MurphyA/hacker-news huggingface dataset:
by tczMUFlmoNk | 2025-08-07 03:29:55+00:00
I think this means:

1. You go to evil.example.com, which uses this flow.

2. It prompts you to enter your email. You do so, and you receive a code.

3. You enter the code at evil.example.com.

4. But actually what the evil backend did was automated a login attempt to, like, Shopify or some other site that also uses this pattern. You entered their code on evil.example.com. Now the evil backend has authenticated to Shopify or whatever as you.
by bpt3 | 2025-08-07 03:31:40+00:00
> 20% of market capture does not cause homelessness

Right, which is why trying to link the two is misleading at best.

> there are many valid arguments that treating housing as an investment isn't a stairway to ending homelessness

Such as? We seem to agree that the existence of rental units isn't a cause of homelessness.
by mkureth | 2025-08-07 03:32:40+00:00
Yes, please repost. I just want more attention on the topic because I have witnessed how it has negatively impacted strong engineers and good people. I was excited when I saw your original blog post referencing the National Science Foundation research. I had conducted research into physical differences of the brain which result in filtering through the interview process, but it was great to read the scientific study confirming my research. I have more information on the project here: https://cinedapt.com/casting/computer-silenced/
by avibagla1 | 2025-08-07 03:33:44+00:00
https://github.com/words/an-array-of-english-words

using this, a combo of "covered enough" for the bit and easy to use

also, since i'm tracking every word (technically a better name for this project would be The Bluesky Corpus) all inflected forms are different words, which aligns with my thinking
by mike1o1 | 2025-08-07 03:34:04+00:00
A bit late but it’s been fantastic so far. I’m using it for a GraphQL backend so I haven’t tried with LiveView yet but I don’t think it’ll differ too much. I know Ash has their own changesets which might be a bit different, but can’t say for sure. In general Ash has a rough learning curve, but it helps a LOT for what I think Phoenix is missing or isn’t opinionated about which is the context layer. Ash basically builds that for you, and probably better and more secure than you can do yourself. The way I see it, a LiveView to display data might do something like MyContext.fetch_items(scope: socket.assigns.scope). All Ash does is derive those functions for you. So maybe you have MyDomain.fetch_items(actor: socket.assigns.user) But then if you want filtering, sorting, etc that’s all there for you, while you’d have to build that yourself with Ecto. But then did you remember to filter your joins to only retrieve the items the user is authorized to see? Sure, you can do that in Ecto, but it’s kinda just built in with Ash policies. I hope that helps - Ash doesn’t replace anything that Phoenix or LiveView offer (except maybe changesets are slightly different), it very much builds on top of it.

Edit to add, Ash is built on top of Ecto. The escape hatches are there, and easily accessed if needed. Ash.Query is very powerful and I haven’t needed any escape hatches on a small to medium sized project so far.
by iLemming | 2025-08-07 03:34:26+00:00
I have a similar but opposite experience. Since around 2015 I've mostly been working with people who primarily use Emacs. In 2014 I was the only weird one, then next team about 3-5, then a dozen, then there was a team of a few dozen where only two were using Vim. On my current team also most of the devs are Emacs users. However, a lot of people use Emacs with Evil-mode, so I guess they can be considered vimmers.

Also, I don't remember the last time when I worked with anyone who writes code and uses Windows.

Anecdotal experiences can lead to a warped understanding of reality; in mine, Windows and non-emacs users are niche.
by rpdillon | 2025-08-07 03:34:31+00:00
> Now that America has no manufacturing capacity

This is a meme that doesn't have any bearing in reality. The U.S. remains the world's second-largest manufacturer behind China, with real output reaching an all-time high of $2.5 trillion in 2021. Manufacturing's contribution to U.S. GDP in 2023 was approximately 10.2%, or $2.3 trillion.

The reason the meme persists, I think, is that fewer and fewer folks work in manufacturing, due to a massive increase in automation. In essence, the U.S. didn't offshore manufacturing as much as they automated it. So it seems to have disappeared from an employment perspective, even though in continues to drive the economy.

