Ey7NFZ3P0nzAe | 2025-07-25 08:13:52+00:00
If you have a TypeError it's already too late. Decorating everything with beartype means I can catch things way in advance. It also forces me to specify types to all my functions which really helps LLM.

See for example in wdoc, my advanced personal RAG library:

https://github.com/thiswillbeyourgithub/wdoc/blob/main/wdoc/...
by bernoufakis | 2025-07-25 08:14:30+00:00
Your example is a strawman, as a determined enough actor, especially a security expert(s) like GOS developers could pull it off and get such patch / exploit. The probability is not zero. It will probably not be obvious to spot, would be spread over multiple files of code that don't necessarily relate to each other at first glance, as many documented CVE illustrated (one that comes to mind given HN context is the XZ utils backdoor from last year for e.g.)

Rossmann himself has no confidence to audit the code, so why take the risk ? Good enough reason to be "paranoid", or at least feel uneasy about it if you ask me.
by Cthulhu_ | 2025-07-25 08:15:08+00:00
I want to say yes, but there's a lot of regression happening right now, with right-wing rhetoric, manosphere influencers, and various regimes pushing the other way - the Trump admin firing people, removing symbols and renaming things that they consider "DEI" for example, or teenagers thinking women are property thanks to people like convicted sex trafficker Tate.

The latest is that the Trump admin wants to institutionalize the homeless and "people with mental disabilities".
by SillyUsername | 2025-07-25 08:15:22+00:00
Counterpoint. My youngest son has DS. He's an absolute nightmare sometimes.

Whereas some children might get into a mood and be ok after an hour, he does not unless his environment is changed.

He will literally scream or moan non stop for 6-8 hours (yes you read that right, and it's no exaggeration). He would do this when in environments he doesn't recognise, so imagine an airplane, imagine a restaurant, imagine a trip out...

We can't do those things anymore because of the actual judgement we get from other people (oh and I could write a post on this alone).

Then, when we return him to the car to drive home, his behaviour instantly turns to a smile and blowing raspberries.

We also can't get respite, our parents are too old, friends don't feel right babysitting, council services won't yet see him as old enough or have no availability, so it leaves us hiring privately, which is expensive, difficult and low availability.

Of course this takes its toll on our mental health, his sibling and us.

So on one hand I'm pleased it can soon be stopped for others, but on the other it makes up my son's behaviour, who I absolutely love regardless of the impact he has on us without realising, because there are times when you will see the stereotypical love and happiness when it is unexpected.

But I would not say I have greater happiness.
by rerdavies | 2025-07-25 08:15:43+00:00
And it's probable that the developer is comparing code compiled at -O0 (no optimization) against hand-coded assembler, like they did the last time they claimed a 90x speed up.

So just to to summary: either a 100x, or a 100% speedup (depending on which source)

- comparing hand-coded assembler vs. unoptimized C code.

- on a function that was poorly written in the first place.

- in code that's so rarely used that nobody could be bothered to fix it for decades.

- and even then, a tiny function whose overall CPU cost was about 2% of CPU cost to perform the obsolete task that nobody cared about enough to fix.

- so basically code that fails the profile before optimize rule, and should never have been optimized in the first place.

I think that covers it.
by jononor | 2025-07-25 08:15:53+00:00
I like the idea. But it is missing something to actually get money out of companies, I think? Because even when there are people in a company that are nominally willing to pay, there is usually so much friction/hassle to actually get money out of a company - that it most often ends up not happening for open source. Unless there is something that "forces" them.
by Cthulhu_ | 2025-07-25 08:19:23+00:00
The article is written in Go, in which - iirc - it's fairly easy and cheap to convert a type alias back to its original type (e.g. an AccountID to an int).

Using the right architecture, you could make it so your core domain type and logic uses the strictly typed aliases, and so that a library that doesn't care about domain specific stuff converts them to their higher (lower?) type and works with that. Clean architecture style.

Unfortunately, that involves a lot of conversion code.
by bernoufakis | 2025-07-25 08:19:37+00:00
> You mean who tried to hijack the project in a very questionable direction, harming their users, he rather lighted the project on fire then let the users' security be compromised? > If anything, that is the greatest compliment you could give him.

On one hand, sure it can be a compliment. On the other hand, it only increases the perception that he is could enact significant harm if he ever comes after you.

> Also, this is fud that he can push any kind of code, like you can easily check any part of the pipeline.

