MurphyA/hacker-news huggingface dataset:
by LeifCarrotson | 2025-08-26 14:43:19+00:00
> It's been out for years now, integrating the root CA shouldn't be much of an issue via group policies (in windows, there are equivalents for mac os and gnu/linux i guess).

How do you do this on a proprietary device from the late 90s that runs a WindRiver VXWorks RTOS with 1 MB of SRAM? The updated (full color!) Panelview HMI is running Windows CE 6.0, so it's perhaps more likely to be compatible, but I don't think the same group policies exist on that platform.

The masses can do it in an afternoon because they can choose to only install modern equipment that's compatible with the new requirements. Some of the "heavy iron" castings for the machines we have to work with were built more than a century ago, and only later automated with tubes and relays, and then again with the first PLCs that could do the job. But now "SSL everywhere" policies and certificate expiration timelines that don't make a distinction between firewalled OT networks and Internet-facing webservers don't allow anything to run for a decade without major, risky rewrites that cost tens of thousands of dollars for highly specialized engineering services and minimal downtime. Sure, adding a cert to the SCADA server is trivial, it runs Windows Server and has a NIC that can access the Internet, but on the other NIC...there's a menagerie of 30 years of industrial oddities.

If your homelab is still working after 2 years, that's great, but if it's not running after 100 years would you call that an organizational failure?
by bawana | 2025-08-26 14:43:19+00:00
How is this ‘equity stake’ different than nationalization? (The thing that soviet socialism did to russian property and business a hundred years ago). After all the government prints the money. So instead of just taking control of a company the govt prints the money to buy it. Isnt it the same thing?

And where is the example of a successful govt run business?

Why dont we encourage businesses here w free trade zones?
by OskarS | 2025-08-26 14:43:37+00:00
As a single developer, you have very little weight against Google. The same is true of a single developer in the US.

What does have weight is the European Union, which Croatia is a member of. If the EU parliament makes a law that Google is not allowed to have these kinds of rules and do business in the EU, then Google will listen. Given the horrible state of the US government, the EU is just about the only force left in the world able and willing to stand up against these tech giants in a way that forces them to pay attention and act responsibly.
by littlestymaar | 2025-08-26 14:44:14+00:00
> an IP that doesn't appear anywhere in your logs suddenly submits two or three login attempts

How is the attacker supposed to bruteforce anything with 2-3 login attempts?

Even if 1M node submitted 10 login attempts per hour, they would just be able to try 7 billion passwords per month per account, that's ridiculously low to bruteforce even moderately secure passwords (let alone that there's definitely something to do on the back end side of things if you see one particular account with 1 million login attempts in a hour from different IPs…).

So I must have misunderstood the threat model…
by amalcon | 2025-08-26 14:44:20+00:00
The thing that drives me nuts is that this is extremely similar to a corporate tax. By itself this is fine - I actually favor corporate taxes in at least some situations. The problems are:

- It is being imposed at least semi arbitrarily, which is obviously a massive corruption risk. You point out part of the risk, but there are other parts too.

- This administration both ran and executed on corporate tax cuts. Backdoor re-introducing a very similar thing does not give confidence.

If the policy was to take a stake in the S&P 500 or something, and it was not implemented by an administration that is otherwise leaning into corporate tax cuts, I would be basically fine with it.
by trenchpilgrim | 2025-08-26 14:44:24+00:00
> from my experience the chin strap isn’t very very tightly strapped

Not on a motorcycle helmet! The double D ring system forces you to cinch it tight, and it does not restrict your jaw or make it hard to talk.

If you are experiencing this your helmet may be the wrong size. Most riders are picking helmets that are far too large.
by homebrewer | 2025-08-26 14:45:26+00:00
You must be aware that ACLs are well supported by all major UNIX operating systems (yes, Linux is UNIX, there are/were two general-purpose Linux distributions certified as UNIX). It's just that basically nobody is using them because they're rarely necessary, and there are easier ways to implement access control if you want something simpler, and also far more powerful mechanisms for when that's needed.
by ChrisMarshallNY | 2025-08-26 14:45:26+00:00
Well, I made a couple of mistakes in the post.

