MurphyA/hacker-news huggingface dataset:
by PhilipRoman | 2025-08-06 18:35:12+00:00
Slightly off topic but we need to normalize the ability to patch external dependencies (especially transitive ones). Coming from systems like Yocto, it was mind boggling to see a company bugging the author of an open source library to release a new version to the package manager with a fix that they desperately needed.

In binary package managers this kind of workflow seems like an afterthought.
by 542354234235 | 2025-08-06 18:35:22+00:00
It reminds me of optical illusions. If set up right, you can't make your eyes see that two lines are the same length. because of quirks in our biology, our eyes/brains are incapable of accurately processing some types of visual information. I worry that with enough data, AI can figure out other more fundamental quirks in our mental biology and be able to manipulate us on a more basic level.
by throwup238 | 2025-08-06 18:35:53+00:00
I’m pretty sure this article is out of date, or at least the lab they interviewed is. The latest Bruker TOF quadrupole ion trap mass spec is able to sample (tens of?) thousands of ion or m/z datapoints per minute with an optional electrospray ionizer that can handle 100s of kilodaltons so that’s no longer the bottleneck for most proteomics. Actually discriminating charge ratios and data analysis now is.

However I don’t think many academic labs have those mass specs because CROs and pharmaceutical companies have been buying out Bruker’s entire production line and running them almost 24/7 to analyze samples from clinical trials. Since they’re limited in how much blood they can draw per patient, those mass specs significantly expand the number of analytes they can test for and they’re willing to pay serious money for that.
by EA-3167 | 2025-08-06 18:35:59+00:00
The way the narrative around the nuclear bombings of Japan has formed is really upsetting and frankly infuriating. A long article full of impressive and emotive pictures, and the entire acknowledgement that Japan had done anything that might have required bombing them is boiled down to:

> The Japanese empire’s bloody march through Asia was over. But the impact on civilians lingered, both in the countries the Imperial Japanese Armed Forces had invaded and at home, where a nuclear Armageddon had come twice.

They killed 3,000,000+ people in their invasion of China alone! They butchered people for the sake of butchering them, starved many more, used humans as test subjects like the Nazis, dropped "plague bombs" on Manchuria... there's a reason that Korean, Chinese, and Filipino people still often have strong feelings about Japan. Japan has also had a "struggle" with coming to terms with their guilt in these matters, avoiding "small issues" like memorializing war criminals, and accepting what they did.

The article and most accounts focus on the terror and the horror of the bombs, while somehow missing that conventional firebombing (i.e. of Tokyo) was both more deadly and just as horrific. The need to create a specific "the nuclear attacks were inhuman, inhumane, horrific, special" is ultimately self-serving and often used as deflection from self-examination.

The article and most accounts also ignore why the US government undertook both the conventional and nuclear bombings: Because in the end an estimated 25,000,000 human beings died in the Pacific Theater, in the context of an overall war (all theaters) of more than triple that number. The prospect of continuing to go island-hopping at tremendous cost to human life just so that the Imperial Japanese leadership didn't have to surrender was a non-starter. An alternative existed, strategic bombing, and part of that ended up being nuclear.

Another issue with the narrative as written is that it's framed as entirely an attack on civilians, focuses on their experiences and ignores why the cities in question were chosen, what industries existed in them, and what their role was in the war. Putting this together with the rest and it's increasingly hard to see this pattern as something other than historical revisionism. The same contortions aren't required when discussing what happened to Berlin or many German cities for example, because their horror is understood to have served a purpose and/or been the result of actions taken by the Germans themselves.

To be clear, none of this is to deny the suffering of civilians in Hiroshima or Nagasaki, or Tokyo or Dresden or Berlin... all of that is very real and deserves to be a part of the history we discuss, part of the horror of the war. BUT NOT LIKE THIS. Not as the centerpiece, not in a way that confers a kind of passive victimhood on Japan and its people.
by apple4ever | 2025-08-06 18:36:00+00:00
Imagine you hear a sound late at night and you are sleeping. You can check the cameras and see if anyone is inside.

