MurphyA/hacker-news huggingface dataset:
by roenxi | 2025-07-18 10:20:52+00:00
> A rational anaylsis would therefore conclude I'm wasting my time and energy...

No it wouldn't. You haven't established the link between your premise and conclusions and the rational view is the opposite of what you came to. You've established that in the best case the candidate you prefer will win by more than one vote - which is correct but not the end of the line of thought.

Think of it like building an embankment. If you design the embankment to exactly hold back the maximum amount of water you expect it to hold it'll probably fail in an emergency when it shouldn't have because something slightly unexpected happens. The rational thing to do is engineer in a margin of safety. You're trying to optimise the wrong metric which is ~30-60 minutes of a voters time vs. probability of the legislature behaving in a way that is favourable to them. In both voting and embankment building it'd be silly (dare I say, irrational) to aim for a narrow success. The median election (analogy: median storm) should make the margins for your candidate (analogy: embankment tolerance) look excessive (analogy: over-engineered).

Otherwise, you're basically arguing that rational people should optimise their way to being on the losing side of elections - which is a big tip-off you're making a logic error in your argument somewhere. Rational behaviour can't, almost by definition, predictably lead to bad outcomes.
by eqvinox | 2025-07-18 10:20:56+00:00
mokutil is technically the wrong tool for this, it lists shim-installed machine owner keys (MOK). This is about UEFI-installed key exchange keys (KEK). If you don't know what's going on you'll be very confused about empty key lists. It can in fact show KEKs but you need to know that this is a KEK thing to begin with…

mokutil --kek | egrep '(Not |Subject:|^[^ ])'

is the magic incantation if you really want to use mokutil
by zozbot234 | 2025-07-18 10:22:19+00:00
> Not updating is not a solution, unless the motherboard manufacturer really fucked up and doesn't validate the expiration date.

The article mentions that most motherboards will probably not validate the expiration date. There is a residual concern that new versions of the Shim will not be signed with the expired key, and thus be unbootable on hardware that doesn't accept the new key.
by WhyNotHugo | 2025-07-18 10:22:46+00:00
You should not use f-strings for logging, because that performs all the formatting _before_ the logging module determines if the log needs to be printed. You want the formatting overhead to happen only for logs that will get printed. You can’t achieve that with f-strings, just use normal logging calls.

It kinda speaks bad of the auto-completion that it suggests such anti-pattern.
by Esrbwt | 2025-07-18 10:22:57+00:00
Hello HN, For a while now, I've been bothered by the fundamental business model of the internet, where our attention is the product being sold. I started thinking about what a web architecture would look like if it were built on a foundation of 'digital dignity' instead. This is the result: a whitepaper for a protocol I'm calling Aletheia. It's a design for a decentralized, open-source, non-profit public utility that aims to let users own their attention and reputation, using a combination of zero-knowledge proofs and a community-trained AI. The entire project starts with zero capital—just this whitepaper and an open-source license. The goal is to build a system that is owned and governed by its users and builders, not by a corporation. I know it's incredibly ambitious, and there are probably a hundred reasons it won't work. That's why I'm posting it here. I would be immensely grateful for your critique, feedback, and harshest criticism. Does this have a chance? What are the biggest technical or philosophical flaws you see? The full whitepaper is in the repo. Thank you for your time.
by defrost | 2025-07-18 10:24:09+00:00
In other current "AI" assisted effects in TV series - virtual dubbing:

Watch the Skies review – see the lips move in alien abduction sci-fi with pioneering AI

https://www.theguardian.com/film/2025/jul/08/watch-the-skies...

https://news.ycombinator.com/item?id=44498995

This nicely put together Swedish UFO throwback is notable for its early use of ‘vubbing’ – using tech to match lip movements to new English dialogue.
by sensanaty | 2025-07-18 10:24:22+00:00
My favorite part is people taking the 98% number to heart as if there's any basis to it whatsoever and isn't just a number they pulled out of their ass in this marketing material made by an AI company trying to sell you their AI product. In my experience it's more like a 70% for dead simple stuff, and dramatically lower for anything moderately complex.

And why 98%? Why not 99% right? Or 99.9% right? I know they can't outright say 100% because everyone knows that's a blatant lie, but we're okay with them bullshitting about the 98% number here?

Also there's no universe in which this guy gets to walk his dog while his little pet AI does his work for him, instead his boss is going to hound him into doing quadruple the work because he's now so "efficient" that he's finishing his spreadsheet in an hour instead of 8 or whatever. That, or he just gets fired and the underpaid (or maybe not even paid) intern shoots off the same prompt to the magic little AI and does the same shoddy work instead of him. The latter is definitely what the C-suite is aiming for with this tech anyway.
by eqvinox | 2025-07-18 10:24:32+00:00
You need to replace the PK with one of your own, because that is used to sign all the other keys, and generally there can only be one PK. You can then re-sign the existing keys with your own PK (e.g. if you want to dual boot Windows) — or just ditch the existing ones¹, and/or you can generate your own keys of the other types (KEK & DB).