One, is that line about LARPing. I think that's what's really gotten folks upset, and rightly so. I sincerely apologize. It came across as snide. It was a poor choice of words.

The other, is that I gave the impression that I approved of the practice of removing safety gear. It was an observation; not an approval. I've watched "cowboy" arborists at work, and find it terrifying (and, TBH, impressive, as well). I think they are accidents waiting to happen.

But it still goes on, in many industries, including software development. Another poster talked about the calculations that people make, taking risks, in order to move faster. Their post seemed unpopular, but they were absolutely correct.

A big problem with experienced folks demonstrating reckless behavior, is that it gets aped by folks that may not be able to manage things safely, and that's where the real danger lies.
by IcePic | 2025-08-26 14:45:37+00:00
I think for certs, you are not better of paying $5 for the cert, than paying nothing to get an LE cert. It is already "subsidized" into cheapness, and the $5 company will bug you with ads for EV certs and whatnot in order to make a profit off you somehow since you are now a customer.

What I think LE did was to gather the required bag of money that any cert issuer needs to pony up to get the infra up and validated, and then skipped the $5 part and just run on donations. So while LE might stop tomorrow, you don't have any good guarantees that the $5 cert company will last longer if their sidebusiness goes under, and if you go to a $100 cert company, you are just getting scammed from some company who soon will realize that most certs are being given away and that they can't prove why their $100 certs are "better" in any meaningful way so they will also be at risk of going under. In all these cases, you get to use your cert for whatever validity period you had, and then rush over to the next issuer, whoever that is left when the pay-for-certs business tanks.

As opposed to cars or whatever, you can't really put more "quality math" into the certs so they last longer, the CAs have limits on how long they are allowed to last, so no more 10-year certs for public services anyhow. You might aswell get the cheapest of the ones that are still valid and useful (ie, exists in browser CA lists) and LE is one of those. Might be more (zerossl?) but same argument would hold for those. The CA list is curated by the browser teams lots better than me or you shopping around websites that make weird claims on why their certs are worth paying $100 for.
by queenkjuul | 2025-08-26 14:45:53+00:00
On my ryzen laptop, i have to manually ensure that Linux is setting the right power settings. Once i do that, my 5950HS laptop from 2022 is completely competitive with my work MacBook M2. Louder and hotter at full tilt, but it also has a better GPU (even with the onboard Nvidia turned off) and i can get ~6 hours of web dev out of it if I'm not constantly churning tons of files.

I would try it with Windows for a better comparison, or get into the weeds of getting Linux to handle the ryzen platform power settings better.

With Ubuntu properly managing fans and temps and clocks, I'll take it over the Mac 10/10 times.
by packetlost | 2025-08-26 14:45:57+00:00
If Intel were well managed they would purge like 2/3rs of the managers and anyone in the bottom 50th percentile and then pay whatever it takes to get people skilled in their core industry back, training the remaining people as necessary to fill in gaps for the future.

They literally cannot have a culture that encourages the now-traditional job hopping that is so pervasive in American business culture. They can't afford it.
by const_cast | 2025-08-26 14:45:59+00:00
Its not that type of argument, because seatbelts actually work - play integrity does not.

Play integrity is just DRM. DRM does not prevent the most common types of attack.

If I have your password, I can steal your money. If I have your CC, I can post unauthorized transactions.

Attestation does not prevent anything. How would attestation prevent malicious login attempts? Have you actually sat down and thought this through? It does not, because that is impossible.

The vast, vast VAST majority of exploits and fraud DO NOT come from compromised devices. They come from unauthorized access, which is only surface level naively prevented by DRM solutions.

For example, HBO Max will prevent unauthorized access for DRM purposes in the sense that I cannot watch a movie without logging in. It WILL NOT prevent access if I log in, or anyone else on Earth logs in. Are you seeing the problem?
by allan_s | 2025-08-26 14:46:04+00:00
For regulatory requirements: yes !

I currently for EIDAS certificates, I can only choose a vouched certificate provider, and it's mostly somes that requires me to in person with my ID card with someone verifying the guy who made the CSR is actually me.

