MurphyA/hacker-news huggingface dataset:
by ProstZero | 2025-07-25 06:51:17+00:00
A few month back, I went to a friend's birthday party. I wasn't drinking that night—early meeting the next day. Within 30 minutes, someone handed me a warm Diet Coke and asked, "You good?" Then came the questions: "Are you driving?" "Are you on meds?" "Everything okay?"

I realized something: there's no social script for not drinking. And worse, there's no good drink option either.

I started looking into alcohol-free alternatives, just to have something better next time. But it turned out more annoying than expected. A lot of options are buried inside regular booze websites, or scattered across brand pages, each with their own overly-polished marketing copy that doesn't really help you figure out what anything actually tastes like.

On top of that, some alcohol-free options are only available in Europe while others are US-only. So I'd find a great recipe calling for some specific ingredient that's apparently amazing but only ships to certain regions. Which meant I had to research what similar products were available in different markets and map out replacements.

All I really wanted was a simple place to browse legit zero-proof drinks, read actual descriptions of what they taste like, and see all the options in one place instead of hunting across different brand websites. So I started collecting recipes I liked in one place—stuff I'd actually drink. Some are from brands, others are easy DIY. Mostly just things that taste good and don't feel like a compromise.

I put it all together here: https://prostzero.com

It's not trying to be the definitive source—just what I wished existed when I started looking. You can search by ingredients, filter by dietary needs, or just browse by type of drink. I found some solid options and made it work for both US and European users—ingredients in recipes automatically get replaced with available options in your current region.

Happy to hear what others are doing in this space, or any good drinks I should check out.

What’s been your best alcohol-free find lately?
by globular-toast | 2025-07-25 06:51:25+00:00
That's how global optimisation works. Generally speaking you will always miss out on a bunch of local optima when you go for a global optimum. This was well understood by designers in metro systems like the London Underground[0] and road signs.

When each individual strives for the best result for themselves (a local optimum) we often end up in a worse result for everyone (see tragedy of the commons, prisoners' dilemma etc).

[0] https://m.youtube.com/watch?v=IrHRQSm6LIs
by vrighter | 2025-07-25 06:51:37+00:00
I try to once in a while but, for example, last time I ended up being instructed to make a bunch of changes to make the automated tool make all the little mistakes that were usually done during the manual process, so that if the process needs to be done manually, they wouldn't be confused. For example: Setting up a volume of a particular size, and then, so they wouldn't have to bust out a calculator, they put in a nice round number that's nice for them to write (lots of zeros), meaning it wastes space.

The point of the automated tool is to do it quicker and correctly, and remove the need for a calculator (which just involves dividing one number by 4096 at some point, really). But I had to re-fuck-it, and as a bonus, they never used it at all. I doubt any of my colleagues remembers it exists.
by rdl | 2025-07-25 06:51:48+00:00
I am mostly a P365 carrier/shooter now, but for a couple years a P320 Compact was my primary handgun (with an X5 P226 SAO for competition); I put probably 15-20k rounds through the P320 (1k round classes, etc, back when ammo was $150-180/case) (and never got the drop-safe mod done), and no problems. So it's some combination of QC, specific units, and bad luck -- but even a 0.001% risk of something happening is a big deal.

The quick P250 -> P320 without really designing it properly does seem to have been a mistake, though.
by matheusmoreira | 2025-07-25 06:52:20+00:00
Not at all. They are one and the same. Both of those things will literally destroy the computer freedom we enjoy today.

GrapheneOS can attest to the device's security. The question is whether the app developers will trust such an attestation. Will they put money, time and effort into evaluating and trusting GrapheneOS? Of course not. They will just decide to trust nobody except Google and Apple.

This is the future. We'll be discriminated against. Can't even log into an account from an "unauthorized device". Their servers will just refuse to talk to our phones if they can't cryptographically verify that we have not "tampered with" them. We'll be refused service straight up unless our computers are straight up owned by corporations.

