MurphyA/hacker-news huggingface dataset:
by OutOfHere | 2025-07-26 17:38:35+00:00
This was the only article that opened my eyes; it's a lot better than the Wikipedia article on the topic. It covers the XFF header, also related headers, clearly from both defense and offense perspectives.

Two things it failed to advise for defense are:

(1) I can simply just reject requests that provide multiple keys of this header. In Go, I will use `http.Header.Values(headerName)` to check the count. There is no good reason for having multiple keys of it. Any misconfiguration in setting them is the client's problem.

(2) I can and I must reject large requests that have too many header bytes. In Go, when initializing `http.Server`, I can give it the `MaxHeaderBytes` argument. Sending megabytes of headers stops here.

If I understood correctly, when wanting the rightmost-ish XFF value, I can use the rightmost value that is not in a list of trusted subnets, assuming there is at least one remaining value left of it.
by stouset | 2025-07-26 17:39:06+00:00
“This doesn’t make sense. We’ve only added 200ppm of CO2 to our atmosphere. Shouldn’t affect anything.”

Systems at a roughly stable equilibrium can be surprisingly easy to shift out of that equilibrium by pushing them ever so slightly outside a local minima. Nobody right now is saying this particular situation is going to result in catastrophe, but we should exercise some caution when we are causing observable effects to the one planet we inhabit.
by constantcrying | 2025-07-26 17:39:25+00:00
>If Waymo has taught me anything, it’s that people will eventually accept robotic surgeons.

I do no think that example is applicable at all. What I think people will be very tolerant of is robot assisted surgeries, which are happening right now and which will become better and more autonomous over time. What will have an extremely hard acceptance rate are robots performing unsupervised surgeries.

The future of surgery this research is suggesting is a robot devising a plan, which gets reviewed and modified by a surgeon, then the robot under the supervision of the surgeon starts implementing that plan. If complications arise beyond the robots ability to handle, the surgeon will intervene.
by netbioserror | 2025-07-26 17:40:43+00:00
This is the solid particles in the ground moving in place. As the wave passes through, any given volume of ground is displaced somewhat. In a balanced low-intensity wave, the soil or rock gets jostled around a bit. In a high-intensity balanced wave, the ground is yanked back and forth, potentially damaging foundations or buildings above the foundation. Particles will be displaced, but not permanently, with a net of 0.

In an unbalanced wave, the earth is permanently displaced in a particular direction. We can measure that net displacement in a particular direction using an anti-derivative if the total average velocity is nonzero (if we included negative velocities around a given axis). Earthquakes, of course, tend to have nonzero net displacement, and thus an extremely biased velocity waveform along a particular axis.

So in fact, the soil beneath you vibrating back and forth at 1 to 5 inches per second is not fun. At 118 inches per second? Catastrophe.
by oxguy3 | 2025-07-26 17:40:58+00:00
It's wild how easy this was. I feel like we're really in the wild west era of security with these AI tools -- reminds me of early Web 2.0 days, like when "samy is my hero" hit and Myspace didn't even have a security team. I anticipate many high-profile incidents before they figure out how to tame this beast.
by leptons | 2025-07-26 17:41:01+00:00
Back around 2001 I visited South Carolina, and it was like being transported to the future of mobile internet. They had some kind of high-bandwidth cellular setup in the area that was far ahead of the rest of the country at the time, I think I recall it being around 20Mbit wireless. I was told the area was a testing ground for new tech. I was kind of shocked that somewhere that seemed so stuck in the past had such cutting edge tech deployed. I thought why is this not in SF??
by echelon_musk | 2025-07-26 17:41:18+00:00
> Elon Musk, who I assume you lionise based on your handle

It's a portmanteau of ECHELON [0] and Elon Musk. I've never cared for him, and especially not now that he is advancing fascist ideology.

To counter your point, it would depend on how you define extremism. If you want to define extremism as acts of violence then I can understand.

