MurphyA/hacker-news huggingface dataset:
by sim7c00 | 2025-07-24 10:17:12+00:00
its a bit ironic governments push policies advocating for user privacy and data protection etc. yet criminalize use of good encryption and privacy preserving technologies. :')

i guess it's their usual trademark tho -_- 'ew, war is bad' drops bombs on children via proxy state

Luckily, they still, in most countries, need to actually _prove_ criminality. But the line there is also growing ever thinner... confiscating your device as_if you are a criminal despite not being able to prove anything... - they will happily destroy your qubes laptop rather than admit they can't prove anything.

You either unlock it for them, or see it destroyed.

This to the point that if you care about privacy and want to travel internationally, i'd say, take a burner phone u use for holidays and get the local sim -_-. if they take that, nothing is lost except a few $$ for a cheap device.
by shafyy | 2025-07-24 10:18:43+00:00
I don't work at Uber, so I don't know what they are doing. But what some things Uber could do, just off of the top of my head:

- Take complaints more seriously

- When selecting drivers, have a more rigourous selection procedure regarding this topic

What we as society can do? Many things, but let me list some that just spring to mind:

- Stop objectifying women in ads, movies, porn, popular culture and other places

- Stop treating nudity as some kind of crazy thing (of both genders, but again, double standards here because male topless nudity is not a big deal, but female is)

- Providing more suport for women who have been stalked or harassed or raped by men (ideally, so that we can pre-emptively stop those activities, not after it's too late)

- Education: Include gender education early on in school, mixed gender sports classes, mixed bathrooms, etc.
by edanm | 2025-07-24 10:19:29+00:00
Idk. Maybe that's true today (though even today I'm not sure) but how long before AI becomes better than just finding random text on a website?

After all, AI can theoretically ask follow-up questions that are relevant, can explain subtleties peculiar to a specific situation or request, can rephrase things in ways that are clearer for the end user.

Btw, "What temperature should a food be cooked to" is a classic example of something where lots of people and lots of sources repeat incorrect information, which is often ignored by people who actually cook. Famously, the temp that is often "recommended" is only the temp at which bacteria/whatever is killed instantly - but is often too hot to make the food taste good. What is normally recommended is to cook to a lower temperature but keep the food at that temperature for a bit longer, which has the same effect safety-wise but is much better.
by subscribed | 2025-07-24 10:19:46+00:00
From what I found they're brilliant on repairability, but not so much on security, which is a bummer :(

Couple of pieces on hardware:

- Fairphone does not include a secure element making brute-forcing PIN trivial

- Fairphone 4 used TEST KEYS for verified boot: https://forum.fairphone.com/t/bootloader-avb-keys-used-in-ro... The above alone shows insecurity by design.

I cannot find any of Fairphone technical documentation that would provide details on their implementation of the TEE/HSM. As of now I believe it's only Pixel's Titan and Samsung's KNOX that provide a discrete secure element on Android devices.

Android project recommends secure element to process sensitive data: https://source.android.com/docs/security/best-practices/hard... What it's supposed to provide: https://developer.android.com/privacy-and-security/keystore

On vendor: Drivers, firmware patches, OS upgrades are a necessity, not an option: most security and privacy updates are not backported. Vendor can't just wait for AOSP to deliver all the patches. Vendor must show a track record providing updates to their hardware

- After a lengthy two-year delay, the phone got a taste of Android 12 in February 2023, with Android 13 arriving relatively quickly in October 2023. For Android 14, Fairphone promised to roll out the update in H2, 2024, almost a year after Google released it. Now, with less than two months left in the year, the company is postponing the update's release to 2025. -- https://www.androidpolice.com/fairphone-4-long-delayed-andro...

- their Security Bulletin patches are consistently 1-2 months behind

- Fairphone 5 is still on Android 14 (since Jul 2024). Android 15 has been released in September 2024. Year and a half later AOSP is on Android 16.

- Fairphone 6 is still on Android 15

- Fairphone 5 and 6 latest security patches are from June 2025: https://support.fairphone.com/hc/en-us/articles/244637136412...

