MurphyA/hacker-news huggingface dataset:
by jjjutla | 2025-07-31 18:32:48+00:00
Thank you. SAST tools built on AST or call graph parsing will struggle to detect code logic vulnerabilities because their models are too simplistic. They lose the language-specific semantics in dynamically typed languages where objects change at runtime, or in microservices where calls span multiple services. So they are limited to simple pattern-based detections and miss vulnerabilities that depend on long cross-file call chains and reflected function calls. These are the types of paths that auth bypasses and privilege escalations occur in.

AI code review tools aren’t designed for security analysis at all. They work using vector search or RAG to find relevant files, which is imprecise for retrieving these code paths in high token density projects. So any reasoning the LLM does is built on incomplete or incorrect context.

Our indexer uses LSIF for compiler-accurate symbol resolution so we can reconstruct full call chains, spanning files, modules, and services, with the same accuracy as an IDE. This code reasoning, tied with the LLM's threat modelling and analysis, allows for higher fidelity outputs.
by GuB-42 | 2025-07-31 18:33:21+00:00
Mozilla is nothing like Xerox, if anything Google is the new Xerox: they have way too much money so they throw it at R&D side projects without a business plan.

The big one for Google is transformer models, they basically invented LLMs only to play catchup with OpenAI later.

Mozilla successes have always been focused on the web browser, from the very beginning. Even the name reflects that: "Mozilla" stands for "Mosaic killer", Mosaic was the leading web browser at the time. They beat Mosaic with Netscape, they beat IE with Firefox, beating Chrome was their mission, and Rust and Servo were their weapons. It is sad that they dropped the ball.

Like Xerox (and Google), Mozilla tried doing some side projects, but unlike Xerox, they didn't have money to burn from their quasi-monopolies, and I can't think of anything particularly innovative coming from Mozilla that isn't a browser. I don't consider Rust to be a side project, it is a programming language for writing a browser, that it is useful for projects other than a web browser is a happy side effect.
by unsupp0rted | 2025-07-31 18:33:44+00:00
There's no moral argument against ripping DVDs one way or the other.

There's a civil/economic argument: arguably copyright/intellectual property make for stronger societies that produce better stuff for everybody.

But there's nothing immoral about copying or watching something you came across. The author isn't injured by it- nobody is. Except, like I said, perhaps society in general.
by godelski | 2025-07-31 18:34:07+00:00
Here's my method, which is a bit similar to the siblings.

Your first "docs" are your initial sketch. The pieces of paper, whiteboard, or whatever you used to formulate your design. I then usually write code "3" times. The first is the hack time. If in a scripting language like python, test your functions in the interpreter, isolated. Then "write" 2 is bringing into the code, and it is a good idea to add comments here. You'll usually catch some small things here. Write the docstrings now, which is your 2nd docs and your first "official" ones. While writing those I usually realize some ways I can make my code better. If in a rush, I write these down inside the docstring with a "TODO". When not rushing I'll do my 3rd "write" and make those improvements (realistically this is usually doing some and leaving TODOs).

This isn't full documentation, but at least what I'd call "developer docs". The reason I do things this way is that it helps me stay in the flow state, but allows me to move relatively fast while minimizing tech debt. It is always best to write docs while everything is fresh in your mind. What's obvious today isn't always obvious tomorrow. Hell, it isn't always obvious after lunch! This method also helps remind me to keep my code flexible and containerize functions.

Then code reviews help you see other viewpoints and things you possibly missed. You can build a culture here where during review TODOs and other similar things can be added to internal docs so even if triaged the knowledge isn't completely lost.

Method isn't immutable though. You have to adapt to the situation at the time, but I think this is a good guideline. It probably sounds more cumbersome than it is, but I promise that second and third write are very cheap[0]. It just sounds like a lot because I'm mentioning every step[1]

[0] Even though I use vim, you can run code that's in the working file, like cells. So "write 2" kinda disappears, but you still have to do the cleanup here so that's "write 2"

[1] Flossing your teeth also sounds like a lot of work if you break it down into all subtasks 1) find floss, 2) reach for floss, 3) open floss container, ...
by nunez | 2025-07-31 18:34:22+00:00
So I hate Safari with a burning passion and Firefox on iOS isn't much better. Ideally I'd run FF everywhere, but lacking Apple Pay support and iOS anti-competitively locking out extensions to non-Safari browsers make this a non-starter.