Ed.: ¹ there are cases where ditching the existing keys breaks the system, because the board vendor was stupid and signed the VGA UEFI driver with one of those keys instead of tying it directly into the BIOS/UEFI image. AFAIK this only affects a specific series of Lenovo laptops, but Google the details before breaking your system.

Ed.#2: actually I think the PK signature is only checked while installing keys into the KEK/DB list, so you don't need to re-sign the existing Microsoft keys, they just stay in the list by default. (Unless they got cleared somehow.) It's been a little while since I did this.
by stdbrouw | 2025-07-18 10:24:59+00:00
> Then again, this is nothing like the type of problems I work on a daily basis.

I thought it'd be fun to take a stab at it in Python, which I haven't used in a while, but only barely still remembered that I could accept command-line input with the built in `input` function, something I don't think I ever used after writing my first lines of code 15 years ago. Then I figured I'd use just lists instead of a numpy array but had forgotten that [[0] * 4] * 4 would just create 4 references to the same list. And that pretty much derailed the whole thing for me, even though I was sure I'd get it done in 25 minutes or under :-)
by vbezhenar | 2025-07-18 10:25:04+00:00
There are ways to solve that issue. But I think that you're correct, pinpointing the core issue with popular Linux distributions. It doesn't have to be this way, though.

1. You can sign and verify initramfs, it's supported by bootloaders.

2. You can merge kernel and initramfs into UKI and sign the whole image.

I don't know why that's not implemented.
by account42 | 2025-07-18 10:26:24+00:00
> The same cannot be said for databases, game engines, web servers, cryptographic primitives, etc.

It absolutely can in many cases.

- Many applications don't need much more of a database than files plus perhaps a runtime index. Spawning a database server or even embedding SQLite can be overkill in many cases.

- Most games would be better off with a bespoke game engine IMO, especially those made by small teams. The only real advantage to using an established engine is the familiar asset pipeline for replaceable artists but you pay for that with a huge overhead. Remember that custom engines or at least heavily modified ones maintained by the game developer used to be the norm - "just use Unity^WUnreal" is a relatively recent trend.

- There is no real difference in complexity between a simple web server and FastCGI application.

- Not all uses of cryptographic primitives are a security issues. If you calculate a hash to check against corruption you can implement that yourself (or copy an existing implementation) instead of pulling in a huge library. If your use cases is decrypting existing data offline then again you don't really care about cryptographic security only about getting the correctly decrypted output.

And there are many more cases like these. Learned helplessness when it comes to "hard" subjects helps no one.

Just because some existing solution "solves" your problem doesn't mean its the best or most efficient way to do it.
by JdeBP | 2025-07-18 10:27:06+00:00
The revealing shibboleth is when people call it "ANSI". (-: "ANSI" is what people call it when they are working from paltry and incomplete samizdat doco of how this stuff works, from Microsoft's old ANSI.SYS appendix to its MS-DOS user manual, to innumerable modern WWW sites all repeating received wisdom.

The thing to remember is that the "E" in "ECMA" does not stand for "ANSI".

* https://ecma-international.org/publications-and-standards/st...

* https://ecma-international.org/publications-and-standards/st...

* https://www.itu.int/rec/T-REC-T.416-199303-I

If you read ECMA-35, you'll find that there's actually a whole system to escape sequences and control sequences. As I pointed out last month, it's often the case that people who haven't read ECMA-35 don't realize that parameter characters can be more than digits, don't handle intermediate characters, and don't grasp how DEC's question mark and SCO's equals sign fit into the overall picture. People who haven't read ECMA-48 and traced its history don't realize that there's subtlety to missing parameters in control sequences. And people who haven't read ITU/IEC T.416 do what many of us did years ago and get 24-bit colour wrong. Twice over.

* https://github.com/tattoy-org/tattoy/issues/105#issuecomment...

Other common errors include missing out on all of the other 7-bit aliases for C1 characters. Or not realising that the ECMA-35/ECMA-48 syntax allows for any control sequence to have sub-parameters, not just SGR. Or using regular expressions and pattern matching instead of a state machine. Only a state machine truly handles the fact that in the real world terminals allowed, and enacted, various C0 and C1 control characters in the middle of control sequences, as well as had ways of cancelling or restarting control sequences mid-sequence.

* https://github.com/jdebp/nosh/blob/trunk/source/ECMA48Decode...

But it gets even worse for a real world control sequence decoder.

