MurphyA/hacker-news huggingface dataset:
by Mountain_Skies | 2025-08-20 20:23:30+00:00
The FOSS community has become full of ideological landmines, with projects now including clauses in their requirements, often vague and ill defined, about how those who build upon their projects must act and believe. As a result, some are now finding it less risky to roll their own base dependencies instead of using someone else's project that could at any time become problematic for non-technical reasons.

While I doubt this had anything to do with the decision by the Zed team to make their own toolkit, it is something becoming more common. Hopefully it doesn't start happening in the encryption space.
by saveen_kumar7 | 2025-08-20 20:24:18+00:00
We needed to build a soft delete system that preserved user data for audit, regulatory, and business continuity purposes — especially in a financial context.

Django’s default User + Profile model got in the way. So we implemented a fully custom User model with: - Soft delete flags and audit fields (deleted_at, deleted_by) - on_delete=PROTECT on linked financial data - Admin panel actions for reversible delete/restore - Clean separation between 'inactive' and 'deleted'

This post walks through the design, pitfalls, and full code implementation.

Would love feedback from other Django engineers — and curious how you handle deletion in your apps.
by anorak27 | 2025-08-20 20:24:25+00:00
Thanks for trying it out!

Zooming in to reveal things will only make it more ambiguous since the right depth at which we hide away content will vary based on the content.

We can more intuitively build this with nestable using deep links. Each layer/level can be shown in one canvas and a deeplink to another canvas that captures a more granular level of any of the components would be a much scalable and generic approach.
by pjmlp | 2025-08-20 20:24:35+00:00
Or why you don't insist in using Khronos stuff on Windows, when most OEMs only care about the native API, DirectX.

Lets recap that this lesson has been learned by Godot developers, regarding their backends as well.

The ICD mechanism is a kind of escape hatch leftover due to backwards compatibility, and even user mode drivers build on top of DirectX runtime infrastructure.
by xp84 | 2025-08-20 20:24:44+00:00
> still nowhere for the TLS cert for your printer to live under this scheme. The printer itself has no concept of speaking TLS. (Why would it? It expects to only ever be local-segment routable

one minor correction: modern (even 5-10 year old) printers do support TLS -- and they even try to push you to use it when they only have the built-in self-signed certificate. I've seen screens encouraging me to "click trust" etc. which seems idiotic to train anyone to do when the stakes of letting them admin the printer, over the LAN, over HTTP are so low. I'm so sure that a random rogue IOT device on my LAN is listening to that printer administration traffic, real high-value stuff there. Mind you that this is unrelated to whether a rogue LAN actor could sniff the actual documents being printed, since I don't think computers are typically set up to print with IPP over TLS, but use unencrypted protocols instead.

Anyway, with my HP printer, you can upload a cert and key file and that way it'll use a cert of your choice.
by yakovsh2 | 2025-08-20 20:24:56+00:00
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.
by johnea | 2025-08-20 20:25:00+00:00
That's all pretty impressive, for a bunch of monkeys...

Dance, Monkey, Dance:

https://www.youtube.com/watch?v=xLNA7MRdjlw

The monkeys feel alone, all 6 billion of them...

The monkeys shave the hair off of their bodies in blatant denial of their true monkey nature...

The monkeys don't want to be monkeys, they want to be something else, but they're not...

Ernest Cline at his peak...
by porridgeraisin | 2025-08-20 20:25:20+00:00
A year or two ago I moved away from one of the neovim distros when they randomly changed all the keybinds on an upgrade (such things really anger me) and set up my own config. Funnily enough, I preferred vimscript. I still do use lua of course for various things, but those just go in lua EOF blocks in the vimscript. Vimscript is really terse and convenient for many things, I love it.
by 1vuio0pswjnm7 | 2025-08-20 20:25:24+00:00
From https://github.com/NLnetLabs/unbound/issues/132

"Some users of our service (NextDNS), discovered this issue since edgekey.net has been added to some anti-tracker blocklists, resulting in the blocking of large sites like apple.com, airbnb.com, ebay.com when used with unbound."

As Pi-Hole is a modified dnsmasq, NextDNS may be a modified unbound
by tshaddox | 2025-08-20 20:25:30+00:00
Absolutely. The camera bump is a complete non-issue, and probably easily solvable with a case if it's really the thing pushing you away from an entire smartphone platform.

I shudder at notion of feeling compelled to group every photo I take into exactly one folder. A directory tree makes very little sense for organizing everyday photos. If I for some reason had a natural temptation to do this, I'd be grateful to Apple for discouraging it in their Photos app.
by mhb | 2025-08-20 20:25:47+00:00
There is no chance this will be solved by convincing people to stop using fossil fuels. If you somehow were able to convince the Western countries, you're not going to convince China and the rest of world.

