MurphyA/hacker-news huggingface dataset:
by CGamesPlay | 2025-07-27 23:54:53+00:00
> QUIC which looks like a reliable, ordered protocol as opposed to the unreliable, unordered nature of UDP which is what many games need.

This isn't right, as a sibling comment mentions. QUIC is a UDP-based protocol that handles stream multiplexing and encryption, but you can send individual, unordered, unreliable datagrams over the QUIC connection, which effectively boils down to UDP with a bit of overhead for the QUIC header. The relevant method in Iroh is send_datagram: https://docs.rs/iroh-net/latest/iroh_net/endpoint/struct.Con...
by EGreg | 2025-07-27 23:55:13+00:00
I wonder who's more authoritarian these days, UK, Russia or China when it comes to free speech. Actually Konstantin Kisin wondered that years ago already:

https://www.youtube.com/watch?v=0r7GRx8Sl-s

hmm: https://www.foxnews.com/world/cs-lewis-tolkien-orwell-among-...
by zahlman | 2025-07-27 23:56:51+00:00
People absolutely can fork uv, and if Astral ever does anything shady then I would absolutely recommend that people do so.

I'm designing PAPER to be small and efficient (to the extent Python allows), with an explicit API — largely with the intent of making it easy for others to extend, wrap, fork, integrate, interoperate with etc. it.

> I had notes for something that would have been equivalent to "uv" in many ways, in particular it would have a correct resolving algorithm.

Pip gained a correct (relative to the standards and metadata availability of the time) resolving algorithm in 2020 or soon thereafter. uv adds performance largely via heuristics and shortcuts (i.e., given multiple options for trying to fix a problem, it tries to try them in an order that's more likely to find a solution earlier). This stuff seems like the hard part and I'm probably doing to just drop in pip's logic (which has already been isolated as `resolvelib`, though it requires some interfacing) at least to start.

> uv's answer to be not written in Python was genius, not least because it contributes to speed (caching matters a lot, a pure-Python system could dot that) but because a static linked binary completely eliminates the dangers of corrupted environments. (poetry gets fubared if you use it long enough)

All you needed to do was make your tool have its own isolated environment (in an out-of-the-way place), have it function cross-environment (pip now accomplishes this by a "re-run the code" hack; PAPER has logic to just inspect the target environment explicitly) and refuse to install anything in the tool's environment that isn't vetted as necessary for a tool plugin etc. Yes, I'm sure data scientists can screw up environments something fierce. That's why you let them have their own playground. My plan is to also create a default "sandbox" environment (like what pip originally tried to do with `--user`, except actually a virtual environment and not given special path-hack treatment) for "library" installs when no target is explicitly specified, and do all "application" installs in new environments by default.

I don't know what issues you encountered with Poetry. If they're still a thing in 2.x (apparently they're at 2.1.3 now), I'm sure they'd appreciate a reproducer.

> I didn't got forward with it because when I asked around I found Pythoners just didn't give a damn that the pip resolver didn't really work -- it works for them, if their project is simple.

Pip does work for a lot of people (although it's slow even when it does literally nothing), which is a big part of why it didn't face a lot of pressure to improve. Circa 2017, the complaints were more nebulous, and probably a bigger share of them could be attributed to poor ecosystem standards (in particular, metadata availability) and to Setuptools. Things in the pyproject.toml era are the same in many ways, but very different in others.
by lern_too_spel | 2025-07-27 23:57:47+00:00
No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about

Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-andro...
by altairprime | 2025-07-27 23:58:01+00:00
You would need to release a kernel and OS that requires users who modify the attestation and hardware token components of it to provide their own signing key rather than your production EU-registered one, chained back to the HSM signature emitted by the phone’s HSM signed bootloader; and then you would simply let the app check that its secure boot attestations chain to a secure bootloader/image/OS triplet that’s on file with the EU. Mix in some tech spice for the EU to prohibit OS releases that are validly signed but whose specific instance of a signature is found to be exploitable to bypass age checks and you’re set. None of this would prevent users from modding their devices, any more than macOS prevents modifications today if you turn off the security protections; but once you turn off the security protections, it can no longer attest with Apple’s signature because your modifications don’t match the signature any longer, and so Apple Wallet is inaccessible.

