MurphyA/hacker-news huggingface dataset:
by krishnasangeeth | 2025-07-08 18:46:09+00:00
Yeah , that's fair. More than promotion i was trying to suggest i had also built something similar and kind of understand the product space. It's this dev thing, can't shake it off i guess. But i get what you meant.

Apart from that i have a theory that there is a lot of ML based ranking and classification that is happening at the backend.
by GuB-42 | 2025-07-08 18:46:37+00:00
> In mid-2024, he pointed out its "Original Sin" of adopting digital rights management.

I disagree on that one. Maybe it could have been an option 15-20 years ago, when Firefox was a significant force. But now, if it didn't have DRM, platforms that use DRM would just tell people to use another browser, or a specialized app. And people who are not activists would just switch to "the browser that runs $service", and then you give free reign to whoever controls these browsers, including making the DRM more restrictive and more invading.

DRM is an addon, it lets you do thing that you can't do without (i.e. watching protected content), but it won't affect non-DRM content. You can turn it off if you want, you just won't be able to watch Netflix (or whatever), making it a worse user experience.

If you refuse to support DRM (and therefore denying your users of some content), hoping that it will discourage adoption of DRM by platforms, you have to keep your users captive so that they won't just switch. And considering that Firefox doesn't rely on lock-in: they don't have the means to do so, and it is against the spirit in the first place, they have to offset that by offering something else. And unfortunately, they don't have much to offer besides ideology.

The original sin, if we can call it that, is that Firefox technically lagged behind Chrome: slower, more bugs, less secure,... Having to accept DRM, as well as anything Google decided was standard is a consequence of that.

That's why I had high hopes with Servo. It had the potential to make Firefox a "better browser", giving them some weight when deciding not to support some anti-feature, but they lost it.

They also lost an opportunity on mobile by not supporting extensions for too long, and generally, for not being taken seriously. Why did it take them so long to support DNS-over-HTTPS for instance?

Now, they have an opportunity regarding ad-blocking, I don't know how they are going to waste that one, but knowing them, they are probably going to manage it.
by TrackerFF | 2025-07-08 18:47:04+00:00
As we have all learned, ad and subscription models aren't mutually exclusive. You can still get ads while paying for a subscription.

In fact, I don't believe the ad model would have gone away if everyone started paying for a subscription. The bottom tier would still be filled with ads.

Ideally, the market would solve this. The companies that are pushing annoying would lose customers to the companies that don't. But since we don't live in a ideal world, I honestly think regulations would be the only way. Something like "If a customer pays for subscription in any way, you can't show ads" - and then let the companies put a realistic price to their subscription tiers, which makes it worthwhile for them.
by socalgal2 | 2025-07-08 18:47:06+00:00
> open vs closed source products

Chrome is for all intents and purposes, open source. Yes, there is 0.000001% that's not. It's hard to argue that tiny portion is the difference.

> Chrome is actively ending ad block support in its plugins.

Chrome has not ended ad blocking - I'm using ublock lite and ads are blocked.
by shabazahmed | 2025-07-08 18:47:27+00:00
May be they are reading the notification using notifications reading service (Feature in Android) and use intents to send messages. But from intent you can either share (user action) a message to a particular contact or automatically open whatsapp on a particular contact and prefill the message in text box. May be whatapp may have exposed an intent to directly send message or they are just prefilling the text box
by not_your_vase | 2025-07-08 18:48:09+00:00
My first adult job, like almost 20 years ago, was to help introducing an ERP system at a steel tube retail company. My first office job, and all.

A few months into the job, there was a pretty big rain storm, and the roof of the warehouse started to leak - lotsa steel tubes drenched in water.

In the next week, everyone, including the warehouse workers and the office workers (including the CEO - it wasn't a big company, like 20 or so people) spent all time in the warehouse cleaning all the tubes, only 1 girl was allowed to take the phonecalls.