I VERY BADLY want to make this my daily driver across all of my devices, but between weird rendering bugs (which are decreasing), janky 1Pass support (which is improving), lacking history sync and the inability to run multiple instances like I can with Firefox*, it has been difficult to make the switch.

I know that Vlad and team are working hard to quash the bugs, so I'll keep trying the betas every once in a while.

*: I know that Safari and Orion have profiles. I prefer to isolate my browsers at a process level, i.e. a separate browser process for work and personal stuff. FF can mostly achieve this with Containers, which I used with the Multi-use Containers extension to create containers based on URL, but things gets weird with intermediate URLs. Safari cannot do this. Orion theoretically can, but I don't think it does right now.
by cjrp | 2025-07-31 18:34:39+00:00
> Passengers reported they were told one of the flight attendants had suffered a broken rib, another person a fractured leg. The trolleys had been lifted and impacted the cabin ceiling and fell to the floor several times, passengers not wearing their seat belts also hit the cabin ceiling. The crew announced they had lost more than 1000 feet of altitude, they hadn't seen such severe turbulence ever before.

https://avherald.com/h?article=52b0a50c&opt=0
by Imustaskforhelp | 2025-07-31 18:35:01+00:00
Lets hope that you guys open source this in a great manner and actually still live really nicely.

If I may ask a philosophical question, when would you consider your product to "succeed", would it be when someone uses it for something important or some money related benchmark or what exactly

Wishing Ursa team peace and success. maybe don't ever enshittify your product as so many do. Will look at you from the sidebars since I don't have a purpose to even kafka but I would recommend having some discord or some way to actually form a community I suppose. I recommend matrix but there are folks who are discord too.

Anyways, have fun building new things!
by Zigurd | 2025-07-31 18:35:02+00:00
I've made a number of video essays about both SpaceX and Blue Origin, mostly from the point of view of management style. To most sane people Bezos can look more competent. But he fired his experienced rocket guy and replaced him with the Alexa guy.

Running a rocket company with KPI dashboards turns out to produce about the same non-results as running your rocket company out of the K hole. Space is hard. Though if I were to bet on one, it would be Blue Origin because they haven't done as many wild ass design decisions that have the potential to scuttle the whole project.
by nucleardog | 2025-07-31 18:35:24+00:00
> I'm surprised that Apple's power management doesn't have an alert for this.

I'm more surprised that any application can prevent sleep _when you close the lid_.

I can understand the utility behind something like stopping sleep via timeout so a media player can tell the system "hey, they're watching a movie don't turn off even if they don't touch you for a bit".

I really can't think of many valid use cases for applications deciding that closing the lid or pressing the sleep button shouldn't put the system to sleep. Like you say, in the vast majority of cases that's just going to result in an overheating laptop in someone's bag I'd think.

Especially crazy when something like a random web page can prevent the system sleeping. Laptop won't turn off... which of my 70 tabs is it?!

Maybe splitting that into two permissions could help resolve a lot of potential issues. Sure, let lots of things disable the sleep via timeout... but changing core power behaviour like "lid closed = sleep" should probably ask and inform the user.
by unethical_ban | 2025-07-31 18:36:16+00:00
I couldn't get my Elgato Key Light Air (or whatever its called) to work on my Unifi network - something was amiss with the WLAN settings that others reported was specific to unifi.

I didn't like how they stopped supporting on-prem Unifi Video server, and only allow you to use it with a hardware appliance now.

They moved beyond "just build good product" and into unwanted cloud services and closed ecosystem.

If this is a re-opening of some of their self-hosting, then great. They're back to par, I guess?
by vel0city | 2025-07-31 18:36:35+00:00
Apple is not the only one doing this. Windows, depending on how its configured and the hardware in it, will keep WiFi and even Bluetooth devices connected even while "asleep".