None of this prohibits users from modifying their bootloader, kernel, or OS image; but any such modification would invalidate the secureboot signature and thus break attestation until the user registered their own signatures with the EU.

The EU currently only transacts with Google in this regard because, as far as I know, they are the only Android OS publisher (and perhaps the only Linux publisher?) that bothered to implement hardware-to-app attestation chaining live in production end-user devices in the decades since Secure Boot came onto the scene. All it takes to change that is an entity who has sufficient validity to convince them that outsourcing permitted-signature verification to Google is unethical, which it is.

It’s a safe bet that Steam Linux was already working on this in order to attest that the runtime environment is unmodified for VAC and other multiplayer-cheating prevention systems in games — and so once they publish all that, I expect we’ll find that they’ve petitioned their attested OS signature chain to the EU as satisfying age requirements for mature gaming.

The vendor lock-in here is that Apple and Google and, eventually, Valve, are both willing to put the weight of their business behind their claims to the EU that they do their best to protect the security of their environment from cheaters, with respect to the components required by the EU age verification app. The loophole one could drive a truck through that the EU has left open to break that lock-in in the future? Anyone can petition the EU to accept attestations from their own boot-kernel-OS chain signatures so long as they’re willing to accept the legal risks visited upon them if found to have knowingly permitted exploitation for age check bypasses, or neglected to respond in a timely and prudent manner when notified of such exploitability by researchers — and if the EU rejects their petition improperly, they’ll have to answer for that to their citizens.
by lemoncookiechip | 2025-07-27 23:58:24+00:00
We shouldn't need Age Verification checks for adults in the first place.

Create a better, standardized, open-source parental control tool that is installed by default on all types of device that can connect to the web.

The internet aspect of the parental control should be a "Per Whitelist" system rather than Blacklisting. The parents should be the ones to decide which domains are Whitelisted for their kids, and government bodies could contribute with curated lists to help establish a base.

Yes, there would be some gray area sites like search engine image search, or social media sites like Twitter that can allow you to stumble into pornography, and that is why these devices that have the software turned ON, should send a token through the browser saying "Parental Control". It would be easier for websites to implement a blanket block of certain aspects of their site than expect them to implement whole ID checks systems and security to make sure that no leaks occur (look at the TEA app) like the UK is expecting everyone to do.

Also, I'm for teenagers (not little children) having access to pornography. I was once a teenager, every adult was, and we know that it's a natural thing to masturbate which includes the consumption of pornography for most in some way. Repressing their desires, their sexuality, and making this private aspect of their life difficult isn't the way. Yes, yes, there is nuance to it, (very hardcore/addiction/etc) but it should be up to the parents to decide with given tools if they trust their kid to consume such a thing.

As for the tool itself. Of course we have parental tools, but they can be pretty garbage, their all different, they're out of the way, and I understand that many people simply don't know how to operate them. That's why I believe that creating a standardized open-source project that multiple governments can directly contribute to and advertise for parents is the way, because at the end of the day, it should be up to the parents to decide these things, and for the government to facility that choice.

Obviously, besides the internet aspect, the tool should have all the bells and whistles that you'd expect from one, but that's not the topic.

