MurphyA/hacker-news huggingface dataset:
by dev-ns8 | 2025-07-10 15:00:54+00:00
What is the value proposition for these form libraries? Is it scale? Is it the custom builder? How complex are people's HTML forms these days from a UX perspective?

I was browsing the code, and noticed this forms library was using Supabase, presumably a paid service if this OSS library takes off. I just can't seem to grasp why a custom form building library needs a 3rd party, managed Database included. Scale maybe?

These are genuine questions as I'm woefully unaware of the state of HTML forms / Frontend in 2025
by jadamson | 2025-07-10 15:01:31+00:00
> There is an untested assumption that hashes achieve randomness because they appear to be a random collection of characters.

lol, no. Cryptographic hash functions are specifically designed to achieve this property.

> Never in mathematics or logic

Let's not get ahead of ourselves. Start with English - what does "pseudo" mean?

> This can be described by equivocation, fallacy of composition, inductive fallacy, and more.

For example, what is a pseudo-intellectual?
by jcalvinowens | 2025-07-10 15:01:55+00:00
It's not wrong. The only thing preventing me from forging your certificate is my inability to generate a new cert which hashes to the same digest as what is in your cert's signature. I don't actually need the keys if I break the hash.

EDIT2: I'm doing a bad job of explaining this... you obviously need the keypair associated with the cert to initiate connections with it and not trigger MITM alerts. But if you break the hash function, you don't need the private key from the root cert, the verbatim signature from the original cert will appear to be valid when spliced into your forged cert if the hash digest computation on the forged cert is the same.
by diggan | 2025-07-10 15:02:07+00:00
> And expect to do tons of marketing.

Fun fact: Typeform basically did no "traditional" marketing in the beginning of its life, and most users came from the "Powered by Typeform" button in the bottom right, which was visible for every free form IIRC. Those users, also publishing their own forms, led to more users finding Typeform from that same button.
by epistasis | 2025-07-10 15:02:29+00:00
Farms quite often have fairly bulky connections that allow them to use their existing grid connection for smaller scale solar. Enough for them to have steady consistent income unconnected to seasons and weather, and a very good tradeoff. You see a ton of these in rural Minnesota because the utility, Xcel, is one of the very few utilities in the country that's not stuck in the 1970s, and can adapt to new technology.
by sshine | 2025-07-10 15:02:49+00:00
Prior to AI, outside the context of crypto, it is/was often not “worth it” to fix security holes, but rather bite the bullet and claim victimhood, sue if possible, and hide behind compliance.

If automated exploitation changes that equation, and even low-probability of success is worth trying because pentesting is not bottlenecked by meatspace, it may incentivise writing secure code, in some cases.

Perversely enough, AIs may crank out orders of magnitude more insecure code at the same time.

I hope this means fuzzing as a service becomes absolutely necessary. I think automated exploitation is a good thing for improved security overall, cracked eggs and all.
by TheAmazingRace | 2025-07-10 15:03:57+00:00
We are quickly approaching two decades of Bitcoin existing. And yet, I have zero reason to own any for myself. On the other hand, nearly two decades after the World Wide Web came into existence (around 2006 or so) - we all knew the Web was here to stay even well before then.

Side-note: Going back through my comments history here on HN, I feel like I've been engaging on this topic too much. I feel like a curmudgeon, even though I don't want to be. :-)
by earcar | 2025-07-10 15:04:44+00:00
Fair point on the syntax, I should have been clearer. What I meant is that your existing Ruby code doesn't need modifications. In Python you'd need to use a different HTTP library, add `async def` and `await` everywhere, etc. In Ruby the same `Net::HTTP` call works in both sync and async context.

The `Async do` wrapper just at the orchestration level, not throughout your codebase. That's a huge difference in practice.

Regarding pgbouncer - yes, it helps with connection pooling, but you still have the fundamental issue of 25 workers = 25 max concurrent LLM streams. Your 26th user waits. With fibers, you can handle thousands on the same hardware because they yield during the 30-60s of waiting for tokens.