Example: I go out to the park with my Windows laptop. I turn on the computer. I pair my headphones and hop on my phone's wifi tethering. I do some stuff. I close my laptop lid, the system goes to "sleep". My headphones still think they're connected. My phone still shows the laptop is a client. I walk around the park for an hour. My headphones are still connected, my laptop is still a client on the tethering. I sit down, I open my laptop, it wakes up, and it's still connected to everything.
by ecshafer | 2025-07-31 18:36:54+00:00
Does this data get sold to hedge funds or other groups? Companies that process large amounts of purchases must have some of the most accurate data sets on consumer spending that can exist, and should be able to get that data up to date for a time period much faster than any company or gov could compile a survey. Amazon, Shopify, Square, Visa, Mastercard, etc they could all easily calculate inflation easier and more accurately than the gov.
by trynumber9 | 2025-07-31 18:37:01+00:00
>why don’t more companies follow Ferrari’s lead

Ford did try before. For example, the 2006 Ford GT. In comparison, the similarly-priced Ferrari F430 of the era was the mass market automobile with about 5x as many made.

So I wonder how much one should draw from these rationalizations of prestige marketing. At the end of the day Ferrari still uses its larger super-car production capacity to keep even Ford only an occasional entrant into the low-end of market.
by boogieknite | 2025-07-31 18:37:33+00:00
i think youre right that unpacking could get in the way of enthusiasm. speaking for myself i simply enjoy the challenges of software development and enjoy most new challenges the deeper i go

on the other hand i think unpacking is good because most people dont really know what they want to do coming out of high school, at least in the USA. in america adult jobs are a nebulous concept: i did well at accounting in DECA because i could do mental math better than peers. i assumed id be an accountant because i had to get some job. i assumed id wear a suit and do some math. its a good thing to tell adults because they approve. i took one database class and bailed on accounting to teach myself to code

maybe unpack a career path if there isnt passion and enthusiasm for the process
by n8cpdx | 2025-07-31 18:37:59+00:00
It depends on your ideal balance. There are jobs that involve field work, thinking, and socializing, but there are always trade offs. I find that being indoors from dawn to dusk with a 30 minute walking commute and a hike once or twice a year is my ideal balance.

Police officer actually has a really good balance of physical exertion, mental/social challenge, and indoor/outdoor exposure. And you get to write A LOT. But there are lots of adjacent roles, and many more not so close; e.g. I know someone who used to do field data collection and data analysis for some conservation nonprofit; lots of nature, physical exercise, and mental stimulation.
by BeetleB | 2025-07-31 18:38:23+00:00
“if I have to sit in front of a computer every day for the rest of my life I’ll kill myself.”

Heh. And then they go become a "real" engineer (mechanical, electrical, whatever), and end up sitting in front of a computer all day, dealing with poor UI and poorly designed SW because a lot of CAD tools are either built in-house or owned by monopolies who have no incentive to improve the experience.

I've lived both worlds.

https://blog.nawaz.org/posts/2016/Jan/code-monkey-or-cad-mon...
by NoMoreNicksLeft | 2025-07-31 18:38:47+00:00
>I'm of the opinion that our failure (as a society) to prevent this type of attrition of democracy

I'm not a fan of democracy. You wouldn't be either, if you thought about it for very long... you just can't help yourself, it was championed as some sort of virtue ever since you were old enough to realize that governments existed. From kindergarten or pre-k.

The things you'd claim you like about democracy aren't even things that make it a democracy. The one (and only) criterion of democracy is "can you vote". And there are better ways to get all the other things than voting... voting/people do not scale. It is the undoing of democracy, people get what they deserve from it. Good and hard.

>That democracy is not robust does not mean it is not good nor something worth aspiring to.

It does not scale. You're aspiring to something that not only does not and cannot work, but you're trying to make it even bigger, true "the beatings will continue until morale improves" style. If I can figure out how to strike out on my own and be a million miles away from you when you rally for your most ambitious attempt yet, that's what I will do.
by yjftsjthsd-h | 2025-07-31 18:39:23+00:00
https://www.mozillafoundation.org/en/donate/help/#frequently...