The options are nuclear for baseline with solar and wind supplementing it. Or geoengineering. The cost will be astronomical and voters will not be happy to pay for it. Also, bizarrely, countries with nuclear have actually been turning off their nuclear.

Given the incentives that exist, it would probably be a good idea to think seriously about the geoengineering options.
by neuralRiot | 2025-08-20 20:26:06+00:00
Exactly this, last time I went to HD I had a cart with maybe 20 items, NONE of the working self-checkouts accepted cash so I just walked out with empty hands. Now I decided that if a place doesn’t have human cashiers I just don’t shop there and give priority to small stores, I might pay more but at least I know the profits are for a neighbor.
by Imustaskforhelp | 2025-08-20 20:26:31+00:00
I am not again AI art completely since I think of it as an editing instead of art itself. My thoughts on AI art are nuanced and worth discussing some other day, lets talk about the author of anubis/story of anubis

So, I hope you know the entire story behind Anubis, firstly they were hosting their own git server (I think?) and amazon's ai related department was basically ddosing their server in some sense by trying to scrape it and they created anubis in a way to prevent that.

The idea isn't that new, it is just proof of work and they created it firstly for their own use and I think that they are An AI researcher/ related to AI, so for them using AI pics wasn't that big of a deal and pretty sure that they had some reason behind it and even that has been changed.

Stop whining about free projects/labour man. The same people comment oh well these AI scrapers are scraping so many websites and taking livelihood of website makers and now you have someone who just gave it to ya for free and you are nitpicking the wrong things.

You can just fork it without the anime images or without the AI thing if you don't align with them and their philosophy.

Man now I feel the mandela effect as I read it somewhere on their blog or any thing that they themselves feel the hypocrisy or something along that (pardon me if I am wrong, I usually am) But they themselves (I think?) would like to get rid of working in the AI industry while making anti AI scraper but they might need more donations iirc and they themselves know the hypocrisy.
by coldpie | 2025-08-20 20:26:46+00:00
My iPhone 13 Mini is just a touch too big for my taste. For phones I've owned, I'd probably give the nod to the HTC Incredible 4G LTE[1]. Relatively stock Android, 4" screen, headphone jack, soft touch plastic back. It was perfect.

[1] https://www.phonescoop.com/phones/phone.php?p=3701
by simianwords | 2025-08-20 20:27:16+00:00
I can't be analysing stuff from a think tank with 2 to 10 employees. If you have more credible sources from bigger institutions I would be happy to look at it.

I hope you can understand how this complicates things because every subject has many sides to it.. of course its worth looking at all but I do put my threshold at slightly larger institutes.
by qcnguy | 2025-08-20 20:27:59+00:00
And yet Labour have blown through all the spending and borrowing levels they proposed without "terrifying the market"?

No, go read up on it. There was a chain reaction in the pensions market caused by over-leverage. Similar issue to 2008. Truss wasn't aware of it.

Now that doesn't excuse over-spending. Of course she should have been cutting costs rather than just lowering taxes. But apparently there aren't any British political parties willing to lower costs. Eventually the IMF will have to force the issue.
by AIPedant | 2025-08-20 20:28:05+00:00
This is true - the most compelling evidence we are in a bubble is not the content of this story (maybe it's just a day in the markets) but the triviality of the cause for hand-wringing. A somewhat disappointing product release from a single company should not strike investor dread across the entire sector. The tenor of the conversation changed dramatically over the weekend because bubbles are very thin and pop quickly.

That said, "GPT-5 will not be any better than competitors' products, demonstrating OpenAI was bluffing about AGI and destroying investor exuberance" was a very specific prediction made by (for example) Gary Marcus.
by viega | 2025-08-20 20:28:50+00:00
If you baseline against what people do when they skip builtin locks, then yes, that's spot on.

Though, I was more coming from the assumption that most people are really learning about the primitives that are going to be there, and they're going to be reaching for in the real world.

So I was thinking more, "what does my language's standard library provide", which has mostly moved from sysv (or worse, sure) -> futex.

It's true though, there have been some recent defections to custom waiting. I haven't looked at any of the well-used parking lot implementations in any depth.

It's a bit of a tangent, but obviously, such constructs can be done completely in userland if you're running your own scheduler. But I assume most of them are not, so if they're not using a futex, I'd assume they're instead writing to a blocking FD and managing their own queues?

If so, how much of a win is that, really? I'm surprised it'd be worth the effort.
by DamnInteresting | 2025-08-20 20:28:50+00:00
I was about to make approximately the same comment. My site has been front-paged on HN multiple times, as well as in some big subreddits.

A link from HN: Usually comes with thoughtful discussion, and a detectable but temporary uptick in site donations (it's an ad-free, reader-supported project). There are always some detractors, but that's to be expected.