For comparison GrapheneOS had eight releases in July alone (GrapheneOS had a full A16 release on 30th of June for all supported devices). Security patches are usually released within one-three days (or earlier, from the tree, without waiting for being published in the bundle)

GOS Release for Pixel 9 was ready three days after the device launch.

Exploitability matrix as per Cellebrite: https://discuss.privacyguides.net/t/updated-cellebrite-iphon... That supports the claim the hardware + OS holds.
by subscribed | 2025-07-24 10:20:06+00:00
> what are you talking about? are you talking about the kernel or the vendor?

Yes. See my response to the sibling comment (I don't want to pollute the discussion with sending twice the same)

> please tell me graphene is not rawdogging Alphabet's compiled stuff

What do you mean? Patching and compiling AOSP tree like every OEM does is "rawdogging Alphabet's compiled stuff" now? Or allowing users to run unprivileged/sandboxed Google services in the isolated user profile they choose?

> if so they ought to be replaced anyways for a secure phone. please tell me graphene is not rawdogging Alphabet's compiled stuff.

Say you don't know what GOS does without saying that out loud.

> if you are talking about tpm and other stuff, eh. they are closed source anyways and i, as a user, cannot actually validate them

Yeah, closed source BUT they exist so for example there's actual, physical throttling of the PIN, Weaver token is stored in the safe place, and we can have downgrading protection support, etc
by proto-n | 2025-07-24 10:20:22+00:00
Not exactly. You can't steal anything unless the person revealed the public key. Addresses are just hashes of public keys, therefore qc resistant. However, you can't ever reuse an address, as signing reveals the public key.

Otoh, afaik either it wasn't like this in the satoshi era or satoshi revealed the public key. In any case, satoshi's wallets are crackable by qc.
by ohdeargodno | 2025-07-24 10:20:25+00:00
In most countries, yes. Despite the push for SUV-styled cards (which are heavier than a regular city car, but not by that much), engines have been small.

Toyota Yaris - HSD - 1.5L 4cyl Renault Clio - E-Tech - 1.6L Hyundai Kona (SUV) - 1.6L Honda Jazz - 1.5L Peugeot 208 - 1.2L Peugeot 3008 (SUV) - 1.6L Peugeot 5008 (Family SUV) - 2L And the list goes on. Even BMW with it's xDrive puts out 1.5L engines.

Huge engines are only common in two places: sports cars (and even then, only a specific category like AMGs and friends, because even a Porsche 992 only has a 3L engine) and the US.
by subscribed | 2025-07-24 10:20:55+00:00
Samsung devices have basically everything except hardware memory tagging, afair (which is allegedly being added now?), and it looks like it's possible to both OEM unlock and relock the bootloader?

Also looks like they improved security even further, hopefully exceeding Pixels: https://semiconductor.samsung.com/news-events/news/best-in-c...

In general I'm quite sure dev any hardware that meets these requirements would be considered: https://grapheneos.org/faq#future-devices

Re: OEM:

https://grapheneos.social/@GrapheneOS/114722432094158776

> We have talks with a large Android OEM ongoing and they're doing initial work towards supporting GrapheneOS. We hope there will be another device we can support in 2026 or 2027 based on this. Qualcomm releasing MTE support this year is key and appears to be happening.

https://grapheneos.social/@GrapheneOS/114729018035689722

> The initial devices built for us by an OEM are going to be their regular devices improved to meet our security and support time requirements. We aren't going to have much influence over the initial hardware. If GrapheneOS on these devices is highly successful, then we can make the business case that it makes sense to have custom hardware and firmware beyond meeting our minimum requirements. Our minimum requirements cannot require more than what we have on current devices. A.K.A: the minimum requirements are current requirements (currenly only met by Pixels)

Also older one: https://xcancel.com/GrapheneOS/status/1490518600339308544?cx...

I, for one, am excited. I like my Pixels because they can run GOS (and my Pixel 9 Pro XL has a great camera), but I'd love to have a choice.
by maurits | 2025-07-24 10:21:58+00:00
(forgot what type of flour you need for bread in supermarket)

innocently googles 'flour bread'

half the screen, CONTINUE WITH GOOGLE - stay in browser, click

COOKIES We and our 917 partners CARE ABOUT YOUR PRIVACY, click, click,

NEWSLETTER, NEWSLETTER, click, rotate screen because the overlay is to big, click Im sad person who's doesn't want daily bread in his mailbox.