> How will my donation be used?

> These funds directly support advocacy campaigns (i.e. asking big tech companies to protect your privacy), research and publications like the *Privacy Not Included buyer's guide and Internet Health Report, and covers a portion of our annual MozFest gathering.

Notice what donations aren't used for: Firefox.
by laurencerowe | 2025-07-31 18:39:33+00:00
The FAQ states it is often much slower:

> We have support for c-extension modules (modules written using the C-API), so they run without modifications. This has been a part of PyPy since the 1.4 release, and support is almost complete. CPython extension modules in PyPy are often much slower than in CPython due to the need to emulate refcounting. It is often faster to take out your c-extension and replace it with a pure python or CFFI version that the JIT can optimize.

https://doc.pypy.org/en/latest/faq.html#do-c-extension-modul...

I have seen great success with cffi though.
by kwanbix | 2025-07-31 18:39:34+00:00
What exactly do you mean by "not MacBook quality"? Aside from Apple’s M-series chips, I’d take a ThinkPad over a MacBook any day. The T, X, and P series ThinkPads are at least on par with MacBooks in terms of build quality. I will even argue that they are better. And with a ThinkPad, you don’t have to deal with that cold, rigid metal body that MacBooks are known for, and the horribly screens which are like a mirror.
by hinkley | 2025-07-31 18:39:56+00:00
My friend in college was worried she would fall into trap that she eventually fell into: She wanted to be a writer, and she felt that Comparative Lit put you in danger of knowing your writing was crap before you had the motivation and discipline to do something about it.

I tend to give junior devs as much rope as I can because they're just going to be awful until they get about 1000 hours in, and no amount of me scaring them is going to make that any better. And once in a while they surprise me by doing something they shouldn't have been able to do. We all have our preconceptions and nobody's are right all the time.
by perennialmind | 2025-07-31 18:40:48+00:00
Dotnet's GC has a real latency problem. Miguel de Icaza gave a nice talk on why noticeable pauses are inevitable in a stop-the-world tracing GC, proposing Swift's reference-counting GC as the viable alternative [1]. Still, there are recent developments (Satori GC) with the promise to make the worst case far more palatable (e.g. 250ms -> 5ms) [2].

[1] https://www.youtube.com/watch?v=tzt36EGKEZo

[2] https://github.com/dotnet/runtime/discussions/115627#discuss...
by bitshiftfaced | 2025-07-31 18:40:59+00:00
Much more efficiently. Carbs and protein rely on de novo lipogenesis to convert into fat. But you're right in that a surge of insulin from carbs ensures that the available dietary fat will prefer to go to storage instead of being used as fuel.

In a scenario where you're running a calorie surplus, the effect of overeating carbs will work together with and make dietary fat more significantly contribute to body fat. In a scenario where you're running a calorie deficit to lose weight, and the insulin isn't surging, choosing carbs over dietary fat can actually make sense.
by minimaxir | 2025-07-31 18:41:11+00:00
They do, they just don't advertise it well (and only confirmed it with a footnote after criticism of its omission): https://openai.com/index/new-embedding-models-and-api-update...

> Both of our new embedding models were trained with a technique that allows developers to trade-off performance and cost of using embeddings. Specifically, developers can shorten embeddings (i.e. remove some numbers from the end of the sequence) without the embedding losing its concept-representing properties by passing in the dimensions API parameter. For example, on the MTEB benchmark, a text-embedding-3-large embedding can be shortened to a size of 256 while still outperforming an unshortened text-embedding-ada-002 embedding with a size of 1536.
by MattSayar | 2025-07-31 18:41:19+00:00
> FORTRAN was proposed by Backus and friends, and again was opposed by almost all programmers. First, it was said it could not be done. Second, if it could be done, it would be too wasteful of machine time and capacity. Third, even if it did work, no respectable programmer would use it -- it was only for sissies!