In the real world, not only do terminals interpret the same control sequences, and their parameters, differently depending from whether the terminal is sending or receiving them; but several terminal emulators like the one in Interix, rxvt, the one built in to Linux, and even XTerm, send control sequences that not only break ECMA-35 but also conflict with received control sequences. So if one wants to be comprehensive and be cabable of decoding real data, one needs a switch to tell the program whether to decode the character stream as if it is being received by the terminal or as if it is being sent by the terminal.

* https://jdebp.uk/Softwares/nosh/guide/commands/console-decod...

Microsoft Terminal tries to do things properly, which many modern terminal emulators and tools do not, and handles this with two distinct entire state machines, one for input and one for output.

* https://github.com/microsoft/terminal/tree/main/src/terminal...

I handled it with a few goto statements and a handful of flags. (-:

* https://github.com/jdebp/nosh/blob/trunk/source/console-deco...
by mnurzia | 2025-07-18 10:27:40+00:00
Neat tool, I could see this being handy for debugging TUI tools.

I noticed that it works with _escaped_ ESC characters ("\x1b", "\u001b", "\033") but it didn't recognize raw ESC characters that I had in my clipboard. It might be useful to support those (maybe highlight them similarly to how VS Code highlights whitespace characters). The characters show up as numbered unicode error glyphs (I'm on Firefox, if that helps)
by aa-jv | 2025-07-18 10:27:57+00:00
I have been programming since I was 8 years old. In 1978 I touched my first computer, a Commodore Pet which had been added to the office of a friend of my family, who had no idea what to do with it.

I was immediately drawn into this world and that moment changed my life definitively.

I've since been around the world twice, have written software in a diverse array of markets, including realtime/embedded/safety-critical, professional audio, and scientific instrumentation fields.

I'm a highschool dropout, became a competent POSIX developer in the 80's, a competent cross-platform developer in the 90's, an embedded and safety critical developer in the 2000's, and for the past decade have been shipping products in the professional audio realm. I've also been involved in multiple startups - some huge and impactful, but most small and irrelevant.

I dropped out of high school in 1987.

Throughout this era I've been constantly challenged by academic-trained developers who say things are impossible/can't be done/etc., only to have my work demonstrate otherwise.

The key to this is, I am full of self-doubt, and double-check myself, repeatedly, in order to not wreck myself. Whereas, academically-oriented devs have had to eat humble pie, time and again. This is not to toot my own horn - just an observation that over-confidence (or indeed, radical under-confidence) is often the product of a huge investment in ones' education, especially if there are large debts involved (I have no student debt, but I do have 40 years of computer history sitting in my living room, having kept every single platform for which I've done some form of development ...)

For many years, I saw computer programmers graduate who could not program their way out of a sealed/wrapped box, and many, many times have had to teach them, myself, to get things done.

That said, I've also been humbled by the brilliance of the DSP and machine learning engineers I've worked with, who could not have established their competencies without having had the time to study.

I've done software dev projects in Japan, the USA, Australia, Germany, Serbia, Kosovo, Italy, the Netherlands .. with many of my projects still in use on a global scale.

I think with software development there is a self-study discipline which must be maintained in order to stay relevant - I was lucky to learn that skill at an early age and to use that discipline to gain more skills. I don't think this discipline is taught well enough in the various markets in which I've worked:

It's not what you know. Its that you know you don't know and know how to know.

Project workflow, debugging techniques, separation of concerns, and most important of all: proper analysis (identifying similarities/identities/differences in ontology). All generations of software developers have issues with this, and all of us can improve.
by Arch-TK | 2025-07-18 10:29:00+00:00
Just to try to understand your point. Are you saying that there is no bad or irresponsible way to teach something?

If I teach you to weld and don't explain welding gloves, long sleeves, or welding helmets, is that still okay or is it crossing a line because someone's safety is at stake?

What if someone takes their arduino learning's and starts controlling dangerous things like heating elements for pressure vessels? Would you agree now that its irresponsible? (Actual real world cases of exactly this.)

Or if someone who used arduino thinks their C++ is great and writes network facing software which controls a heated pressure vessel (again, actual real world cases of exactly this).
by 0manrho | 2025-07-18 10:29:48+00:00
> Everyone who says mac is unix and is just as good as linux is a fool and should never be trusted.

Seconded.

> Linux just works

While there are instances where this is the case (System76 hardware w/ PopOS for example), This is certainly not true in the general, and this is coming from someone that's been on linux since the dotcom era. It's very very important you get a well supported device or it most certainly does not "just work", and that's goes triple if you're not using some flavor of ubuntu/debian (in the past fedora generally does pretty good too but I've not been keeping up with the fedora sphere since IBM drove me away from the redhat/fedora/centOS ecosphere). Thankfully, there's never been more options or support for linux on laptop, so it's not as near as difficult to achieve as it once was.

