MurphyA/hacker-news huggingface dataset:
by ModernMech | 2025-08-11 14:16:44+00:00
I'm aware of 4 now. Here are the other 3:

Bolt: a language with in-built data-race freedom! (recent discussion: https://news.ycombinator.com/item?id=23122973) - https://github.com/mukul-rathi/bolt

Bolt: A programming language for rapid application development - https://github.com/boltlang/Bolt

BOLT: a programming language that was desinged for begining programmers who have never seen code before in their life - https://sourceforge.net/projects/boltprogramming/files

I'm very much in favor of authors choosing unique names for programming languages because there's still plenty of good names up for grabs without having to step on someone's toes. If the project is dead, that's one thing; the data-race one was a research project and hasn't had any activity in 5 years. BOLT last modified in 2014.

But beariish/bolt and boltlang/bolt were started in the same year and are still under active development. With boltlang/bolt obviously snagging the namespace first, I think they should have claim to the name for now. That said, neither seems to have registered any domains, so whoever gets bolt-lang.org/com/net first will probably have an easier time defending a claim.
by normalaccess | 2025-08-11 14:16:49+00:00
From the Wiki Page:

"The Act does not prevent the Army National Guard or the Air National Guard under state authority from acting in a law enforcement capacity within its home state or in an adjacent state if invited by that state's governor. The United States Coast Guard (under the Department of Homeland Security) is not covered by the Act either, primarily because although it is an armed service, it also has a maritime law enforcement mission."

It's confusing because DC does not have a governor so it looks like an edge case that has not been tested before.
by nickpinkston | 2025-08-11 14:16:56+00:00
Almost a "Trump crossing the Potomac" (Caesar / Rubicon) moment, where the Army enters the Pomerium [1] of democracy.

Let's hope it doesn't have the same effect (ie the eventual fall of the republic)

[1] No military weapons were allowed inside this boundary of ancient Rome. https://en.wikipedia.org/wiki/Pomerium
by written-beyond | 2025-08-11 14:17:14+00:00
Ooof I had a short chat with a maintainer with one of the competing projects and they really hated on the code quality for the sony embedder.

I just didn't like the lack of control you got with the sony embedder, you couldn't specify which display you wanted to show on when using DRM and it was real pain to get it working.

I didn't know about the systemd dependency, but we actually needed it though even though we used Sony because of our dependency on DBus.
by pyrale | 2025-08-11 14:17:25+00:00
The answer is "cartel".

They weren't condemned for the algorithmic pricing part, they were condemned because they "participated" (subtext: along with other landlords).

The "algorithmic" part is just cartel laundering, they probably hoped that by not communicating directly with competitors, but instead having participants giving their data to "the algorithm" which would have consolidated the data and given each participant optimal pricing, they could evade charges.

I agree the title would have been much better if that point was clearer.
by jacquesm | 2025-08-11 14:17:27+00:00
One way to now a chess match is about to begin is to see people place pieces on a chessboard. There is no thread of our possible history that is colored 'good' for the next couple of years that starts off with deploying the NG in Washington, D.C. As a pre-emptive move it is an overt threat and as a response to something that is actually happening it is complete overkill. Either way, trouble is brewing.
by ctbellmar | 2025-08-11 14:17:40+00:00
I had some time for in depth experiments with it this summer and was disappointed. It gets the surface level details alright, but falls apart on any detailed work.

Examples that failed: - opening hours for POI (restaurants, tourist attractions, etc) - mostly made up - GPS coordinates - produced results that were nearly 100% inaccurate - finding contact info (e.g. phone, email) for specific government or public bodies - nearly 100% inaccurate

The issue with above was mainly not a lack of results but rather fabricated/made up ones. As in: here are the coordinates (that don't correspond to actual locations) or here are the phone numbers of such and such departments (that don't exist), creating more work to try and discover they are nonsensical vs. just giving "no results found" message.
by cnst | 2025-08-11 14:17:49+00:00
Note that the former employee of her company was still left permabanned even after producing the ID, per the post.

