MurphyA/hacker-news huggingface dataset:
by lopsotronic | 2025-08-29 16:23:46+00:00
XSLT is by and large single-threaded, and most jobs in the print domain get horrifyingly ginormous due to basic conceptual flaws of XML/XSL. Your Operations guys might have a panic attack when they see how that impacts on the server side. But then, to mitigate that, someone's going to need to cook a queueing system with some kind of notification/email doohickey, and now the InfoSec guys are also having a panic attack.

You're probably going to save money, end of the day, just homebrewing some XSL drop ins with a real programming language.

I gotta say, as a mostly-defense XSL guy[1] who also knows his way around TS and Py, this is probably going to be a real boom time to kick this dumb XSLT work to the curb and do some high dollar contracting making JS/TS drop-ins for govcons and defense.

[1] Who also thinks XSLT is a joke told by an idiot. My morale? Oh, it's great.
Show HN: Claude Code Subagents – 100 domain-expert helpers for dev workflows
by 0xfurai | 2025-08-29 16:23:57+00:00
I built a collection of 100+ specialized subagents for Claude Code that act like on-call experts (Python, React, Postgres, Docker, Stripe, Kafka, Prometheus, etc.). They can be auto-invoked by context or explicitly called (“use the postgres-expert to design indexes”), and each carries a focused system prompt + quality checklist. The runner picks a Claude model per task to balance speed/cost.

- Covers languages, frameworks, DBs/ORMs, DevOps, testing, ML, observability, auth, payments, messaging, and more. - Zero server: they’re just files in ~/.claude/agents/. - MIT-licensed and contributions welcome.

I’d love feedback on missing domains, rough edges in prompts, and real-world cases where this helped (or failed). Thanks!
by chucky_z | 2025-08-29 16:24:25+00:00
I did the reverse, I needed something to keep CPUs pegged at 100% power all the time, and for some reason the boxes I was using at the time kept going 'no no it's ok I need to save power,' but that lead to really inconsistent performance. Tuned, in that environment, 'just worked' after I wrote a custom profile.

There was another issue I was able to fix with it in AWS, but I legitimately can't recall what it is.
Show HN: FFmpeg Pages – because I was tired of fighting FFmpeg
by CodeWithNeer | 2025-08-29 16:25:13+00:00
You ever just want to shrink a video… and suddenly you’re buried in flags, half-broken StackOverflow answers, and 10 tabs open just to figure out one command?

That’s been me. Every. Single. Time.

So I built FFmpeg Pages — a dead-simple collection of the commands I kept searching for. No fluff, no digging, just the stuff that actually works.
by bwfan123 | 2025-08-29 16:25:23+00:00
I just completed a prototype of a non-trivial product that was vibe-coded just to test the ability and limits of LLMs.

My experience aligns largely with your excellent comment.

>But the level of integrative intelligence, combined with specialized world >knowledge required for that task is really very far away from what current >models can do.

Where LLMs excel are to put out large templates of what is needed, but they are frayed at the edges. Imagine programming as a jigsaw puzzle where the pieces have to fit together. LLMs can align the broader pieces, but fail to fit them precisely.

>But they are quite bad at abstracting textual information into a more >fundamental model of program and world state and reasoning at that level.

The more fundamental model of program is a "theory" or "mental-model" which unfortunately is not codified in the training data. LLMs can put together broad outlines based on their training data, but lack the precision in modeling at a more abstract level. For example, how concurrency could impact memory access is not precisely understood by the LLM - since it lacks a theory of it.

> the technical challenge is how do you pose a training problem to force a model > to learn beyond that.

This is the main challenge - how can an LLM learn more abstract patterns. For example, in the towers of hanoi problem, can the LLM learn the recursion and what recursion means. This requires LLM to learn abstraction precisely. I suspect LLMs learn abstraction "fuzzily" but what is required is to learn abstraction "precisely". The precision or determinism is largely where there is still a huge gap.