A link from a popular subreddit: A LOT of site traffic and server overload (once in 2015, Google Analytics showed over 6,600 concurrent visitors from /r/TodayILearned), and a lot more bile in the inbox and discussion thread. No uptick in donations.

No surprises there really, but it's useful to verify assumptions.
by com2kid | 2025-08-20 20:29:14+00:00
Being ~2 weeks into migrating from Windows to Linux for my dev machine, there are a lot of good reasons why people use Windows, and I keep learning more each and every day!

From a lock screen that appears ~3 seconds after my desktop does (during which time I can interact with my desktop...) to getting Nvidia GPU passthrough working in Docker being harder running on Linux natively than what it was making it work on WLS (...) to absurd amount of time it takes my machine to come out of sleep.

Oh also the popping and clicking over my BT headset every time someone speaks in a meeting. That was wonderful.

Despite using an older model MB, I needed to install some kernel extensions to get system temperatures working.

Also if I want to develop desktop software, I'm going to be writing against Windows anyway because at least that is somewhat documented, vs the ever changing landscape of Linux desktop software development. (Windows used to be the OS for desktop software, but Microsoft shot themselves in that foot, then removed the entire leg, long ago, by constantly changing and deprecating frameworks, ugh, 20+ years of API stability down the drain...)
by viccis | 2025-08-20 20:29:21+00:00
>In EC2, you can now change security groups and IAM roles without shutting the instance down to do it.

Hasn't it been this way for many years?

>Spot instances used to be much more of a bidding war / marketplace.

Yeah because there's no bidding any more at all, which is great because you don't get those super high spikes as availability drops and only the ones who bid super high to ensure they wouldn't be priced out are able to get them.

>You don’t have to randomize the first part of your object keys to ensure they get spread around and avoid hotspots.

This one was a nightmare and it took ages to convince some of my more pig headed coworkers in the past that they didn't need to do it any more. The funniest part is that they were storing their data as millions and millions of 10-100kb files, so the S3 backend scaling wasn't the thing bottlenecking performance anyway!

>Originally Lambda had a 5 minute timeout and didn’t support container images. Now you can run them for up to 15 minutes, use Docker images, use shared storage with EFS, give them up to 10GB of RAM (for which CPU scales accordingly and invisibly), and give /tmp up to 10GB of storage instead of just half a gig.

This was/is killer. It used to be such a pain to have to manage pyarrow's package size if I wanted a Python Lambda function that used it. One thing I'll add that took me an embarrassingly long time to realize is that your Python global scope is actually persisted, not just the /tmp directory.
by tshaddox | 2025-08-20 20:29:32+00:00
This is because iPhone photos are ubiquitous which causes photos from less common phones to stand out. And the less common phones likely optimize for this A/B test scenario by e.g. increasing contrast and saturation. Meanwhile Apple likely has little to no interest in optimizing for A/B tests with minor smartphone players, and instead optimizes merely for delivering satisfying photos in the widest range of scenarios.

Pixel photos are very good too, for the record. I just think the "blind camera test" is worthless.
by zahlman | 2025-08-20 20:29:49+00:00
Wow. What a — well, I don't have polite words for this. I feel like I'm walking a fine line (WRT our own community guidelines) trying to say anything here that's actually worth saying, but I'll try.

> ...Code of Conduct says that the leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of religion and ethnicity. ... How can anyone feel like [this] means anything at all, when [a company that's partnered with someone who expressed negative views of a religion] is an investor?

There are so many leaps of logic required here that I find it hard to understand why complaints like this are ever taken seriously. The money didn't come from the other person, the other person's statements didn't address anyone in the "community", money is not speech, and people are anyway not responsible for the actions of their business partners. When Brendan Eich was being pilloried for his donations to anti-SSM lobbying organizations, were all employees morally obliged to resign from Mozilla?

The OP there is linking to a website called "genocide.vc" for supporting evidence and is engaged in highly contentious culture-war framing (that happens to be opposed to Maguire's) while in the middle of making a Code of Conduct complaint. If it were a comment on HN, I would flag it. If I were a Jew who contributed to the project, I would file my own complaint in response. (And I can already vividly imagine how Bryan Lunduke will describe this story.)

Codes of Conduct are not supposed to result in a project hosting political discussions where people say things like

> that’s a funny way of saying "I don’t care if my tax dollars are used to kill 50,000+ children"

and get any positive reception from anyone for doing so.

Codes of Conduct are specifically there so that people can feel like they can participate regardless of who they are.

Having people associate you with the mass murder of children, simply because they don't share your moral intuition (this was a response to someone critiquing Mill's contribution to classical liberalism), is not welcoming.
by ndriscoll | 2025-08-20 20:29:50+00:00
Yeah, unfortunately the one criticism of XSLT that you can't really deny is that there's no information out there about how to use it, so beyond the tiny amount of documentation on MDN, you kind of have to just figure out your own patterns. It feels a little unfair though that it basically comes down to "this doesn't have a mega-corporation marketing it". That and the devtools for it are utterly broken/left in the early 00s for similar reasons. You could imagine something could exist like the Godbolt compiler explorer for template expansion showing the input document on the left and output on the right with color highlighting for how things expanded, but instead we get devtools that barely work at all.