- Richard Hamming, The Art of Doing Science and Engineering
by Permit | 2025-07-31 18:41:28+00:00
> I looked at the uses and it seems like the guy was using the term crazy to describe ideas and things being done, not as a negative label for a human being. Splitting hairs? Maybe but I understand where the OP is coming from. Here's the 8 times (7 because one of them is the post we are discussing)

You're giving them too much credit. Take a look at the usages in the article they linked: https://www.npr.org/2019/07/08/739643765/why-people-are-argu...

They're identical to their own usage of the word.

Further, they do use terms like "mad man maniac" to describe a person: https://news.ycombinator.com/item?id=12458323

All of this tells me that this probably isn't actually an important issue to them. Such comments are noise and we should ensure that they're unwelcome here.
by PaulHoule | 2025-07-31 18:41:48+00:00
> Irrelevant exageration.

No. Not at all. See

https://en.wikipedia.org/wiki/G%C3%B6del%27s_incompleteness_...

also the problem that many questions can't be answered out of the database or by principles but only by taking observations which may not be possible. "Truth" is the most problematic concept in philosophy and when the word is wheeled out it impairs the truth. See "9/11 Truther", Godel's idea is that you can break first order logic + arithmetic if you try to introduce the concept of "truth" to the system because it lets you make statements like "I am lying now" Consider also how it took people hundreds of years to prove Fermat's Last Theorem.

See

https://www.sciencedirect.com/science/article/pii/S187705091...

for research on this topic being done in the open.
by ben7799 | 2025-07-31 18:42:01+00:00
That still doesn't prove anything. The market demand for the Ford GT could have been 1/2 what Ford produced but the market demand for the F430 was double what Ferrari actually produced.

I am not saying that is actually the case, but production #s just don't really tell the whole story.

Ford only dabbles in these kinds of cars, they have different reasons for picking the # of units they build. They are a lot like Honda, they are not dedicated to this and they instead just build a small # of sports cars every once in a while to try and improve their reputation.

The article glosses over the core founding purpose of each company too. Ford was founded to build massive #s of assembly line built cars at a price the average worker could afford. Ferrari very reluctantly built street cars to fund racing and decided the sport/luxury cars were the best way to make the maximum money with the smallest # of street cars. Less street cars meant less distraction from building the racing cars.
by Tainnor | 2025-07-31 18:42:51+00:00
I have no idea how these things are related.

In any case, to my knowledge, no cipher has ever unconditionally been proven secure except the one time pad. We just have a bunch of conditional security proof that are correct if the underlying assumptions (e.g. factoring primes is hard) are correct. Critically, I think all (?) such proofs only work if P != NP, which still remains unproven.

> 1) FLT may have been proven by Wiles

The "may" is misplaced here. Wiles's proof has been extensively reviewed, just because it hasn't been formalised doesn't mean it's wrong.
by cultofmetatron | 2025-07-31 18:43:26+00:00
right now , the israeli government is building a "moral concentration camp" for them in gaza atm where gazan will forced to go to or be shot on sight.

can you understand how that isn't any better than what the nazis did?

https://www.aljazeera.com/news/2025/7/16/israel-presses-ahea...
by fzwang | 2025-07-31 18:43:32+00:00
VCs are going to look at a solo technical founder, and ask:

* Are they going to have an interest in the business side? If not, they may ignore/be unaware of problems that are existential to the company.

* Will they have the capacity to deal with non-tech issues? Running a company, esp a fast growing company, is too much work for one person to handle.

* Can they attract other talent to work for them? If they're a solo, are they difficult to work with/for?

It'd be good to address some of these underlying issues, rather than check the box.

* As you mentioned, having previous success helps alleviate some of the concerns.

* If your product is growing very quickly, they may take the risk.

* Finding another potential cofounder organically as a pre-condition for funding. VCs will rarely force you to find a co-founder. That might actually introduce further friction into the team and risk the investment. The hope would be for you to find another person with whom you have good working relationships, which is the key. Even if they're also technically inclined, they can be trained to handle the other sides of the business. Generally speaking, it's easier to train a tech founder on sales/business skills, rather than vice-versa.

Personally, I'd recommend you continue building, but with the intent to find other folks who are also interested in the product/business. It'll be good for you whether you decide to get venture fund or not.