Sure, for pure performance you'd pick another language. But that's not the point - the point is that you can get much better performance for IO-bound workloads in Ruby today, without switching languages or rewriting everything.

It's about making Ruby better at what it's already being used for, not competing with system languages.
by GTP | 2025-07-10 15:05:00+00:00
The article is lacking a lot of details, so maybe I'll check the paper if I have the time in the coming days. But, my understanding from the article is that this attack works by breaking a premise of the considered protocols that doesn't have much to do with the random oracle model. They basically say that, if you agree on a program to use and you hash it as part of your commitment, then you can use the Fiat-Shamir transform to prove claims regarding the program's output. But it seems natural to me that, if you are tricked into accepting the use of a malicious program, then the protocol breaks. After all, the hashing of the program at the beginning is meant to ensure that you're using a specific binary you agreed upon, but it does nothing to show that such a binary works as intended. This has to be verified outside of such protocol.

Am I missing something? Or maybe the point is that, under the random oracle model, it should be hard to write a program that contains its own hash? But then again, would the trick of reading the hash from an external configuration file that isn't considered as part of the hashing be fair game?
by smus | 2025-07-10 15:05:01+00:00
We benchmarked Gemini 2.5 on 100 open source object detection datasets in our paper: https://arxiv.org/abs/2505.20612 (see table 2)

Notably, performance on out of distribution data like those in RF100VL is super degraded

It worked really well zero-shot (comparatively to the foundation model field) achieving 13.3 average mAP, but counterintuitively performance degraded when provided visual examples to ground its detections from, and when provided textual instructions on how to find objects as additional context. So it seems it has some amount of object detection zero-shot training, probably on a few standard datasets, but isn't smart enough to incorporate additional context or its general world knowledge into those detection abilities
Show HN: GhostCV – embed AI-readable text in your resume (without losing design)
by kirchoni | 2025-07-10 15:05:12+00:00
I suspect a lot of resumes — especially the ones designed in Figma or exported from Canva — look great to humans but get completely butchered by resume parsers.

Most of these systems don’t use vision or layout — they just extract raw text. And if the PDF is made of outlines, floating layers, or flattened design, there’s often nothing to extract So I built this thing: ghostCV - It takes your visual resume - Lets you write what you want the AI to see - And embeds that as transparent text in the PDF

The result: the parser sees clean text, the human sees your design, and nobody knows the difference.

Is this sketchy? Maybe. Useful? I think so.

No login. No tracking. Just a tiny hack for anyone who’s been ghosted by a bot

Curious what HN thinks — anyone else try this kind of thing?
by hn_throwaway_99 | 2025-07-10 15:05:36+00:00
This was a post on the GenX subreddit (from a Gen Zer) from just a couple days ago asking about if parties as portrayed in late 90s/early 00s "teen movies" were actually a real thing:

https://www.reddit.com/r/GenX/comments/1lu102v/were_parties_...

The responses from the Gen Xers were a mix of bewilderment and sadness, stuff like "What do you mean parties like this, it's just a normal teenage party!? I feel so ancient and also so confused by this question." The whole comment section is worth a read, especially the disconnect between how the Gen Xers experienced adolescence and how the Gen Z poster does.

It's really sad to me how we have completely fucked a lot of youth with social media, smart phones, and over-scheduling/over-protection. I also disagree with some of the comments here that are bringing up things like "real estate, transportation, and lodging". Sure, those are issues, but you have families and kids in the suburbs today just like you had families and kids in the suburbs in the 90s, and the fact that kids today can't even recognize "basic teen parties" and question whether they are some sort of made up fantasy can't just be waved away by the fact that real estate is more expensive today.
by epistasis | 2025-07-10 15:05:37+00:00
Honestly I think Canada should go back to the CANDU rather than the BWRX. As long as they don't modernize it too much to take advantage of "new technology" it might still be cheap. And they can use their own uranium, and not be dependent on the hostile nation to the south. You won't hear me say this very often, but the Decouple Pod is right:

https://youtu.be/CXVHRkd3byg?si=-wqRibYVIOb-E75f

And the fuel flexibility of the CANDU brings all this back to the waste reprocessing original topic too!
by talos_ | 2025-07-10 15:05:41+00:00
déjeuner is a literal translation though. "Breaking fast" -> "dé-jeuner" (undo fasting).