This so called "integrity checking" is meant to protect the corporations from us, not the other way around. It's so we can't do things like hack our way around their "policies".
by godelski | 2025-07-25 06:54:24+00:00
I've taught undergraduates and graduates how to code. I've contributed to Open Source projects. I'm a researcher and write research code with other people who write research code.

You could say I've seen A LOT of poorly written human generated code.

Yet, I still trust it more. Why? Well one of the big reasons is exactly what we're joking about. I can trust a human to iterate. Lack of iteration would be fine if everything was containerized and code operates in an unchanging environment[0]. But in the real world, code needs to be iterated on, constantly. Good code doesn't exist. If it does exist, it doesn't stay good for long.

Another major problem is that AI generates code that optimizes for human preference, not correctness. Even the terrible students who were just doing enough to scrape by weren't trying to mask mistakes[1], but were still optimizing for correctness, even if it was the bare minimum. I can still walk through that code with the human and we can figure out what went wrong. I can ask the human about the code and I can tell a lot by their explanation, even if they make mistakes[2]. I can't trust the AI to tell an accurate account of even its own code because it doesn't actually understand. Even the dumb human has a much larger context window. They can see all the code. They can actually talk to me and try to figure out the intent. They will challenge me if I'm wrong! And for the love of god, I'm going to throw them out if they are just constantly showering me with praise and telling me how much of a genius I am. I don't want to work with someone where I feel like at any moment they're going to start trying to sell me a used car.

There's a lot of reasons, more than I list here. Do I still prompt LLMs and use them while I write code? Of course. Do I trust it to write code? Fuck no. I know it isn't trivial to see that middle ground if all you do is vibe code or hate writing code so much you just want to outsource it, but there's a lot of room here between having some assistant and having AI write code. Like the OP suggests, someone has got to write that 10-20%. That doesn't mean I've saved 80% of my time, I maybe saved 20%. Pareto is a bitch.

[0] Ever hear of "code rot?"

[1] Well... I'd rightfully dock points if they wrote obfuscated code...

[2] A critical skill of an expert in any subject is the ability to identify other experts. https://xkcd.com/451/
by Kon5ole | 2025-07-25 06:54:30+00:00
>My understanding is that every other form of energy production has similar or worse concerns

You are suffering from a misunderstanding then. Maybe several, since Germany has cut their coal use by more than half since Fukushima. (262 TWh from coal in 2011, 108 in 2024).

Nuclear waste and the efforts it requires to manage is really orders of magnitude worse than other kinds of waste produced in energy production. Even if it can be argued that coal is second, it's a distant second, and nobody replaces nuclear with coal.
by slg | 2025-07-25 06:55:22+00:00
>He thought that analytics was changing the probabilities of discrete events by single digits.

That is actually huge in baseball. As an example, the player who was least likely to get a hit last year did it in 19.6% of their at bats (this typically isn't represented as a percentage and would instead be listed as .196 batting average), while the player who was most likely to get a hit did it 33.2% of the time, meanwhile the league average was 24.3%. That means "changing the probabilities of discrete events by single digits" is what separates the average player from the outliers at both the top and bottom of the talent pool.
by brabel | 2025-07-25 06:55:52+00:00
Optimizing for the JVM is a nightmare (or trivial depending on your point-of-view).

Another anecdote: I profiled our Java-based server and concluded that most of the time was being spent on creating temporary DI containers for request handling. I spent several days trying to avoid copying the "app" scope components to the "request" scope container (we forked and heavily modified our DI container implementation) so that creating request containers was cheaper. I wrote a JMH benchmark that tried to emulate the real thing based on the real data (with something like 40% of components in the "app" scope, 60% in the "request" scope). My optimisation made the code noticably faster, I can't remember by how much exactly, but probably something like 25% faster.