So I can totally understand why she wouldn't play those games!

To be frank, it would seem that producing an ID in such a situation, is pointless from the user's POV. It seems like it's simply abused by the vendor to institute and enforce a permanent ban.
by mesotron_dev | 2025-08-11 14:18:05+00:00
Spreadsheet programs such as LibreOffice are the next level. These are the most advanced and easily customized text files yet. Think of these as multidimensional text files that are all connected in an endless grid. Text files may seem ok, but managing tens of thousands of pages across sheets and books seems more straightforward with the spreadsheet format. But Vim is a great fallback when sheets are overkill.
by jddj | 2025-08-11 14:18:12+00:00
I always wondered about this claim.

If I have a secret, A, and I encrypt it with classical algorithm X such that it becomes A', then the result again with nonclassical algorithm Y such that it becomes A'', doesn't any claim that applying the second algorithm could make it weaker imply that any X encrypted string could later be made easier to crack by applying Y?

Or is it that by doing them sequentially you could potentially reveal some information about when the encryption took place?
by rdl | 2025-08-11 14:19:04+00:00
Mostly the best market is intelligence agency vendors. As a US citizen, I would only be comfortable selling to US contractors. There are a bunch; if you go to conferences you probably meet the people there (look at the sponsors...).

It won't be tax-free, though; you'd probably get a 1099, but if you're smart could set it up as corp to corp and deduct a bunch of other expenses from it. Part of the sale is signing a bunch of NDAs, etc so you can't then release it to others.
by api | 2025-08-11 14:19:07+00:00
Even if Trump isn’t the one, this means we are ready for our Caesar and fall of the Republic.

Of course I think we’ve been sliding toward our decadent imperial phase for quite some time. This did not materialize out of nowhere. The Executive long ago took the power to declare war from Congress, at least in practice, and that was one of the first huge steps.

Personally I think Trump will die, there will be a power struggle, and it will be one of the next few. There’s even some chance it could be a left-populist authoritarian. Political winds can shift fast in an environment like this.

Speed running the fall of Rome.
by NoMoreNicksLeft | 2025-08-11 14:20:09+00:00
Most parents do not have the technical skills to effectively limit that usage. The vast majority may not even be aware that software tools and features exist that could limit it. For that matter, I am aware, and the features on most products are insufficient... I shouldn't have to block Youtube at the router-level, but that's about the only thing I can do. Works for the Xbox, which is plugged into ethernet, but it won't work for the iPhone since it just does fallback to cell service. What's to stop the kid from buying some cheap Android device and swapping in their sim, so they can get around Apple's parental controls?

>except that today most 18 year old already lost their virginity, True when we were kids. But bizarrely less true today.
by mort96 | 2025-08-11 14:20:24+00:00
This works, but now you have a very sensitive secret to keep track of. Losing that secret immediately destroys your database (you can't just create a new one like you would if you e.g lost an API key for a third party service), and leaking the key leaks all creation dates. For lots of use cases, this UUID secret would be the most critical secret of all; and for lots of other use cases, it would be the only secret.

Plus, the UUIDs obviously wouldn't be encrypted at rest, so all creation dates would leak if you had any kind of database leak (although you could argue that leaking creation timestamps would be the least of your concerns if you had a DB leak).

So it's a valid solution for sure, but certainly not without trade-offs.
by chasil | 2025-08-11 14:20:44+00:00
In OpenSSH root cannot login.

In TinySSH, which also implements the ntru exchange, root is always allowed.

I don't know what the behavior is in Dropbear, but the point is that OpenSSH is not the only implementation.

TinySSH would also enable you to quiet the warning on RHEL 7 or other legacy platforms.
by const_cast | 2025-08-11 14:21:00+00:00
> All openings and responses must be calculated and faked

Thinking about the things you say isn't faking it - it's just using your brain and being considerate.

If you just blurt out anything with no filter, that doesn't make you authentic, it usually makes you an asshole.

Not all thoughts are productive, many are bad and many are stupid. You should delete those or revise them. Not only when talking to other people, but even to yourself.

