MurphyA/hacker-news huggingface dataset:
by Chinjut | 2025-08-19 15:01:44+00:00
My one quibble with the comment I linked is about asymptotics. By the Prime Number Theorem, asymptotically, the density of black squares should approach zero and the density of red squares should approach 100% (including among the left diagonal which is entirely black in the displayed window, and including losing the regular appearance of rows that are entirely black except for their last cell. These black line patterns in the displayed window are both small number phenomena caused by (1 - 1/ln(R))^100 being nearly zero for small R, which stops and then goes the other way for large R.)
by everforward | 2025-08-19 15:02:23+00:00
I don't see how that could be done at either a technical or political level. From the technical, there's no difference in the traffic to detect. From the political, foreign VPNs would be unencumbered and given that it's free there's no lever to pull at banks to stop payments.

Some VPN providers will take payment in cash that you mail in. There's probably also convoluted ways to get access without a credit card. Roblox money -> Bitcoin -> VPN, or maybe just those crappy phone apps that have you do surveys and stuff that allow you to redeem a VPN coupon.
by mcv | 2025-08-19 15:02:59+00:00
Yeah, there's a massive difference between a system that can handle a specific number of well-defined situations, and a system that can handle everything.

I don't know what the current state of self-driving cars is. Do they already understand the difference between a plastic bag blowing onto the street, and a football rolling onto the street? Because that's a massive difference, and understanding that is surprisingly hard. And even if you program them to recognize the ball, what if it's a different toy?
by 9rx | 2025-08-19 15:03:04+00:00
Which approximately translates to:

SELECT p.pnum, p.pname, p.qoh FROM part p WHERE p.qoh < 25

But a more direct translation would look something like:

FROM part p SELECT p.pnum, p.pname, p.qoh WHERE p.qoh < 25

Even closer would be:

FROM part p; SELECT p.pnum, p.pname, p.qoh WHERE p.qoh < 25

Of course they are different languages so we can only take things so far, but the pertinent bit is that the range specifier is declared first in ALPHA, whereas it is declared later, after the projection is defined, in SQL.
Ask HN: C++ code protection in desktop apps. How do you keep your boss happy?
by kkkqkqkqkqlqlql | 2025-08-19 15:03:20+00:00
I have a Windows C++ app which is supposed to be used with a license, with user and password, like Autodesk Fusion, and a user should not to be able to use it with invalid or expired credentials. We have a simple authentication scheme with signed Json Web Tokens which are checked with a server on startup. However, since now we want to sell the application to final users, we need to somehow protect the code, so that it's not exactly trivial for an end user to use the software without license, or for a hacker to decompile the code and get all our IP. I am completely aware of the fact that a hacker with enough time will be able to bypass any license check no matter how complicated and decompile all our code and get all our IP. However, I understand there are common practices, like stripping debug symbols and code obfuscation. Are there, like, standards for this so that in the inevitable moment a hacker decompiles our app and gets all our IP we can at least say "we did protect our code, let's file a lawsuit" or something like that?
by epistasis | 2025-08-19 15:04:25+00:00
The reply defining terms from busterarm was flagged, so I'm repeating them here:

> TAM or Total Available Market is the total market demand for a product or service. SAM or Serviceable Available Market is the segment of the TAM targeted by your products and services which is within your geographical reach. SOM or Serviceable Obtainable Market is the portion of SAM that you can capture.
by afavour | 2025-08-19 15:04:35+00:00
A recurring thought is that the modern day really, really suffers from politicians having no clue how tech works. And if you are someone who knows how tech works, why would you go work for the government when you could earn far more working in tech itself?