However there are plenty of fundamentalist/extremist views within the UK which exist regardless of what the right wing does.

[0] https://en.wikipedia.org/wiki/ECHELON
by martinpw | 2025-07-26 17:41:28+00:00
Figure 1 in the above paper packs a lot of interesting information: https://agupubs.onlinelibrary.wiley.com/cms/asset/d7c477fa-3...

One important factor shown there is that dams hold back water on land, so act to decrease sea levels. It is not as big an effect as groundwater depletion, but is significant (around half as much).

The net effect of these two is much less than the other factors causing sea level rise (melting land ice) - looks like around 10% of total sea level rise comes from groundwater depletion+dams combined.
by Jigsy | 2025-07-26 17:41:57+00:00
They actually have the power to arrest them - or have them arrested - if they ever visit the UK, though.

Especially if they refuse to block stuff or if Ofcom feels that they didn't do a good enough job of censoring content.

This is one of the reasons why Civitai blocked the UK. (As confirmed by a member of staff on Reddit.)
by zbentley | 2025-07-26 17:43:14+00:00
Even if that’s true (and it gets repeated as a very general statement without general data to back it up, so I’m not sure), then why couldn’t payment processors either a) charge retailers in high-risk segments a higher transaction fee, b) charge merchants penalty fees if the number of chargebacks from their transactions exceeds some threshold, or c) compete with each other to serve higher-risk markets?

The answer is, I think, monopoly environments: they contain poor incentive structures for competitive differentiation, and encourage extreme risk aversion by the monopolists. Add to that the “it’s not really about chargebacks, it’s a culture war” agenda (which isn’t just lobbying pressure on payment processors; plenty of the calls are coming from inside the house there), and the outcome of de facto censorship is likely.
by hodgehog11 | 2025-07-26 17:44:43+00:00
I said "most" of those 10 years, since it has become much better now, especially on AMD. Nvidia is still a disaster on Wayland though, basic screen sharing apps like Zoom are broken for many users, even with PipeWire.

The response to this is usually "that program is bad, it has problems and that isn't the fault of Wayland, don't use it". But Wayland broke userspace. If these programs all work well on X, that is a Wayland problem.
by lenerdenator | 2025-07-26 17:45:16+00:00
It depends.

If for some reason you're open carrying in a holster (like perhaps a police officer or soldier would be), and someone tries to get your weapon off of you and succeeds, a manual safety could save your life. They probably won't realize that the safety is on, and when they point the weapon at you and pull the trigger, nothing will happen, giving you a chance to escape or fight back.

Without that manual safety, the weapon just goes off and you now have an aftermarket hole installed in your body.

There's less of an argument manual safties in concealed carry, though. The opponent shouldn't know you have the weapon until it's drawn, so there's less chance of them getting it out of a holster.
by dylan604 | 2025-07-26 17:45:29+00:00
> The problem gets a lot easier when you have a country wide IRL ID system already in place and can write laws.

every time a country wide ID comes up, people freak the fuck out about state's rights and it being a power grab. people are already freaking out about RealID. it will take a very authoritarian system to force this through, yet it's the supporters of that leader that are the most vocally against it.
by const_cast | 2025-07-26 17:45:33+00:00
> Porn addiction is as harmful as gambling, tobacco and alcohol addiction.

I've heard this before, but I've never, not even once, gotten an evidence-based approach to if this is true.

I've only ever gotten morality-based arguments, which, IMO, aren't arguments at all and aren't worth mine, or anyone else's, time.

We cannot just act like pornography being harmful is a foregone conclusion. No, we need to prove it. We should not be legislating things, and giving up our privacy and freedom, before even defining a problem.

Intuitively, sure, it makes sense that porn is bad. It depicts sex, and in western puritanical cultures, that's bad. If people are exposed to sex, surely they're at greater risk of teen pregnancy, or STIs, or whatever.