Automation has significantly boosted productivity and efficiency, enabling higher output, but it has also contributed to the long-term decline in manufacturing employment.

The notion that the U.S. subsists on "exploitative subscription services, lock-in and planned obsolescence" is, while part of the everyday consumer experience, not a good reflection of what is really driving the economy.
by immibis | 2025-08-07 03:34:36+00:00
Well, we had this at university. I think it's just running some protocol to sync user database (yp/nis/ldap/something) and amd to automount home dirs. You want to mount all home dirs on first access, not just who's logged in, unless you want to prevent people sharing files by Unix file permissions. Or mount the whole of /home, but then it has to go through one server.
by barrell | 2025-08-07 03:36:53+00:00
I don’t want human-like behavior or human like voices. Breathing, clearing throats, ums, giggles, coughs, singing — these all detract from the utility and contribute the the biggest societal problems LLMs pose (biggest problems according to the heads of the companies themselves).

If I have an emotionless natural language database that burns a tree for every question, I do not want to have to have small talk before getting an answer
by DecoPerson | 2025-08-07 03:37:03+00:00
The attack pattern is:

1) User goes to BAD website and signs up.

2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.”

3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email.

4) GOOD sends a one-time login code email to the user’s email address.

5) The user is very likely to trust this email, because it’s from GOOD, and why would GOOD send it if it’s not a proper login?

6) User enters code into BAD’s website.

7) BAD uses code to login to GOOD’s website as the user. BAD now has full access to the user’s GOOD account.

This is why “email me a one-time code” is one of the worst authentication flows for phishing. It’s just so hard to stop users from making this mistake.

“Click a link in the email” is a tiny bit better because it takes the user straight to the GOOD website, and passing that link to BAD is more tedious and therefore more suspicious. However, if some popular email service suddenly decides your login emails or the login link within should be blocked, then suddenly many of your users cannot login.

Passkeys is the way to go. Password manager support for passkeys is getting really good. And I assure you, all passkeys being lost when a user loses their phone is far, far better than what’s been happening with passwords. I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money.
by usr1106 | 2025-08-07 03:37:22+00:00
The joke goes: There are 3 kinds of people

The pessimist says: Finnish is too hard for an adult to learn, mission impossible.

The realist says: With 10 years of hard work, it's doable.

The optimist says: I can do it in 5 years.

Myself I was an optimist and I kind of did it in 5 years, but it was tight. However, after having spoken it daily for 25 more years I get more and more pessimistic: There are several aspects I will not master in this life.
by habryka | 2025-08-07 03:38:14+00:00
Interesting idea. Some thoughts:

I think the volume would really be a lot. For the program we'll be dealing with 900 (!) blogposts (30 residents times 30 blogposts). I doubt something with that volume would actually end up with many subscribers

Also, I would feel bad about splitting the audience of the authors. I feel like you really want to build your own audience early on.

And last, I am worried it would push people towards homogeneity. My ideal outcome from the whole project is that we will have a bunch of really very different blogs and essay writers find traction who share little of an audience, but add some important perspective to the world.
by immibis | 2025-08-07 03:38:15+00:00
I live in Germany. It's repressive as fuck. Not being repressive in the standard ways isn't the same as not being repressive. You can say you don't like the chancellor or the party all day long, but you can get arrested for even calling the P_________n situation a g______, for saying anything bad about any person (even if true), doing pretty much anything requires a government license, owner-operators have unlimited liability for everything their business does unless they jump through a whole bunch of hoops and put up a $25k bond, and the government still keeps a registry of where every Jew lives just in case they need that again.

Everything interesting mostly flies under the government radar. There's a lot of it.
by rich_sasha | 2025-08-07 03:38:34+00:00
1 mile = 1,000 [double] paces of 0.8m each = 1,600m

1m = 1e-10 times half-meridian from the North Pole to the equator, via Paris for a croissant, apparently.

