MurphyA/hacker-news huggingface dataset:
by ulrikrasmussen | 2025-08-26 13:47:22+00:00
Alright, I think I misunderstood you. I know most banks allow alternatives other than the app.

But just the fact that there are options which have the side effect of making you choose between convenience and digital autonomy is wrong, and I don't think remote attestation should even exist in the toolbox. We should make dedicated hardware solutions work better instead.
by themgt | 2025-08-26 13:47:25+00:00
I’ll be honest: there is a very good chance this won’t work .... At the same time, the China concerns are real, Intel Foundry needs a guarantee of existence to even court customers, and there really is no coming back from an exit. There won’t be a startup to fill Intel’s place. The U.S. will be completely dependent on foreign companies for the most important products on earth, and while everything may seem fine for the next five, ten, or even fifteen years, the seeds of that failure will eventually sprout, just like those 2007 seeds sprouted for Intel over the last couple of years. The only difference is that the repercussions of this failure will be catastrophic not for the U.S.’s leading semiconductor company, but for the U.S. itself.

Very well argued. It's such a stunning dereliction the US let things get to this point. We were doing the "pivot to Asia" over a decade ago but no one thought to find TSMC on a map and ask whether Intel was driving itself into the dirt? "For want of a nail the kingdom was lost" but in this case the nail is like your entire metallurgical industry outsourced to the territory you plan on fighting over.
by jraph | 2025-08-26 13:48:24+00:00
Why or in which cases is opening a dedicated port better than publishing challenges under some /.well-known path using the standard HTTP port?

(You say hijacking the HTTP port, but I don't let the ACME client take over 80/443, I make my reverse proxy point the expected path to a folder the ACME client writes to, I'm not asking for a comparison with a setup where the acme client takes over the reverse proxy and edits its configuration by itself, which I don't like)
by scarface_74 | 2025-08-26 13:49:04+00:00
As Kosh said, once the avalanche has started, the pebbles don’t have a vote. Unless you are high up in the organization, you can’t change a dysfunctional organization.

It’s best to just leave.

Hell as the most recent CEOs of Intel have found, even if you are high up in the org, you often can’t change a dysfunctional organization.
Show HN: Next-Gen Image/Video AI Studio (Flux, Veo 3, and Custom Models)
by denizhadzh | 2025-08-26 13:49:06+00:00
I built an AI image & video studio that combines state-of-the-art models (Flux, Veo 3, Minimax, Google Imagen 4 etc.) with custom ones we trained ourselves. You can generate and edit content in one place, switching between models seamlessly.
by Roark66 | 2025-08-26 13:49:10+00:00
I think time quickly approaches when everyone will have one mobile phone for "banking/crypto" and the other for everything else.

Samsung used to have a very cool feature on their phones (perhaps they still do, I switched away from the galaxy line). It was called Knox and was basically containers for your apps.

Unfortunately it was limited to only one secure container. What I did was I had all my secure apps outside the container. And insecure inside. I had a fake address book that had only one phone number in "My Knox" and any app I installed there I could give all the file and address book permissions it wanted. As I knew it could only see what is inside.

That is what we need, but better. I never tried Graphene, but I wouldn't be surprised if there was such a feature thre already. It's kind of obvious.
by layer8 | 2025-08-26 13:49:11+00:00
CRLs don’t have to be large, since they only need to list revoked certificates that also haven’t expired yet. Using sub-CAs, you can limit the maximum size any single CRL could possibly have. I’m probably missing something, but for SSL certificates on the public internet I don’t really see the issue. Where is the list of such compromised non-expired certificates that is so gigantic?
by ChicagoDave | 2025-08-26 13:49:29+00:00
I liked the presentation (right or wrong), but wanted to point out I’ve been in IT as a coder and architect for 40 years and never once needed to know big O notation.

Which I think is the complaint here. The article author might have made an effort to connect it’s significance to Internet solutions like Search.

I assume he didn’t because that’s already been done.
by thecupisblue | 2025-08-26 13:49:30+00:00
Yes, but this doesn't do absolutely anything to prevent this.