I can tell myself that I'm dumb or I'm fat or whatever, but that isn't true and just because I thought it doesn't mean I have to internalize it. No, I filter those thoughts, I tell myself "that's not true". Over time, I think them less.

Your own brain is not reliable. It does not operate on truth, or what is or is not productive. So tune it. Not for the sake of others, but for yourself too.

Being an asshole to others is bad, but being an asshole to yourself is arguably worse. The goal is to, overtime, build better thought procedses and mental models. Not to fake it.
by oniony | 2025-08-11 14:21:10+00:00
I've used a TODO.md for years. I prefer it to a .txt as I can get some syntax highlighting in Vim.

About a year ago I merged my TODO with my work journal. So now, instead of two files I just have LOG.md with the TODO stuff at the top, a horizonal line and the journal of what I've been doing each day below.

I also copy the file (e.g. LOG-2024.md) each year and clear out the journal to keep the number of lines down.
by jacquesm | 2025-08-11 14:21:31+00:00
Rome, for all its might was puny in comparison to the United States. The downfall and/or breakup of the USA will leave the world in pieces. If it happens - which I really hope it will not, though I don't see how at this point it is still unavoidable - millions of people will die the world over. Every two bit dictator will see their chance and grab it knowing the next opportunity to do so will be at least a century away. The number of democracies and the number of people living in an (actual) democracy is already a minority. Democracy may well soon become an endangered species in the zoo of possible governments.
by tptacek | 2025-08-11 14:21:50+00:00
To add to the sibling comment, there are also many different ways of making a living doing this stuff:

* You can find killer clientside bugs where the bounty will cover a year's worth of compensation (bear in mind you'll get maybe 1.5 of these payouts a year on your own if you're good but replacement-level)

* You can find these kinds of bugs and work with brokers to sell them to grey-market buyers along with enablement/implants --- more development work, a little more market risk.

* You can find smaller, easier bugs (serverside, web bugs) that get nothing resembling these kinds of payouts but are much easier to find, and make good money on volume. This is a much more common way of making a living on bounty payments.
by antonvs | 2025-08-11 14:22:25+00:00
The last section in the article touches on this, albeit obliquely: "The eBPF trampoline support among different architectures."

Basically the answer is essentially emulation, as I understand it. Fentry can be emulated using kprobes, for example. I haven't absorbed the article well enough to know how that fits in with what it's describing.
Show HN: GemGuard: Ruby gem to scan and auto-fix vulnerable dependencies
by wilburhimself | 2025-08-11 14:22:32+00:00
Hi HN,

I created GemGuard, an open source Ruby tool aimed at improving supply chain security for Ruby projects.

Ruby developers often trust their Gemfile.lock without much scrutiny, but issues like typosquatting, unpatched vulnerabilities, and lack of SBOM (Software Bill of Materials) generation remain significant risks.

GemGuard helps by:

Scanning your Gemfile.lock against OSV.dev and Ruby Advisory Database CVEs

Detecting suspicious typosquatted gems with fuzzy string matching

Generating SPDX and CycloneDX SBOMs for compliance and transparency

Offering an auto-fix command that safely upgrades vulnerable gems and backs up your lockfile

Integrating easily with CI/CD workflows for continuous security

It’s lightweight, Ruby-first, and designed to be part of your normal dev workflow, not an afterthought.

You can check it out here: GitHub: https://github.com/wilburhimself/gem_guard

I’m open to feedback, critiques, and contributions. If you try it, I’d love to hear how it works for your projects or any gaps you discover.

Thanks for reading!
by ctbellmar | 2025-08-11 14:22:33+00:00
"Qwen3-Coder ... is the first open-source model I’ve been able to accept patches from. It isn’t by any means a Claude killer, but it feels like Claude 3.7 Sonnet, maybe even better."