LLM-boosters would point to the bitter lesson and say it is a matter of time before this happens, but I am a skeptic. I think the process of symbolism or abstraction is not yet understood enough to be formalized.
by jihadjihad | 2025-08-29 16:25:38+00:00
Initially upvoted because it's disturbing, but can anyone corroborate this story? There are no mainstream mentions of this story or this person Thomas Vierhaus, and I am using the word "mainstream" pretty liberally.

The only mention I can find is an all-German article in The Epoch Times, which is far from a mainstream source of news [0].

0: https://en.wikipedia.org/wiki/The_Epoch_Times
by Hasz | 2025-08-29 16:25:43+00:00
Sig's response to this clusterfuck will be studied in PR classes for years to come. They started with a wildly overagressive social media campaign and have generally refused to admit there is a problem, and are banning, suing and generally trying to cover the whole thing up.

Independent testing at the local, state and federal level acknowledge you can fire a P320 without pulling the trigger. Making sure the gun only fires when the trigger is pulled is requirement #1, #2 and #3 for any gun.
by hnuser123456 | 2025-08-29 16:25:44+00:00
He has an interest in getting good devs hyped on S&box, but he's being pretty open ended and honest here. Want to be a game dev? Make a game and ship it... all of the resources for the in between steps are out there and it's only getting easier, but for everyone else just as much as you. I grew up in the gmod mini-modding scene and it's still one of the most impactful parts of my life. First there's editing existing scripts, then there's recognizing what people (or yourself) would like that doesn't already exist, then there's the grunt work of turning it from idea into reality, then there's releasing it with your name attached. It's very rewarding. Still working on releasing something with a price tag attached but this post a good reminder and motivation.

And yeah, the steam workshop was way ahead of its time, and feels like a new, higher tier of sandbox game. I don't think there's any other game that came out around the same time as gmod (2006) that has had comparable momentum and staying power.
by mikewarot | 2025-08-29 16:26:04+00:00
There's been a strong theme recently here on HN of confusing programming (the act of writing code to meet specifications) and Engineering(the writing of specifications, and the oversight of said process, along with overview of testing).

AI is definitely not ready for an Engineering role. My recent experience with ChatGPT5(Preview) via Visual Studio Code tells me that it might perform acceptably as a junior programmer. However, because I'm an old retired self taught programmer who only ever managed 1 other programmer, I lack the experience to know what's acceptable as a Junior Programmer at FAANG and elsewhere.
by jakogut | 2025-08-29 16:26:22+00:00
I glossed over parts of this mechanism above, but partially pre-cocked strikers require the trigger bar to pull the striker back more before the trigger bar drops down, releasing the striker. The amount the striker is pre-cocked is not enough to ignite a primer, and the act of pulling the striker back against spring pressure mimics the sear geometry of a hammer fired gun.

Fully cocked strikers are ready to ignite a primer if the striker drops. I don't know of another design like Sig's that has a fully cocked striker, which is not to say there isn't one, or that they're all unsafe.

The P320 in particular suffers from compromises shoehorning a fire control unit designed for one gun into another.

Combined with poor manufacturing techniques, tolerance stacking, part mixing, and poor QA, the striker block, which is the last safety intended to block the striker without an explicit trigger pull, can become ineffective.

To answer your question, there's no mechanical reason a handgun cannot be designed an manufactured to not fire without explicit mechanical input from the user. Indeed almost every commercially produced handgun on the market fits this requirement. A combination of failures on Sig's part has allowed this to happen.
by Balinares | 2025-08-29 16:26:40+00:00
HFT is a different thing from what is being discussed in this thread. With HFT you're talking custom ASICs running within light-nanoseconds range of the target exchange. Ocaml very much isn't in this picture. This is about human-speed trading. Which also provides liquidity and correction of instrument prices towards their fair value, just at a different level.

The societal value of either is debatable all the same, mind you. It's more that wherever you have markets, you have money-making opportunities that can be leveraged, and therefore are.
by JumpCrisscross | 2025-08-29 16:27:42+00:00
> A company runs well. But then they sell to a private equity. The quality goes down

I'm sceptical this pattern is true. But because of the aforementioned ambiguity in terms of what constites private equity, it's an essentially unanswerable question.