I've helped elderly family members and non-techie ones who barely know how to open a facebook account - none of them had "malware apps" installed. Their problems were mostly these:

- Websites asking for notification permission just to spam with unrelated malware or porn notifications

- Their calendars being filled with events that are nothing but links to porn or gambling sites, leading to constant notifications

- Apps that don't work yet are filled with ads - blood pressure meter on your phone, sugar level measurements, step trackers - filled with ads and trying to get 1000$ purchases

- An app actually being a launcher filling your screen with ads.

- Hell, even I, as someone who has deep intimate knowledge of Google Play Billing, got scammed by an app when upgrading from their weekly to their monthly offer, with them now charging both.

Google can intervene at any point here, they have reviewers, they control the store, they control the browser, hell, they basically control the device. And they have rules and policies for it, but it's convenient for them to ignore it. They have their cash cows and will fight tooth and nail to protect them as long as it makes them profit.
by stego-tech | 2025-08-26 13:50:06+00:00
As someone on the other side of the fence who lives primarily in IT land, this is far from a solved problem. Not every device supports SSH for copying certs across the network, some devices have arbitrary requirements for the certs themselves (like timelines, lack of SANs, specific cryptography requirements, etc), and signing things internally (so that they’re only valid within the intranet, not on the internet) doesn’t work with LE at present.

So unless you’re part of the folks fine heavily curating (or jailbreaking) devices to make the above possible, PKI is hardly a solved problem. If anything it remains a nightmare for orgs of all sizes. Even in BigCo at a major SV company, we had a dedicated team to manage PKI for internal certificates - complete with review board, justification documents, etc - and that still only bought us a manual process with a lead time of 72 hours for a cert.

That said, it is measurably improved and I do think ACME/certbot/LE is on the right track here. Instead of constant bureaucratic revisioning of rules and standards documents, I believe the solution here is a sort of modern Wireguard-esque implementation of PKI and an associated certification program for vendors and devices. “Here’s the cert standard you have to accept, here’s the tool to automatically request and pin a certificate, here’s how that tool is configured for internal vs external PKI, and here’s the internal tooling standards projects that want to sign internal certs have to follow.”

Basically an AD CA-alike for SMB and Enterprise both. Saves me time having to get into the nitty gritty of why some new printer/IoT/PLC doesn’t support a cert, and improves the posture of the wider industry.
by ninetyninenine | 2025-08-26 13:50:24+00:00
No need to bring horribleness? You are the one who brought up pedophilia.

My whole point was to bring pedophilia to the same level of severity as scams to essentially show you there’s no logical need to bring that up as a disgusting example. You heightened the level of horribleness, then pretended to be offended when I was trying to lower it.

As you say there’s no need to bring horribleness into this but you decided to do it then pretend to be offended when I compared the two.

You talk as if you’re authority. You’re saying shit like “You should do this” “Or you can’t do that” as if you’re automatically correct and dishing out orders. That’s your tone and it’s not appreciated. You “should” let your own logic stand and don’t make statements as if they are absolute truth without evidence.

The fact of the matter is to you, Singapore is inhumane. But an entire city of people disagrees with you and they have the results to show for it. So march right over to them and give them the orders you gave me. And they’ll give you the opposite order right back. That’s just your opinion. So who the fuck cares? You think telling me that I shouldn’t use severe punishment and stating it in an authoritative way is going to change my opinion? Fuck no.

Tell me why your way is objectively better. And then I’ll tell you why a place like Singapore is better.

First, Have you even considered the positive aspects of what Singapore does? The lack of accessibility of drugs alone has saved the lives of countless thousands of people who otherwise would’ve given in to temptation and ruined their own lives by becoming addicts. The cost? Roughly 15 hanged people.

Thousands of people is a loaded number I made up but it’s a reasonable ballpark counterfactual of the amount of lives saved that we can use to illustrate the deeper logic here which is this:

Your morality results in you killing more people. By being more humane you have actually done a greater evil.

That’s how the real world works. So stop tramping around and delivering orders. Tell me objectively why it’s better.