French people typically say: - breakfast - petit-déjeuner (small breakfast) - lunch - déjeuner (breakfast) - diner - diner

Québecois people say: - breakfast - déjeuner - lunch - diner - diner - souper (eating soup; probably historical roots like "getting your big meal of the day" which is likely broth + potatoes)
by Aachen | 2025-07-10 15:05:56+00:00
Note that this is why you use copy, check, then delete, instead of just "move" data, whenever it's important that the process works correctly

Even if the software doesn't have known bugs, I do it if the data is important enough and especially if I were to not have a backup (for example, because the storage provider takes care of backups and redundancy. I personally like to have another copy that I manage myself, but how many people have their IMAP emails or Spotify playlist data backed up for example? I do, but not many people I think)
by bobbiechen | 2025-07-10 15:06:18+00:00
(Take this with a grain of salt as I only learned about the Fiat-Shamir heuristic via this HN thread last week https://news.ycombinator.com/item?id=44458168, and I only have basic experience in theoretical cryptography)

There exists the concept of a zero-knowledge proof: check out the Wikipedia page for some intuitive examples of how these work in an interactive context. Basically, by asking someone who wants to prove something (the prover) a bunch of questions (challenges), you can get probabilistic confidence that they actually know that thing: https://en.wikipedia.org/wiki/Zero-knowledge_proof#Abstract_...

You want it to be interactive because that makes it much harder for the prover to "fake it" on the spot. But it would be more convenient if you didn't need to be online and actively talking to each other - so we want a non-interactive way to do the same thing.

The Fiat-Shamir transform (or heuristic) says that we can transform interactive protocols into non-interactive ones by relying on "random" challenges. If the prover can't control the randomness, then it's about as good as you interactively challenging them (and you can e.g. make them do more challenges to make up for it).

How do we get randomness? In computing we don't really have anything totally random, but cryptographic hash functions are believed to be very difficult to predict the output to. So, in cryptography there's the "random oracle model" where you say, "Well, I don't know if this protocol is safe with these real-life hashes. But if the hash function was a truly random oracle, I can prove it's safe." (The Fiat-Shamir transform is only provably secure if you believe in the random oracle model).

In the past, researchers have constructed new protocols that are safe in the random oracle model, but once you use a real hash function they're breakable because of real-world implementation details. As the abstract of this paper says, "So far, all of these examples have been contrived protocols that were specifically designed to fail." See https://crypto.stackexchange.com/q/879 for some discussion of the mechanics of how it might happen, once you choose a real hash function.

This new paper advances the field by showing an attack that targets a real-world protocol that people actually use, GKR. It shows (and again, take my interpretation with a grain of salt) that when you pick a real hash function, the attacker can construct an input (circuit) that results in whatever output the attacker wants.

---

What's the real-world impact?

There do exist real non-interactive zero-knowledge proof systems, mainly used in blockchains. Instead of publicly exposing all the info to the world and doing computation on the (slow) blockchain, you can protect privacy of transactions and/or bundle a bunch of updates into a cheaper one (ZK-rollups). Theoretically these could be attacked using the methods described in the paper.

It's unclear to me whether those are affected here (though my guess is no, since they could have mentioned it if so).
by Der_Einzige | 2025-07-10 15:06:22+00:00
lol!!!