Has anyone been able to set up Qwen3-Coder to run locally in agentic mode (via LM Studio or similar)? So far, I have only seen in work as Chat via Continue plugin. It gives reasonable suggestions, and it is supposed to be able to call tools, just haven't figured out how to make that happen yet.
by jpdb | 2025-08-11 14:22:44+00:00
Web performance is probably/mostly valued as efficiently as it needs to be.

The numbers mentioned in the article are...quite egregious.

> Oh, Just 2.4 Megabytes. Out of a chonky 4 MB payload. Assuming they could rebuild the site to hit Alex Russell's target of 450 KB, that's conservatively $435,000,000 per year. Not too bad. And this is likely a profound underestimation of the real gain

This is not a "profound underestimation." Not by several orders of magnitude. Kroger is not going save anywhere even remotely close to $435 million dollars by reducing their js bundle size.

Kroger had $3.6-$3.8 billion in allocated capex in the year of 2024. There is no shot javascript bundle size is ~9% of their *total* allocated capex.

I work with a number of companies of similar size and their entire cloud spend isn't $435,000,000 -- and bandwidth (or even networking all up) isn't in their time 10 line items.

A leak showed that Walmart spent $580m a year on Azure: https://www.datacenterdynamics.com/en/news/walmart-spent-580...

These numbers are so insanely inflated, I think the author needs to rethink their entire premise.
Show HN: I am building nerd: ed for live nw flows (file in motion)
by dantraztrev | 2025-08-11 14:23:10+00:00
sup nerds,

I’ve been experimenting with a weird idea: what if files didn’t live on disk or in memory, but only as packets moving through the network?

NERD is a text editor for living data streams — circulation loops in network traffic that are the file. There’s no storage backend. If the flow stops, the file disappears.

Instead of: File → Storage → Network → Edit → Store NERD does: File IS Network Flow → Edit Flow Pattern Directly

Features:

Files are sustained by packet loops (heartbeat packets keep them alive) Multi-user editing by connecting to the same flow Raw socket programming + custom packet formats ed-compatible interface (append, delete, substitute, etc.) Flow discovery (discover shows what’s “alive” on the network) Example: $ sudo ./nerd shared_doc > append Hello from Node A! On another machine: $ sudo ./nerd shared_doc > append Hello from Node B! Result: Both edits are merged into the same circulating flow. Repo & README: github.com/DantrazTrev/nerd Would love feedback on:

Use cases (is this a toy or something deeper?) Security / network safety concerns Better ways to visualize active flows “The file is not in the nodes, but in the arrows between them.”

toodles
by dexterlagan | 2025-08-11 14:23:25+00:00
I made my own. I needed to have a calendar that showed every todo item per day, and a text editor to edit the tasks just like in a todo.txt. Used it all day every day for over 15 years. I still have it installed on nearly all my Win systems, just because it opens instantly, has priority and colors. I also used it to produce reports for work, so I eventually added export options for HTML to paste directly into an email.

https://github.com/DexterLagan/todo-master
by roscas | 2025-08-11 14:23:43+00:00
So many problems, but let's go to what matters: try other AI models and search the web, because they might get it right once, but all AI output's some info that is dangerous and wrong.

Second, Windows destroys laptops. If you run Windows even on a Thinkpad, you will find the fan to run almost all of the time. I have a Thinkpad at work and it runs hot all day, along with all Windows problems that, are indeed for another reply.

But all my other Thinkpads that run Arch, the fan comes alive only when you put the cpu 100% for some reason, like compile or stress test.

There are a few good ones like Thinkpads, a few enterprise level HP and Dell are ok. But my preference goes for all Thinkpads T series.
by scarface_74 | 2025-08-11 14:23:55+00:00
It couldn’t be too many people. Back in 2015, they only had 2.1 million dial up users and that number must have gone down in a decade

https://www.usatoday.com/story/tech/2025/08/10/aol-dial-up-i...

But then again, I would love to have a business that has 2.1 million people or even 100 thousand people paying $10 a month…
by tptacek | 2025-08-11 14:24:03+00:00
Grey market, not black. It's been several months since I've talked to anyone in the space but full-chain reliable quiet Chrome exploit packages were high six figures, with discussions starting about bugs reaching 7 figures imminently, and the people I talked to might have been talking that down (or talking it up).

