MurphyA/hacker-news huggingface dataset:
by svieira | 2025-08-26 13:58:58+00:00
I may be mis-understanding, but it sounds like this kind of widely distributed attack would also be stoppable by checking how often the account is attempting to log in? And if they're only testing two or three passwords _per account_, per day, then Google could further block them by forcing people not to use the top 10,000 popular passwords in any of the popular lists (including, over time, the passwords provided to Google)?
Open-sourcing an ERP in React and .NET (starting with supply chain)
by adnan1507 | 2025-08-26 13:59:33+00:00
Hi HN,

I’ve been building an ERP system in my favorite stack (React + .NET + PostgreSQL). Instead of waiting until it’s “feature complete,” I’m planning to open-source it early — starting with the Supply Chain Management module.

I know there are existing projects like Odoo and ERPNext, but I wanted to explore building one with a modern React/.NET stack and see if others find it useful. Repo will be public soon.

Would love feedback on:

what features matter most in OSS ERP tools,

whether React + .NET is an interesting approach compared to existing solutions,

any advice for attracting contributors early.

Happy to answer questions and share details.
by duxup | 2025-08-26 13:59:36+00:00
It does feel like the franticness is picking up at the moment.

It's like a guy who views the world through Twitter and the output of his algorithm has gotten more arbitrary and shrill...

Like painting the border fence, wtf?

Hard to really get a good feel for his comments, but his public statements in front of cameras also seem more awkward and straight up confused as well.
by 3D30497420 | 2025-08-26 14:00:05+00:00
> every decision the US takes could be considerate, but as likely also completely random and reversed and bent at any moment in the future.

This my main problem with this investment. I can certainly appreciate the benefit of US government investment to ensure "homegrown" production capabilities. However, this depends a lot on a level of understanding, intelligence, and planning from the US federal government which is monumentally lacking. If no one trusts Intel now, I cannot begin to imagine how anyone would view Intel plus the current US government as more trustworthy.

Just look at the current approach to tariffs as a good example for how current "industrial policy" is being carried out. Unpredictable, vengeful, and declared with little plan or forethought. Why should we expect any differently from other policies?
by jerf | 2025-08-26 14:00:06+00:00
Typescript is a bad introduction to the world of static types in a lot of ways. Typescript is incredible for what it is doing, but still, at its core, laying down a static type system on top of a language ecosystem that was dynamic for years is fundamentally just, well, a bit whacky compared to a language ecosystem that was static from the beginning.

I've been doing Typescript now for about 9 months, so I wouldn't call myself an expert in that, but I also have decades of experience in many other dynamic and static languages (including Haskell), so I can say with confidence that a lot of features in Typescript are to solve problems unique to the Javascript world, and then there are the features in Typescript that are there to solve problems in the other Typescript solutions, and all-in-all while it has great utility and has many fantastic features it just isn't possible to completely overcome the fact that it's a static type system, on top of a dynamic type system.

I've seen a number of posts to the effect of "I'm coming from Typescript and learning Go, how do I do X" and so often the answer has been "Even in Go, even with its very simple type system by static language standards, the answer is that you don't do X at all because X is a feature on top of a feature on top of a feature designed to deal with being on a dynamic language and when you're on a static language you not only don't deploy that solution, you wouldn't even have the problem that's the solution to except that you just created it for yourself by copying Typescript too closely in some other way." A simple example being you don't ask how to type a map/dict/etc. in a normal static language based on the contents of the "type" value, you just declare a properly-typed value in the first place and always use that, at most converting at the edge.

Typescript is a great tool but a very unrepresentative view on how static typing works.
by neogodless | 2025-08-26 14:00:48+00:00
Huh, I paid $270 for a Minisforum UM350 w/ 16GB, 500GB. The RAM was replaceable and last year I upgraded it to 32GB. I swapped out the included M.2 for a 1TB, and then added a second 1TB M.2. All fully supported as-is.
by cogman10 | 2025-08-26 14:01:01+00:00
Types really start pulling their own weight as the size of an application increases.

