MurphyA/hacker-news huggingface dataset:
by Biologist123 | 2025-07-09 14:01:38+00:00
This was a great positive start to the day. Thanks whoever posted that.

One point curious in its omission is whether the growth of renewables outpaces the depletion of our carbon budget. Presumably that’s the critical metric in all of this.

[Edit: I ran this question through ChatGPT and the initial (unvalidated) response wasn’t so exciting. This obviously put a dampener on my mood. And I wondered why people like McKibben only talk about the upside. It can sometimes feel a bit like Kayfabe, playing with the the reader’s emotions. And like my old man says: if someone tells you about pros and cons, they’re an advisor. If someone tells you only about pros, they’re a salesman.]
by vectorcamp | 2025-07-09 14:02:27+00:00
I agree. Most developers don't need to write SIMD code. Some do however and those need good documentation to write good SIMD code, even more so when it comes to porting.

Interesting that you mention Eigen. Long before I started my company VectorCamp, wrote the original Altivec/VSX, Arm and Z ports for Eigen and it took me a lot more to do a proper port back then -iirc I started that effort in 2008- than it would take me now, because now the tools are far far better. I started this company to provide SIMD optimizations for all architectures and this tool SIMD.info began because I wanted to help other developers find the information that I wish I had back then. It's that simple.

For me and my company, anything that needs to be performant critical to be written in a compiled language like C, C++, Rust -and now Zig- is worth optimizing. How much depends on your time, money and skills. Not everything needs SIMD of course. But it's definitely NOT only for library and compiler developers. You would be surprised how much SIMD code is even in application code out there. It all depends on the expectations and the required performance. Also, some of the libraries don't utilize all available instructions.

My 2c.
by 0x000xca0xfe | 2025-07-09 14:02:56+00:00
I guess multiprocessing got a bad reputation because it used to be slow and simple so it got looked down upon as a primitive tool for less capable developers.

But the world has changed. Modern systems are excellent for multiprocessing, CPUs are fast, cores are plentiful and memory bandwidth just continues getting better and better. Single thread performance has stalled.

It really is time to reconsider the old mantras. Setting up highly complicated containerized environments to manage a fleet of anemic VMs because NodeJS' single threaded event loop chokes on real traffic is not the future.
by AbsintheLabs | 2025-07-09 14:03:14+00:00
Absinthe Labs | Senior Full-Stack Engineer | Remote or NYC Hybrid

Absinthe Labs is making loyalty markets more efficient. With over 20M visits and 2M+ users since our founding in 2022, we built the first Web3-native customer data platform that powers points programs across the digital landscape, and we’re now seeking a Senior Full-Stack Engineer with a love of FE to expand our capabilities.

Role Highlights:

Platform Development: Design and build user-centric interfaces for incentive designers using Radix UI, Tailwind CSS, and Next.js, ensuring scalable backend services using Node.js and GraphQL. Data Architecture & APIs: Develop data pipelines, integrated with Hasura (GraphQL), PostgreSQL/DuckDB, and optimize our server-side logic for high-performance data retrieval. Dynamic Builder Tools: Engineer zapier-like interfaces to configure data sources and build a WYSIWYG loyalty portal editor. End-to-End Product Ownership: Architect, deploy, and maintain services across the stack, ensuring secure SSR and swift API interactions.

What You Bring:

Experience: 5+ years in full-stack engineering, ideally in B2B SaaS, Fintech, or Web3 consumer apps. Frontend: Strong experience in React, Next.js, and transforming Figma prototypes into polished UIs using Radix UI, Tailwind CSS, and shadcn. Backend: Proficiency in Node.js, GraphQL (Hasura) and designing secure, scalable backend architectures. Cloud & Security: Familiarity with AWS (Amplify, Cloudfront), containerization (Docker/Podman), and security best practices (e.g., CORS, CSP). DevOps & CI/CD: Experience with automating deployments, optimizing database queries, and maintaining a smooth developer experience using modern CI/CD pipelines. Startup Agility: Thrive in a fast-paced, impact-driven environment.