Again, remember that grey market payouts are tranched, so you could get 3x more than Google would pay, or you could get 0.5x, and for much more work.
by refreeze654 | 2025-08-11 14:24:46+00:00
I use Todoist in a very light weight fashion. I add tasks and they sit on my screen until they're done, basically identical to a text file. I've never used the points, projects, labels, etc.

It does one thing a text file struggles at: scheduling recurring tasks and adding notes to a recurring task. I have annual reminders for infrequent, but important stuff. For example, I have a recurring annual task to review my insurance. Each year, I add context and details that are easily forgotten. Then, when the reminder comes up next year, I can refresh my memory and complete the task quickly.
by Defletter | 2025-08-11 14:25:03+00:00
Just jumping in to say that this is making me genuinely reconsider adopting a licence/policy that forbids repackaging: the fact that someone can repackage my project, but worse, and still use my project's name? Absolutely not. I do not want the burden that inevitably comes when people complain to me that this or that is missing from a repackage.
by api | 2025-08-11 14:25:23+00:00
China will probably rise up in our place, which is why I think MAGA just handed the world to China.

In that first state of the union when he talked about a golden age I was like “yeah, this is the Chinese century. He’s gonna burn it down.” Literally gilding the White House is a caricature of how you’d depict the fall of an empire in bad fiction. An editor would say that was cliche.
by throwanem | 2025-08-11 14:25:36+00:00
I have a "never-ending .txt file" too. About 4100 pages' worth, at the moment, across 25 volumes and counting, over the span of now nearly eight years.

I don't intend particularly to advocate the format here, but I will say that of all my many bookshelves, in a certain way there's none I find more satisfying than the one I work to fill myself. Is that worth more than being able to use grep(1) on their contents? Or are those contents worth more to me because I can't? Who could say, but it's fun to think about, at least. (And for those young enough to be easily swayed by vanity, if you think performative reading is in fashion right now...)
by bluGill | 2025-08-11 14:26:02+00:00
The problem is the problems are hard to measure. How do you know that "Joe" bought from someone else because the competitors website just "felt better". We know from UX research how speed affects how things feel. We know that customers will go elsewhere at times. We also know not everyone who visits your site will buy. I know statisticians have tools to measure the loss, but I'm not able to tell you how they do it or how accurate they are (they can give you a range).
by apprentice7 | 2025-08-11 14:26:19+00:00
Amazing. It doesn't surprise me that the most simple workflows are the ones that work best. Probably because there is not a lot of resistance (keyboard shortcut instead of searching through a list of apps / no tutorial on how to use it; it's just a text file / it's easily readable and you get to choose the formatting and structure of your text).

As a developer, however, I have to scratch the itch of always having "wrangleable" data, and yet again text files are the best at it. I am already thinking of doing this and just follow a set of writing "guidelines" so I can parse the txt if I wanted to do some visualization stuff.
by unhappy_meaning | 2025-08-11 14:27:01+00:00
> Images of these driver’s licenses are publicly accessible web addresses, allowing anyone with the links to access them using their web browser.

> TechCrunch also identified a potential second security issue, in which an email address and plaintext password belonging to the app’s creator, Lampkin, was left exposed on the server

> While the app requests IDs and selfies from its users to verify their identities — a process that is not automatic — users can access a “guest” view of the app without signing in.

Is this just bad development? Are these just things could be missed by any developer or team?

I'm curious as someone who would like to create side projects with users (albiet not dubious ones these like apps) but I'm always afraid of a glaring security flaw that would be basic 101 of web development.
by adrian_b | 2025-08-11 14:27:08+00:00
Nitpick: the C in TCXO stands for "Compensated", not for "Controlled", like in OCXO.

That means that the resonator of an OCXO is held at a constant temperature, while that of a TCXO is at the ambient temperature, but the temperature is monitored and a compensation circuit adjusts the resonance frequency, maintaining it as constant as possible.