So kind of a coincindence... But a very neat one. Meanwhile, ratio of adjacent Fibonacci numbers converves to some expression involving sqrt(5) which is approx 1.6
by oreally | 2025-08-07 03:41:25+00:00
> If a colleague engages in criminal fraud, do they have a rigorous philosophy about when and when not to do that? How do they behave towards the team? Is defrauding the company OK, over something they think they company shouldn't demand anyway, but they will still be honest and responsible towards their teammates? That would be very good to know.

I think the question you're really asking is whether or not they can be trusted down the line so that the system 'works'.

So here's the thing: You can never have a 100% guaranteed trust that someone is going to be doing as the company wills and wishes them to be, even if you have a written contract, and even if you shove a bunch of extra rules in it.

When it comes down to it, people will always have to look out for their best interests eventually, and having extra unneeded rules will push them to think transactionally, system and morals be damned. So the solution would be to treat them well enough to not have them think about it in the first place.
by sriku | 2025-08-07 03:41:35+00:00
The bun and other authors would probably do well to not repurpose already understood terminology. "Macros" are already understood to be code that produces other code. "Comptime" is a nice alternative, but bun's "macros" aren't macros in that sense.

We had sweet-js macros as a library many years ago but it looks like it went nowhere, especially after an incompatible rewrite that (afaik) remains broken for even basic cases. (Caveat: been a while since I looked at it)
by WalterBright | 2025-08-07 03:43:59+00:00
> How would you power it?

Given that the payload would be tiny compared to a generation ship, I expect the powerplant would be able to get it there much faster.

> Solar sail or nuclear?

Solar sail won't work outside the solar system.

> How big would the payload be?

We cannot build it yet. But I expect the technology to do it seems possible.
Can Local Contribution-Based Currencies Replace Crypto?
by mzk_pi | 2025-08-07 03:45:02+00:00
We’re developing a P2P protocol where currency is issued and extinguished based on actual contributions and trust — not ownership, profit, or competition.

It’s designed to avoid inflation, exclusion, and market closure by structuring value around verifiable action and shared trust, not speculation.

There are no gatekeepers. No centralized evaluation. No fixed market limits.

All definitions, structural proofs, and implementation principles are open on GitHub:

GitHub: https://github.com/contribution-protocol/contribution-protocol-project

We welcome feedback from engineers, economists, and anyone interested in post-capitalist design.

This structure is already in use in a local community. Do you think local currencies might hold more promise than cryptocurrencies?
by pavpanchekha | 2025-08-07 03:46:01+00:00
It's not an argument for longer roads or can kicking? The thesis is stated at the top: with 9 bit bytes we'd avoid a couple of bad numerological coincidence (like that the number of Chinese characters is vague but plausibly around 50k, or the population of the earth is small integer billions). By avoiding the coincidences we'd avoid certain problems entirely. Unicode is growing but we're not discovering another Chinese! Not will world population ever hit 130B, at least as it looks now.

If you think there's some equally bad coincidence go ahead and tell me but no one has yet. I think I do a good job of that in the post. (Also it's amazing you and maybe everyone else assume I know nothing except what ChatGPT told me? There are no ads on the website, it's got my name face and job on it, etc. I stand by what I wrote.)
by pandorobo | 2025-08-07 03:47:57+00:00
Specifically they are referring to synced passkeys (passkeys generated by services like Google password manager/1Password/Apple and are linked to that account).

Because these passkeys are stored in the Cloud and synced to your providers account (i.e. Google/Apple/1Password etc), they can't support attestation. It leads to a scenario where Relying Parties (the apps consuming the passkey), cannot react to incidents in passkey providers.

For example: If tomorrow, 1Password was breached and all their cloud-stored passkeys were leaked, RP's have no way to identify and revoke the passkeys associated with that leak. Additionally, if a passkey provider turns out to be malicious, there is no way to block them.
by sriku | 2025-08-07 03:48:49+00:00
A while ago, I implemented a signin approach that looks similar to this "send a link/code" mode but (I believe) can't be exploited this way - https://sriku.org/blog/2017/04/29/forget-password/ - appreciate any thoughts on that.