Good times, lol.
by vidarh | 2025-07-08 18:48:59+00:00
Presumably the (broken) thinking is that if you hand the AI agent an MCP server with full access, you can write most of your agent as a prompt or set of prompts.

And you're right, and in this case you need to treat not just the user input, but the agent processing the user input as potentially hostile and acting on behalf of the user.

But people are used to thinking about their server code as acting on behalf of them.
by comex | 2025-07-08 18:48:59+00:00
What do you mean by “HD music video”? If you mean a literal video, then today’s video and audio codecs are more efficient than what Flash used, not less. If the music videos were that small then they must have given up a lot in quality. If you mean a Flash vector animation, then that’s different of course, but that doesn’t describe a typical music video.
by watwut | 2025-07-08 18:49:02+00:00
Not at all. Summer off is 2 months during which you are supposed to prepare. And you are not allowed to take random holidays outside of that season, unlike other professions. As sibling said, rigs frequently work on 2 weeks off every month.

Second difference is that schools do not want revolving doors of teachers, each leaving after a year or two. That is completely normal on oil rigs. People work on rigs temporary, until they move on to doing something else. Quite a few positions are filled by people who do their two years or whatever and do not plan of making it a career at all.
by gausswho | 2025-07-08 18:49:15+00:00
I hat tip your bravery for pointing out an indulgence likely common among readers. Guilty as charged right here. But.

The comparison doesn't really hold. This is not like an untidy workbench. Modern browsers don't incur a significant penalty for having hundreds or even thousands of tabs. There are workflows that benefit from Never Closing, and I'm glad to see browsers now don't turn into a nipple bar to expose me.

Indeed after years and dozens of times where someone looks over my shoulder to see many tabs and abandons our topic to engage in Shame Time, I am fully innoculated to their barbs and feel it says more about the person pointing than myself. I manage to engage in a world with noise. Some people can't. The worst of them reach for grand overarching conclusions, as you have done here.

I also sometimes leave the evening dishes for the morning cleaning session.
Show HN: Dispytch – Python framework for event-driven services
by e1-m | 2025-07-08 18:49:28+00:00
Hey HN,

I built [Dispytch](https://github.com/e1-m/dispytch), a lightweight async-first event-handling framework for Python.

It’s designed for event-driven microservices — think Kafka, RabbitMQ, or custom transports — with clean dependency injection and a minimal footprint. Inspired by FastAPI.

Would love feedback — especially on real-world fit, pain points, and what’s missing.

Thanks!
by netdur | 2025-07-08 18:50:21+00:00
I have fine-tuned Gemma 3N 2B and it's pretty good, but loads slow on my S23U, once it's loaded though, it works fine

Also tried SmolVLM 256M and 500M, they load faster and you can embed them in assets, they work if you know what you're doing

Just keep in mind that smaller models don't perform as well due to their limited parameters

Also on Android, since you can't ship files larger than 2GB due to Java compression issues, you need to download models separately, then you can't load the model from the download folder, you have to copy it into the app's own folder, this means a Gemma 3N 2B model that's 3.14 GB would need at least 7 GB of free space on the user's phone
by uncleben3k | 2025-07-08 18:50:47+00:00
Amazing game, really. So deep, such longevity, and so cool community. Can't believe it's still being developed with such passion, the active coders of the game are something else, in a positive way. Can't recommend this one enough if you want to learn coding either, they take players as coders and basically crowd source their engine to keep the game running.
by alganet | 2025-07-08 18:51:59+00:00
That's precisely one of the tricks charlatans use.

Western culture likes to foster leadership. Everyone in the west aspires to be that 0.01% ruling class, or to project it.

Again, how much this is actual wisdom you can apply to your life, and how much this is your mind saying "I want to be a leader, this is for leaders, so this is for me!!!"?

It doesn't need to be presented as wisdom per se. Like I said, by being old, and being eastern, and being philosophical, it suggests wisdom.