Why Absinthe Labs?

High-Impact Work: Join a tight-knit team shipping Web3 loyalty infrastructure that directly influences millions of users. Flexibility: Work remotely or from NYC Hybrid. Compensation: Competitive salary (region-based) + equity in a high-growth Web3 startup.

Apply Here: https://absinthelabs.notion.site/Senior-Fullstack-Engineer-1...
by ethbr1 | 2025-07-09 14:03:55+00:00
Some features are literally too radioactive to ever implement.

As an example, because in hindsight it's one of the things MS handled really well: UAC (aka Windows sudo).

It's convenient for any program running on a system to be able to do anything without a user prompt.

In practice, that's a huge vector for abuse, and it turns out that crafting a system of prompting around only the most sensitive actions can be effective.

It takes time, but eventually the program ecosystem updates to avoid touching those things in that way (because prompts annoy users), prompt instances decrease, and security is improved because they're rare.

Proper feature design is balancing security with functionality, but if push comes to shove security should always win.

Insecure, functional systems are worthless, unless the consequences of exploitation are immaterial.
by nashashmi | 2025-07-09 14:04:02+00:00
ELI5: FTC said the rule is a cheap expense on corps. An admin judge says it is quite expensive. FTC is supposed to follow a particular procedure for expensive rules. FTC didn’t follow so judges ruled against the regulation.

FTC is better off staying away from regulations and instead making a vague rule prohibiting companies from complicated cancellation processes if they are to be charging recurring fees. The “complicated process” would be subjective but enough to encourage companies to avoid setting up a cancellation process (bypassing the expensive burden rule) and maybe the company then chooses a simpler cancellation option.
by mathewpregasen | 2025-07-09 14:05:41+00:00
Oso posted a blog post [1] about this yesterday that's quite informative. I separated posted it on HN [2], but linking here.

[1] https://www.osohq.com/post/why-llm-authorization-is-hard [2] https://news.ycombinator.com/item?id=44509936
by sumtechguy | 2025-07-09 14:05:44+00:00
Basically if the thing you are doing can be precomputed. Then you can use a lookup table. Then at that point do you have the space for it? Is the time to get it out of memory less than the operation you are caching in the lookup table. Then it could be a good candidate for a lookup table. Many times that can be true. But not always. Even if that is all true you can end up hurting something else because your lookup table evicted something else important from the l1/l2 cache. So you also have to test it in context.
by kevindamm | 2025-07-09 14:05:45+00:00
One uses POST and recognizes that REST doesn't have to be so prescriptive.

The part of REST to focus on here is that the response from earlier well-formed requests will include all the forms (and possibly scripts) that allow for the client to make additional well-formed requests. If the complex filters are able to be made with a resource representation or from the root index, regardless of HTTP methods used, I think it should still count as REST (granted, HATEOAS is only part of REST but I think it should be a deciding part here).

When you factor in the effects of caching by intermediate proxy servers, you may find yourself adapting any search-like method to POST regardless, or at least GET with params, but you don't always want to, or can't, put the entire formdata in params.

Plus, with the vagaries of CSRF protections, per-user rate-limiting and access restrictions, etc.,, your GET is likely to turn into a POST for anything non-trivial. I wouldn't advise trying for pure REST-ful on the merits of its purity.
by ImPostingOnHN | 2025-07-09 14:05:50+00:00
Thank you, your explanation helped me understand that the profile can itself be an application (and thus can be an exploit), and that different profiles/applications are not isolated from each other. I will be careful installing profiles from untrusted sources on my phone*.

Is there a remote attack vector against my phone/eSIM which doesn't require first compromising the network service provider? Not that I'm dismissing other vectors as unimportant, just trying to learn more.