In order to catch problems in dynamic type languages you end up needing a bunch of additional tests to, ironically, verify the expected type. And even then, those tests don't and can't tell you how a method is actually used throughout the program.

Consider the following class

class Human def initialize(name) @name = name end end

Now imagine you want to refactor this class to something like this

class Human def initialize(first, middle, last) @fullName = "#{first} #{middle} #{last}" @first = first @middle = middle @last = last end end

All the sudden you've got a problem on your hands. You have to find everywhere that referenced `name` on a `Human` object (And don't mess that up, it could be `name` on the `Pet` object) and change them over to full name, or figure out if they are doing something tricky like trying to extract the first name from `name`.

Types make refactoring this sort of code somewhat trivial. You simply change the fields and let the compiler tell you ever position which relied on that field.

This extends into all sort of circumstances, like letting the user of a method know what types are expected. For example, the above ruby code doesn't really guarantee that `first` is a string. In fact, it could be an int or even an object and the code would likely handle it just fine. Types expose interface contracts in a quick and easy way for programmers to understand what they are dealing with.
by concinds | 2025-08-26 14:01:15+00:00
Exactly.

"Free" devices exist. Linux computers. Linux phones. No codesigning, minimal sandboxing, none of that "malevolent" stuff from macOS/Windows/Android. Knock your socks off. You have a choice. Ideologically wanting everyone's devices to be like this is not sensible.

This isn't like anticompetitive behavior (bundling, lock-in, fees) where "you have a choice" is irrelevant because corporate power should be minimized and competition and consumer surplus should be maximized. Tradeoffs between security and nerd-fantasy "freedom" are valid.

I still remember that piece about the tween girl getting her nudes exposed because of a RAT. True "freedom" with technology, for non-nerds, means being able to use technology to pursue your passions, learn singing, fashion, dancing, without having to be terrified that this computer might destroy your life. That's "freedom" for 99% of folks. But the high-empathy folks here will respond "user error", "personal responsibility", "you should have known not to click that". You aren't entitled to be care-free, to have a life, to pay no attention to boring nerd stuff. Become a dead-inside geek like us, you bottom-quintile person, or else.
by nakamotonotes | 2025-08-26 14:01:58+00:00
I’ve been experimenting with a side project where I try to make Bitcoin market signals as easy to understand as a weather forecast.

Right now, most retail investors either follow x.com hype or get lost in complex TradingView charts. I wondered if there’s a simpler way to show “the market feels safe/neutral/hot/overheated” at a glance.

So I built a free “Bitcoin Barometer” dashboard (web + mobile) that condenses 8 respected on-chain and sentiment metrics (e.g., NUPL, Fear & Greed, Pi Cycle Top, MVRV Z-score, etc.) into a single 4-color dial: Chill, Neutral, Heated, Euphoric.

My questions for HN: - Do you think this kind of “sentiment simplification” is actually useful, or does it oversimplify? - Which additional signals (macro, on-chain, technical) would you personally want included? - For those who’ve built consumer finance tools: what’s the best way to balance clarity vs. depth?

Download app here if curious: https://nakamotonotes.com/mobile-app

Really curious to hear feedback from people who either build similar tools or trade crypto themselves.
by ToucanLoucan | 2025-08-26 14:02:22+00:00
I honestly don't see myself ever leaving Macbooks at this point. It's the whole package: the battery life is insane, I've literally never had a dead laptop when I needed it no matter what I'm doing or where I'm at; it runs circles around every other computer I own, save for my beastly gaming PC; the stability and consistency of MacOS, and the underlying unix arch for a lot of tooling, all the way down to the build quality being damn near flawless save for the annoying lack of ports (though increasingly, I find myself needing ports less and less).

Like, would I prefer an older-style Macbook overall, with an integrated card reader, HDMI port, ethernet jack, all that? Yeah, sure. But to get that now I have to go to a PC laptop and there's so many compromises there. The battery life isn't even in the same zip code as a Mac, they're much heavier, the chips run hot even just doing web browsing let alone any actual work, and they CREAK. Like my god I don't remember the last time I had a Windows laptop open and it wasn't making all manner of creaks and groans and squeaks.