“ It seems that the original modern American swingers were crew-cut World War II air force pilots and their wives. Like elite warriors everywhere, these “top guns” often developed strong bonds with one another, perhaps because they suffered the highest casualty rate of any branch of the military. According to journalist Terry Gould, “key parties,” like those later dramatized in the 1997 film The Ice Storm, originated on these military bases in the 1940s, where elite pilots and their wives intermingled sexually with one another before the men flew off toward Japanese antiaircraft fire.“

https://www.psychologytoday.com/us/blog/sex-at-dawn/201211/n...
by tonyhart7 | 2025-07-10 15:06:40+00:00
discord is manned in 20s-30s employee, valve who makes steam is also has small number of team

if you thinking you need 500s employee or something well you are wrong since many company do this for a long time and still do well

for example they fire legal team division and offload that into external agency

they just fire all "administration" related people and keep the bulk of engineering team which they should since tech company being lean is most advantage of tech company has
by dragonwriter | 2025-07-10 15:07:55+00:00
> These prices seem to keep increasing while we were promised they'll keep decreasin

I don't remeber anyone promising that, but whoever promised you that, in some period of time which includes our current present, frontier public model pricing would be monotonically decreasing was either lting or badly misguided. While there will be short term deviations, the overall arc for that will continue be upward.

OTOH, the models available at any given price point will also radically improve, to the point where you can follow a curve of both increasing quality and decreasing price, so long as you don't want a model at the quality frontier.
by 1vuio0pswjnm7 | 2025-07-10 15:08:15+00:00
"The settlement doesn't include Flo Health Inc., which operates the app, and Meta Platforms Inc., which faces similar privacy claims."

The wiretapping claims (cf. privacy claims) against the other defendants, Flo and Meta, have been dismissed.

https://archive.org/download/gov.uscourts.cand.372884/gov.us...
by chlodwig | 2025-07-10 15:08:36+00:00
Yeah, I've wondered if there is some sort change in how people think about and label their activities. Would a 1950s parent even think of themselves as doing a defined activity called "childcare"? Or rather, the children are just around, as the parent is doing things. If I am cooking dinner while a toddler putters around the floor and a baby is in a high-chair eating scraps I give him, am I doing "childcare"? Would a 1950s parent think of that as doing "childcare"?
by bonoboTP | 2025-07-10 15:08:50+00:00
It's also simply hard to teach most of this beyond caricature level in secondary school. Ideally it wouldn't be a separate thing but integrated into how you learn the science itself. And this is somewhat attempted yes, there are often small-print framed stories in textbooks about how a discovery came about, but learning the actual science is hard enough and physics is better taught topicwise instead of chronologically with all the dead ends. The modern picture of the world is complicated enough without teaching how the process of it unfolded. Especially while the students haven't really learned the necessary context in history class to even have a "mental map" of the centuries, to place major temporal landmarks on it, to know who lived in parallel with whom.

This is the biggest issue in general, that the material is fragmented and separated. You learn about romanticism and its poets in literature class but it doesn't get connected to how romanticism motivated changes in scientific attitudes and what discoveries are from that era etc. I needed at least 10 years of curious self-directed reading after high school to appreciate such things. Just randomly arriving at the same topic from different angles and different disciplines. The same familiar characters and events start to pop up at new places in new light. Then suddenly even articles that would have seemed super boring started to become interesting because a story could be surprising and counterintuitive. If you have no background knowledge or expectation or intuition then any story is "meh" and not "who would have thought that!".

Indeed if I sent high school myself the OP article, he wouldn't get much out of it, other than a flood of names, dates and boring facts. Once you are out of college, you have points of reference to be curious what all those years were actually based on.

And my complaint was more that it also doesn't happen in university education.
by ben_w | 2025-07-10 15:09:15+00:00
The only one that is number one is SpaceX (and Starlink, if you count that separately).

None of the neuroscience people I follow think much of Neuralink; none of the civil engineers I've talked to IRL think much of TBC; none of the car people I follow favour Tesla over the huge range of competitors, and that includes the robo-taxi where they're about 6.5 years behind Waymo; X.com is so painful that whenever someone shares a link with me, I edit the URL to Xcancel.com *because that loads faster by a bigger margin than the time taken to edit the URL* and actually shows me the thread without needing an account of my own.