But is this actually the case? In the past 20 years, teen pregnancy has fallen off a cliff. Rates of STIs are lower, too. In areas that teach abstinence-only education, they actually have higher teen pregnancy. Taking a more puritanical approach does not guarantee better outcomes, and based off the real-world statistics, it seems to do the opposite.

In addition, I have zero reason to believe porn addiction is even real. There's a lot of dispute among psychologists, with most not recognizing it as an addiction. The problem here is that an addiction is not a compulsive action. An addiction needs to impair your everyday life. That's the clinical definition of an addiction.

We're not seeing a lot of bad outcomes or impairment from pornography. It is exceedingly rare that someone who is consuming pornography is doing it to a degree where it negatively affects their lives. Sure, it's possible, but for the vast, vast majority of people this just does not appear to be the case.

Now, to get ahead of the curve because I've already had this conversation a hundred times - no, I am not addicted to pornography and I very rarely consume it. I have a happy and healthy sex life. I just reject the idea that it's harmful with no evidence provided, and I reject moral arguments in general.
by Eric_WVGG | 2025-07-26 17:46:03+00:00
I don’t believe so. It would be hugely useful, but I have found the iOS implementation to be kind of wonky, so I’d rather it not come to web unless the idea can be perfected.

Also I think a proper implementation would require reference to line count in the CSS markup, and CSS seems to have an awful time with properties that depend on character or line counts. We still don’t have working line-clamp!

ex.

div { font-size: 24px; } div[line-count > 2] { // doesn’t exist, and must be difficult to implement font-size: fit-width; // … what about vertical text? min-font-size: 8px; // maintain legibility max-font-size: 28px; // why not }

Sure would make a lot of my designers happy, though…
by cobertos | 2025-07-26 17:46:04+00:00
> Most date parsing woes (in my opinion) come from ambiguity: from supporting too many formats or attempting maximum flexibility in parsing. ... There is a maintenance freedom and simplicity in strict parsing requirements ...

Is this the endgame of "be liberal in what you accept, but strict in what you output"? You end up supporting an untold amount of usage patterns, not even chosen by yourself if you use a library like `luxon` to handle the "be liberal" part for you.
by pstuart | 2025-07-26 17:46:14+00:00
My comment about some truth was to specifically about:

* It models unrealistic and possibly unhealthy notions about sexuality * It can be exploitive of its subjects (yes, sometimes empowering too)

That's kind of it. I don't think it should be banned at all.

I believe that "free speech" is critical to a well functioning society, but we need to recognize that it can have negative impacts. A key example is the right-wing Hate Industrial Complex: decades of right wing propaganda have conditioned tens of millions of Americans to consider their fellow citizens as non human.

I don't have an answer for how to address this, but you can't fix a problem until you recognize the problem and that it needs fixing.
by marssaxman | 2025-07-26 17:46:16+00:00
An introductory lesson in BASIC programming on the Apple II sparked the flame when I was eight or nine, and I was enthusiastically self-taught from then on. After I got online in the early '90s, and developed a reputation for helpfulness in certain programming forums, people started offering me contract work - either not knowing or not caring that I was just a teenager. Anybody capable of operating a compiler could get paid to do it back then!

Three semesters into college, not yet having taken any CS classes, this little consulting business had grown so much that I was turning away more work than I had time to accept. Why should I bother finishing a degree, I had to ask, when I already have a career throwing itself at me?

It's worked out fine; I've been writing code for a living ever since. I've worked for a few of the bigcos, but I prefer smaller companies. Some applications work, from time to time, but mostly dev tools, or system software. I like compilers; currently working on a tensor compiler for an ML system.
by xg15 | 2025-07-26 17:46:26+00:00
I believe the author, but I'd also have liked some "before/after" comparisons, where the sane scene is shown with the actual, "bad" tone map and a fixed one.

You can get a bit of a feel for what the author meant though if you compare them with the "good" examples further below, in particular the Zelda one.
by PaulHoule | 2025-07-26 17:46:28+00:00
Performance of Flash was awful on mobile.