The last one would be solved I guess if you went for something super high end, or at least I hope it would be, but I dunno if I'm dropping $3k+ either way I'd just as soon stay with the Macbook.
by cosmic_cheese | 2025-08-26 14:02:25+00:00
Unpopular opinion maybe, but even under Linux and BSDs I’ve felt that dot folders/files in home are poor practice. Hiding them was a band-aid for bringing *nixes into the GUI era and just adds an extra hurdle outside of the CLI, and many of them are overly specific compared to the other standard user folders.

I think macOS has the right idea with ~/Library/ though I’m not as sure about the name. Maybe ~/Support/ or ~/System/ or something makes more sense, but whatever the case I’d rather see the dot files/folders swept up into proper unhidden directories under that directory, e.g. ~/Support/Config/, ~/Support/SSH/, etc.

Which really is all the reason more why programs should actually check $XDG_CONFIG_HOME. It’s not good to just assume when a distro or user might have different conventions set up.
by skylurk | 2025-08-26 14:02:43+00:00
> Someone on Hacker News or Reddit is shouting: "Just use the cloud? Nobody is capable of maintaining a Linux server."

I like to host stuff from my house, and take a sick pleasure in not caring when my self-hosted personal projects fall offline. This is the luxury of personal projects.

For something other people are paying for, I (too) would rather not have to think about tripped breakers or ISP maintenance knocking out the service.
by donkeybeer | 2025-08-26 14:02:52+00:00
You should trust people who live in countries that tariff a lot. You won't get quality crap. When tariffs cause the imported good to become equal to $200, the local good doesn't suddenly get cheaper it rises to match $180. Obviously any incentive that remained for local product to improve is now totally dashed too because of state forced back protection from competition. You end up paying multiple times the prices for the same shit sane countries buy much cheaper than you and life turns to shit, and the lower classes don't get better but end up loosing more money on the same crap.
by shadowgovt | 2025-08-26 14:02:55+00:00
It's a good question. I've looked at PinePhone, but last time I looked at it in detail it was light-years outside my needs for usability (very much a "we are CLI authors and are trying our hands at a mobile UI as a hobby" situation).

I think I'll look into what Android phones are out there that aren't glued to the Google Play ecosystem. Side-loading is still a feature the OS core supports even if Google switches it off (for now, and AFAIK the OS is forkable if they press the issue).
by Ajedi32 | 2025-08-26 14:03:10+00:00
Especially if it's illegal (like speaking against the government, in some countries).

Maybe this is a bit of a hot take, but I think any government that has the ability to absolutely prevent people from breaking the law is a government with far too much power. I'm all in favor of law enforcement, but at some point it starts to cross over the line from enforcement to violation of people's free will.
by 8organicbits | 2025-08-26 14:03:44+00:00
Lots of ACME software supports configuring CA fallbacks, so even if a CA is down hard for an extended period you can issue certificates with the others.

Using LetsEncrypt and ZeroSSL together is a popular approach. If you need a stronger guarantee of uptime, reach for the paid options.

https://github.com/acmesh-official/acme.sh?tab=readme-ov-fil...
by troad | 2025-08-26 14:04:01+00:00
I gave Sorbet a red hot go on a decently-sized codebase maybe a year ago. I stopped writing Ruby not long after coming to the conclusion that Sorbet is a dead end. I never seriously considered RBS; the idea of maintaining C-style header files always struck me a kind of nuts from a DRY perspective, and very antithetical to the elegance of Ruby.

I ended up rewriting my Ruby codebase in Elixir (with thanks to some kind pointers here on HN). Elixir has perfectly satisfactory gradual typing via Erlang's dialyzer, which will happily power an LSP right now, and work is underway on a handmade gradual set-theoretic type system. It's a direction of travel I feel more confident in than Ruby's.
by eichin | 2025-08-26 14:04:07+00:00
Yeah - the best time to do automated renewal was ~5 years ago, the second best time is now - I just get email once a week with the list of cert renewals (which is how I learned, to my surprise, that sometimes the letsencrypt renewals do fail! but I've never seen it happen twice in a row.)