Btw this predates passkeys which should perhaps be the way to go from now on.
by deathanatos | 2025-08-07 03:49:36+00:00
I haven't actually seen these being used as passwords like TFA states; they're usually a form of 2FA.

If they actually are passwords, yes, my password manager is a better UX than having to fetch my phone, open SMS, wait for the SMS, like good grief it's all so slow.

(In the 2FA form, I'd prefer TOTP over SMS-OTP, but the difference is less there.)
by joegibbs | 2025-08-07 03:49:40+00:00
The environmental stuff is so overblown. Speaking of veganism? Eat a steak and that’s 10,000 litres per kilo! Combine that with the methane etc and you’d offset your year’s AI usage. Same with driving your car to the shops. Take the scenic route and that’s another years worth. It’s 10x more than a google search because a google search was basically nothing in the first place.
by BobbyTables2 | 2025-08-07 03:49:41+00:00
I really don’t understand lobbying.

Does $400k over 5 years really change a governor’s behavior?

(Have neither love or hate of Newsom besides the horrible hairstyle)

Surely there is some sort of longer term play after office?!?

Otherwise the 1 million affected people could donate $10 each and control their destiny?
by duskwuff | 2025-08-07 03:50:43+00:00
What's especially funny about the names in Noita is that a lot of them are Finnish colloquialisms or jokes, e.g.

- Hämis (little spider) is "spidey", like a childish nickname - Ukko (lightning mage) is "old man" - Stendari (fire mage) is "cigarette lighter" (slang) - Stevari (holy temple guardian) is "mall cop" (slang)
by somenameforme | 2025-08-07 03:51:03+00:00
And the enemy is using the exact same thing against you. Yet infantry will remain critical for claiming territory, clearing areas and more. As drones advance, war will probably become even bloodier. And drone operators that survive are already coming home completely broken men suffering from extreme PTSD.

Then factor on top of this logistics. You need to transport men, keep them fed, equipped, and more. You need to move a massive amount of stuff constantly in war, yet drones are going to be buzzing everywhere. So I think we're seeing the future of war now - slow, grueling, bloody wars of attrition.

And war where high prices tags are replaced by high costs in stuff, making it more apparent than ever that economies maximized through financial games and services are paper tigers when facing economies based on the production of tangible things.
by canucker2016 | 2025-08-07 03:52:03+00:00
One story I remember reading was about the high quality and robustness of Compaq hardware. [Web search sucks these days so google and bing can't find the story]

The story goes that the floppy disk drive for Compaq computers was rated for a very high number of floppy disk insertions and ejections. More insertions/ejections than were possible unless one was doing nothing but inserting and ejecting floppy disks all the time.

So the exec selected a lower-rated floppy disk drive, saving a bunch of money.
by 8organicbits | 2025-08-07 03:52:38+00:00
> So if you’re going to be writing a database-backed web application in Python, and you’re not doing Django, you are almost certainly going to be using SQLAlchemy.

I've preferred the Django ORM over SQLAlchemy, but I'm curious what others feel. I've gone so far as to use Django ORM for non-web projects as well. It takes a bit of work to extract though. If Django ORM had a better stand-alone story, I think more people would use it.
by jjani | 2025-08-07 03:53:03+00:00
This is what I was referring to, and we already have seen this happen in the wild with PayPal at one point (possibly still) blocking passkeys from e.g. Firefox. For now the argument against this seems to be that "Apple zeroes this out so service providers can't do it without risking issues for their many users who use Apple to store their keys", but clearly this is so precarious of a situation it may as well not be a thing. You can't depend on one trillion-dollar company not changing their minds on that tomorrow.
by WalterBright | 2025-08-07 03:53:58+00:00
I rewrote my Empire game in PDP-11 assembler, long ago:

https://github.com/DigitalMars/Empire-for-PDP-11

but I have little knowledge of how the CPU works internally. One could learn the -11 instruction set in a half hour, but learning the AArch64 is a never-ending quest. 2000 instructions!
by bccdee | 2025-08-07 03:54:03+00:00
I have beavers in my area too—I'm well aware that dammed lakes are their own rich ecosystems full of niches for other species to thrive in. The comparison was deliberate: There's no reason why humans shaping the environment has to be a bad thing. Obviously the way we're doing it now is bad—I'm not disputing that—but we could simply do it well instead.