The certificate is used for double SSL to authentify the server doing the request , i.e that the server doing an API call to the bank server is one I own. (I find it a pretty neat solution and much better than requiring to make a theater dance to get a token to renew every 3600 seconds )
by andreareina | 2025-08-26 14:46:15+00:00
The way that Sean Carroll says it is something along the lines of, the fundamental physics governing everyday life are understood. That is to say, we can solve for what an electron, proton, etc (or a collection of maybe a few dozen) are going to do in a particular experiment. The second and third generations of charged particles are excluded from the definition of everyday life, as are any other hypothesized particles because they require higher energy levels than are relevant. Explaining how the brain works is excluded as not being fundamental, though in principle a sufficiently advanced computer would be able to simulate it.
by PaulRobinson | 2025-08-26 14:46:29+00:00
Fair enough, but Apple Silicon is not a specialist chip in the way a SPARC chip was. It's a general purpose SoC & SiP stack. There is nothing stopping Intel being able to invest in SoC & SiP and being able to maintain backward compatibility while providing much better power/performance for a mobile (including laptop and tablet), product strategy.

They could also just sit down with Microsoft and say "Right, we're going to go in an entirely different direction, and provide you with something absolutely mind-blowing, but we're going to have to do software emulation for backward compatibility and that will suck for a while until things get recompiled, or it'll suck forever if they never do".

Apple did this twice in the last 20 years - once on the move from PowerPC chips to Intel, and again from Intel to Apple Silicon.

If Microsoft and enough large OEMs (Dell, etc.), thought there was enough juice in the new proposed architecture to cause a major redevelopment of everything from mobile to data centre level compute, they'd line right up, because they know that if you can significantly reduce the amount of power consumption while smashing benchmarks, there are going to long, long wait times for that hardware and software, and its pay day for everyone.

We now know so much more about processor design, instruction set and compiler design than we did when the x86 was shaping up, it seems obvious to me that:

1. RISC is a proven entity worth investing in

2. SoC & SiP is a proven entity worth investing in

3. Customers love better power/performance curves at every level from the device in their pocket to the racks in data centres

4. Intel is in real trouble if they are seriously considering the US government owning actual equity, albeit proposed as non-voting, non-controlling

Intel can keep the x86 line around if they want, but their R&D needs to be chasing where the market is heading - and fast - while bringing the rest of the chain along with them.
by conductr | 2025-08-26 14:46:45+00:00
This is only an issue with a single photo or low sample sizes. In the case of family photos, you’d like have a whole bunch of them to reference and could spot inconsistencies more easily. If it becomes so good to be completely indistinguishable from reality, then not sure what the gripe is. You could just as easily think of all pictures as unaltered. It’s a matter of optimism/pessimism or perhaps red pill/blue pill.

Granted, if your grandparents are showing you their vacation pictures from their world travels that never happened, this is a different scenario that is weird and can could happen. It’s a balance of trusting nothing you see while making a few exceptions for your family and whatnot
by Nextgrid | 2025-08-26 14:46:48+00:00
A GNU/Linux phone is dead on arrival unless it provides features that the masses consider a benefit. It's been attempted countless times, and every time it fails to gain adoption because the benefits rarely outweigh the downsides (yes, I know I will get at least one free software maximalist disagree, but in general, adoption rates support my point: these phones are used by such a small minority they're effectively a measurement error in the data).

If anyone wants to give it a shot again, don't start with a GNU/Linux phone, start with something the masses actually will care about. Reverse-engineered, adversarially-interoperable social media apps for all the mainstream networks with no ads/dark patterns? Cool. Adblocking by default? Sure thing. Built-in support for a wide range of cloud providers (including standard protocols such as SFTP/S3/etc). And so on.

Address actual pain points that people have. "GNU/Linux" by itself does not address anything. The non-technical majority don't even know what that is or means, and even for technical people it isn't a perk by itself - sure, you can run whatever software you want... but you (or someone else) still need to write said software to begin with... or you could just trade a bit of money and "freedom" and buy an iPhone which doesn't have any of those problems.
by ch4s3 | 2025-08-26 14:47:03+00:00
They aren't just looking at tech jobs in the study but all job in the data set that they've coded as being AI exposed.