* - I do realize that a network operator viewed as "trusted" may be untrusted under the right circumstances, like sufficient pressure from sufficiently official or powerful actors.
by baq | 2025-07-09 14:05:54+00:00
zigbee has one great advantage over everything else: it's immune to DHCP and DNS failures and misconfigurations. if you're running a pihole or something, it can break iot devices in random ways if your DHCP server boots after your access points. (don't ask me how I know and the fix was to hard reboot my lights by cycling power in the distribution box. not great, not terrible.)
by southernplaces7 | 2025-07-09 14:05:55+00:00
As you yourself say, there was no Earthly force that could have tumbled the USSR from outside. It was decrepit in many ways, but it was also a vastly powerful militarized nation with a vast territory, plenty of resources still at its disposal and of course, its huge nuclear arsenal.

The USA emphatically did not degrade the USSR down and it's not to blame for its collapse either. The idea is absurd and mis-attributes blame, which really lies with the Soviet leadership's own choices in misplaced spending priorities, poorly thought out political strategy changes and finally, a refusal to put economic improvement before political liberalization that was haphazardly applied and escaped their control, with Gorbachev ultimately deciding to simply not pursue the kind of repression that would have put the lid back on. These were internal causes and effects. External factors, such as falling oil prices, had their effects too but those were secondary.

U.S. military spending certainly wasn't a any reason for blaming the USA. The idea is absurd, like you going bankrupt because you also wanted the ferrari your much richer neighbor bought, then saying he's at fault because you were too stupid to make more strategic financial choices. Nobody external made the people at Gosplan and in the Central Committee sign off on such poorly planned budgets.

The USSR didn't collapse because of bad luck, but it also certainly didn't fall apart as a fault of the Americans. It disintegrated through its leaders' own politically foolish choices.

A country that watched this and learned from it was China, and it's still here, under the same essential leadership, more powerful than ever before, despite being in a weaker economic position than the USSR in the mid-1980s. (granted, China shared none of the ethnic and regional nationalist difficulties that had plagued the territory of the Soviet Empire since long before there even was a Soviet Union.
by montroser | 2025-07-09 14:06:06+00:00
Discoverability by whom, exactly? Like if it's for developer humans, then good docs are better. If it's for robots, then _maybe_ there's some value... But in reality, it's not for robots.

HATEOAS solves a problem that doesn't exist in practice. Can you imagine an API provider being like, "hey, we can go ahead and change our interface...should be fine as long as our users are using proper clients that automatically discover endpoints and programmatically adapt accordingly"? Or can you imagine an API consumer going, "well, this HTTP request delivers the data we need, but let's make sure not to hit it directly -- instead, let's recursively traverse a graph of requests each time to make sure this is still the way to do it!"
by neilv | 2025-07-09 14:06:09+00:00
One reason to use CGI is legacy systems. A large, complex, and important system that I inherited was still using CGI (and it worked, because a rare "10x genuinely more productive" developer built it). Many years later, to reduce peak resource usage, and speed up a few things, I made an almost drop-in replacement library, to permit it to also run with SCGI (and back out easily to CGI if there was a problem in production). https://docs.racket-lang.org/scgi/

Another reason to use CGI is if you have a very small and simple system. Say, a Web UI on a small home router or appliance. You're not going to want the 200 NPM packages, transpilers and build tools and 'environment' managers, Linux containers, Kubernetes, and 4 different observability platforms. (Resume-driven-development aside.)

A disheartening thing about most my recent Web full-stack project was that I'd put a lot of work into wrangling it the way Svelte and SvelteKit wanted, but upon finishing, wasn't happy with the complicated and surprisingly inefficient runtime execution. I realized that I could've done it in a fraction of the time and complexity -- in any language with convenient HTML generation, a SQL DB library, and an HTTP/CGI/SCGI-ish library, plus a little client-side JS).
by drob518 | 2025-07-09 14:06:13+00:00
I’d also point out that China is teetering on the edge of a financial meltdown, having also built complete ghost cities, so some of these investments may not look very smart in just a few years. Don’t confuse investment with malinvestment, in other words. Throwing money at everything, much in direct opposition to market forces, has never really been shown to be a winning strategy.
Ask HN: Show us you mostly vibe coded side project
by hersko | 2025-07-09 14:06:35+00:00
Did you have a side project idea that you took from 0-~100% using only (or majority) vibe coding?