I think the greatest thing Adobe accomplished was making video practical on the web without users installing plug-ins. There was this great war which is now largely forgotten by Microsoft and Real Player and a few others: you could publish video on the web in 1999 but you'd probably have to encode it for three different clients and give people links to where to go install one if they didn't have it.

I think browser vendors didn't perceive Flash as a video client that was part of the war so it managed to get 100% deployment so you didn't have to be a "plughead" and ask people to install something knowing only 20% of people would -- it made YouTube possible and the rest was history.

Now Facebook put an end to those social games. It used to be you could get free publicity by spamming every event in a player's game to all of their friends. It wasn't just annoying, under

https://en.wikipedia.org/wiki/Sheryl_Sandberg

Facebook realized its business was selling people's attention and they weren't about to let the likes of Zynga get attention for free.
by pseudo0 | 2025-07-26 17:46:55+00:00
Are you talking about the Southport mass stabbing that killed three children and wounded 10? The perpetrator was a second-generation African migrant found with an Al-Qaeda training manual and ricin, who had been repeatedly referred to Prevent. The UK government initially refused to release information about the perpetrator, which caused speculation and confusion about the attack.

It's a bit odd to focus on the anti-government protests and call them terrorists, when they were out protesting because the government failed to adequately protect them from an actual terrorist.
by nyarlathotep_ | 2025-07-26 17:47:27+00:00
When companies (non-"tech") started adopting them they also had no "guardrails" for content outside what the intent of such products were (dunno what the standard term for this is).

There was a boba tea company that had a free, no-sign-in required LLM that I used to generate a few bash scripts before ChatGPT free-tier started.
by __MatrixMan__ | 2025-07-26 17:48:01+00:00
Your characterization of hip hop shoots the messenger. It's the stories of an oppressed people, if you don't like the violence in their stories, blame their oppressor.

It's the same with porn and the Christian Right. If people feel incomplete and try to fill that gap with a porn habit, the porn is an indicator of a problem, not the problem itself. Filling that gap with right wing propaganda doesn't address the problem, it just changes it into something that can be used for political advantage.

You're missing the root causes here.
by wredcoll | 2025-07-26 17:48:25+00:00
God, is there literally anything more tedious than people crying about something as completely fake as "cancel culture"?

I don't know how to explain to people that humans have been punished via shame and ostracization because of their speech and actions for literally the entirety of human history.

Not very long ago, in america, people got "cancelled" by fire bombings, drive by shootings and literally lynchings, just for existing as a different skin color.

There were humans that were so incredibly sensitive and fragile that they couldn't even stand in the same line as someone else with darker skin colors.

Now in the year 2025 someone acts like an ass and... gets, what, fired? Oh, no, how awful that they're the only person who was fired from their job this year. Lets all make a big deal about it.
by pests | 2025-07-26 17:49:06+00:00
I’m guessing this is in reference to a recent YT video about private equity buying up YouTube channels in recent years, mostly in the science and engineering spaces.

Channels publicly acquired by PE:

Task & Purpose, Donut Media, Veritasium, Simple History, Fern, Fireship, Economics Explained, Futurism, Astrum

“Your favorite YouTube channel is (probably) owned by private equity.”

https://youtu.be/hJ-rRXWhElI?si=8h4h6lnbUpBDLiQp
by furyofantares | 2025-07-26 17:49:06+00:00
> Earlier LLMs used to be a goldmine for company secrets (when it learned documents that shouldn't be on public internet).

Sounds fake. LLMs don't usually memorize things that appear once in their training set anyway, nor have I heard about major issues accidentally training on a bunch of non-public data.

I can see how someone would believe it to be true though, since LLMs can easily hallucinate in a way that looks like this is true.
by badlibrarian | 2025-07-26 17:49:16+00:00
Physical libraries act under a different set of rules and those were already made well known to Brewster as part of the Hachette lawsuit.