But the space nerds I follow are still impressed with SpaceX, and they have extremely obvious reasons to be impressed.
by 999900000999 | 2025-07-10 15:09:24+00:00
100$ a year is a lot of money if you aren't planning I'm selling anything. The instructions to build from scratch or run it without signing aren't difficult.

I've literally had to argue with Apple for months to get my account approved.

It was not a fun process, eventually they did grant me an account, but then just keep up an old hobbyist game I was wasting that 100$ a month.

I ended up just recompiling for WebGL and uploading to itch.

Going through the hoops for code signing and getting account doesn't make sense if OP isn't going to sell it on the app store.

Finally, it's not like this is the only raw editor.

How many people.

A: Will pick an open source feature lite raw editor which isn't going to be as good as Darktable or Lightroom.

And

B: Aren't willing to build from source or literally run a single terminal command to run the unsigned version.

Now, if OP wants to sell it on the app store then I'm completely wrong. But otherwise it's not a good use of time.

You're free to reach out to OP and offer them 100$ + another 300$ for time spent having to apply for a Developer account.
by triceratops | 2025-07-10 15:09:59+00:00
Funny how no one seems to consider the environmental impact of digging up fossil fuels when they discuss solar.

It's similar to how you can identify Real Bird Lovers. They stay silent when they see pictures of oil-covered birds after an Exxon Valdez or a Deepwater Horizon. Show them a windmill and boy do they get passionate about bird safety and welfare.
by Aachen | 2025-07-10 15:10:31+00:00
I don't have any of those issues, besides perhaps crashes but the last one must be two years ago (I remember because we're always watching for exploits coming in). Maybe nobody else has these issues you mention either. If you want them to be fixed by the next time you install, have you considered reporting the issue and seeing if there is a volunteer is willing to fix it for you?
by Aurornis | 2025-07-10 15:10:39+00:00
> It's really sad to me how we have completely fucked a lot of youth with social media, smart phones,

You have to be careful with Gen Z threads like this on Reddit and Twitter. They are inherently biased toward Gen Z people who are chronically online and deep into social media.

If you spend time with kids in the real world, you learn very rapidly that most of them aren't on platforms like Reddit and Twitter. Of those who use Reddit, few of them actually post anything or even have accounts.

The subset of Gen Z who actually post on Reddit is small and a lot of them fit the description of chronically online, so it's no wonder that Reddit Gen Z people speak as if their generation is not socially engaged at all.
by CSMastermind | 2025-07-10 15:10:50+00:00
Bond Studio AI |Software Engineer, Backend | NYC or Remote | Full-time Bond Studio transforms the physical world into a real-time 3D environment built for commerce. Our spatial engine leverages state of the art CV+AI tech and is already being used across industries – from boutique stores to Fortune 50 enterprises. We’re currently in stealth, have a team of ~18 engineers, and are backed by Tier 1 institutional investors.

We’re looking for a software engineer to own the creation, design, and maintenance of our backend, infrastructure, and data systems. You'll be at the forefront of applying breakthroughs in LLMs and spatial reasoning to real-world challenges transforming commerce. Join us in an environment that is fast-paced, has little technical debt, and utilizes the latest tech.

Interested? Email us at careers@bondstudio.ai
by bachmeier | 2025-07-10 15:11:03+00:00
I've updated my comment for clarity. The bug (which I've never encountered in more than 20 years as a Thunderbird user) is that users move messages to a local email folder, but the messages are deleted from the server without actually downloading them. At a minimum they should disable that operation. The guy that originally reported it worked at Sun and lost hundreds of work messages as a result of this bug. AFAICT the user wouldn't be affected if they did a copy of the messages and then manually deleted them from the server folder after confirming the copy was successful.
by yababa_y | 2025-07-10 15:11:06+00:00
What's stopping you at pasting only a single file? I use the workflow Elon suggests (although I've never used it with Grok) predominately, it's well over 30% of my use of LLMs. I have a small piece of python called "crawlxml" that filters + dumps into <file> tags. And of course the LLM doesn't need your actual code in its context to do its job.