When I ran the "real" performance test that simulates real-world usage of the server (not just the containers) the performance was slightly worse!! Ended up throwing the code away, as the OP. I had already spent too much time on it so I couldn't dig much further into why that was. But from other experiments, I can say that the JVM, thanks to JIT compilation of bytecode, will heavily optimize the hot path anyway based on the actual usage patterns, so much that the Java code you wrote may resemble very little of what machine code is actually executing in the end. That's why I said it may also be "trivial" to optimize JVM code: just let the JIT do its job.

Of course you may still obtain big gains when you optimize code that was doing stupid things, but because of JIT "magic", even your stupid code might run really fast given enough JIT passes.
by phire | 2025-07-25 06:55:59+00:00
Yeah, it was the 0.1 release. I can't remember exactly when Rust entered the general "programming language discourse" on hackernews and /r/programming, but it was somewhere around here. I'm sure the people behind Go would have known about it by this point in time.

And while rust did have optional "garbage collected pointers", it's important to point out that it is not a garbage collected language. The ownership system and borrow checker were very much front-and-centre for the 0.1 release, it was what everyone was talking about.

Actually, my memory is that while the language had syntax to declare garbage collected pointers, it wasn't actually hooked up to a proper garbage collector. It was always more of a "we are reserving the syntax and we will hook it up when needed", and it turns out the ownership system was powerful enough that it was never needed.
by judge123 | 2025-07-25 06:56:22+00:00
Okay, the technical breakdown is wild. But my first thought was: how on earth do I explain this risk to my non-technical boss or clients? If I say 'they can bypass DKIM with a replay attack,' their eyes will just glaze over. We need a simple, powerful way to communicate this stuff. Anyone have a good one-liner for this?
by mvATM99 | 2025-07-25 06:56:26+00:00
I've been using GitMCP.io + Github Copilot for this problem specifically (AI assistant + accurate docs). The downside is that you need to add a separate MCP server for each repository, but the qualitative difference in agent mode is incomparable.

I used it recently to do a major refactor and upgrade to MLFlow version 3.0. Their documentation is a horrid mess right now, but the MCP server made it a breeze because i could just query the assistant to browse their codebase. Would have taken me hours extra myself.
by jauntywundrkind | 2025-07-25 06:56:26+00:00
I generally think there is a lot of good use for local models. Works like Lucy have a ton of potential to help drive tools, do basic reasoning. https://huggingface.co/Menlo/Lucy

But I think this week we are seeing a lot of extremely capable large models. DeepSeek V3 (670B) was joined by Kimi K2 (1T), and now Qwen3 Coder (480B). Trying to run these at home with any reasonable speed is very hard. Smaller models can be quite useful too but I feel like one absolutely wants to be able to tap these large models for a lot of core crucial work. https://www.reddit.com/r/LocalLLaMA/
by menaerus | 2025-07-25 06:56:32+00:00
The issue was that they were hand-optimizing the SIMD for a workload that doesn't even exist in their case so they ended up seeing one big nothing once they profiled the code with a new optimization - a classic trap with 95% "optimizations". It turned out that the distribution of their data is in those 1 and 2 byte LEBs, and in that case their SIMD approach doesn't give the gains as it does with 9 and 10 byte LEBs.

I am wondering more about the bit-by-bit compatibility part from "This was verified in a benchmark that ran both versions on billions of random numbers, confirming both the huge speedup and the bit-for-bit compatibility of the result.".

How does one test for 18.4 quintillion numbers? This isn't possible.
by librasteve | 2025-07-25 06:57:40+00:00
yes … I find it as useful as I used to find perl (spent 4 years as a perl coder back in the day) and use for ad hoc scripts … data migration, PDF/CSV scraping, some LLM prompt engineering in a business setting, wrote a module to manage/install Wordpress on EC2 for example

raws-ec2 —eip —nsu launch raws-ec2 —q connect | pbcopy

https://raku.land/zef:librasteve/CLI::AWS::EC2-Simple

mainly I find Raku (and the community) much -Ofun
by Thorrez | 2025-07-25 06:58:06+00:00
A lot of the discussion in the comments here is about gun mechanisms.