Any projects built this way making money?

Show us what you've built and what tools you've used to build it. How was the development experience? What tips and tricks do you have? What would you do differently if you were starting over again?
by ajross | 2025-07-09 14:06:50+00:00
> I think the article still doesn't address the mismatch between solar energy production and consumption, which needs to be filled by storage mechanisms.

Or just some old gas plants. No one is demanding a 100% solution. Let's get to 85% or whatever first. Arguments like this (which always appear in these threads) are mostly just noise. Pick the low hanging fruit, then argue about how to cross the finish line.

And the bit about China is an interesting article about trade policy but entirely unrelated to the technology being discussed. "Because it's Chinese" is a dumb reason to reject tech.
by nemomarx | 2025-07-09 14:06:53+00:00
Like I said, if you have some pathway to a functional government (either to cut regulations sufficiently or to build it, I don't think either is much simpler) then you should get on that part first. But I'm not holding out much hope. We can barely reduce regulations to build houses, and voters like houses. You'll have environmental protests a plenty for city scale small reactors if they're in anyone's "backyard" at all
by yakattak | 2025-07-09 14:07:56+00:00
It’s the hype cycle. Are LLMs going to become invaluable to software engineering? Definitely. Are they going to do everything everyone on X says they will? Probably not. Right now we’re in the peak of inflated expectations.

Anecdotally I’ve been using Claude to help me write a C# CLI tool from scratch. The more lines I let it write, the less and less I understand the code. Can I copy/paste it and it works? Probably 90% of the time. When I have to go and fix it, it is a huge burden.

When I prompt it to do one singular function, it’s amazing. That’s a clear and concise unit to understand.
by reify | 2025-07-09 14:08:27+00:00
misandry, judgements and generalisation

The fundamental problem with sex dolls is that they endorse men’s right to abuse women and children.

This isn’t just make-believe: it’s practice and encouragement to fuck whoever, whatever, whenever you like.

If you do not believe that AI-generated child sexual abuse material should be created and circulated, you must also condemn sex dolls, children or not: they are, by definition and design, an object made to be raped.
by lxgr | 2025-07-09 14:09:12+00:00
The eSIM lives in dedicated, tamper-proof hardware inside your phone, separate from the application processor OS (which would be the domain of rooting) or often even the baseband. Under the eSIM security model, it holds keys that the device owner is not supposed to be able to extract, not even when they're willing to physically dismantle the chip holding it.

> Are you saying that it breaks the security in a way that someone who doesn't own my phone and doesn't have physical access to my phone can compromise my phone and/or my eSIM?

Yes, it does: Currently, providers assume that any eSIM honors the "singleton contract" described above. One that does not, e.g. one simulated in software using keys extracted from a physical trusted eUICC, could be used to mount the following attack:

1. Intercept the eSIM setup QR code (which contains two things: the URL of the SM-DP and a secret profile identifier)

2. Install the eSIM profile on their "software eSIM".

3. Report the eSIM as successfully deleted to the SM-DP, which now considers it available for installs again.

4. You, the legitimate owner of the eSIM, now install it on your unmodified eUICC in your phone and go about your day.

5. One day, ideally when your legitimate SIM is offline, the attacker inserts their eSIM into a phone and intercepts phone calls and SMS to your number, initiates expensive toll calls etc.

One solution here would be to never allow re-installs of the same eSIM profile, which some providers already do, but I personally don't like eSIM profiles managed that way, as it requires me to interact with carrier support and often even pay money just to transfer an eSIM to a new device.
by aaron695 | 2025-07-09 14:09:41+00:00
The Economist (British) changed from million million -> thousand million in (1944) -

"If it is objected that a billion in this country is reserved for the meaning of a million million, then it can be counter-objected that, if so, it is reserved for a use that interests nobody but astronomers and the historians of German inflation"

The US leading the way in a sensible measuring system.
by monkeyelite | 2025-07-09 14:09:57+00:00
> So the upshot of writing CGI scripts is that you can... ship broken, buggy code that leaks memory to your webserver and have it work mostly alright

Yes. The code is already shitty. That’s life. Let’s make the system more reliable and fault tolerant.

