MurphyA/hacker-news huggingface dataset:
by tzs | 2025-08-26 15:39:21+00:00
I've only put maybe 2 seconds of thought into this so it is probably stupid, but why don't we have an alternative that does not require third party certificate authorities?

For example why not allow an organization to have its own self-signed certificate authority, and allow it to publish its self-signed root certificate through DNS, and make browsers accept that root for use with that domain?

I see two objections offhand.

Objection #1. It doesn't provide any validation that the certificates were actually made by the legal entity that they claim to be for. It just shows that whoever made the CA had write access to the domain's DNS records. It can't replace EV certificates or OV certificates.

Retort #1. So? Those sites that need EV of OV certificates can keep using the current approach. But a very large number of sites don't need EV or OV certificates. This can be seen by the success of Let's Encrypt which only issues DV certificates. Even some large sites use DV certificates, such as Amazon.

Objection #2. If someone gets write access to your DNS records they can replace your CA!

Retort #2. So? If someone gets write access to your DNS records they can make Let's Encrypt certificates for your domain.

What have I overlooked?
by ericpauley | 2025-08-26 15:39:26+00:00
It seems like the core problem here is that certificates are considered part of infrastructure, and further that they're part of infrastructure that requires approval!

Clearly not all automated infrastructure requires approval: autoscaling groups spin up and tear down compute instances all the time. Further, changes to data can't universally require approval, otherwise every CRUD operation would require a committee meeting.

Are certificates truly explicitly defined to be infrastructure that requires change approval? If not, perhaps more careful interpretation of the regulations could allow for improved automation and security outcomes.
by reify | 2025-08-26 15:39:58+00:00
meaningless bullshit

There are 28,800 seconds in an eight hour working day

Losing focus for 1200 times a day for just one second is just a mere 20 minutes.

losing focus for 20 minutes out of an 8 hour day doing boring meaningless automated tasks staring at a monitor, can only be a good thing.

I would expect the loss of focus it to be much much worse.

developers are not machines.

I say they need to lose focus more often

this is heading towards ai being better at staying focussed, not those lazy unfocussed developers, dossing around all day chatting with their mates.
by hollerith | 2025-08-26 15:40:02+00:00
The point is that GrapheneOS will continue to allow the sideloading of Android apps (and Google cannot do anything to prevent that).

Just because Google has been generous enough (or inattentive enough) to allow Pixel devices to run alternative OSes is not a reason to avoid GrapheneOS. Also, the Graphene project is in discussions with a manufacturer to produce a non-Pixel phone running GrapheneOS.
by kmeisthax | 2025-08-26 15:40:21+00:00
Not a question about the Framework Laptop 16 specifically, but why are the upgrade kits[0] for the Laptop 13 still marked as "register interest" on the Framework Marketplace? The Ryzen AI 300 motherboards, RAM, and Wi-fi cards are all available separately already.

[0] https://frame.work/products/framework-laptop-13-mainboard-ki...
by Ma8ee | 2025-08-26 15:40:46+00:00
Waterfall certainly has processes for going back and adjusting previous steps after learning things later in the process. The design was updated if something didn’t work out during implementation, and of course implementation was changed after errors was found during testing.

Now that agile practitioners have learned that requirements and upfront design actually is helpful, the only difference seems to be that the loops are tighter. That might not have been possible earlier without proper version control, without automated tests, and the software being delivered on solid media. A tight feedback loop is harder when someone has to travel to your customer and sit down at their machines to do any updates.
by thunderbong | 2025-08-26 15:40:54+00:00
Thankfully, the title was explained in the beginning of the article. It was very confusing for me!

> Having a Hot Chips article with a cheekier title is not something we normally do, but we saw this slide. In terms of world economies, cybercrime now ranks between Germany and China in GDP according to Microsoft’s chart at just over $9T in 2024, and expected to be over $10T in 2025.
by cesarb | 2025-08-26 15:40:55+00:00
> It does, but if you look at the mainboard manuals of computers, usually it's 32 lanes of which 16 go to the GPU slot and 16 to the southbridge, so no storage directly attached to the CPU.