This could be considered gun tech. Note that HN doesn't require posts to be tech related, although this post might be a little borderline regarding the "If they'd cover it on TV news, it's probably off-topic." guideline.

https://news.ycombinator.com/newsguidelines.html
by sim7c00 | 2025-07-25 06:58:47+00:00
well read before u run was obviously for the shell script not gcc sources :'l. i dont think thats a fair comparisson. but you do make a good point. its why i write my own OS :D and yes, once that is up own toolchain would be next, as an experiment to see what'd be needed to be secure ,even forgetting ofc the hw we run on. wasnt planning to play with horrible acids to see what is in there, tho its possible.. :D. (it will never be finish in my life haha, i know...).
by SideburnsOfDoom | 2025-07-25 07:00:11+00:00
> a properly constructed ID type has a non-trivial amount of code

That is correct, I've looked at the generated code and it's non-trivial, especially when validation, serialisation and casting concerns are present. And when you have multiple id types, and the allowed casts can change over time (i.e. lock it down when the migration is complete)

That's why I'd want it to be common, tested code.
by alwillis | 2025-07-25 07:01:00+00:00
You will start seriously worrying about coding AI bills within 6 months

Nope.

More open models ship everyday and are 80% cheaper for similar and sometimes better performance, depending on the task.

You can use Qwen-3 Coder (a 480 billion parameter model with 35 billion active per forward pass (8 out of 160 experts)) for $0.302/M input tokens $0.302/M output tokens via openrouter.

Claude 4 Sonnet is $3/M input tokens and $15/M output tokens.

Several utilities will let you use Claude Code to use these models at will.
by NoPicklez | 2025-07-25 07:01:29+00:00
Press must love these types of articles.

ChatGPT isn't some person but people see it as mystical enough that this hyped up product provides results for things that are unfavorable.

You know what else provides similar results when you ask it, Google. It's just that this tool speaks the results back to you in a way that makes it seem human.

I am looking forwarded to the day where we're not so surprised that LLM's give you answers and responses for things that are unfavorable.
by oefrha | 2025-07-25 07:01:42+00:00
This is a very confusing read. It gives the impression that the attacker managed to manipulate the email body to insert their phishing link, by talking at length about how the sites.google.com link is suspicious (of course it is, no doubt about that). But at the same time, they don’t say or show evidence that the body was manipulated; in fact quite the opposite.

My understanding is that the DKIM signature contains a bh= field with a hash of the email body. While you can technically also include an optional I= field to limit the body length for hashing, so that an attacker can append to the body, which is a pretty big security hole, it’s probably never used by Google for such short emails (I checked some of my own emails from no-reply@accounts.google.com and they certainly don’t have I=). Therefore to pass DKIM and DMARC the body had to be intact, so the “phishing link” was actually from Google, just intended for a different recipient.

If my analysis is correct then TFA really is a lot of words to say a scary email was forwarded to wrong people to scare them. Scary of course, but much less scary than the “DKIM replay attack” title implies to technical people who are not deep into this subject.

Edit: Oh, I thought “The Takeaway?” was the end of TFA since it had CTA for their product. Apparently there’s an update below explaining the link was actually part of a Google OAuth app name which was then inserted into Google’s email template. Terrible writing and structuring of the article, burying arguably the most important part of the attack that made it somewhat convincing, and misleading readers to believe the attack can be used to send arbitrary content.

Edit 2: Other commenters pointed out that the screenshot of the email is conveniently cut off so the fixed part of the Google email template isn't shown. The attack is probably even more clumsy then it seems from the quite deceptive crop.
by rhubarbtree | 2025-07-25 07:02:17+00:00
I think you’re right.

But most startups aren’t building for 10 years out. If you use a lot of typing, you’ll probably die way before then. But yeah if you’re building a code base for the long term then use types unless you’re disciplined enough to write comments and good code.

As for refactoring, that is exactly what test suites are for.
by NitpickLawyer | 2025-07-25 07:02:28+00:00
The problem with benchmarks is that they are really useful for honest researchers, but extremely toxic if used for marketing, clout, etc. Something something, every measure that becomes a target sucks.