> We use two different approaches for measuring occupational exposure to AI. The first uses exposure measures from Eloundou et al. (2024). Eloundou et al. (2024) estimate AI exposure by ONET task using ChatGPT validated with human labeling. They then construct occupational exposure measures by aggregating the task data to the 2018 SOC code level. We focus on the GPT-4 based β exposure measures from their paper.

>The second primary approach we take uses data on generative AI usage from the Anthropic Economic Index (Handa et al., 2025). This index reports the estimated share of queries pertaining to each ONET task based on a sample of several million conversations with Claude, Anthropic’s generative AI model. It then aggregates the data to the occupational level based on these task shares. One feature of the Anthropic Economic Index is that for each task it also reports estimates of the share of queries pertaining to that task that are “automative,” “augmentative,” or none of the above. We use this information as an estimate of whether usage of AI for an occupation is primarily complementary or substitutable with labor.14
by thyristan | 2025-08-26 14:47:29+00:00
Maybe, maybe not. Antibiotic resistance develops because antibiotics are only somewhat deadly to bacteria, so natural selection can occur and bacteria develop resistance over time. There are some antibiotic/bacteria combinations where this doesn't happen, because the respective antibiotic is so deadly to that special kind of bacteria, that no survivors can pass on their slightly increased resistance.

And bacteria self-replicate, whereas a virus needs to infect a cell and be reproduced by that cell. Some antiviral mechanisms attack the reproduction proteins that the human cells use, which the virus cannot do without. And the human cells don't have reproductive pressure to replicate viruses, quite the contrary.
by Avamander | 2025-08-26 14:47:42+00:00
> Probably because making sure that clients trust the right set of non-public CAs is currently too much of a pain in the ass. Possibly an underrated investment in the security of the internet would be inventing better solutions to make this process easier.

I don't see a reason why that should be a problem to solve for public CAs and rest of the internet? Complaining about multi-perspective validation or lifetime is silly if the hindrance is someone's own business needs and requirements.
by giancarlostoro | 2025-08-26 14:47:43+00:00
The M4 I have lets me run GPT-OSS-20B on my Mac, and its surprisingly responsive. I was able to get LM Studio to even run a web API for it, which Zed detected. I'm pleasantly surprised by how powerful it is. My gaming with with a 3080 cannot even run the same LLM model (not enough VRAM).
by spwa4 | 2025-08-26 14:47:46+00:00
I'd look up a few more stats and stories about the situation in Japan. Their economy has been stagnant ... well they call it a "lost decade". Despite the name, "decade", it's coming up on 36 years now. Outside of the major cities (and frankly inside, just to a lesser extent), everything has crashed - from education to grocery stores, to apartment sizes.
by thinkharderdev | 2025-08-26 14:48:11+00:00
> I mean both sides are guilty. ‘08 saw us bail out banks and now the likes of Fannie Mae and Freddie Mac are GSE’s.

George W Bush (also a Republican) was POTUS in 2008 and it was his administration that oversaw the bank bailouts (the program continued under the Obama administration but was designed and implemented by the Bush admin) and the nationalization of Fannie and Freddie.
by mike_hearn | 2025-08-26 14:48:53+00:00
Dedicated hardware solutions are remote attestation. The smartcard OTC readers are doing exactly that: you sign a challenge with a private key that never leaves the smartcard and is paired to the bank at the factory. This is what remote attestation is doing behind the scenes, the only difference is the smartcard user interaction is much more limited. It's of no use for protecting your financial privacy, for example, only for stopping a hacked display device authorizing transactions.

If you evolve the smartcard based systems with better I/O capabilities, then you end up with a modern smartphone. At which point you may as well let the user supply their own rather than charging them lots of money for a dedicated device that's not much different.
by babl-yc | 2025-08-26 14:49:07+00:00
One crazy stat --

In 2024, 21% of all bachelor's degrees awarded were Computer Science from University of Maryland College Park.

It was 3% in 2011.

I don't agree with the article that AI is wrecking job prospects. I see it is as companies are just now trending towards running leaner vs hiring every good engineer available during ZIRP.