AFAIK that's not the case at least on AMD (not Threadripper, but the mainstream AM5 socket). They have 28 lanes of which 16 go to the GPU slot, 4 go to the southbridge, 4 are dedicated to M.2 NVMe storage, and 4 go to either another PCIe slot or another M.2 NVMe storage. See for a random example this motherboard manual https://download.asrock.com/Manual/B650M-HDVM.2.pdf which has a block diagram on page 8 (page 12 of the PDF).
by jofla_net | 2025-08-26 15:41:43+00:00
Well it is still a phone after all, what with UMA and baseband processing. You don't need to spend much time at Blackhat/Defcon to realize any true attempts at sealing it up are akin to plugging leaks in a sieve with epoxy. Its far too porus.

Meanwhile if attestation does reduce fraud, the ownability (by the user) of the device is now forfeit due to chasing a dragon's tail.
by athrowaway3z | 2025-08-26 15:41:50+00:00
On the one hand, the guy makes it sound like it 'spawns cmd prompts' which suggests a Windows machine and a bunch of amateurs selling crap to third parties (and to the state), instead of being a state level actor. (which shouldn't be able to gather that much valuable metadata by spying on the network anyways)

On the other hand, 250$ is a suspiciously high number when you can get a dozen people to do it for 50$ in an afternoon.

ps. "top secret" clearing is a not secret club - it's a very big club and its practical purpose is you agreeing to increase legal liability by getting thrown into a different judicial tract if you screw up - eg by installing Russian hardware on your home.
by mmarian | 2025-08-26 15:42:21+00:00
- Sharing my latest blog post on various socials to gather feedback - it's about the problems with pinning GitHub Actions by commit hashes: https://developerwithacat.com/blog/202508/github-actions-com...

- Casually investigating a construction tech startup idea with an architect

- thinking of what to do long term. Feeling pretty lost at the moment.
by eythian | 2025-08-26 15:42:28+00:00
I run a few low-stakes hobby things, and LE cert automation took the "once a year or so figure out how to do this because I haven't done it in a year and I should write it down but when I'm done I just go to the pub instead" to "", which was a nice change. Now I only have to interact with it when I add a new vhost to the web server, and that's just run a command to do so.
by 827a | 2025-08-26 15:42:38+00:00
No, I hate this change from Google, and everyone involved with it should be ashamed of themselves, but Stallman is an extremest and I don't believe his world would be better than this one.

There's genuine need for application developers to gain access to extremely secure end-to-end attestation of the environment their apps are running in. Its a rare need, but it does exist. There's also genuine need for some consumers to opt-in to a strict security regime.

Google's change forces this draconian, dishonorable regime on all application developers and on all users. Its a change that serves no one except their shareholders.
by mock-possum | 2025-08-26 15:42:40+00:00
fwiw I’ve been writing code for 2 years and I have occasionally benefitted from half-remembering the concepts that big O notation describes (even though my memory of the proper terminology is pretty shoddy, it’s been a long time since we covered it in college)

When new releases of website features have resulted in notably poor performance, and profiling has revealed a particular function taking time on the order of seconds to complete (seconds are an eternity in UI land) it’s important to be able to reach into code that processes big chunks of data, and identify loops-within-loops-within-loops that could be rearchitected to play out more efficiently.

Knowing that you’re going from O(n^2) to O(2n) is really just a matter of jargon - knowing that your list of results now displays in 1/10th the time, and why, is still pretty important. The underlying logic/math is the important bit to have a concept of, imo, big O is just a fun way to talking about it.
by kikkia | 2025-08-26 15:42:55+00:00
Maybe I am just a bit naive on the under the hood workings of the play integrity system, but I would imagine most of the devices not passing attestation are just Rooted or 3rd party roms. Those can easily change around keyboxes and mock stuff out (for now at least) to try and pass these checks, would that not also spoof device id making this void? I guess you could also use this to store info on devices that are not spoofing stuff, like device level bans for a game or something. Maybe that's more the use case here rather than the continued war against enthusiasts.
by bob1029 | 2025-08-26 15:43:00+00:00
In the general case, it appears to be impossible to beat a hardware vendor that is also entirely in charge of the operating system and much of the software on top of that (e.g. safari).