It's really hard to trust anything public (for obvious reasons of dataset contamination), but also some private ones (for the obvious reasons that providers do get most/all of the questions over time, and they can do sneaky things with them).

The only true tests are the ones you write yourself, never publish, and only work 100% on open models. If you want to test commercial SotA models from time to time you need to consider them "burned", and come up with more tests.
by Ey7NFZ3P0nzAe | 2025-07-25 07:02:41+00:00
Shoutout to the absolutely awesome beartype for python. With simple decorators it adds runtime type checking with virtually no performance cost!!

https://beartype.readthedocs.io/en/latest/

Or see their page about performance: https://beartype.readthedocs.io/en/latest/faq/#faq-realtime
by SideburnsOfDoom | 2025-07-25 07:03:37+00:00
Is it "overkill" if it's already written and tested?

Once you have several of these types, and they have validation and other concerns then the cost-benefit might flip.

FYI, In modern c#, you could try using "readonly record struct" in order to get lots of equality and other concerns generated for you. It's like a "whole library" but it's a compiler feature.
by JamesCarter2025 | 2025-07-25 07:04:28+00:00
I tried Memories.ai with some old recordings of my dad, and I didn’t expect it to hit so hard emotionally. The voice felt familiar, and the way it responded brought back a wave of memories. It’s not perfect, of course, but there’s something comforting about hearing his voice talk to me again. Felt like a warm hug from the past.
by bfg_9k | 2025-07-25 07:04:41+00:00
You're right - but in that instance the justification in my mind (and what you'd presumably argue if challenged legally) is that they're difficult to work with - which I'm okay with.

But not wanting to concrete that person's driveway because they're in the army, or because they're a politician or whatever else along those lines I think shouldn't be allowed.
by tialaramex | 2025-07-25 07:05:24+00:00
Yeah, all these types have problems, we've decided to put up with the IEEE floating point numbers, we could have chosen to have the big rationals, or drawn any other line. I don't disagree that there's no satisfying "correct" answer but it's a little disappointing that programmers so easily accept the status quo as though nothing else could be in its place.

Maybe Python having automatic big numbers like Lisps often did will help introduce new programmers to the idea that the 32-bit two's complement integer provided on all modern computers isn't somehow "really" how numbers work.
by michaelt | 2025-07-25 07:06:35+00:00
The other reason is: If a user figures out a way to upload javascript and have it work, you don't want them to steal other users' login cookies.

This is why your gmail attachments should show up on googleusercontent.com instead of google.com

Many years ago, some naive websites would let users upload images, but wouldn't validate their content; and some browsers would ignore file content type headers if they had a better guess. So an attacker could rename a .html to a .jpg, upload it as your user profile image, then direct people to www.example.com/avatars/eviluser.jpg and they'd get a HTML page and run its javascript.

That's why, to this day, you sometimes see websites sending the header "X-Content-Type-Options: nosniff" which tells Internet Explorer 8 not to guess the content type.
by lurk2 | 2025-07-25 07:09:23+00:00
This is not an attitude exclusive to progressives. The chief grievance here is that the historical “solution” to the “problem” of Down Syndrome has been abortion. Opposition comes from the pro-life movement (which is generally conservative) and disability advocacy groups (which are generally liberal).

A novel therapy that does not result in the termination of the pregnancy might satisfy the conservatives, but it does nothing to satisfy the disability advocates, who point out that these kinds of technologies fundamentally normalize the idea that they should never have been born the way that they are.
by Mawr | 2025-07-25 07:11:22+00:00
> if you happen to go over the limit

Yeah I hate when that "just happens" too.

> or god forbid set the cruise control above the limit

The word limit is the key here.

> Because setting the cruise control to 50 when in a 50km/h zone will have you driving 45 in reality

Dear god! I hope you somehow made it through that insufferable experience. To think of the few seconds of your life you've irreplaceably lost! Sending a virtual hug!