If you want to support the hypothesis, you focus on investors who use a lot of leverage (LBOs) and those who focus on distressed assets. There is reason to criticise the former, which often amounts to limited-liability arbitrage. The latter is just sampling bias.

Similarly, if you wanted to reject the hypothesis, you'd include venture capital in private equity, as well family offices that quietly collect businesses in an area they've long operated in, but want to say they're in private equity versus the family restaurant-parts supply business or whatnot.

Going back to something like disability services, I don't see it being run phenomenally better by a VC or family or public company. The problem is fundamental to the profit incentives of the industry. Not the fact that the owners brand themselves as private equity.
by bdamm | 2025-08-29 16:27:44+00:00
It is now sort of common for embedded chips to generate on-die encryption keys for external processes (flash) and there could even be a one-time encryption key for the ROM (pushed to the on-die ROM and then wiped from manufacturing). Encryption RAM is basically free because the chip can generate a key internally at each boot. There can even be deeper lock-downs although obviously the deeper you go the less common it is. Getting to the on-die key can be pretty much impossible unless you can find some bootloader attacks, and then you're very much into dangerous territory. In some cases even looking for a bootloader attack can be paramount to disruption of international arms treaties, legally.

I'd expect them to also have fleet keys for stuff like navigation data. And of course, public-key based firmware signing. That's just table stakes these days.
by echelon | 2025-08-29 16:28:45+00:00
AI can't replace humans, but it can be an exoskeleton for human pilots.

AI code tab-complete is fantastic. It's at least an order of magnitude more powerful than IDE-assisted auto refactors.

AI graphics design tools are probably the single best thing in the field. Editing photos, creating new graphics, making marketing materials, shooting and editing videos is now extremely easy. It's a 100x speed up and a 1000x cost reduction. You still have to re-roll the generations repeatedly, but with a competent editing tool you can speed run any design work. This is one area where non-experts can also use the tools.
by soraminazuki | 2025-08-29 16:28:52+00:00
Says the person advocating for companies to get rid of consent, the bare minimum they can do when screwing over people for profit. That's not deciding what's best for you. That's you unilaterally deciding that no one deserves consumer protection. You are trying to force on everyone what 96% of people are opposed to [1]. So don't you dare pull off that DARVO nonsense and accuse me of being an oppressive dictator.

Also in what universe are utter fantasies like "'no one wants to share their data' is just assumed" or "the defaults are always 'deny everything'" true? Tech companies are bypassing user consent all [2] the [3] time [4].

[1]: https://arstechnica.com/gadgets/2021/05/96-of-us-users-opt-o...

[2]: https://hn.algolia.com/?q=opt%20out

[3]: https://hn.algolia.com/?q=opt%20in

[4]: https://hn.algolia.com/?q=consent
by leetharris | 2025-08-29 16:28:54+00:00
I work in this field, so I can answer.

Embeddings are great at basic conceptual similarity, but in quality maximalist fields and use cases they fall apart very quickly.

For example:

"I want you to find inconsistencies across N documents." There is no concept of an inconsistency in an embedding. However, a textual summary or context stuffing entire documents can help with this.

"What was John's opinion on the European economy in 2025?" It will find a similarity to things involving the European economy, including lots of docs from 2024, 2023, etc. And because of chunking strategies with embeddings and embeddings being heavily compressed representations of data, you will absolutely get chunks from various documents that are not limited to 2025.

"Where are Sarah or John directly quoted in this folder full of legal documents?" Sarah and John might be referenced across many documents, but finding where they are directly quoted is nearly impossible even in a high dimensional vector.

Embeddings are awesome, and great for some things like product catalog lookups and other fun stuff, but for many industries the mathematical cosign similarity approach is just not effective.
by seanw444 | 2025-08-29 16:29:19+00:00
GrapheneOS is too precious. Being able to pretend like the app has full access to my gallery, while only specifically allowing certain directories or photos, is awesome. I've actually discovered that selecting a photo in the gallery and "sharing" it to a Messenger chat skips the need for it to be in the allowed directory, so I've been doing that too. Anyone know if that's working as intended, or if it's a potential security hole?