I'm not really sure what the answer is. The government is always going to be susceptible to "won't someone think of the children" logic and there's no-one trusted to push back.
by Refreeze5224 | 2025-08-19 15:04:37+00:00
> Unfortunately, I'm highly confident that 90% of the intelligence community looks at us insisting that crypto standards be inviolable, and thinks we're all as infuriatingly naïve as a ChatGPT comment

Until they can prove this is the case, and not just fear mongering to justify their massive budgets, overreach and assaults on civil liberties, I am happy to continue being considered naïve by them.
by dawidpotocki | 2025-08-19 15:05:25+00:00
From what I found in UK banks will let 16 year olds to open an account independently.

You could also mail cash (Mullvad), buy a VPN gift card in a physical store or online or get something like a prepaid Visa/Mastercard or a paysafecard.

Even if that is not an option, it's not like age restrictions have prevented everyone underage from alcohol or smoking, people will find a some shady VPN provider or a friend to buy them one.

And also, the transaction can have a very useless business name.
by antoninor | 2025-08-19 15:05:29+00:00
Building on top of Pedro Tavares viral post (https://news.ycombinator.com/item?id=44429789), I argue that the shift we need isn’t from slow coding to fast coding, but from vibe coding to vibe designing —using AI not just to produce more code, but to challenge and clarify the problems worth solving in the first place. I expected more from AI when it came to solutions, but it’s in framing the problems where it has truly surprised me. TL;DR AI makes it easy to code faster—but the real bottleneck is understanding the problem, not typing speed. Chasing velocity risks producing the wrong solutions more quickly. The real opportunity is to shift from vibe coding to vibe designing: using AI to deepen our modeling, clarify assumptions, and shape better problems before we ever write code.
by robenkleene | 2025-08-19 15:05:34+00:00
I comment on the Mac App Store part here https://news.ycombinator.com/item?id=44952088

> But once an app has free reign to read and write anywhere on a shared folder, it defeats the purpose as opposed to being able to read and write to the apps own folder and the user can choose a file from another folder explicitly.

Not sure I'm following this statement, isn't just being able to read/write to a shared folder a large improvement over an app being able to write to the entire file system (user-permissions allowing, granted)? I.e., "it defeats the purpose" seems like an odd phrase to use there? (For the record, I wish all this sandboxing/entitlement-based security stuff didn't exist on desktop computers [my priorities are clearer from my linked to comment], so I'm probably wrong person to ask anyway, but I was missing what you meant there.)
by awithrow | 2025-08-19 15:05:40+00:00
I think like most things there is a power law distribution when it comes to these sort of roles. I've worked with a few really good security teams in my career. The good ones work with the teams, possibly embedded on improving security. The better ones also write tools and libraries for service teams to consume. The best ones act like internal white hats, constantly probe and assess, and submit patches as well.

Sadly the vast majority of sec teams are not this and exist solely to run some tool that spits out a list of dubious vulns and then dump said list as a pile of tickets into the dev backlog.

One place i worked, the CISO even came up with some slogan for the info-sec along the lines of "observe and report" after I kept trying to show the info-sec how to run, build, test, and patch our various packages and tools their scanners would complain about.
by exasperaited | 2025-08-19 15:06:19+00:00
> any more than they were interested in ensuring that Prince Andrew received justice for abusing a minor

Prince Andrew didn't break any laws in the UK, though, did he? Virginia Giuffre was 17 (over the age of consent) when she was photographed here with Andrew.

The USA didn't charge him and seek extradition so what was the UK to do?
by sp3ktrum | 2025-08-19 15:06:24+00:00
My bookkeeper and accountant are from the same company. I'm trying to find alternatives as I'm not happy with their services. They just use Quickbooks which is fine. But really trying to track down accountants used by SaaS companies. I've noticed some SaaS companies start to implement the collection of taxes for each specific state. I feel like I need someone who has that knowledge to advise and potentially implement.
by anonzzzies | 2025-08-19 15:06:45+00:00
Tikv is very (very) slow (compared to redis, not sure about elogkv) and it's redis layer seems unmaintained. TiDB is very interesting product ; we tried to replace our massive mysql (master with multi read replica/standby's) system and it is just so slow that it's unusable really. Maybe it's great for other goals though, I don't know; I like the idea so we tried some setups with it.
by dc396 | 2025-08-19 15:07:43+00:00
No.