In special cases, such as not caring about battery life, x86 can run circles around M1. If you allow the CPU rated for 400W to actually consume that amount of power, it's going to annihilate the one that sips down 35W. For many workloads it is absolutely worth it to pay for these diminishing returns.
by NoSalt | 2025-08-26 15:43:07+00:00
I wonder if this is where the writers of The Big Bang Theory came up with this conversation:

Stuart: Oh, Sheldon, I'm afraid you couldn't be more wrong.

Sheldon: More wrong? Wrong is an absolute state and not subject to gradation.

Stuart: Of course it is. It's a little wrong to say a tomato is a vegetable, it's very wrong to say it's a suspension bridge.
by goku12 | 2025-08-26 15:43:08+00:00
I thought that was the default understanding. That's one of the options you have to choose in many installers. For example, an option exists to install the software over ADB from within Android (eg: Shizuku). So, one of the other options you get is "install using system package manager" or something similar. In fact, that was the only method that worked for me until recently.
by digdugdirk | 2025-08-26 15:43:17+00:00
Random question for framework owners - my 1st gen Framework 13 recently started screaming it's fans all day, every day, even when it's asleep.

Where's the best places to go for troubleshooting, user guides, etc? I've played with all the bios and framework settings I can find, so I'm guessing it's hardware related, if that changes the resource recommendations.
by tim333 | 2025-08-26 15:43:52+00:00
>Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices.

It's annoying combined with them making that much harder to be a verified developer. I had an android dev account for years and published an app when it was $20 for life but now there's a bunch of hassle involved. If they had the old $20 and upload your passport to prove id it wouldn't be so bad.
by pzo | 2025-08-26 15:43:58+00:00
So is better to do nothing because we cannot divest everything right now? You start by divesting partners that are getting complicated (this year US). Apple divest its supplies by using many different partners and stop using one if they having problem with one.

EU can for sure get a most of those you mentioned from South Korea and Japan who are also having issues with US. At least with those countries EU has stronger hands than with US.
Show HN: Simdgrep is a file grepper not written in Rust
by coyove | 2025-08-26 15:44:34+00:00
simdgrep is written in plain C, works like 'grep -rinE' out of box, with multithreading and gitignore filter.

My sloppy testing on Linux shows a slightly better result compared to ripgrep, but it varies because of software and hardware jitters, on macOS (sonoma) simdgrep sometimes performs worse.

More benchmarks are welcomed.
by oracleclyde | 2025-08-26 15:44:41+00:00
I just tried it inside Gemini with a Medium article. Here's my prompt: "Read the article at this url and provide a hero image that incapsulates the message the author wants to convey: https://bioneers.org/supreme-oligarchy-billionaires-supreme-..."

The response was a summary of the article that was pretty good, along with an image that dagnabbit, read the assignment.
by tlogan | 2025-08-26 15:44:55+00:00
If you are disciplined and unsubscribe from mailing lists, you will stop getting most of the spam in your inbox. Sure, your spam folder might still be full - but with actual spam.

Honestly, I think it all comes down to discipline. You should immediately unsubscribe if you do not want someone’s newsletter.

But my problem is different: I get a lot of emails that I do want to receive, but I do not need to read them right away - or sometimes never. For example, mortgage monthly statements, which I really only need at tax time.
by oceanplexian | 2025-08-26 15:44:56+00:00
They all works fine because Microsoft allows distros to sign their keys. We are a single bad law or a change of corporate politics away from them not doing that and deleting Linux out of existence on personal computers.