Also, we use them for kids and cats - keep and eye and find out what happened. In fact for our one cat we heard a sound and we were able to see she fell off a desk and was hurt. So we could help her immediately.
Show HN: I Built No-Code Documentation Builder
by uaghazade | 2025-08-06 18:36:10+00:00
as a solo builder i was struggling to create docs for all my saas projects. there aren’t many good options out there. open-source ones and mintlify all require code, and that takes too much time. i tried doing it in notion but it never looked like proper docs and didn’t feel professional. gitbook is the only one left and like mintlify, its pro plans are too expensive for a solo maker.

so i built NoDocs.io . its nocode docs builder. you can create docs for your saas or project even with a free plan using the built-in nodocs subdomain. it only shows a small nodocs branding for reach more people.

other plans includes unlimited projects, pages, custom domain, and searchable docs.

you can try it free and if you have feedback i’d love to hear.
by JoshTriplett | 2025-08-06 18:36:18+00:00
My dotfiles have a massive .gitignore in them for all the things I don't want to share, or can't easily divide into shareable and non-shareable. The largest section in my .gitignore is:

# Some transient, some configuration files, but configuration files get written # out every time, and not just the changed values. Some also contain # machine-specific configuration, and private data.

It includes things like .config/libreoffice , which is a baffling combination of:

- backup copies of documents (which should go elsewhere)

- copies of icons from the icon theme (which should go elsewhere)

- log files (which should go elsewhere)

- piles of binary pack files, probably containing a mix of things

- configuration in XML form (potentially useful to version), but with embedded lists of recently opened files (private, should go elsewhere), including base64-encoded thumbnails.
Ask HN: Did you find any job boards not flooded with spam?
by tss93 | 2025-08-06 18:37:00+00:00
Hi HN,

Did anyone find a platform that is not overwhelmed with bots?

I am a product manager, and the moment I see the job (posted 1-2 hours ago) it already has 100 applications on LinkedIn. And I believe the same is true for all the lever/greenhouse ATS systems.

I am genuinely trying to apply only to relevant jobs, but it feels like I outcompeted by bots.
by adamiscool8 | 2025-08-06 18:37:05+00:00
All of these points are irrelevant. If you have the data that shows 99.5% win rate, you would have the data on your expected win size, and could compute a fixed loss stop that would keep you on-side. In the example, which I'm assuming must be hyperbolic, your average win would only need to stay >1/199th of your average loss. I would agree that if a person cannot manage their positions to this, that person should stick to investing.
by diggan | 2025-08-06 18:37:21+00:00
> filtered data. i.e. it have never seen anything that is unsafe, ever

I don't think that's true, you can't ask it outright "How do you make a molotov cocktail?" but if you start by talking about what is allowed/disallowed by policies, how examples would look for disallowed policies and eventually ask it for the "general principles" of how to make a molotov cocktail, it'll happily oblige by essentially giving you enough information to build one.

So it does know how to make an molotov cocktail, for example, but (mostly) refuses to share it.
by evilduck | 2025-08-06 18:37:24+00:00
Meta seems to have now stepped out of the running despite being the local LLM catalyst. Anthropic has done nothing. IBM's Granite and Microsoft's Phi are both very far behind. AWS doesn't even attempt to compete. Grok failed to make good on their promise. OpenAI only even entered the game yesterday so it's hard to tell if they're actually serious since they released such an overly censored model that isn't really better than Qwen options and at its smallest still requires a decent computer. Google seems to be the only domestic contender on the level of what Chinese companies are doing and they're being very careful to not cannibalize Gemini with Gemma.

Right now though China is dropping huge improvements across the entire spectrum of model sizes with Qwen, Kimi, DeepSeek, GLM, and Yi. We've also got Mistral doing competitive self-hosted models too, but they're French. Local AI tooling is plainly _not_ being driven forwards by the United States.
by NoMoreNicksLeft | 2025-08-06 18:37:28+00:00
>I would think that those who claim that git is a good tool for an environment completely unlike software development

Laws consist of strings of characters in a particular sequence, occasionally you don't want to be additive but subtractive, and these sequences are grouped into multiple papers. It's just code. Code on paper, but code nonetheless. They can't easily check what the previous version was, or compare two or more different branches. Lots of strike-throughs and other such crap.

Many of the defects in legislation and the legislative process itself stem from how they try (so desperately) to keep it from being like code. Trying to hide who edited what and when. Fuck, Congress has this big long drawn out process for reconciling two slightly different versions of the same piece of code... with every single act. You've simply never considered this.

>But sure, lets change the entire legislation workflow to

I wasn't changing any workflows. I was just going to dump existing legislation into a repo so I could see what it would look like. Not sure what you're reading into this. You're stomping on an experiment that someone was going to run for free in a way that didn't interfere with you and ridiculing the idea in casual conversation.

>and doesn't even normally use text-files

It's text. On a "file" (which is what we called bundles of associated paper back before computer filesystems, they'd put them in a filing cabinet).
by BizarroLand | 2025-08-06 18:37:38+00:00
Do what Linus Tech Tips has done (when they're doing it right): report that they got the device, tested it for a while, and it broke, so what they currently know about it is not the full picture, and that they might revisit the product when they have confirmed that they've worked out the kinks with the device in question.