I’m betting you can’t. But go ahead, prove me wrong.
by ziml77 | 2025-08-26 13:50:28+00:00
My venture outside of MacBooks included a Dell XPS. Supposed to be their high end, and that year's model was well reviewed by multiple sources.... yet I returned it after like a week. The fan would not only run far too often but the sound it made was also atrocious. I have no clue if mine was defective or if all the reviewers are deaf to high frequencies. And the body was so flimsy that I would grab the corner of the laptop to move it and end up triggering a mouse click.
by CamouflagedKiwi | 2025-08-26 13:50:55+00:00
I've worked with a major financial institution (let's just say that you'd definitely recognise the name) in a past job, and while I couldn't really see exactly what was going on with the certs they issued, I'm sure it was a pretty manual process given our observations of things changing then reverting again later. I don't think regulation was really the issue though, just bad old processes.

I wonder what they will do with the shorter validity periods. They aren't required to comply in the same way; it's not a great look not to but I can't believe the processes will scale (for them or their customers) to renewing an order of magnitude more frequently.
by elp | 2025-08-26 13:50:56+00:00
Unless I'm completely misunderstanding things Letsencrypt has been doing this since 2020 https://letsencrypt.org/2020/02/19/multi-perspective-validat...

I.e they check from multiple network locations in case an attacker has messed with network routing in some way. This is reasonable and imposes no extra load on the domain needing the certificate all the extra work falls on the CA, and if Letsencrypt can get this right there is no major reason why "Joe's garage certs" can't do the same thing.

This is outrage porn.
by bikamonki | 2025-08-26 13:51:17+00:00
Let them be rich. Stoicism would recommend you not try to control what isn't in your hands to control; just accept it. Can you imagine that centuries ago, the same rules of class, power, and money drove society, and some very smart philosophers came to the right conclusions? Let it be. Meanwhile, those hands, freed from frustration and fear, can build the extraordinary.
by 9dev | 2025-08-26 13:51:22+00:00
How on earth would that make more sense than properly setting up ACME and forgetting about the problem for the next hundred years?? If your bespoke ERP system is really so hostile toward cert changes, put it behind a proper reverse proxy with modern TLS features and self-sign a certificate for a hundred years, and be done with it.

It'll take about fifteen minutes of time, and executive level won't ever have to concern themselves with something as mundane as TLS certificates again.
by echelon | 2025-08-26 13:51:25+00:00
I really hate the HTTPS requirement that Google unilaterally mandated for everyone.

Just wait until SSL is used to prevent us from publishing anything.

Your ID will have to be on file and be compliant.

We've gone from really simple tools to tools that could easily be used to ensnare us and rid us of our rights.

Encryption doesn't necessarily mean privacy. It can also mean control.
by perihelions | 2025-08-26 13:51:25+00:00
Most US states don't have criminal defamation laws ("...more than a dozen states still maintain criminal libel laws"[1]). They're infrequently used, except[0,1] an abusive tactic by police; most experts seem to think they're unconstitutional, but they haven't (yet) been invalidated on First Amendment grounds.

[0] https://www.aclu.org/press-releases/u-s-supreme-court-declin... ("U.S. Supreme Court Declines to Hear First Amendment Challenge to Criminal Defamation Law" (2023))

[1] https://www.thefire.org/cases/frese-v-formella ("Frese v. Formella")

> "Throwing someone in jail for badmouthing a public official is profoundly undemocratic and un-American."

> "But that didn’t stop police from arresting Robert Frese after he insulted them on Facebook. According to the Exeter Police Department in New Hampshire, Frese violated the state’s criminal libel law when he referred to an officer as a “coward” who was “covering up for a dirty cop.” New Hampshire’s law makes it a misdemeanor to say or write anything that you know is false that will expose someone to “public hatred, contempt or ridicule”..."
by mrweasel | 2025-08-26 13:51:26+00:00
I've lost so much code, photos and other digital assets over the years. I regret losing most of it, yet I can seem to get started on archiving the things I care about.