They aren't "invalid requests". You can put literally anything in a domain name (see RFC 2181, section 11) and the upstream should respond. I'm curious what resolvers are dropping these requests.

The correct behavior is for dnsmasq to forward requests to the upstream regardless of the content of the QNAME. If dnsmasq doesn't get a response back in some reasonable amount of time, it should (probably) return SERVFAIL to its client.

Further, DNS mostly uses UDP which is unreliable -- all DNS clients must deal with the query or response being lost. Dnsmasq's timeouts might be overly long (I didn't bother to check), but this is a minor configuration issue.

This sounds like the (well known) birthday attack, the defense of which is precisely the point of DNSSEC. AFAIK, dnsmasq supports DNSSEC, so the right answer is to turn on validation.
by matthewdgreen | 2025-08-19 15:08:10+00:00
I don't understand why this relatively simple conversation is taking so long. Let me summarize:

1. Standard built-in meeting recording tools (like Zoom, Meet and Teams) all give a warning to other participants, and have done so for years. These are the gold standard for what users expect from recording-enabled tools, because they've been (essentially) the primary game in town and I can bet that everyone reading this conversation has encountered the warning at least once before Otter etc. came along.

2. If you want to build your own meeting recording tool that joins the meeting as a "participant" (or as an add-on to a real participant's own machine) then it seems like a good idea to try to mimic the same warning UX for the other participants. At worst you're following "best practices" and at best you're insulating yourself from a lawsuit like this one.

3. I don't know what you're talking about when you mention Otter (the subject of TFA) because I clearly see Otter notetakers join as a participant. Or per the docs: "Otter Notetaker can automatically join your Zoom, Google Meet, or Microsoft Teams meetings and transcribe your meetings in real-time." I can't see any reason why, as a separate participant, they would be technically unable to display a written warning on the video feed and/or emit an audio warning.

4. From perusing Otter's site, it looks like you can also upload a Zoom recording (which will cause Zoom to emit the standard warning) or you can sync in an Otter app, which requires Zoom Admin and presumably has capabilities like "warn the other users" since the integration is pretty tight.

5. Even if the software is running purely locally, I imagine there are ways to insert a warning into the meeting. Maybe in a few cases there is some technical reason it's absolutely impossible that I don't understand! But frankly, I do not believe that the lack of warning is purely due to technical limitations, since Otter Zoom participants also don't recite one. I'm fairly certain that even tools that purely use local feeds, there is likely a way to emit this warning to other users if you want to badly enough.

6. If this is a purely technical argument about the limitations of the product used in that one specific case, then let's have it.
by tsimionescu | 2025-08-19 15:08:20+00:00
For a given version, yes. But the security risk here is about publishing a new (malicious) version of a previously trusted package, by taking control of an expired domain.

Say I'm using mydomain.org/abc and it's a perfectly fine package. I'm currently using v1.25.7. Two months later, I see a new version of mydomain.org/abc, v1.25.8. I will likely update to it and use it relatively confidently. But, unbeknownst to me, mydomain.org's registration expired one month ago, and a malicious actor has grabbed it in the meantime; and they have now released a malicious version of this package. Nothing in Go's security model prevents this type of attack, except that Google's package "cache" (the package repo that Go downloads things from) can be configured by Google to not provide that malicious package.

This is a major design flaw with the silly idea of using an extremely imparmenent identifier - DNS names, which can only be leased for a limited time and are automatically auctioned off after they expire - as the main identifier for something as long lived as Go packages. No other package ecosystem has this terrible design concept - even when they do use DNS, they use it only for an initial authentication, not as the only identifier.