Now, maybe you’ll still be allowed to if you have a special license from the government to purchase approved hardware to run it in a datacenter. Which can be promptly revoked if you were found to be running illegal VPN software or something like that.
by kube-system | 2025-08-26 15:45:20+00:00
It is a minority stake so they won't "control" Intel in the way we typically associate with "nationalized" businesses.

> And where is the example of a successful govt run business?

This is a bit of a loaded political question until you first define "success" and "business". Most of the reasons you'd even want a company to be run by the government in a mixed-market economy are precisely because you want it to be run differently than a private company.
by jsmith45 | 2025-08-26 15:45:24+00:00
I'm confused.

$XDG_CONFIG_HOME is clearly meant for data that would otherwise be in a configuration style dotfile. This is the sort of configuration that that users may well want to sync between machines such that a dotfile manager should include them by default. (That said, there may be some data from some of the other XDG directories worth syncing too, but generally a dotfile manager should not include those other folders in full by default.)

Beyond that the spec defines $XDG_DATA_HOME as "base directory relative to which user-specific data files should be stored.". The default path ($HOME/.local/share) might suggest that this should be read-only data, but it actually is read-write.

The description of the $XDG_STATE_HOME makes it quite clear that $XDG_DATA_HOME read-write: "The $XDG_STATE_HOME contains state data that should persist between (application) restarts, but that is not important or portable enough to the user that it should be stored in $XDG_DATA_HOME". This makes it clear that important and portable data should be written to $XDG_DATA_HOME.

And thus we also have $XDG_STATE_HOME. The list of examples that follow the previously quoted sentence make it clear that this is stuff that gets persisted, but if it were omitted from a backup, the user will probably not care too much (i.e. stuff like logs, history, set of open files, undo history, etc.

$CDG_DATA_HOME does also include any read-only reference data, which should be searched for there, and in $XDG_DATA_DIRS (which defaults to "/usr/local/share/:/usr/share/").

It could certainly be argued that read-only reference data and read-write user data should not have been mixed. After all Unix does keep them separate that at the top level `/var` vs `/usr/share`, but the spec authors apparent felt this distinction was not necessary at the user level.
by Herring | 2025-08-26 15:45:34+00:00
I used to play a lot of Coup in college. In that game, I can bluff about having a card that lets me steal 2 coins from you. Our group quickly learned that if you let someone get away with that bluff once, not only would they steal from you every turn, everyone else would also start stealing from you too, because they assume you wouldn't challenge them.
by E39M5S62 | 2025-08-26 15:46:26+00:00
At least on Thinkpads over the years, I've never seen anything remotely close to that either. I've had my Thinkpad x260 power draw down to 2.5 watts at idle, and around 4 or 5 watts with a browser and a few terminals open. That was back in 2018! With the hot-swappable battery on the back, I could go for 24 hours of active use without concern.
by jbrisson | 2025-08-26 15:46:27+00:00
Languages come and go. There was a time when there was a huge momentum behind Ruby (and Rails). It is not (sadly) the case anymore. It is a matter of traction. C'est la vie. I remember back in the 90s there was great interest in Delphi (Borland OO language) but then came Java. I don't even know if someone is still coding in Delphi. I guess Ruby will eventually go the same way.
by gchamonlive | 2025-08-26 15:47:00+00:00
I think part of this can be explained by the fact that in many corporations, code and everything supporting it, like development time, developer quality, infrastructure maintenance and software architecture aren't seen as investiment but sunk cost that needs to be reduced ad infinitum to appease shareholders, so they throw human suffering and business risk at it to make it look good in the next quarterly report.
by simonsarris | 2025-08-26 15:47:32+00:00
That is what my company does except we basically hire out of high school. After the founders, 100% of our employees (including myself) were hired directly as high school interns, kept for years during college, and got offers after graduation.

I wrote about this a bit. I wish we could hire more. I am kind of shocked how few companies do it. There are a LOT of smart kids who would love a summer programming job.

https://simonsarris.com/p/growing-software-developers
by lazide | 2025-08-26 15:47:51+00:00
Also, water is not readibly fungible as it’s not generally economic to ship large distances. So either you have it, or you dont.