And it's not like the automation is hard (when I first did letsencrypt certs I did a misguidedly-paranoid offline key thing - for my second attempt, the only reason I had to do any work at all, instead of letting the prepackaged automation work, was to support a messy podman setup, and even that ended up mostly being "systemd is more work than crontab")
by mbac32768 | 2025-08-26 14:04:34+00:00
I set my parents up with a computer and locked it down nice and good. A few months later they called me asking me about this full screen message they couldn't figure out how to make go away that was demanding they call Apple or Google for tech support.

I was able to remote in and close it. Then I noticed the message saying uBlock Origin had been disabled in Chrome (because Google broke ad blocking).

Thanks Google.
by cogman10 | 2025-08-26 14:04:45+00:00
I'm on the fence. On the one hand I love the power of TS types that they can expose. On the other, I've seen a class of dev that, instead of relying on simple types, will try and make a monstrosity type that does unholy things.

I feel a little bit about it like I feel about RegEx. Small and simple are good, but once you start diving into the entire catalog of regex capabilities for a single expression you've made a mistake.
by echelon | 2025-08-26 14:04:59+00:00
Every engineer should be familiar with at least the basics of computational complexity.

If you're stacking loops, you ought to know what that does.

You also really ought to also what your core data structures are, how they work under the hood, and how the different operations on them consume space and time.

If you don't familiarize yourself with at least those bare basics, you're doing yourself and your customers (and your future maintainers) a disservice.
by sgarland | 2025-08-26 14:05:08+00:00
This varies wildly with the subject, and the degree of inaccuracy.

If you say, “hash maps are generally O(1), and are a great default choice,” you’re not that wrong (subjectivity aside).

If you say, “storing integers as strings guarantees precision, so you should prefer them over decimal or float types,” you’re technically correct about the first part, but are enormously wrong for a variety of reasons about the conclusion.
by bikamonki | 2025-08-26 14:05:52+00:00
I'd bet she was probably scrolling through the endless stream of fear (war, poverty, crime), guilt (diets, fitness, beauty), and shallowness (jokes, celebrities). In those moments with loved ones, I choose to engage, explain what's happening, and make them aware of how it's making them feel. Then I guide them toward alternatives. We play, we cook, we read, we plant, we dance.

It isn't entirely our fault. It's deliberately made and constantly adjusted to be addictive, for the sole purpose of selling ads, swaying votes, counting more MAUs, and increasing valuations.

Still, knowing something is bad for you isn't enough to make you stop, right? Yet, once you are out, you can choose to help others, especially the ones you care about.
by PhilippGille | 2025-08-26 14:05:55+00:00
Let's Encrypt is run by a nonprofit organization [1], funded by corporate and individual sponsors (like Google and AWS, but also the EFF and Mozilla) [2].

That doesn't guarantee they don't have malicious intents, but it's different from a for-profit company that tries to make money with you.

[1] https://www.abetterinternet.org/about/

[2] https://www.abetterinternet.org/sponsors/
by ameliaquining | 2025-08-26 14:06:07+00:00
"If it's not a public service, why should it have a certificate from a public CA?"

Probably because making sure that clients trust the right set of non-public CAs is currently too much of a pain in the ass. Possibly an underrated investment in the security of the internet would be inventing better solutions to make this process easier, the way Certbot made certificate renewal easier (though it'd be a harder problem as the environment is more heterogeneous). This might reduce the extent of conservative stakeholders crankily demanding that the public CA infrastructure accommodate their non-public-facing embedded systems that can't keep up with the constantly evolving security requirements that are part and parcel of existing on the public internet.
by spwa4 | 2025-08-26 14:06:16+00:00
You're right, I guess, but ...

Mass immigration is the only thing currently saving Europe from demographic collapse in the working age population. It is the only thing keeping pension systems afloat for the moment. It is faltering, the working age population will still collapse (and immigration is not saving anything but the huge cities. In the south of Europe entire regions are essentially depopulated and those regions are growing despite mass immigration)

Yet another problem where there is no choice. Or there is a choice between "collapse now" and "collapse in 10 years".