EDIT: And yes, some children would find a way, just like they're doing now for the currently implemented ID checks. It's not lost of me that VPNs with free plans suddenly exploded in 4 digits % worth of downloads. A lot of those are tiny people who are smart enough. Or using an app like a game to trick Facial Recognition software.
by A4ET8a8uTh0_v2 | 2025-07-28 00:01:01+00:00
This is genuinely a real issue. It seems that most people cannot forsee an issue down the road unless it just happens to personally affect them after it took place ( ideally immediately after ). Valve is a good example, because while it is providing good value for the service it provides, it will not stay like that forever, but the environment it did set up will. And it will hurt once MBAs divvy up that kingdom. Just sayin'

And obviously it is not just one arena, because it seems to be one glaring issue with human beings: they do not want to see the road ahead. And the ones they do are, at best, ignored.
by t-writescode | 2025-07-28 00:02:43+00:00
Alternatively, they could be very, very conscious of being hyper-honest. There is a huge amount of overlap between people with a “strong sense of justice” (and honesty about using controversial technologies could be covered in that), and people on this forum.

You might not think that’s sufficient for a disclaimer; but if I was worried about AI use and wanted to be super duper up front, I would put that on my own journal if I used it for the things I mentioned.
by zahlman | 2025-07-28 00:03:07+00:00
> I think the desire for something like UV comes from the fact that people just don't think about what is going under the hood.

Given the sheer number of downloads pip and Setuptools have, I have to assume this is the case. It's hard to imagine this happening without poorly configured CI pipelines that either accidentally defeat or deliberately circumvent the download cache.

https://pypistats.org/packages/pip https://pypistats.org/packages/setuptools
by amy_petrik | 2025-07-28 00:03:10+00:00
The death knell for the industry is the redefinition of the unit of American society.

The unit at the time of DaBeers smashing 1947 "Diamonds are Forever" campaign, in 1947, was the -family-. It wasn't too long after women's suffrage, and still women were expected to be barefoot and pregnant, after all, birth control wouldn't come for another 20 years. Families were the operative entity messaging targeted, and the campaign was successful because the diamond was a sort of foundation for the foundation of the family, the marriage, not dissimilar in spirit from long held human societal norms of dowries and such.

The sexual and hippie revolution of the 1960s shook the whole thing up. Women didn't need families, there was birth control, women could work, a revolution carrying forth to the 1980s shark killer business woman to today where in fact many universities have become female majority. The modern unit of american society is the individual, not the unit, making the diamond an anachronistic echo of a once proud culture, now seen as a bit dated, a bit weird, a bit unsettling and paternalistic, instilling the same feelings in a person that an old Playboy magazine might.
by zeta0134 | 2025-07-28 00:03:29+00:00
I keep coming back to the actual solution being to keep kids off the internet period. If you are under 18, and online without some sort of adult supervision, we have failed you. Maybe that ship has sailed with so much coursework requiring online access, but I maintain that perhaps we should declare it lost at sea and try again.

Because the practical reality here is, like, porn is the big scary word, but the actual danger to kids is *other people.* Other addictions still exist. Removing one vice without solving the underlying systemic problem merely shifts the goalposts, and everyone is up in arms about what a slippery slope that is for good reason.

EDIT: Clarity here because I phrased that badly in a hurry: I'm in disfavor of internet access being a requirement for schoolwork, but I failed to set that context initially. If parents trust their kids enough with access, once they've reached a certain point of maturity, that's fine. I'm against technological age gates and I'm against removal of bad content from the net at large. Parents should decide when their kids are ready, and guide them appropriately.

I will leave my original remarks unedited so the remaining discussion is sensible. (Sorry!)
by wtn | 2025-07-28 00:04:04+00:00
> “The Air Force completed a replacement of the aging SACCS floppy drives with a highly secure solid-state digital storage solution in June [2014],” Justin Oakes, a spokesman for the Eighth Air Force, said in an email. “This replacement effort exponentially increased message storage capacity and operator response times for critical nuclear command and control message receipt and processing.”
by godelski | 2025-07-28 00:04:37+00:00
> [balloons] are not interactive as far as I know

I mean you use completion, right? That's interaction? In insert mode <C-p> or <C-n>, same to scroll through options.

> [tabbar is] still restricted to terminal characters (you could probably do something fancy with sixel,

Wait... you want it as an image? I mean... sure? You could, but I'm really curious why you would want that. I told you this was one option, but there are others. Are you referring to the one that was more visual and didn't show actual text? Idk, I'm not going to hunt down that plugin for you and I'm willing to bet you that it exists.