And yes, putting Messenger on my GrapheneOS phone is dumb, but my normal people friends all use Messenger, so that's where our group chats are. Best I can do is fail to convince them to install an XMPP client and join my self-hosted server, or minimize the impact of Messenger.
by bryanrasmussen | 2025-08-29 16:29:20+00:00
I see I need to clarify what I think about the unfairness aspect.

It is my experience that even much smaller companies than Google would have a Lawyer or multiple lawyers go over the details of how such a program would work.

The lawyers would of course talk to the developers and the project managers and interested parties and define risks. The risk of someone pushing in bugs to then report really seems like a programmer defined risk, but the unfairness thing is a lawyer defined risk. The first you conceive of thinking like a programmer, the second thinking like a lawyer.

But the risk I would assume a lawyer would see is - determining the severity of bugs is somewhat up to the developers and managers at our company, therefore we may encounter a situation in which a person reporting a bug thinks their bug is very severe but we think it is less severe, furthermore there may even be similar bugs in the past that we have paid out large amounts for but in this case we pay out a smaller amount, this will create an appearance of unfairness. The people pursuing the bug bounty have put in work to get the money, we of course will structure our contracts about bug bounty work etc. so that they cannot expect the process to be fair and that this is not a form of employment therefore the payout is not guaranteed, but that only goes so far, and if things look unfair then the shield our contracts offer may be blown apart.

The ability of someone to work on a project, and find bugs in that project quicker than other people gives them an advantage in reporting bugs therefore they need to invest less time to get a potential reward, they can report more bugs quicker etc.

Depending on jurisdiction, and we cover the damn world, this might be a problem because hey can someone who is not part of a project able to sue someone who is part of a problem somewhere because that person got more payoffs based on their access to the codebase of a project. Can our communications be requested to see if we evaluated things in any way unfairly?

What about if we have people on the same project as the guy that is reporting bugs for that project, can it be argued that we favor someone we "potentially" work with? This is another aspect of unfairness. Will they be able to sue and get access to communications regarding bug bounties in any case regarding unfairness - will our contract hold up against this?

For safety's sake let's just disallow these potential pieces of unfairness in the rules of the bug bounty, thus keeping from having any conflict of interest. Oh the developers said maybe someone could put in bugs in projects and then report it, seems legit also good reason we don't allow it. But yes, seems like a nasty can of worms all over, let's not open it.

The point of worrying about the unfairness is not that one thinks even that one would lose the case, but to avoid the case altogether, To have a contract that says essentially you can't do anything about it because we don't have to be fair, but then also remove anything that might look unfair.
by sottol | 2025-08-29 16:29:29+00:00
This is nothing new - Germany has always had pretty "strict" libel laws. Eg there have been "200,827 investigated cases as of 2009" [1].

I think this post comes in light of Europe being seen as curtailing free speech recently. Europe and the US have always had different ideas on the limits of free speech.

[1] https://kellywarnerlaw.com/germany-defamation-laws
by nicce | 2025-08-29 16:29:41+00:00
But you can domestically hire that junior too - I am just arguing about that pure replacement model. You can pick the top talent from juniors too. Otherwise, if nobody ever hire juniors, at some point you run out of any workers because there is a portion for their life when they simply cannot get the job in their field. Young people won't invest the field if the first job requires that you are magician or have 10+ years of work experience that you either can't have or need to use your free-time.

Anyway, big tech doesn't work as an generic example because they have much more resources and therefore it cannot be generalized.

US also is an exception because the only expectation is English language. In other countries you may need two languages.
by dmicah | 2025-08-29 16:29:51+00:00
I have a single night of sleep logged to Apple Health in the last 6-months, and the 6 month average exactly matches that single night. It seems that the author of this app is assuming that Apple is using the wrong denominator when calculating the 6-month average, but I think there could be other explanations for the difference in calculated values. For example how the two approaches might deal with data from different sleep data sources within Apple Health from the same date, how multiple sleep sessions on the same calendar date are merged prior to averaging, etc.
Show HN: Create Private or Public Tool-Sharing Clubs with Patio
by rocknrollisdev | 2025-08-29 16:30:02+00:00
Hey HN

I’ve been working on Patio, a platform to make DIY & home improvement more community-driven. Just shipped a new feature: Clubs.