We're seeing a repeating theme here.

And no worries: the EU governments are going to use spending cutbacks to get themselves out of this situation. Which again is the stupidest thing imaginable, because I can't even imageine a way to make that work ... but here we are.
by zoeysmithe | 2025-08-26 14:06:23+00:00
There's a real folly in capitalist countries thinking they can be self-sufficient walled castles. Capitalism by its nature will seek out the lowest cost be it in labor or manufacturing. That means often means outsourcing.

Our system has no breaks for this. In fact it works actively for this, hence the neolib ideal of "just move towards efficiencies, and let the chips fall where they may." This is ideal under capitalism. As long as we avoid the needed migration to socialism, this is the best we can do.

Neolib economies generally work as much as anything "works" under capitalism. The GDP of the USA, median salary, quality of life, etc was the envy of the world until the recent nationalist movement that's based on "insourcing" and tariffs. You can't go back and capitalism migrates to efficiencies, which means outsourcing. Its more efficient to export factories and keep cushy office/service jobs here and drain the profits from those factories overseas.

Nationalism/protectionism and capitalism are fundamentally incompatible, so here we are. Demagogy and populism and "return to the past" mentalities used to win political power are the actual problem here.

Also what exactly happens if intel goes under? We have to buy 'foreign' licensed ARM? Manufacture in Asia? We're already doing that. And we have AMD which is a good, if not, superior product, regardless of manufacturing locale. We don't need local fabs the same way we don't need local factories for a lot of other things. You can't just depress wages with a wave of a hand nor do tariffs work outside of some really focused edge cases.

>The U.S. will be completely dependent on foreign companies

This is true of nearly all things in nearly all countries. Recent nationalist movements won't change how capitalism works and recent tariffs and protectionism has only hurt these industries and the working class. The toothpaste is out of the tube and it cannot be put back in. What we're seeing with the government buying intel is an attempt to do that, and it will fail. Expect more tomfoolery like this until we get responsible leadership, but until then we all have to sit here and watch these various economic horrors unfold. Be it this, inflation, mindless tariffs, etc. This will fail and its obvious it will, but currently it buys political power, so we will go this route because voters, largely uninformed on how capitalism works, think this is the "one weird trick" that will make them wealthy. It won't. In fact, all recent indicators are more negative as these policies continue. It will instead make them poor.
by stblack | 2025-08-26 14:06:36+00:00
Nobody has yet mentioned how certificates induce and support churn.

In 2025 it's not possible to create an app and release it into the world and have it work for years or decades, as was once the case.

If your "developer certificate" for app stores and ad-hoc distribution is valid for a year, then every year you must pay a "developer program fee" to remain a participant. You need to renew that cert, and you need to recompile a new version within a year. Which means you must maintain a development environment and tools on an ongoing basis for an app that may be feature- and operationally-complete.

All this is completely unnecessary except when it comes to reinforcing hegemony of app-store monopolists.
by Insanity | 2025-08-26 14:07:12+00:00
To be honest, regardless of the government involvement or not, I have little hope for intel. Maybe they can, over time, have an AMD-esque comeback, but given their track record of the past few years I'm not hopeful.

The Pentium -> Core2Duo was a great era for intel, but I feel like ever since then they've started a decline in both price/value proposition as well as just general hardware.

The i-series was arguably pretty good for gaming, but then they started exploiting that position by having relatively poor price-to-performance, thinking they wouldn't have any competition.. and they kept the 'we are winning' mindset even while AMD was hot on their heels.
by IanCal | 2025-08-26 14:07:14+00:00
Second order effects do not mean they're less important, perhaps that's the misunderstanding.

> I couldn't care less about the technicalities cooked up by ofcom.

Then you will be incapable of discussing it with anyone looking at how things are implemented and will continue to make assertions that don't match what they're seeing.

> if every store was required to check your ID digitally, in real time, and storing that information

Which has no parallel to what's in the OSA.