Nonetheless, it's gotta be tough out there for new grads.

https://www.usmd.edu/IRIS/DataJournal/Degrees/?report=Degree...
by aredox | 2025-08-26 14:49:35+00:00
1) Viruses don't adapt instantly nor perfectly - that's why viruses can be animal-specific. Influenza (or recently SARS-CoV) are famous because they are malleable enough to adapt to new hosts, human or animal, within a few months or years, but not all viruses have this ability.

2) To further illustrate, some viruses have been nearly eliminated with a single vaccine. Polio didn't manage to adapt before going almost extinct. And a good reason why is:

3) Viruses can only evolve inside contaminated hosts. If you find a cure that stops quickly the virus from multiplying and contaminating, you are also curtailing its ability to adapt. A contaminated host is a giant casino machine, allowing the virus to mutate until it hits a new evolutionary step. A strong enough vaccine or treatment is like throwing out the virus before it has time to play much.
by busyant | 2025-08-26 14:49:48+00:00
Viruses can acquire resistance by mutation. This has been well established for decades.

FWIW, I was trained as a bacterial geneticist and routinely used bacteriophage (viruses that infect bacteria) with various resistance mutations.

Viral mutations are not restricted to viruses that infect bacteria.

edit: in fact, fundamental aspects of the genetic code were determined by analyzing and exploiting viral mutations.

https://en.wikipedia.org/wiki/Crick,_Brenner_et_al._experime...
by hcrisp | 2025-08-26 14:49:53+00:00
McPhee was recommended as someone whose writing "makes boring things interesting". I did enjoy The Curve of Binding Energy (nuclear science) and to some extent Coming out of the Country (Alaska). Both of those featured interesting vignettes and colorful characters which propelled along the narrative.

However, I then turned to his magnum opus on geology, Annals of the Former World. That was a long slog which, although I enjoyed moments of it, now I wonder if my time wouldn't have been better spent reading something more interesting.
by realusername | 2025-08-26 14:50:14+00:00
It's not a coincidence that this big push for Safetynet/Play Integrity happened after the pressure against Cyanogenmod and then Huawei.

If they really care about scams, they could remove all these casino-like games on the playstore. But they aren't going to do that because a huge chunk of the playstore revenue comes from those scam games.
by ameliaquining | 2025-08-26 14:50:50+00:00
Who exactly in the CA/B member companies is going to demand that the 47-day lifetime be reversed, and why are they going to do that?

If an org is tech-forward enough to have bothered setting up HTTPS for internal use cases on their own initiative, just because it was good for security, then they're not going to have major problems adapting to the 47-day lifetime. The orgs that will struggle to deal with this are the ones that did the bare minimum HTTPS setup because some external factor forced them to (with the most obvious candidate being browsers gradually restricting what can be done over unencrypted HTTP). Those external factors presumably haven't gone anywhere, so the orgs will have to set up private CAs even if they'd rather not bother.
by geysersam | 2025-08-26 14:51:09+00:00
Not sure porting the apps would be such a big problem.

You could probably get away with porting only a tiny fraction of all apps.

I only use ~10-20 apps. If I was sure those work reliably I'd not hesitate to move.

Here's a list for anyone who's interested:

* Firefox * Money / bank * Identity * Maps * Email / calendar * Public transport * Chat (Whatsapp, signal, telegram, Facebook messenger, hangout, slack, discord..) * Camera * Music * Podcasts * YouTube * Taxi * Renting bikes * Parking * Digital "postbox" (not email) * Gym * 2FA * Calculator * Phone/SMS * Google Drive
by cmckn | 2025-08-26 14:51:20+00:00
It’s an interesting example, knowing when to make a breaking change is really tricky in codebases like these.

You could avoid it by leaving “name” and just adding the additional fields. Maybe that’s the “right” thing to do if you have a ton of consumers and spotty test coverage. But if there’s a lot of fragile code out there (parsing “name” in subtlety different ways, etc.) it’ll never be fixed/improved. Things can get gnarly over time because there’s multiple ways to do something, and everything starts to feel like “legacy code”.

I tend to think that for private codebases, it’s important for breaking changes to be easy.