For example, in Java's Maven repo, to publish a package org.mydomain.abc from a Maven Central account, you need to prove that you have ownership of abc.mydomain.org once when associating this package. Afterwards, the package name remains associated with your Maven Central account, forever. If you lose access to that domain name and someone else obtains, they can't go through the same steps, Maven Central won't let them, since that package name is already tied to your account.
by AnotherGoodName | 2025-08-19 15:08:23+00:00
Yep and you can also just keep going with this to get to the Prime Number Theorem.

If you just consider odd numbers you know that at best only half of numbers can be prime. We've ruled out 1/2 of numbers.

If you then multiply 2 x 3 to get 6 you can state all prime numbers above 6 are of the form 6n + [1 or 5], everything else is a multiple of 2 or 3. We've now ruled out 1/3 more numbers in that remaining half we already ruled out above. Leaving 1/2 x 2/3 = 1/3 numbers possibly being prime (you could write this in a non-simplified form as 2/6 to match the count above).

If you then multiply 2 x 3 x 5 to get 30 you can state that all numbers above 30 are of the form 30n + [1,7,11,13,17,19,23,29]. The rest are multiples of 2,3 or 5. You've now ruled out another 1/5 of numbers from that remaining 1/3 above. Leaving 1/3 x 4/5 = 4/15 numbers possibly being prime (or 8/30 if you don't simplify the fraction to more clearly match what we counted above).

If you continue this you have a series that's multiplicative_sum( 1 - 1/p) of all primes so far. This function is called Euler's product formula and is the inverse of the famous Riemann Zeta Function (1/ζ(s)). This series converges to the Prime counting function https://en.wikipedia.org/wiki/Prime_number_theorem#Non-vanis... which you can intuitively understand from what i've written above.

Fwiw these patterns in prime numbers, or more specifically the gaps where numbers can't possibly be prime, are extremely well understood. They were first documented by Erasthosenes in BC times who used the above to quickly find new large prime numbers. While it's fun to look at patterns in primes and any enthusiasm should be encouraged i will take a moment to point out that mathematicians occasionally deal with lay people who think they've stumbled on some revelatory new thing by observing these well known patterns in primes. There's a myth that 'there's no patterns in primes'. But... that isn't true at all. We know there's patterns. It's the basis for prime number theory. It's been known for a few thousand years now.
by bilbo0s | 2025-08-19 15:08:31+00:00
Oh absolutely.

Every tax cut is a spending program in disguise.

I'm just saying that things like the Park Service are the least of the worries. To the extent that it makes people feel good, please, go ahead and make cuts to the Park Service. But that can't be the plan to restore good financial order. It takes wayyyy more than that if we're being honest.
by boleary-gl | 2025-08-19 15:08:48+00:00
Shitty AI bro here.

I would love to know if and how you disagree. I am (I thought obviously) making a jump here from her desire to make FLOW-MATIC human-readable. Also, I don't believe that AI will take developers's jobs, but I do believe a developer using AI will replace ones not using it...so I'm intentionally provocative there, yes.
by xarcolade | 2025-08-19 15:09:07+00:00
Hello! Sharing on HN is a first for me. When I wrote this I thought I was producing something with a steady enough on-ramp that someone could follow along with a little bit of sustained curiosity. After sharing it with some friends I realise it might still be a steeper/poorly constructed ramp than I initially thought. Either way I'd love to hear from you if you found this interesting!
by EdSchouten | 2025-08-19 15:09:40+00:00
Exactly! At the same time you also don't want to call into the kernel's internal malloc() whenever a thread ends up blocking on a lock to allocate the data structures that are needed to keep track of queues of blocked threads for a given lock.

To prevent that, many operating systems allocate these 'queue objects' whenever threads are created and will attach a pointer to it from the thread object. Whenever a thread then stumbles upon a contended lock, it will effectively 'donate' this queue object to that lock, meaning that every lock having one or more waiters will have a linked list of 'queue objects' attached to it. When threads are woken up, they will each take one of those objects with them on the way out. But there's no guarantee that they will get their own queue object back; they may get shuffled! So by the time a thread terminates, it will free one of those objects, but that may not necessarily be the one it created.