For music, the Music Modernization Act set up a statutory process for making things available, even downloadable. Brewster and others celebrated the measure in blog posts and speaking gigs. Then didn't follow the process, didn't honor polite requests to stop, then got sued for $700 million.

Previously they did some seriously stupid things in their implementation of Controlled Digital Lending, and got the whole concept killed. Not even a debate, just destroyed on summary judgement without even a trial. This set the future many of us want back decades, and ruined a lot of proper efforts that were run much better than the well-intentioned but undermanaged Internet Archive.

Combined with them giving the finger to the fairly innovative and progressive music act, this caused damage not only to reputations, but also the culture.

Regarding copyright basics, we're likely to agree on many positions, including some radical ones. But Internet Archive cannot be a long-term archive, an activist organization, and an open library. There are different laws, risk profiles, and financial/management requirements for each.

And you can't beg people for donations to "save the internet" then set it all on fire to save a bunch of old records that already existed at the Library of Congress. Or act surprised that just because you scan them, it doesn't mean you can then make them available for unlimited download without permission. Again, archives behave differently from libraries. Although it's annoying to tech people, there are good reasons for it.

Brewster likes his honorary library status and degree but he and the site violate the majority of the librarian code of ethics. https://www.ala.org/tools/ethics
by squarefoot | 2025-07-26 17:51:02+00:00
I couldn't agree more. If vendors decided to give the web development the resources it deserves, the experience would turn out vastly superior for the users: no apps to download (browser is usually bundled), well standardized consistent interface where you know what a control does and how does it look like, more control on security and safety, and a lot less resources consumption. Unfortunately heavy advertising, catchy effects, colorful interfaces, and not caring for the web side, convinced most users that the apps approach is the best one, while it's actually the other way around. Apps also give vendors a tool to more easily infiltrate users devices and grab much of their personal data so I guess the motivation to change that is less than nil.
by meepmorp | 2025-07-26 17:51:54+00:00
Why would leaving an unsecured bike to catch thieves be illegal? Entrapment is when law enforcement gets people to commit crimes they wouldn't have considered committing otherwise.

Plus your lawyer needs to make a convincing case that you only took the bike because the cops left it unsecured to trick you, and not because just you're a thief who stole some shit and got caught. Tough row to hoe.
by MisterTea | 2025-07-26 17:52:02+00:00
MIL-DTL-5015 is from the 1930s and used in avionics as well as industrial electrics: https://en.wikipedia.org/wiki/MIL-DTL-5015

I have soldered a lot of these into cable assemblies for automated welding fixtures. They are also found on some servo motors and cables.
by kylebyte | 2025-07-26 17:52:07+00:00
The backend has plenty of complexities, but frontend developers have to deal with something just as complex - the user.

Given ramp up time, most backend engineers could build a bad frontend, or build a good one if they have a really good UX team that thought through everything and are just implementing their work.

In the real world though where UX is understaffed and often focused on the wrong problems - I've had to rescue too many frontends built by backend focused teams to share your confidence.
by jpc0 | 2025-07-26 17:54:14+00:00
> Complexity is not inherently bad. Browsers are more or less exactly as complex as they need to be in order to allow users to browse the web with modern features while remaining competitive with other browsers.

What a sad world we live in.

Your statement is technically true, the best kind of true…

If work went into standardising a better API than the DOM we might live in a world without hunger, where all our dreams could become reality. But this is what we have, a steaming pile of crap. But hey, at least it’s a standard steaming pile of crap that we can all rally around.

I hate it, but I hate it the least of all the options presented.
by ezekiel68 | 2025-07-26 17:54:30+00:00
In any interesting tech position, "your job" is a myriad of things. And if everything is a priority, nothing is a priority. They ask us to automate our work so that "someone else on the team could do it during an outage at 3 am" for a reason. So my point is that moving away from the exotic and towards the commodity is an IT imperative.