It's like Häagen-Dazs. It sounds scandinavian, but it's not. It's never presented as "true scandinavian ice cream", but people fell for it for a while.

https://en.wikipedia.org/wiki/H%C3%A4agen-Dazs#Origin_of_bra...
by mynameisash | 2025-07-08 18:53:25+00:00
> Do you really think you're going to send 1,000,000 nudes to your wife without accidentally sending one to the wrong person!?

That seems like the wrong way to spin this hypothetical probability.

A quick search says there are 1.38B iPhone users worldwide. According to[0], 87.8% of 18+ year olds have sexted, so let's estimate that to mean 1.21B users. Even if we assume users only ever send one nude, that means 1,210 gaffes if you assume one in a million.

[0] https://www.womens-health.com/sexting-statistics
by beala | 2025-07-08 18:54:12+00:00
More information here (https://github.blog/open-source/git/git-security-vulnerabili...) on the new CVE:

> When reading a configuration value, Git will strip any trailing carriage return (CR) and line feed (LF) characters. When writing a configuration value, however, Git does not quote trailing CR characters, causing them to be lost when they are read later on. When initializing a submodule whose path contains a trailing CR character, the stripped path is used, causing the submodule to be checked out in the wrong place.

> If a symlink already exists between the stripped path and the submodule’s hooks directory, an attacker can execute arbitrary code through the submodule’s post-checkout hook.

Along with a bunch of other git CVEs that are worth a look.
by bumby | 2025-07-08 18:54:32+00:00
No offense, but nature of these replies sounds more like someone parroting tech speak than someone applying principles that have a context beyond just tech or AWS.

>scale free organizational culture

The fact that the meetings are bottlenecked by decision makers ability to synthesize information imply it is not, in fact, “scale free”. Scale free would imply there are not such bottlenecks.

I agree it’s about developing resilient processes. What you allude to is not that, because it implies single points of failure within decision-making, bottlenecks etc. It doesn’t come across as a clear understanding of true process-oriented culture.

>he reads the document and there aren’t Oxford commas he ends the meeting and you have to reschedule

I can’t know, of course, but I suspect this has more to do with ensuring due-diligence than document formatting. It’s the same thing Van Halen did in the 1980s by requiring brown M&Ms removed from the bowl in their dressing room. It was a quick heuristic to ensure the venue read their rider/contract completely and adhered to it because a lack of due diligence in set design, pyrotechnics etc. would have been a major safety issue. I’m willing to bet checking for a lack of Oxford commas is shorthand for “what other details did they miss?”

>And that number is a lot because Amazon is enormous

Again, this implies the opposite of “scale free” culture. A true scale free org wouldn’t have any nodes with a large number of connections. A large number of decisions does not mean any single individual has to involved in those decisions directly. Why is he not willing/able to select someone capable of making those decisions? (Honest question to understand the dynamic).
by simonw | 2025-07-08 18:54:44+00:00
The support thing here is just an illustrative example of one of the many features you might build that could result in an MCP with read access to your database being exposed to malicious inputs.

Here are some more:

- a comments system, where users can post comments on articles

- a "feedback on this feature" system where feedback is logged to a database

- web analytics that records the user-agent or HTTP referrer to a database table

- error analytics where logged stack traces might include data a user entered

- any feature at all where a user enters freeform text that gets recorded in a database - that's most applications you might build!

The support system example is interesting in that it also exposes a data exfiltration route, if the MCP has write access too: an attack can ask it to write stolen data back into that support table as a support reply, which will then be visible to the attacker via the support interface.
by carlosjobim | 2025-07-08 18:55:00+00:00
Genetical evidence shows that twice as many women as men successfully reproduced during the history of our species. And if it wasn't for a period of massive population increase combined with monogamy, that ratio would probably be maybe five to one or more.

The sex ratio of children is hard coded genetically at 50/50 for pretty much all mammals, since any deviance would be corrected back to 50/50 within a couple of generations.