Clubs are like little hubs where you and your people can:

- Share tools & leftover materials (instead of letting them collect dust) - Lend/borrow in private groups (family, friends, coworkers) or public ones (like a neighborhood tool library) - Pin a location for your club - Share guides, plans, or helpful links

The idea: make it easier to share what’s already in your garage and cut down on waste. That half-box of tiles or extra paint? Could be exactly what your neighbor’s looking for.

We’re still early, would love your feedback on how this could work best for neighborhoods, families, and organizations.

Thanks and have a great day!

Julien
by godshatter | 2025-08-29 16:30:29+00:00
I'm old school I guess. I keep a manually-curated index.html file that my browser uses as it's homepage on my desktop at home. I've grouped together types of bookmarks and have a few hundred URLs saved (~600 or so). Mostly YouTube creator pages. I generally search for stuff when I want to go somewhere new, then save the bookmark if it looks like I might need it often.

This works for me because I don't try to sync the file. I don't browse on my phone much because I hate typing on one, and I keep work and home separated.
by whilenot-dev | 2025-08-29 16:30:34+00:00
Regardless whether it's opt-in or opt-out, the business will need to confirm anything it opted for you by asking. If you don't select the opposing choice in a timely fashion, then the business assumes that it opted correctly in your interest and on your behalf.

> So, I think this is opt-in, until Sept 28.

If the business opted for consent, then you will effectively have the choice for refusal, a.k.a. opt-out.
by nostrademons | 2025-08-29 16:30:57+00:00
"We noticed that our app reviews on TV, Watch, and VR suck, why could that be? Are the OSes on those platforms terrible? Are user expectations just super high? Can we ever make money on those platforms?"

"When you're on TV, you need to use a DPad to laboriously type in a review. Same with the watch and its tiny screen. When you're on VR, you're using a laser pointer. That makes the barrier to leaving a review very high. As a result, people only bother to leave reviews if they have particularly strong feelings. The strongest motivating emotion is anger. Ergo, we are getting a disproportionate number of reviews from people who are angry, and everyone that is happy is not going to bother leaving a review."

Same goes for many kinds of user feedback situations. The feedback you're measuring is P(user holds that opinion | user bothers to tell you that opinion). The denominator needs to be understood in order to evaluate that probability, but by definition, you don't have any data on people who don't bother to engage with you, unless you can measure their interaction in some other way (eg. usage data). This is why online reviews of many offline businesses skew negative; why businesses will often nag you to leave a review if you're satisfied; why corporate executives often overestimate employee satisfaction, particularly in prestigious businesses (anyone who is dissatisfied will leave and get a job elsewhere), and why Congress has such a low approval rating (by definition, you can't escape the laws enacted by Congress, so there is no "exit" option, and you get an accurate appraisal of what people really think).
by chrismorgan | 2025-08-29 16:31:14+00:00
The Payment Card Industry has a set of Data Security Standards: if you want to accept cards, you must comply with their rules, or they may ban you. There are different degrees of compliance requirements. If someone else handles everything (e.g. external link or iframe), you get the easiest time: Self-Assessment Questionnaire A. If the data is actually in your DOM but you’re submitting to someone else (by form post or by JS), your burden is a little more, but still fairly small: SAQ A-EP. But if the card number is ever going to touch your server, you can’t use these things, and must go up to SAQ D which is several hundred questions long, and some of the requirements of which may be bothersome, involving things like quarterly penetration testing from approved vendors; and if you have a larger number of transactions, you end up needing mandatory full on-site audits.

(In practice, at the lower levels compliance is not typically validated, and I wouldn’t be surprised if less than 1% of e-commerce merchants were actually fully compliant even at SAQ A.)