Of course, when species are destructive to their environments, that's natural too. Consider the mass extinction caused by cyanobacteria back when they first evolved. It's not "nature" we want, it's biodiversity and healthy ecosystems. Shrinking the human population to 500M might feel "natural" to some people, but it really has little to do with our actual environmental goals.
by max__dev | 2025-08-07 03:54:17+00:00
The following is copied from wikipedia.

The authentication factors of a multi-factor authentication scheme may include: 1. Something the user has: Any physical object in the possession of the user, such as a security token (USB stick), a bank card, a key, a phone that can be reached at a certain number, etc. 2. Something the user knows: Certain knowledge only known to the user, such as a password, PIN, PUK, etc. 3. Something the user is: Some physical characteristic of the user (biometrics), such as a fingerprint, eye iris, voice, typing speed, pattern in key press intervals, etc.

Email and phone are both in category one, comprising only one unique factor.
by __rito__ | 2025-08-07 03:55:49+00:00
> MOOCs never achieved the transformative potential promised during the early hype.

I don't get this gloom and doom about MOOCs.

A substantial amount of people have transformed their lives by learning from MOOCs. I am one of them.

It’s not the usual suspects like, "people don't have self-discipline", "one learns much more in university", etc. that have limited the perceived influence of MOOCs. It is pure credentialism that is behind MOOCs not reaching their full potential.

Everyone is all about skills untill the hiring time comes. Now companies want the students of the best colleges, the best degrees, etc. Students with proper skills might not even get through the door without the proper degree.

I did projects with skills that I learned via MOOCs, I answered questions in interviews with the knowledge that I started getting from MOOCs. But it was my Master’s in CS which ultimately mattered in my getting interviews. In that degree, they still teach GOFAI, "soft computig", and fuzzy set theory, "expert systems", and more things from the 80s.

MOOCs matter, MOOCs are loved and studied by a serious set of students and professionals. But they still can't get you interviews for most roles in most companies. In frontier AI labs, they are now basically treating PhDs as the minimum qualification for most roles.

MOOCs + projects + self-directed learning, even if you are very good, offers you little in terms of career opportunities. That's why they have not been apparently "transformative".

I know the arguments about making hiring easier for companies, etc.
by wkat4242 | 2025-08-07 03:57:34+00:00
Yeah me too, though in college. There was even a program called "xbl" (or "blast" on some platforms) that would turn your mouse pointer into a crosshair and when you clicked somewhere it would make a round hole in the window. Which wouldn't go away until you killed the app. In fact they could even stay after it quit! It was so funny. https://man.freebsd.org/cgi/man.cgi?query=blast&sektion=1&ma...

Also running xfishtank on someone's root window. So many things you could do.
by jnaina | 2025-08-07 03:58:34+00:00
I remember going to the huge Compaq Singapore factory in Yishun in 1992, which had around 1600 employees, to assess if we can take over the support of their Banyan Vines system, as a junior engineer. 7 years later, in 1999, they laid off everyone and closed the factory, which supplied 90% of Compaq's PC boards worldwide.

Compaq's CEO at the time of the Compaq downsizing and eventual acquisition, Michael Capellas, is now the advisor to the company I work for. And the man who sold the Banyan Vines solution to Compaq in the 90's is now my boss.
by robertritz | 2025-08-07 03:59:40+00:00
MOOCs have always given value to a certain group (about 3% of people who are motivated to self learn) and are basically useless for everyone else. Which is why they are primarily virtue signaling devices to fluff your LinkedIn.

When I started learning to code for data science I appreciated the lectures and examples. Once you reach a certain technical level these MOOCs aren't really helpful though.