Who is "you" ? Neither Rossmann, neither me (software dev albeit not in cybersecurity), and even less so the average GOS user, and I would venture to guess that neither you can audit GOS code with enough confidence to declare that the risk of an exploit or backdoor being introduced is zero. Open-source is not a guarantee that code or software is secure (for e.g. CVE in xz utils and many such cases).

Edit: some clarifications.
by ddalex | 2025-07-25 08:19:46+00:00
I came to the same conclusion months ago with the advent of coding LLMs.... I used to treat code as precious, carefully saving, cataloguing and referencing git commits and SQL scripts and command line histories, because they were painful to write, and thus they are valuable. I mean, they were, because when I had the same need again, I could find previous instances and reuse stuff.

Now ? I just dump the problem into an LLM and it spits up a script that solves it, and then I throw away the script because it horribly bugged for any other case then my particular problem, but hey, I just solved my problem
by spwa4 | 2025-07-25 08:20:09+00:00
I don't agree. They got the trends right. They got the "giga$" right. They just totally failed to execute. For example, there WAS tons of money in making mobile CPUs. Intel invested in it ... and failed to make them. Despite that their mobile cpus were better, I've used them (in other words: it wasn't the technical department failing to produce good enough/better chips. It was sales and marketing failing to sell from a position of having the better product)
by oc1 | 2025-07-25 08:20:20+00:00
I'm using Claude Code - with some MCP installed - so you would assume that whole MCP thing would work with an agentic product from the makers of this standard. In 9 out of 10 cases where a MCP would make sense to use - it doesn't know when to call the MCP. And yes, i've done all the claude.md crap. There is no transparency in this protocol about how AI would know when to call an MCP (besides direct prompting). To cut short - it's not reliable.
by Kon5ole | 2025-07-25 08:20:27+00:00
>Noone seriously calculated that nuclear waste would be orders of magnitude worse than coal per TWh

Not sure what you mean here but I agree that nobody was able to predict what the cost of nuclear would actually end up being when they first started with it in the 50s.

EDF was bailed out for 50 bn despite having neglected maintenance so badly that half their plants were offline in 2022, and the first thing France did when they took over was to double the purchase price. If that's enough remains to be seen.

If you mean that you disagree that nuclear is an order of magnitude worse per TWh, then perhaps you don't know how much more energy we get from coal, or how much money, time and effort is spent on nuclear?

Just as an illustration, during the 40 years it was active, Fukushima generated as much electricity in total as the world gets from coal in one week.
by alecco | 2025-07-25 08:21:19+00:00
> I have not had the self-recall fix done

Why? Also, isn't that only an issue in early P320s? (at least according to Sig)

> and I'll never chamber a round in it again

Isn't this good enough for most uses? Heck, a long time ago I was trained to only chamber after unholstering AND entering a situation requiring quick response. The extra round not being worth the risk. 17 instead of 17+1 for the 9mm P320, right?

Honestly, this all smells like an overblown hysteria campaign to pump American brands. I would like to see the accidental discharge rate per units in use. This is one of the most popular handguns.
by bryanrasmussen | 2025-07-25 08:21:58+00:00
I have in the past, about 4-5 years ago found some aspects of documentation on MDN in the examples that did not work in browsers because not implemented at the time, as well as some lack of clarity in documenting differences between fit-content function and fit-content keyword therefore I raised an issue https://github.com/mdn/sprints/issues and got the documentation amended. However of course that no longer works for the reasons already mentioned, not sure if there is some other place or process whereby you can raise issues and get documentation changed.

on edit: the issue, 5 years ago https://github.com/mdn/sprints/issues/3723
by sparkie | 2025-07-25 08:22:43+00:00
They were already called "painted types" by same the inventor of Hungarian notation. Simonyi used this term in his PhD thesis, Meta-programming, in 1976! (Published 1977).

Meta-programming also introduced a notation which was the precursor to Hungarian Notation (page 44,45), so painted types technically pre-date Hungarian Notation.

https://web.archive.org/web/20170313211616/http://www.parc.c...

Relevant quote:

> These examples show that the idea of types is independent of how the objects belonging to the type are represented. All scalar quantities appearing above - column numbers, indices and so forth, could be represented as integers, yet the set of operations defined for them, and therefore their types, are different. We shall denote the assignment of objects to types, independent of their representations, by the term painting. When an object is painted, it acquires a distinguishing mark (or color) without changing its underlying representation. A painted type is a class of values from an underlying type, collectively painted a unique color. Operations on the underlying type are available for use on painted types as the operations are actually performed on the underlying representation; however, some operations may not make sense within the semantics of the painted type or may not be needed. The purpose of painting a type is to symbolize the association of the values belonging to the type with a certain set of operations and the abstract objects represented by them.
by aa-jv | 2025-07-25 08:22:57+00:00
Same. I grew up with computers. I wrote games on my Oric like my life depended on it (well, it was because that was the only way to get any games on the Oric..)