If you do have it, often you have more than you can store or use effectively (the rest just runs off).

If you have a lot of water, then going to a bunch of effort saving it is indeed silly.

If you don’t have a lot of water, then it is indeed essential.
by jmyeet | 2025-08-26 15:48:00+00:00
I'm surprised I haven't seen this before. Thanks for mentioning it. It is long and I did skim some sections but I read large chunks. I'd actually be curious to know the author's politics because that is a deeply anti-capitalist essay (which I agree with, for the record).

The Bungie grenade example was funny because I've seen this exact same ignorant data fuckery. Blizzard does this with World of Warcraft now because they're tuning talents that classes have based on how much they're used, which ignores how often people just copy builds and how some abilities are just inherently fun (as the grenades apparently were). The net result is they just keep nerfing anything people like.

When he was talking about Valve and Steam and EA and sports exclusivity, he may as well have just said "enclosures" (in the capitalist) sense because that's exactly what he means.

Every modern corporation is just looking for a formula that they can repeat ad nauseum. He talks about this with media properties and the Marvel and Star Wars slop (my word, not his) that we get as a result. This is fundamentally incompatible with creative projects, be it movies or games.

One of the most destructive ideas to come out of the 20th century is this idea that a good business leader can manage anything. So we get a lot of "leaders" who end up running things they know nothing about and in large companies, "leaders" get shuffled around every 6-12 months on purpose, to avoid them ever failing because they're never anywhere long enough to see the consequences of their actions.

You see that with the VP shuffle at any large tech company.

I also appreciate that he was anti-NFTs as I was for the exact same reasons: it doesn't actually solve any problems or give consumers anything they actually want.
by nonethewiser | 2025-08-26 15:48:14+00:00
Is it just me or is the author only making an argument for why Intel is too big to fail? He says hes steelmanning the equity stake but then he doesn't argue why it's necessary. He devotes 2 sentences to CLAIMING its necessary after aruging that Intel is too big to fail.

The article is basically like this:

> Leading edge domestic foundry companies are a national security concern. Therefor Intel is too big to fail.

OK. Many can agree with this. And I think the author makes a very good argument for it. He makes some good points:

- Startup cant replace Intel - US cant rely on TSMC alone - Artificial demand could actually improve Intel by solving the chicken and egg problem

But that doesn't answer the question, "why the equity stake?" And for more context, it's replacing what would have been grants with the equity stake. So it's, "Why replace the $XB in grants with an equity stake?"

He does touch on it but it's just a claim thrown in at the end:

>The single most important reason for the U.S. to own part of Intel, however, is the implicit promise that Intel Foundry is not going anywhere. There simply isn’t a credible way to make that promise without having skin in the game, and that is now the case.

OK, maybe. But that now needs to be argued for. The US can give them money as grants. Grants put skin in the game for the US because they require Intel to meet the terms.
by diggan | 2025-08-26 15:48:20+00:00
> Where's the best places to go for troubleshooting, user guides, etc?

I guess general "laptop maintenance" guides should be good enough? Guides that mention things like "Clean out all the dust/vent-junk once every X months/years" (if you have pets, you can't do this often enough it seems) and "redoing the thermal paste each X year".
by Night_Thastus | 2025-08-26 15:48:20+00:00
Like it or not, Nvidia is the dominant player in the GPU space. They have objectively the most powerful GPUs and the best support for development (CUDA).

It would be cutting out a massive chunk of Framework's potential customers to not even offer Nvidia GPUs.

I don't like Nvidia at all, they're a scummy company. But just offering their products as an option is not "openly hostile and offensive" to Linux users. That's a bizarre take.
by Lio | 2025-08-26 15:48:24+00:00
> I know that goes against a lot of the fundamentals in the language.

You're not the only person to reply with something like this but just to repeat, Ruby has had official gradual static typing support for 5 years now.

Gradual typing is fundermentally already part of Ruby.

Ruby could do with better static analysis tooling but people are being paid to work on that.