So many funny little project, so much code I'd like to revisit, so many photos lot.

Any recommendations on how to start a life as a digital hoarder?
by Mallowram | 2025-08-26 13:51:50+00:00
In 1973 Basil Bernstein studied how UK scores in math defied class boundaries while scores in reading comprehension/essays stayed tied to them, and he developed a theory with Halliday that language embeds so much that we cannot decipher easily: dominance, status, control, land-centering, gender/mate-selection, and much more, that they assumed language was far more a social system of primate-simian signaling rather than what Shannon and classical linguists took as "communication". My guess is, LLMs are really unresolvable revelations of these hidden nuances. In a way, LLMs demand a specific language, which doesn't exist, in order to function.
by harryjosh | 2025-08-26 13:51:50+00:00
Hey HN We’re working on MedTechAI — a project to help AI/ML folks build better healthcare models without dealing with real patient data. We generate high-quality, privacy-compliant synthetic medical datasets that mimic real-world medical scenarios (but with no actual patient info, so no HIPAA headaches). The data comes in formats like JSON and TXT, and it's designed to be easy to plug into your workflows — whether you're building a medical chatbot, training a model, or just experimenting with healthcare analytics. We’d love your feedback: What would you want in a medical dataset for AI/ML? Any features or formats you think we're missing? Would this be useful for what you’re working on? Open to ideas, suggestions, and collaboration. Happy to answer any questions!
by Andoryuuta | 2025-08-26 13:52:07+00:00
Semi-related: Firefox 142 was released a few days ago and is now using CRLite[0], which apparently only needs ~300kB a day for for the revocation lists in their new clubcard data-structure[1].

[0]: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...

[1]: https://github.com/mozilla/clubcard
by JamesSwift | 2025-08-26 13:52:10+00:00
Based on what Ive read [1], Sorbet was born out of very specific circumstances at Stripe, in the same sort of way that go was at google. I think it missed the mark due to it being a specific tool for specific usecases instead of an "open source project for the general public" first.

I love ruby but I do look forward to having a good option for types at some point. The community makes up for lack of types by adding more tests to their test suite, which is nice but I'd love to layer some encoding into the codebase itself and save the CI time.

[1] - https://blog.jez.io/history-of-sorbet-syntax/
by everforward | 2025-08-26 13:52:10+00:00
Yes, because you want to know what certificates you're issuing. You could be automatically issuing and deploying certs on a system where the actual app was decommissioned. It's probably mostly a risk for legacy systems where the app gets killed, but the hardware stays live and potentially unpatched and is now vulnerable to a hacker taking it over.

With manual renewals, the cert either wouldn't get renewed and would become naturally invalid or the notification that the cert expired would prompt someone to finish the cleanup.
by tantalor | 2025-08-26 13:52:17+00:00
Just because a word is "in the dictionary" doesn't make it English.

For example, we can all agree "schadenfreude" is not an English word, but it's in the dictionary.

https://www.merriam-webster.com/dictionary/schadenfreude

There is no English word for "pleasure derived by someone from another person's misfortune". Yes, we can borrow from German; that doesn't make it suddenly become English.
by tacostakohashi | 2025-08-26 13:52:45+00:00
Bosses assigned higher level projects or goals, but to a larger extent developers were expected to have some domain and product knowledge, and to figure out and have opinions on the individual tasks for improving the product for themselves.

Now, the "product manager", "product owner" and "scrum master" roles have been created, so that developers are more like interchangeable / replaceable cogs in the machine.

This all works well for quickly adding new buttons to existing apps, but its pretty useless for innovating new products or architectures, especially since inevitably no one person ends up with a good understanding over the overall product or architecture.
by johannes1234321 | 2025-08-26 13:53:02+00:00
The exact time probably has no "best" but from past times: I have seen so many places where multi-year certificates were used and people forgot about them, till some service suddenly stopped working and then people having to figure out how to replace that cert.

A short cycle ensures either automation or keeping memory fresh.