I stopped playing video games after a stint at a popular video game company, where I realized that the purpose of the company was basically to trap teenagers in a box, like rats, and watch them try to get out.

Flight sims are about all I can be bothered to invest in, time-wise these days. Oh, and I love my retro- collection. I frequently find myself MAME'ing out, just for the nostalgia. Crazy Climber and Scramble and Juno First and Defender, in case you're wondering.

Synthesizers, on the other hand - I just can't get enough.

Not all nerds are gamers. Some of us are knob tweakers too.
by csmattryder | 2025-07-25 08:23:31+00:00
I got it installed last weekend, really powerful mobile OS.

I did do about three weeks of research, as I worried that maybe a number of apps wouldn't run on it or needed some form of deep attestation. Didn't find much, OpsGenie and other work apps are happy with the GOS level of attestation provided.

Great to have Google kicked off the phone. So nice to shut off the network permission for any apps that only require an internet connection to serve ads.

One tip from me, if you came from stock Pixel: You can download the default Pixel sounds and set them up like it was. Have a look for "Your New Adventure" online, the message sound is "Eureka".
by snorlaxmorlax | 2025-07-25 08:23:31+00:00
Hi, I'm from of the MDN team. While the team was briefly scaled down to just two members and a few contractors, we've since grown significantly.

Today, MDN is supported by a thriving team of 15, comprising core staff, contractors, and a broad network of partners and contributors who generously share their expertise to keep MDN strong and up to date.

Our team → https://developer.mozilla.org/en-US/about#our_team
by iamkonstantin | 2025-07-25 08:24:08+00:00
Apart from the UI being more point and click, what does Kiro (or Cursor) add that for example Claude Code's CLI doesn't do?

> With Kiro, I spend more time upfront articulating what I want to build, but then I can step back and let it execute

This sounds like exactly the kind of exercise one does to /init a project with Claude, define tasks/spec etc.
by richrichardsson | 2025-07-25 08:24:32+00:00
> it's an incredibly complicated and poorly documented

So much this. I was interested in using WiX, but it's just impenetrable for a noob, and any "beginners" guides were either hugely out of date or just assumed you understood what GUID you should be using and if it was important or not to change the example they gave. Quickly gave up. :(
by rob74 | 2025-07-25 08:24:53+00:00
The article shows no such thing. The crowds of people are not the root cause most of the time - if the buses would come at regular intervals, statistically they would all have the same delay because of passengers. But if a bus is already delayed ("if Bus B is delayed by traffic congestion, it incurs a penalty"), there will be more people waiting, which will slow boarding, which leads to more delays, which leads to even more people waiting at the next station etc. But of course, the cause for the initial delay is not always traffic congestion, it can also be a bus breaking down, a large group (e.g. a school class) boarding the bus etc. So dedicated bus lanes (and other measures such as buses/trams being able to influence traffic lights) can't completely eliminate bunching.
by Imustaskforhelp | 2025-07-25 08:25:19+00:00
Now, I am all for it except the fact that I've heard that some people have actually recommended the wayland protocol + wasm to be a better alternative really.

And I personally feel like (I may be wrong) that at the end your proposal and the wayland proposal might be the same..

The problem with wayland protocol/your proposal is the fact that such things have already been tried (java applets) and they were insecure, and accessibility was a mess, so reverting back to it does feel like a massive chaos since javascript was created to solve that problem..

I am not a js advocate, honestly I wish that ephemeral running of apps cross platform becomes genuinely easy (in my mind nix-shell comes) There is htmx which is nice too I guess but I think I still need some js to sprinkle in some more interactivity/animations.

Astro with htmx / islands architecture kinda feels the best, imagine using svelte/vue/react and htmx+golang in the same project..
by rkrisztian | 2025-07-25 08:25:24+00:00
On the GrapheneOS forum you will see a lot of bad opinions about F-Droid, for example this:

> It doesn't matter that the app is trustworthy, because F-Droid are extremely incompetent with security and the apps you install from F-Droid are signed by F-Droid rather than the developer.

https://discuss.grapheneos.org/d/20212-f-droid-security-in-s... https://discuss.grapheneos.org/d/18731-f-droid-vulnerability...