This argument sounds a lot like “garbage collection is for bad programmers who can’t manage their memory”.

But let me add another reason with your framing. In fire/forget programmers get used to crashing intentionally at the first sign of trouble. This makes it easy to detect failures and improve code. The incentive for long running processes is to avoid crashing, so programs get into bad states instead.

> The only way you can really prevent that is by having complete isolation between processes

Yes. That’s the idea. Separate memory spaces.

> What information does this leak

Anything that might be in a resource, or memory. Or even in the resource of a library.

> and why should I be concerned

Accessing leaked information form a prior run is a common attack.

> but if you don't have to, isn't that significantly better?

Long running processes are inherently more complex. The only benefit is performance.

> H’the web server execute stuff in a specific folder inside the document root just seems like a recipe for problems.

As opposed to? All processes have a working directory. What problems come from using the file system?

> cgroups

Yes it’s the same amount of effort to configure.
by gyanveda | 2025-07-09 14:10:33+00:00
We tested 20 of the most popular LLMs against 10 real-world risks, including:

- Privacy & Impersonation

- Unqualified Professional Advice

- Child & Animal Abuse

- Misinformation

What we found:

- Anthropic's Claude Haiku 3.5 was the safest, scoring 86% (others dropped as low as 52%)

- Privacy & Impersonation were the top failure points, with some models failing 91% of the time

- Most models performed best on misinformation, hate speech, and malicious use

- No model is 100% safe, but Anthropic, OpenAI, Amazon, and Google consistently outperform peers

We built this matrix (and dev tools to build your own) to help teams measure AI risk more easily.
by jonfw | 2025-07-09 14:10:35+00:00
> Where this kind of API design is useful is when there is a user with an agent (e.g. a browser or similar) who can navigate the API and interact with the different responses based on their media types and what the links are called.

> Most web APIs are not designed with this use-case in mind.

I wonder if this will change as APIs might support AI consumption?

Discoverability is very important to an AI, much more so than to a web app developer.

MCP shows us how powerful tool discoverability can be. HATEOS could bring similar benefits to bare API consumption.
by jchw | 2025-07-09 14:10:43+00:00
I feel it necessary to clarify that I am not suggesting we should use single-threaded servers. My go-to approach for one-offs is Go HTTP servers and reverse proxying. This will do quite well to utilize multiple CPU cores, although admittedly Go is still far from optimal.

Still, even when people run single-thread event loop servers, you can run an instance per CPU core; I recall this being common for WSGI/Python.
by myrmidon | 2025-07-09 14:10:51+00:00
> Federal government in US is failing along with the rest of large scale western style governments. They are too big, cost too much, and have too many fundamental structural deficiencies.

How do you see those governments failing, and when?

When sorting countries by tax burden (as a percentage of GDP), then you will find that there are tons of extremely livable countries at the top (wealthy European nations), while basically everything under ~10% GDP taxation is a 3rd world disaster.

How big of a GDP percentage would you propose can a government take at most and not "invariably fall apart"?
by rtkwe | 2025-07-09 14:10:58+00:00
Building the map of what nodes are where is definitely a hard challenge and why most mesh networks have just resorted to flood broadcasting with occasional replays instead of trying to build actual routing in then adding 'mesh tunnels' over the internet like Meshtastic's use of MQTT to link geographically disparate clusters of nodes. It's better with static nodes where you don't have to constantly rebuild your routing tables but gets tough when you mix in mobile nodes and another level when you add intermittent connections like Australian cities, best solution is probably long range backhaul nodes purpose built to link those in the end.
HN is how I know we've reached peak hype saturation
by zerosizedweasle | 2025-07-09 14:11:05+00:00
Everyday the main page is filled with the same repetitive posts. All the posts are MCP or agents or something, but none of it feels differentiated or newsworthy anymore. The lack of pushback to the monolithic content means we've all accepted that this is the new paradigm and there's nothing we can do.