In modern society, an average woman can have as many sexual partners as she chooses to, and very distinguished men can have that. Birth control means that there isn't any actual children resulting from these encounters, but our biological imperatives are still the same. A woman's reproductive value is infinitely higher than a man's in modern society, where the man's reproductive value is approaching zero.
by tuetuopay | 2025-07-08 18:55:00+00:00
Using other languages would likely fix the issue but as a side-effect. Most people would expect a C-vs-Rust comparison so I’ll take Go as an example.

Nobody would write the configuration parsing code by hand, and just use whatever TOML library available at hand for Go. No INI shenanigans, and people would just use any available stricter format (strings must be quoted in TOML).

So yeah, Rust and Go and Python and Java and Node and Ruby and whatnot would not have the bug just by virtue of having a package manager. The actual language is irrelevant.

However, whatever the language, the same hand implementation would have had the exact same bug.
by throw310822 | 2025-07-08 18:55:10+00:00
Never got this, honestly.

Well, first light does 500 miles in 3ms, but the connect signal needs to come back, right? So it should be 250 miles, at most? But this is just a detail.

More importantly, because it seems to assume that all other operations besides the signal actually reaching the destination are instantaneous. As you point out yourself, computers are not abstract machines, so the actual response time between the signal being received by the destination (even assuming it's just one straight line with zero electronics in between) and the destination replying is not zero. I imagine there can be a large variation between physical installations and different types of hardware, so much as to make it very hard to detect a clear 500 miles boundary.

Or am I missing something?
by gpm | 2025-07-08 18:55:32+00:00
You can, but in languages like python/java/go/rust/... you wouldn't, because you wouldn't write serialization/de-serialization code by hand but call out to a battle hardened library.

This vulnerability is the fault of the C ecosystem where there is no reasonable project level package manager so everyone writes everything from scratch. It's exacerbated by the combination of a lack of generics (rust/java's solution), introspection (java/python's solution), and poor preprocessor in C (go's solution) so it wouldn't even be easy to make a ergonomic general purpose parser.
by AtlasBarfed | 2025-07-08 18:56:38+00:00
The telephon system is pretty much totally broken.

Can you trust incoming numbers? No they can be spoofed. Can you trust the sound of voice? Nope, AI. Can you trust companies to enforce anti robocall and other privacy legislation? Hell no.

US mail isn't much better. The fact that seniors have been scammed by us mail for five decades or more with no improvement to regulation or protection is an embarrassment.

Email of course is a lost cause.
by pier25 | 2025-07-08 18:57:19+00:00
> doesn’t really fit well into any good use case

I agree.

If you want an SPA just use Vue's official router. It's getting better now thanks to Eduardo working on file-based router, data loaders, Pinia colada, etc.

If you want a static site or MPA, Astro really seems like a better choice than Nuxt.

https://uvr.esm.is/

https://pinia-colada.esm.dev/
by Walf | 2025-07-08 18:58:29+00:00
That's a good assessment, but it misses the fact that the person with the effective dysfunction genuinely believes they will 'be there in a second', because they cannot accurately assess time. The lack of forthcoming contrition is not difficult to explain, shame discourages people from drawing attention to their faults. If it's happening frequently, one would always be feeling 'faulty'. Aversion to that is expected.
by estebank | 2025-07-08 18:58:42+00:00
> it's fairly common knowledge that the Rust community leadership regards all other programming languages as existing in an adversarial, finite-sum outcome space with any remotely adjacent programming languages and regard it's elimination of other language use as a first-order good.

I call bullshit on this. If you can show any quote that could even be misconstrued as wanting some kind of language supremacy over every other from anyone in a position of "leadership", I'll eat my hat.
by zdragnar | 2025-07-08 18:58:43+00:00
> "Ritual" also covers the comportment of people in their individual relationships, particularly unequal ones such as parent/child and lord/minister, where each side has their own particular obligation to the other.