They also say, if you use F-Droid, at least use F-Droid Basic:

> Dont use the main F-Droid client. Android is pretty strict about SDK versions and as F-Droid targets legacy devices, it is very outdated.

https://discuss.grapheneos.org/d/11439-f-droid-vsor-droid-if...

> If the app is only available on F-Droid / third party F-Droid repo, use F-Droid Basic and use the third party repo rather than the main repo if available. > > If the app is available on Github then install the APK first from Github then auto-update it using Obtanium. Be sure to check the hash using AppVerifier which can be installed from Accrescent (available on the GrapheneOS app store).

https://discuss.grapheneos.org/d/16589-obtainium-f-droid-bas...

By the way, while GrapheneOS recommends Accrescent, I don't use it anymore because they can't even add apps like CoMaps, while some of the apps they actually added are proprietary.
by kelnos | 2025-07-25 08:26:11+00:00
This is true, but I don't think the extra calorie burn via extra muscle mass is dramatic enough to move the needle that much. Studies are a bit weak here, but a quick search suggests that a pound of muscle mass burns between 4.5 and 7 calories per day. That's... not that much. A bodybuilder that's putting on competition-worthy levels of muscle mass is going to be spending several hours every single day at the gym lifting weights, and very few people are going to sign up for that just for the hope of losing some weight.

I've been doing some strength training (arms, legs, core) for the past year and a half. Nothing too heavy, but enough that I can see nice muscle-tone changes in my body, and I notice that day-to-day physical tasks are easier. At most, I've put on about 10lbs of muscle (and honestly it's probably more like half that). So I'm burning another 45 to 70 calories per day. That's like... 4 to 7 plain potato chips of calories.

So lift if you want to look good, be generally stronger (core strength is especially good for you!), or just feel healthier. And sure, the act of lifting those weights will burn calories that you weren't otherwise burning. But the muscle mass you gain isn't going to burn a useful amount of extra calories per day.

And yes, cardio does suck! Unfortunately, doing only strength training is leaving out really important parts of your body that need to be strong and healthy: your heart and lungs. I'm in decent physical shape, but if I stop working on cardio even for a month or so, walking up the four flights of stairs in my condo building leaves me a little winded, and I don't like that feeling.

I guess my point is: do cardio and strength training to increase your general level of health and fitness. But if you want to lose weight, change your diet. Change it sustainably and permanently. If you just change it until you get to your target weight, you're going to put those pounds right back on afterward.
by bloppe | 2025-07-25 08:27:07+00:00
You're applying macroeconomic theory to microeconomics and it isn't working. individuals will broadly try to maximize their own productivity and minimize their own costs. I'm not gonna pay an extra 20% for the same product everyone else is getting cheaper when my individual contribution to "national economic health" is a drop in the bucket. If that's what society wants then we'll have to tax and subsidize our way there. That's just how macro works
by rafaelcosta | 2025-07-25 08:27:25+00:00
There's a reason why this went from widely supported/used to... not so much. And even if most people claim it's big-co's locking down their ecosystems (which is partly true), the "extensibility" of XMPP allows for a very convoluted ecosystem with some servers supporting certain XEP and some not. Also, sorry, but XML just sucks to work with nowadays :(
by sqrtc | 2025-07-25 08:27:52+00:00
I tried out Kiro last week on quite a gnarly date time parsing problem. I had started with a two hundred-ish word prompt and a few bits of code examples for context to describe the problem. Similar to OP it forced me to stop and think more clearly about the problem I was trying to solve and in the end left my jaw on the floor as I saw it work through the task list.

I think only early bit of feedback I had was in that my tasks were also writing a lot of tests, and if the feedback loop to getting test results was neater this would be insanely powerful. Something like a sandboxed terminal, I am less keen on a YOLO mode and had to keep authorising the terminal to run.
by berkes | 2025-07-25 08:28:41+00:00
> commonly distributed with torrents

This is the key part. And it's not certain this happened. Not defending AI data gobbling, but if we truly and honestly want to fight big-AI use of content, we cannot just presume bad faith. OpenSubtitles.org has a large dataset that is "public". It is be a dataset perfectly suitable, intended for, and therefore used for, training and data analysis.

I've used it for data analysis.
by gneuron | 2025-07-25 08:28:52+00:00
Arguably he already did with the $40B round from Masayoshi Son, who essentially committed only $10B and the other $30B was conditional on OpenAI converting from a non profit by the end of the year, but now that possibility is in question because OpenAI and Microsoft can't agree on a deal (and Microsoft controls whether or not OpenAi converts to a for profit, and when).