> For example options to refactor based on the current location.

First off, when quoting it helps to add more >'s to clarify the depth. So ">>>" in this case. I was confused at first as I didn't say those words (Also, try adding two leading spaces ;)

Second, sure, I refactor all the time. There's 3 methods I know. The best way is probably with bufdo and having all the files opened in a buffer (tabs, windows, or panes are not required). But I'm not sure why this is surprising. Maybe you don't know what ctags are? If not, they are what makes all that possible and I'd check them out because I think it will answer a lot of your questions.

> Basically where's the "extract this as named constant", "rename this type across the project"

Correct me if I'm wrong, but you are asking about "search and replace" right? I really do recommend reading about ctags and I think these two docs will give you answers to a lot more things that just this question[0,1]. Hell, there's even The Primeagen's refactoring plugin in case you wanted to do it another way that's not vim-native.

But honestly, I really can't tell if you're just curious or trying to defend your earlier position. I mean if you're curious and want to learn more we can totally continue and I'm sure others would love to add more. And in that case I would avoid language like "vim doesn't" and instead phrase it as "can vim ___?", "how would I do ____ in vim?", or "I find ___ useful in VS code, how do people do this in vim?" Any of those will have the same result but not be aggressive. But if you're just trying to defend your position, well... Sun Tzu said you should know your enemy and I don't think you know your enemy.

[0] https://vim.fandom.com/wiki/Browsing_programs_with_tags

[1] https://vim.fandom.com/wiki/Search_and_replace_in_multiple_b...

[2] https://github.com/ThePrimeagen/refactoring.nvim
by Das_F1sHy312 | 2025-07-28 00:05:06+00:00
Hi HN,

I’m Das_F1sHy312 and currently building something called Pointer – a privacy-focused, offline-first code editor that integrates locally running LLMs for suggestions, completions, and refactoring.

The idea is simple: bring the power of tools like Cursor or Codeium to your own machine — no cloud, no API keys, no tracking, and 100% open-source.

Current focus areas:

- Seamless integration with local LLMs via Ollama or LM Studio

- Designing the Agent with all possible tools

- Minimalist UI - btw not a VSCode fork

- Embedded inline buttons for common tasks (e.g. refactor, explain, fix)

- Designed to be fast, simple, and distraction-free

It’s still early — no stable release yet — but development is active and public.

GitHub: https://github.com/f1shyondrugs/pointer

Landing page: https://pointr.sh

Discord: ^^

Would love to get thoughts, early feedback, or help shaping the direction.

– Das_F1sHy312
by MinimalAction | 2025-07-28 00:05:50+00:00
I'm amazed at the short-sighted nature of this late-stage capitalistic world. A company like Meta which makes its fortune via insane amount of anti-user policies gets to earn a revenue of $164B with a profit of over $62B. A scientific organization that benefits everyone in so many innumerable ways, something that serves as a champion of humanity cannot be allowed to maintain a budget of $25B a year. Shut everything, let us bow to our AI overlords!
by kldg | 2025-07-28 00:05:53+00:00
I've definitely been surprised by how it's being used; it's replacing people in places I don't think (even as a closet AI/LLM enthusiast) AI should ever be used: elder care, customer support (even on phone lines), for homework grading. -But I shouldn't have been so surprised, because some were already using robots for these tasks (or maybe not robots explicitly, but making CSRs/similar stick to scripts); my daughter was taking college placement tests recently -- even the essay questions were graded by software, and she's watched by software as she writes it. These things still seem to me like jobs which fundamentally require a human touch -- it's been especially amazing to me teachers are using AI to detect AI; you can't determine whether or not a robot wrote it, but you can assign a grade to it? Huh??