I think the first operating system to use this method was Solaris. There they called these 'queue objects' turnstiles. The BSDs adopted the same approach, and kept the same name.

https://www.oreilly.com/library/view/solaristm-internals-cor...

https://www.bsdcan.org/2012/schedule/attachments/195_locking...
by tapoxi | 2025-08-19 15:09:50+00:00
I've been using Zen for a few months after I lost faith in Arc/The Browser Company.

I like the workflow of swiping between profiles, vertical tabs and pinned favorites. I haven't been able to find a browser that works just like that.

I'd prefer to use Chromium over Firefox though, that's the only downside. I keep running into weird Firefox specific issues. Passkeys didn't work properly (and still won't support TouchID), pages don't render correctly, etc.
by JdeBP | 2025-08-19 15:09:54+00:00
Yes. RFC 2181 § 11 explicitly contradicts this report.

That said, I should point out that there is nowadays a loophole for special-casing labels that begin with underscore, called out by the SVCB document. The loophole does not allow for dropping the client requests, though.

On the gripping hand, all that this report boils down to is a rediscovery that if the queried server does not answer immediately, there's a window for an attacker with access to the path between client and server (or at least the ability to blindly route packets into that path with forged source addresses) to inject forged responses; that the message ID and random port number system is woefully inadequate for making brute forcing hard at even late 1990s network speeds; and that most of the mitigation techniques for forgery (including the PowerDNS one called out in this report) are useless if the attacker can see the query packet go by in the first place. The right answer is proper cryptography, not nonsense about punctuation characters that are supposedly "malformed".

Something we have known since 2002.

* https://cr.yp.to/djbdns/forgery.html

The DNS protocol is a terrible protocol. This report is not some novel discovery.
by gjsman-1000 | 2025-08-19 15:10:05+00:00
It's not quite that hard. Hypothetically, you have a digital certificate, signed by the government, for your VPN provider with a list of VPN endpoints. Your client presents that certificate to the ISP, unblocking ports in that specific instance, to those endpoints. Otherwise, all common ports are blocked, and anything that smells VPN-y gets throttled.

Alternatively, the UK could have a self-service whitelisting system, when a legal entity signs a contract stating that traffic inside the tunnel is also filtered, at the endpoints listed.

Also: The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it?
by birn559 | 2025-08-19 15:10:22+00:00
> In essence, it’s a century-old colonial project that is entirely inline with the 19th and 20th century European colonialism, with a supremacist idealogy at its core (ethnostate).

I don't think that's a proper characterization. Migration way strongly regulated back then. Only after WWII when the crimes of the Nazis became public, mass migration to the southern Levante were allowed. It's therefore not a colonial project, but driven by what happened at that time (Holocaust). Arabic/Muslim and other citizen are well integrated into society as far as I am aware so I am not convinced supremacist/ethnostate is a fitting description either.
by spicyusername | 2025-08-19 15:10:24+00:00
Anyone who regularly uses LLMs to produce code knows that vibe coding anything larger than a to-do app is not currently realistic.

Once your codebase reaches the size needed to solve actual business problems, the quality of the output varies wildly, the complexity of the prompts required to produce useful code increases, and the output code requires significant editing to actually integrate without bugs or errors.

My personal opinion is that for vibe coding to be viable as the complexity of feature requirements or the size of the code base increase, the specificity and complexity of the input prompt will eventually demand more from the engineer than just writing the code, since code is more specific by definition than natural language.
by al_borland | 2025-08-19 15:11:06+00:00
Not only in coin counting machines.

I've seen people on YouTube using the U-Scan at Walmart like a CoinStar. Apparently if you lift where the coin slot is you can dump in coins and it will process it all. If the total is more than your bill, it gives you the money back.

While I'm not sure about the refund of an overpayment, there are also the toll booths that have buckets to throw change into. Though most tolls seem to be electronic these days.