APP APP APP, install APP, click click, can't hit the x, let it be

LOG IN WITH YOUR FOOFLE ACCOUNT, click

5 pages with autoplay video and SEO slop

I'm enjoying AI, while it lasts.
by saubeidl | 2025-07-24 10:22:14+00:00
That is not a definition. What is the philosophical framework? What is critically analyzed by those theories? What is "clear"? Where are all the bad bad Marxists hiding?

In my experience, y'know, as a Marxist, all Hollywood has ever pumped out is pro-capitalist propaganda. To say there's any Marxism in it is downright insulting.

I believe that Marxism has become an abstract target for conservatives to project their grievances on.

Zizek also spoke to this at his debate with Peterson: https://www.youtube.com/watch?v=oDOSOQLLO-U
Show HN: Digital Solitude – A website that only works for one person at a time
by G_S | 2025-07-24 10:22:39+00:00
Hi HN! I built a small experiment in digital solitude: a website that intentionally fails when more than one person tries to visit it.

The concept is simple - if you're alone, you see the site. If someone else arrives, it breaks for everyone until only one person remains.

An experiment in anti-scalability: genuine digital scarcity without tokens, chains, or ownership records. The server's capacity of one creates exclusivity through architecture rather than artificial economics.
by hypercube33 | 2025-07-24 10:23:55+00:00
I did bring my dell craptop with that I scrounged parts from 3 nonworking used business ones together...it had the ATi Mobility 1 (Rage 128?) and could do half life 1 if you really tweaked things or Quake 3.

That aside, it sucked performance wise even with a Pentium 3. My main PC and 19in monitors were what we drug around to LANs all over.

There used to be an old movie theater in North Branch MN that was converted to basically a permanent LAN Party where people would just come and go.

Movies and bands would play on the stage on weekends or something, too. Best time of my life.
Show HN: Private and offline alternative to ChatGPT on your PC
by zainbahari | 2025-07-24 10:24:08+00:00
Zamara runs entirely on your PC, ensuring privacy and speed. No internet required. You can run any LLM from Hugging Face in GGUF (llama.cpp) format. You can also chat with your files, including PDFs, Word documents (.docx), Excel files (.xlsx), PowerPoint presentations (.pptx), CSV files, and plain text files.
by skinkestek | 2025-07-24 10:24:11+00:00
Monetizing is fine with me: There’s nothing stopping creators from showing relevant ads—ones they choose themselves. Sometimes I have even found myself wishing there had been an ad a few months ago for a software conference I just realized I missed.

If someone blogs about woodworking, show static ads for tools they actually use and love. If they're into programming, show JetBrains, cloud providers, or anything dev-adjacent. Totally fine by me.

The problem is that almost everyone defaults to Google Ads—which then serves me wildly irrelevant junk, think brain-melting pay-to-win mobile games or even scammy dating sites that have zero connection to the content I’m reading and zero relevance to my interests.

It’s not just noise, it’s actively degrading the experience.
by sehansen | 2025-07-24 10:24:23+00:00
No, the Concorde was profitable for the airlines up until 9/11: https://simpleflying.com/did-british-airways-make-a-profit-f... https://etonomics.com/2025/05/14/the-economics-of-concorde/

The Concorde was a loss for the manufacturer, though.
by cardanome | 2025-07-24 10:28:29+00:00
If all the characters in games were people that you couldn't relate to and that you don't feel represented by, you wouldn't like that, no? You would complain. Rightfully so.

So why are other people not allowed to also complain if they are not represented in games? Why is that bad?

This does not mean they want to ban certain games. It is often not even about pushing devs to create more diverse characters though that would be great but just to create awareness how certain beauty standards and ideas of normality are recreated and enforced in media.

Embracing that people are different is something that is good for everyone. There will always be a Stellar Blade but there could be also so much more.
Show HN: Learn foreign languages by doomscrooling Twitter – Chrome extension
by edgars_xx | 2025-07-24 10:29:28+00:00
Hi HN,

I created this Chrome extension, doomlingo.com, to help people learn foreign languages while browsing their Twitter/X feed. The idea is simple: the extension converts all of your Twitter content from English to one of the five currently supported languages: Italian/French/Spanish/ German/Portuguese and you have to understand the message by translating the text. The extension provides a simple, fast UI to help with that.