I have a very vocally anti-AI friend, but there is one thing he always goes on about that confuses me to no end: hates AI, strongly wants an AI sexbot, is constantly linking things trying to figure out how to get one, and asking me and the other nerds in our group about how the tech would work. No compromises anywhere except for one of the most human experiences possible. :shrug:
by wat10000 | 2025-07-28 00:05:55+00:00
I think it’s even simpler: government is seen as bad. The military and some law enforcement are excepted, but otherwise, dismantling government agencies is a goal in and of itself.

I listened to way too much Rush Limbaugh in the 90s and none of this stuff is a surprise. Distressing, but exactly what this particular segment of Republicans have been working towards.
by inetknght | 2025-07-28 00:06:03+00:00
> You can capture the telemetry data with a HTTPS MITM and read it yourself.

That's not helping me, the user.

That's helping me, the developer.

> Or (if you're working lower level) you can see an obfuscated function is emitting telemetry, saying "User did X", then you can understand that the function is doing X.

Again, it helps me, the developer.

Neither of these help me, the user.
by JeremyNT | 2025-07-28 00:06:34+00:00
This is the pr on it [0]. It was linked on hn at the time too [1]

For all the shit Google deservedly gets they seem to be genuinely trying to implement good and privacy preserving solutions to a lot of these problems.

The issue of course is that there's essentially no way to do all this stuff with software and hardware the user actually controls themselves, so you end up with hard requirements that you use big tech as gatekeepers.

This is the slippery slope that IMO eventually ends the open web.

If you take that outcome as inevitable, which at this point I basically do given all the forces lined up to restrict access to information, I suppose Google is about the best steward you could hope for.

[0] https://blog.google/products/google-pay/google-wallet-age-id...

[1] https://news.ycombinator.com/item?id=43863672
by CyberDildonics | 2025-07-28 00:06:43+00:00
I definitely do disagree because if you distill it down to making a single recursive call or pushing a value on a stack with local scope, I would say pushing a value on the stack in simpler every time.

If there are multiple recursive calls you could use multiple stacks instead.

All of the debugging is going to be more difficult if you have to move through multiple call stacks to get at the previous values, where you could just see the entire stack values in a debugger or print out the stacks.

For number 3, I think that doesn't apply, since tail-recursion is really a funky way of looping and not a funky way of using the call stack for a stack.
by johnnyanmac | 2025-07-28 00:06:44+00:00
In my eyes, institutional knowledge is figuring out what things do NOT work, not what did back then. When you lose that, you're wasting years or even decades hitting the exact same pitfalls the old guard hit once upon a time. Many truly bright minds aren't those asserting how this was the best method and then burying their heads in the sand when other ideas come out.

My time working with some of the brightest minds in my industry taught me that they aren't necessaily some visionary, nor super genius, nor even some workaholic putting 20+ hours a day into their craft (though I have met a few I would describe as such). The gap between me and them wasn't over some raw intellect. It was many times a matter of me thinking of an idea and them talking about how that was tried 5-20 years ago and why that lead down a huge rabbit hole.
by impossiblefork | 2025-07-28 00:07:29+00:00
The big problem is that it's 15% US tariffs and no reciprocal EU tariffs.

The problem created is this: EU firms get shut out of the US, but the US firms that compete with them are not shut out of the EU. Thus the US firms can operate at greater scale and outcompete the EU firms, leading to one-sided job losses having nothing to do with merit.

So I can have a great, well-run EU firm and do everything right, and then I can lose it all for no reason, due to this insane political decision.

If this is the protection the EU offers, then why should I invest my money here? Why should I even live here? Because from this I can only read it as that the commission believes that Americans should have more rights than I do and that I shouldn't be allowed to have a business.
by m348e912 | 2025-07-28 00:08:34+00:00
It sounds like you're downplaying methane's impact on climate change. I don't know enough about climate change to challenge your point but it does seem like methane a serious enough issue that some countries have considered culling hundreds of thousands of livestock to reduce emissions and meet climate goals.

https://www.dairyherd.com/news/business/ireland-proposes-cul...