Linux does what it's told, which is why I love it, but if you don't know what you're doing, and/or if the autoconfiguration tools/drivers aren't compatible with the hardware in question, you've got a recipe for frustration for anyone that's new to linux/not in the mood to tinker.
by dzaima | 2025-07-18 10:29:52+00:00
A rough sketch for a more direct way to extend the XOR trick to finding more than two differences:

For e.g. 3 differences: instead of a binary xor (i.e. binary-digit-wise sum mod 2), do a binary-digit-wise sum mod 3 (negating one input); a 0 (mod 3) sum result for a given bit means that the bit is the same in all entries, and 1 (mod 3) or 2 (mod 3) mean that you can partition on the bit, resulting in partitions with sizes `sum` and `input_different_element_count - sum`; then you repeat this recursively until they reach containing just 1 difference. (rounding the modulo up to the next power of two instead of odd modulos for the summing is perfectly fine, the final infinite-precision sum is in the range of [0; diffcount] anyway)

Extends trivially to more than 3 differences, and collapses to the basic trick for 2 differences. The accumulator size is O(log(diffcount) * element_size), but the recursive partitioning takes O(n) space or O(diffcount * n) time (plus some logarithm something maybe). Tradeoffs are probably reasonably possible, but the basic hashset approach can reduce its O(n) space requirement at the cost of taking >O(n) time too by partitioning on a hash.
by yorwba | 2025-07-18 10:30:43+00:00
They do not explicitly state this fact, but they link to the homomorphic encryption scheme they're using, which works like this. To perform an operation between a plaintext value and an encrypted value, you first encrypt the plaintext with the public key and then you can do your operation on the encrypted values to get the encrypted output.

Moreover, even if the details were slightly different, a scheme that reveals absolutely no information about the query while interacting with a database always needs to do a full scan. If some parts remain unread depending on the query, this tells you what the query wasn't. If you're okay with revealing some information, you can also hash the query and take a short prefix of the hash with many colliders, then only scan values with the same hash prefix. This is how browsers typically do safe browsing lookups, but by downloading that subset of the database instead of doing the comparison homomorphically on the server.
by DoctorOW | 2025-07-18 10:30:57+00:00
This isn't unique to AI. Visual effects have been achievable on my desktop computer for as long as I can remember (I'm in my mid twenties). Industry standard compositing tools such as Nuke, Autodesk, Fusion, have had free educational/non-commercial versions forever, and you can replace almost all of those with Blender. Watch Tears of Steel, a short film done almost entirely in FOSS.

Technology aside, I believe that the monopoly on talent, as in the hiring of talent is symptomatic of a monopoly on distribution, which means the devaluing of talent over reach is actually worse for the independent filmmaker.
by tim333 | 2025-07-18 10:31:55+00:00
No, it's not pro fascist.

Re articles getting flagged, see the HN guidelines:

>Eschew flamebait.

>Please don't use Hacker News for political or ideological battle. It tramples curiosity.

>Off-Topic: Most stories about politics, or crime, or sports, or celebrities

Also re Musk there have been ten Musk stories submitted in the last 24 hours, none actually flagged as far as I can see, though with little interaction. You can have too much of that stuff.
by TFYS | 2025-07-18 10:32:17+00:00
> And if people don't work, or don't work nearly as much as they did before, then how is the system going to be sustained?

I think people and markets would just adapt to a lower level of consumption and amount of work. The work that people find truly important, like growing food, construction of housing, healthcare, etc. would remain in demand. The demand for things that people don't really want to work to create, or work to consume, would be reduced. So salaries for work that actually matters to people would increase and people would still do that work, and salaries for work that produces things that people don't really need would be reduced. In the end we'd have a society that only does the work that people actually want and need to get done and consume only things that have enough value to justify working for it. Less work, less consumption, probably happier people.
by perrin_veronica | 2025-07-18 10:33:03+00:00
I agree that it sounds harsh. But I worked for a company that hired interns and this was the way that managers talked about them- as cheap, unreliable labor. I once spoke with an intern hoping that they could help with a real task: using TensorFlow (it was a long time ago) to help analyze our work process history, but the company ended up putting them on menial IT tasks and they checked out mentally.
by blendergeek | 2025-07-18 10:33:11+00:00
> How often are you trying to install custom drivers on a smartphone, console or car? Why would you have secure boot issues on those?

The only reason there isn't a thriving community of third party OS's on most smartphones is because secure boot prevents it. And no, users do not have the freedom and choice to disable it (except on a very few models where the manufacturer has graciously allowed users to use their own devices how they want).
by kasey_junk | 2025-07-18 10:33:45+00:00
Yeah. I don’t think it’s an all or nothing thing. Sometimes a change is best done all through async iterations, sometimes you want to be interactive and sometimes agent wrangling is just not worth it.

The painful thing for me right now is setting up the agent instructions, permissions and sandboxes varies for each of those use cases and the tooling around that is very rudimentary right now.