You're right on the href; maybe there's not a slick/more "HTML beginner friendly" way to get rid of the <xsl:choose> stuff even in 3.0. I have no experience with 3.0 though since it doesn't work.

I get a little fired up about the XSLT stuff because I remember being introduced to HTML in an intersession school class when I was like... 6? XSLT wasn't around at that time, but I think I maybe learned about it when I was ~12-13, and it made sense to me then. The design of all of the old stuff was all very normal-human approachable and made it very easy to bite a little bit more off at a time to make your own personal web pages. "Use React and JSON APIs" or "use SSR" seems to just be giving up on the idea that non-programmers should be able to participate in the web too. Should we do away with top level HTML/CSS while we're at it and just use DOM APIs?

There were lots of things in the XML ecosystem I didn't understand at the time (what in the world was the point of XSDs and what was a schema and how do you use them to make web pages? I later came to appreciate those as well after having to work as a programmer with APIs that didn't have schema files), but the template expansion thing to make new tags was easy to latch onto.
by Imustaskforhelp | 2025-08-20 20:30:21+00:00
Honestly I am okay with anime catgirls since I just find it funny but still it would be cool to see linux related stuff. Imagine mr tux penguin gif of him racing in like supertuxcart for the linux website.

sourcehut also uses anubis but they have removed the anime catgirl thing with their own logo, I think disroot also does that I am not sure though
by jerf | 2025-08-20 20:30:27+00:00
"Although the long term problem is the business model of servers paying for all network bandwidth."

Servers do not "pay for all the network bandwidth" as if they are somehow being targeted for fees and carrying water for the clients that are somehow getting it for "free". Everyone pays for the bandwidth they use, clients, servers, and all the networks in between, one way or another. Nobody out there gets free bandwidth at scale. The AI scrapers are paying lots of money to scrape the internet at the scales they do.
by jfengel | 2025-08-20 20:30:43+00:00
I have not seen the word "cursor" used that way. From context it sounds like it means "the point where the pen meets the page", which does fit in with the etymology of cursor ("a thing which runs").

But I couldn't find a dictionary which supported that definition. Is that your own coinage, or is it a jargon that I didn't know?
by qcnguy | 2025-08-20 20:31:09+00:00
Where do you people get this stuff?

The economy saw no impact from Brexit whatsoever. Remarkable but true. Go look for yourself. The huge deficits are structural and driven by unrestrained immigration and welfare spending combined with the ruinous costs of lockdown, which put the debt load onto an unsustainable trajectory. Instead of being stable after lockdowns ended interests costs started continuously rising as a percentage of the budget.

Labour certainly has not decreased the deficit unless you're counting a "reduction" from lockdown costs.
by glawrence13 | 2025-08-20 20:31:25+00:00
Rye is an awesome company! They're in the universal checkout space now, stay tuned for a Rye + Channel3 demo in the next week :) We think the combo of product discovery with Channel3 and universal checkout is the future of commerce. To answer your questions:

1. Channel3 doesn't support shipping/payments, but there are a lot of great companies that do, so Channel3 + universal checkout is a full-fledged e-comm site. 2. We hope our pricing ($7/1000 req) is low enough that any reasonably-converting store won't need to worry about it. Average e-commerce order value is $180, so at 5% commissions you need <1 sale per 1000 queries. We're cheaper than any alternative, and, with rev share, we pay you to use us! (+ vector store is expensive :) ) 3. We do have shopify stores on our platform 4. An interesting idea! We're excited to see how agentic commerce evolves, and for now we're just trying to build the best discovery solution out there.
by planb | 2025-08-20 20:31:47+00:00
I’ll answer to this as a placeholder for all the „just do xyz“ replies:

Searching the whole index and then filtering is possible, but infeasible for large indexes where a specific user only has access to a few docs. And for diverse data sources (as we want to access), this would be really slow, many systems would need to be checked.

So, access rights should be part of the index. In that case, we are just storing a copy of the access rights, so this is prone to races. Besides that, we have multiple systems with different authorization systems, groups, roles, whatever. To homogenize this, we would need to store the info down to each individual user. Besides this, not all systems even support asking which users have access to resource Y, they only allow to ask „has X access to Y“.
by Rohansi | 2025-08-20 20:31:52+00:00
> I don’t want the browser to even be capable of it, because regardless of what permissions and security measures are put in place, someone is going to find a way around them.

You surely trust the permissions and security measures your phone provides to apps so what makes browsers worse in this area? Especially if you're using iOS where you only have Apple's web browser available to use.