These writings, like those from kongzi (Confucius), mengzi (Mencius) and others of the period are tailored to the ruling class, because it was a time of turmoil, but were for the purpose of fostering a harmonious and peaceful society. As such, the philosophy covers everyone in scope, at least in parts.

We have unstated, uncodified rituals everywhere in our lives. When you go to work, you wear more formal clothing than in your daily life. You act respectfully towards your boss, and use less profane or vulgar language. This is less true among hip SWEs but is generally true in most cultures.

Unlike xunzi's original audience, we won't get much out of the writings on ruling, as we don't have the means or culture to enforce behavior. We can and do order our own lives, however. Some go to church once in awhile out of habit, and some revolve their entire lives around their faith such as the Amish. Others find more of a middle ground.
by qualeed | 2025-07-08 18:58:52+00:00
Yes, I know it was an example, I was just running with it because it's a convenient example.

My point is that we've known for a couple decades at least that letting user input touch your production, unfiltered and unsanitized, is bad. The same concept as SQL exists with user-generated AI input. Sanitize input, map input to known/approved outputs, robust security boundaries, etc.

Yet, for some reason, every week there's an article about "untrusted user input is sent to LLM which does X with Y sensitive data". I'm not sure why anyone thought user input with an AI would be safe when user input by itself isn't.

If you have AI touching your sensitive stuff, don't let user input get near it.

If you need AI interacting with your user input, don't let it touch your sensitive stuff. At least without thinking about it, sanitizing it, etc. Basic security is still needed with AI.
by 10000truths | 2025-07-08 18:59:34+00:00
This is a big problem with using ad-hoc DSLs for config - there's often no formal specification for the grammar, and so the source of truth for parsing is spread between the home-grown serialization implementation and the home-grown deserialization implementation. If they get out of sync (e.g. someone adds new grammar to the parser but forgets to update the writer), you end up with a parser differential, and tick goes the time bomb. The lesson: have one source of truth, and generate everything that relies on it from that.
by abruzzi | 2025-07-08 18:59:35+00:00
never tried Radium, but in Apple's Logic Pro you can write Javascript to do stuff to the MIDI as it comes in or goes out. I've found it quite useful. I once wrote a small script (at the request of another Logic user) that turned a monosynth that only supported "low note priority" into "last note priority." I'd be interested to see what Radium can do.
by sbeli | 2025-07-08 18:59:38+00:00
I built a food delivery price optimization platform that algorithmically stacks discounts across multiple layers (store promos, credit card rewards, gift cards, etc). Initially, I found a lot of discounts were hiding behind the massive marketing budgets of delivery corporations. I originally architected cross-platform price comparison, but delivery platforms' terms of service explicitly prohibit displaying "priced items from multiple retailers on the same screen." This forced a complete pivot from comparison to single-platform optimization. Basically they don't want me comparing their prices and promos to competitors. Makes sense.

So my adapted approach is: Instead of price comparison, the system takes your list/search terms and builds optimized platform-specific carts.

- Real-time promotion discovery - Credit card reward optimization - Smart cart building so it can qualify for all discounts - Uses ML to suggest product swaps that maintain savings while improving nutritional value - Predictive rebate matching based on shopping patterns

In early testing I'm seeing around 35% higher cart values on average. So I really think the idea has legs and I don't want to give up, but navigating these partnership dynamics as a solo founder is proving to be challenging.

Has anyone else had to completely restructure their product architecture due to partnership requirements? How do you balance technical capabilities with business partnership limitations?
by ic_fly2 | 2025-07-08 19:00:05+00:00
Very neat looking tool.

Do you expose an api to set and get network information like valve placement, demand at nodes or pump schedules?

In my old research group we ran a forked versions of epanet to do some of these things and there was a previous effort called oompnet that tried to bring oo into working with epanet.

If researchers can use epanet-js to give their researched algos and methods for wdn control or management, the combination could actually give Bentley a run for their money.

You might want to present this at ewri and ewra or ccwi, there are usually quite a few people working with epanet there.