So, if you want to get your daily dose of dopamine, you'll have to work for it. My hope is that my craving for the daily Twitter feed will be strong enough to motivate me to go through the struggle of translating and understanding foreign text. But that remains to be seen and may vary from person to person. The opposite might also happen: you may not want to use Twitter anymore because it's simply too much work.

You can download the extension from the Chrome Web Store. Unfortunately, you’ll have to register to try it because I’m using an LLM to translate the Twitter feed in real-time, and I need to rate-limit users to avoid DDoSing my API. As a free user, you get a certain number of translation tokens per month. Beyond that, it’s a paid membership, since the LLM translation service I use is not free.

Would like to hear your thoughts and feedback on this, thanks all.
by traceroute66 | 2025-07-24 10:29:35+00:00
I'm very fond of Debian, fantastic OS.

But what I really wish is they would some have more automation options suitable for the modern cloud world, e.g. something similar to Butane/Ignition as used on CoreOS.

I know there's cloud-init but that's hacky, verbose and opinionated compared to something like Butane/Ignition.

I also know there's ansible etc. in Debian distro but that's kind of yesterday's solution.
by lotussmellsbad | 2025-07-24 10:30:09+00:00
Fair - the write up could def be cleaner and was corrected using Ollama I framed in. The bash is not slop and why I use a another name - I do not want to get wrapped up in formatting vs function - in the spirit of open source here - make it better and fully anticipating I would get comments - honestly - I do not have the skill set (or desire) to strip LLM of guard rails - it was fun and worked on it for sometime - I work database and front end and rebuild radios (part time) in the real world and needed something for a personal project/goal
by mrkeen | 2025-07-24 10:30:15+00:00
Someone ought to write an article explaining the right way to do these things, rather than just telling us to do it right:

> Thawing vacuum-packed fish correctly

> Improper thawing of vacuum-packed fish can lead to a foodborne illness. Learn how to do it safely.

> It is important to handle the fish correctly, as there is a risk for bacterial growth that can lead to a foodborne illness if the product is handled incorrectly.

> Michigan State University Extension advises keeping food, such as fish that is vacuum packaged, at the proper temperature and/or thawing the product correctly.

> When thawing, it is very important to follow thawing guidelines provided by the processor that will be located on the packaging of the fish.

> It is important to follow the thawing recommendations when preparing the product at home to keep your family safe from foodborne illness.
by manbitesdog | 2025-07-24 10:30:48+00:00
If the lane is frequent enough, a 2-3 minutes delay is fine. In many European cities the schedule is not specific times but frequencies per time of the day.

Like "from 7AM to 11AM, one bus every 8 minutes". Then you have the bus app if you want to optimize further (and if you're me, miss it because of being too tight)
by spuz | 2025-07-24 10:30:56+00:00
Yes indeed the London underground does use regenerative braking on many of their lines. The cool thing about a direct rail power system is that the voltage generated from trains that are braking can be fed back into the power rail to instantaneously power other trains on the same line that are accelerating. No need to carry the extra weight of a battery or flywheel. And like you say, it helps keep the tunnels cooler.
by chiefalchemist | 2025-07-24 10:32:10+00:00
> The gains from moving even more were less pronounced, with the death rate 48 per cent lower for those who notched 10,000 steps compared with 2,000. Ding pointed out that 10,000 steps was still associated with better outcomes than 7,000 for some health conditions, such as a 14 per cent further reduction in the risk of depressive symptoms.

“I am clearly not recommending folks who are doing 10,000 steps a day to go back to 7,000,” said Ding, a professor of public health at the University of Sydney.

“However, beyond around 7,000 steps, the additional health gain for each additional 1,000 steps start to become smaller, so there is less ‘return on investment’.”

The study was “an important addition to the literature which helps to debunk the myth that 10,000 steps per day should be the target for optimal health”, said Daniel Bailey, a reader in sedentary behaviour and health at Brunel University of London.

How is a lower incidence of depression not “optimal health”?