Automation of course can also be forgotten and break, but it's at least somewhere written down in some form (code) rather than personal memory of a long gone employee who previously uploaded certs to some CA website for signing manually etc
by baranul | 2025-08-26 13:53:18+00:00
There are a couple things about that take, that many would say deserves push back on: (1) Rust supremacism has been aimed at many other languages, not just Zig in particular. It's been a wide spray. (2) Many would say that Zig's leadership has done similar to what you are saying about Rust. Very clear examples have been the relentless unleashing on Vlang and its creator, and to a lesser extent on C3.

What might be the better critique about this, is that any programming language's leadership should not be engaging in that kind of bad behavior. And any ill words coming from them about another language, should always be taken with a grain of salt and seen as likely bias.
by sombragris | 2025-08-26 13:53:18+00:00
For me, the Kyrie from Tomás Luis de Victoria's Officium Defunctorum (1605) is the best piece of music ever written, period. And I say this after having listened to a lot of music of various styles.

Here's the piece with two great performers:

- The Sixteen: https://www.youtube.com/watch?v=MO-C_zC6KiQ

- The Tallis Scholars: https://www.youtube.com/watch?v=KOko0MqkNcc

Enjoy!
by kukshaus | 2025-08-26 13:53:27+00:00
I built an open-source app that transcribes videos and turns them into notes, PRDs, or Notion exports. It’s a web app that takes audio (from meetings, podcasts, or voice notes) and automatically creates transcripts, structured notes, and even product requirement docs. Under the hood it uses Whisper for transcription and GPT to organize and polish the text, with a simple export to Notion.

I also built it together with Claude, which helped me brainstorm, refine workflows, and polish the final product.
by y-curious | 2025-08-26 13:53:29+00:00
The Epstein thing is the true bait, which I feel Americans are swallowing hook line and sinker.

The real meat of the issue is nationalization of companies, militarization and trying to take over the Federal Reserve.

Honestly, every president of the US has semi-directly killed thousands of people. I feel that whatever exposure he had to Epstein's island pales in comparison to, you know, operating the military industrial complex.

Many people are also surprised that politicians lie and that the ultra rich do abhorrent stuff above the law. Seems like a new trend /s
by ptero | 2025-08-26 13:53:32+00:00
In this definition I think virtually no one assesses the risk correctly. It is a human nature to overreact (post-factum) to an unlikely event to the extent that most languages have a dedicated saying ("having burned yourself on hot milk, one now blows on water" is the non-English version I heard as a kid).

No offense intended, but I also yours is not a good definition of "correctly assessing the risk". If it were followed, an extremely unlikely possibility of a horrible outcome would stop people from doing most optional things. For example, a risk of a horrible disease while on travel will lead to no travel.

Personalities differ and there are daredevils and scaredy cats that differ in pre-event risk assessments, but post (unlikely and traumatic) event assessment change is pretty universal. My 2c.
by rpdillon | 2025-08-26 13:53:35+00:00
Malware exists, but you are only focusing on the benefit of removing user freedoms. Can you provide a similar analysis of the costs, or do you just ignore them because they are hard to reason about?

F-Droid is a massive win for the mobile ecosystem, probably the last bastion of useful free software for mobile devices. Being able to build an APK at home and run it on my phone is the ideal way computers should be used. But you can't put a price on these freedoms.

You're advocating for a system that removes the least abusive app store so we can hand more control to the most abusive app store. I can't support that, especially when it's glaringly obvious that walled app store are neither necessary nor sufficient to provide safety for users.
by 1718627440 | 2025-08-26 13:53:38+00:00
Yes.

I'm not so sure I want MS to go away though. While I'm not a fan of MS and I've never even really used a Windows computer beside it being mandated in school and university, I don't want Windows to go away.

When the masses come to Linux, it will simply become worse and locked down. There are already enough companies invested who will want to do so as soon as it becomes feasible and enough influencable users are on Linux.

Windows is better then mac OS in terms of user control, so I also don't want the masses to go to mac OS.

What I would welcome is, Desktop Linux to not be a rounding error and the OS market to become more competitive, so that MS needs to improve Windows and can't ship whatever crap of the day they want.