Furthermore, they make no mention of walking alone vs walking with someone else (as I see a lot of people / couples do). What is the impact of that extra time from the 3k steps (together) on the relationship? Is that not good for optimal health?
by arghwhat | 2025-07-24 10:32:15+00:00
HN: All of the negativity and toxicity of a Reddit discussion, without having to get disturbed by something as unproductive as smiling or a laughing!

In all seriousness, the average HN comment thread feel a lot less pleasant than the average Reddit thread. Granted, Reddit has way worse places, but comparing HN to all of Reddit is illogical - HN compares more to a single (large/active) subreddit.
by amiga386 | 2025-07-24 10:32:18+00:00
If RewriteCond (or any other Apache directive) doesn't behave as documented, that's a correctness issue.

If you use RewriteCond as the basis of securing your website, that's a security issue for you.

If it's a security issue for a significant number of users, or if the documentation recommends using the directive for a security role, then it's also a security issue for the product itself.
by sschueller | 2025-07-24 10:33:03+00:00
We have such a train in Zürich as well. It's called the Forchbahn [1]. It switches from 600v to 1200v half way through it's trip. There is also the Uetliberg Bahn (but that can't be considered a Tram) which has an offset pantograph[3] in order to travel all the way into the city as one is AC and the other is DC. [2]

[1] https://en.wikipedia.org/wiki/Forch_railway

[2] https://en.wikipedia.org/wiki/Sihltal_Z%C3%BCrich_Uetliberg_...

[3] https://youtu.be/T10puRXXBA8?si=trhIXOhv0ziSNwL-&t=522
by cess11 | 2025-07-24 10:33:29+00:00
Pretty sure there has been BEAM connectivity for Oracle for at least five years. SQLite3 is one of the defaults in Phoenix and have been for a long time. I do mix phx.new curious_idea --database=sqlite3 at least once a week, it's a sub-minute effort to a mostly generated base for a prototype (with OK auth/user management) I can just throw on a VPS and show someone.

If you want an in memory store without interfacing over HTTP, that is less foreign than ETS, try Duckdbex. Mix.install or add to mix.exs, then it's two lines and you get a connection to an ephemeral database with a SQL interface. Can probably do the same with SQLite but I've never done it. If your needs are simple you can just boot a GenServer with a K-V structure as state.

Pattern matching, the capture operator and functional programming style are the really "hostile" parts, in my experience.
by plasticeagle | 2025-07-24 10:33:37+00:00
We use flatbuffers extensively in our message passing framework, and they are extremely fast if you take care with your implementation. They have a few features that make them especially useful for us

1) The flatbuffer parser can be configured at runtime from a schema file, so our message passing runtime does not to need to know about any schemas at build time. It reads the schema files at startup, and is henceforth capable of translating messages to and from JSON when required. It's also possible to determine that two schemas will be compatible at runtime.

2) Messages can be re-used. For our high-rate messages, we build a message and then modify it to send again, rather than building it from scratch each time.

3) Zero decode overhead - there is often no need to deserialise messages - so we can avoid copying the data therein.

The flatbuffer compiler is also extremely fast, which is nice at build time.
by dathinab | 2025-07-24 10:33:44+00:00
oh yes, that is such a dump design of web permissions

alongside of the abysmal UX for listing/removing them (from a "normal" user POV it's somehwhat usable for someone who understands tech a bit more)

like in general IMHO origin separation over time (e.g. permissions, cache, local storage) should be bound to some public key cryptography schema where the public key is shipped alongside DNS and every time it changes (or disappears) it's treated as a new origin.

So basically HPKP but 1. one key per origin, 2. separate from the TLS key, 3. way less harmful if messed up so actually just fine to use without worry to permanently lock yourself out.

Also maybe 4. crypto likeable to a group of person/company identity public keys detached from TLS and not spoofable by government DNS/TLS takeover attacks. But in a way where this system is added on top instead of being a building block to make it hard for regulators to effectively shut it down. Like I which police all luck to find all the criminals but history non stop shows we can't rely on governments not going crazy and start prosecuting people for just being different without different meaning "actively" hurting other people or entrapping and then persecuting people for having different political (or religious) opinions or other similar nonsense.