Easy
by simoncion | 2025-08-06 18:37:39+00:00
In the Windows 95 days (and probably in the Windows 2000 days, and maybe also today) "all" a screensaver was was an .exe renamed to -if memory serves- .scr.

There may have been some special interface that the program being run was expected to conform to so the screensaver subsystem would invoke it, but (IIRC) a screensaver could do anything an ordinary program could do. (That was the big reason for being cautious about where/who you got your screensavers from.)
by turblety | 2025-08-06 18:37:49+00:00
Why has Google totally overcomplicated their subscription models?

Looking at "Google AI Ultra" it looks like I get this Jules thing, Gemini App, Notebook, etc. But if I want Gemini CLI, then I've got to go through the GCP hellscape of trying to create subscriptions, billing accounts then buying Google Code Assist or something, but then I can't get the Gemini app.

Then of course, this Google AI gives me YouTube Premium for some reason (no idea how that's related to anything).
by agentastic | 2025-08-06 18:37:58+00:00
Codex/Jules are taking a very different approach than CC/Curser,

There used to be this thesis in software of [Cathedral vs Bazaar](https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar), the modern version of it is you either 1) build your own cathedral, and you bring the user to your house. It is a more controlled environment, deployment is easier, but also the upside is more limited and also shows the model can't perform out-of-distribution. OpenAI has taken this approach for all of its agentic offering, whether ChatGPT Agent or Codex.

2) the alternative is Bazaar, where you bring the agent to the user, and let it interact with 1000 different apps/things/variables in their environment. It is 100x more difficult to pull this off, and you need better model that are more adaptable. But payoff is higher. The issues that you raised (env setup/config/etc) are temporary and fixable.
by beefnugs | 2025-08-06 18:38:12+00:00
So are there just 100 developers sitting in the edge of their seats constantly refreshing all the spy reports from other AI companies, waiting to copy the exact same idea and shit it out at top speed?

Or is it more of a vibe code thing where every new feature from everyone is recreated by every other company in a matter of days?

Do they even realize they are destroying their own industry economics? The only reason anyone uses big tech is because there are no alternatives
by lrvick | 2025-08-06 18:38:26+00:00
It is absolutely not alarmist. Seriously, go apply to be a Homebrew developer right now under an alias, make some useful updates for a few months, then submit a PR as another alias, and approve and merge your own changes from the first alias. After you get away with skipping code review a few times, now go switch a popular package that relies on abandoned sources to point to your fork that makes a few legitimate updates.

Now in a few months make an update that compromises the random number generator on every brew users laptop making it easy to covertly intercept and manipulate the traffic of any target however you want. Maybe for less chance of getting caught, target sysadmins or release engineers by targeting a niche tool many of them use and wait until they publish new ssh keys to github (which are always public!), that you can re-generate the private keys of since you know about their compromised entropy. Check for public dotfiles of your targets to pick the right niche tool. Now go collect database dumps or crypto from a pile of major companies. Easy money if you do not have ethics.

Seen these attacks in the wild many times, some at close range. A bored teenager could do this, and in fact attacks like this happen every day. And everyone just says pointing it out is "alarmist". People used to defend lead paint and asbestos too. Survivors bias is a hell of a drug.

I have done supply chain attacks along the lines of the above myself to prove the risk is very much real to my clients. It is expensive to fix so wanting the risk to be overstated is understandable, but it is actually super easy. Sometimes you can even get away with buying the expired email domain of a inactive maintainer so you can easily just take over their identity. Done this twice and I am no state actor.

Nix, by the way, is hash pinned, but you just blindly update those hashes when there are updates, right? Their code submission process is as yolo as Homebrew. Any rando can push whatever they want without multi-party code signing. I am the one that submitted the RFC to nix to fix this which was rejected as in the end they admitted they want a hobby distro and do not want the overhead and rigor needed for professional targeted environments.

This is why I was forced to abandon nix and get all my clients to abandon it, in favor of StageX which even as the founder I have no control of. It mandates deterministic builds and cryptographic signing by at least two well known keys of maintainers.

We do not point out risks unless there are solutions to mitigate them.
by mikehotel | 2025-08-06 18:38:29+00:00
The performance improvements are impressive:

> In Automerge 3.0, we've rearchitected the library so that it also uses the compressed representation at runtime. This has achieved huge memory savings. For example, pasting Moby Dick into an Automerge 2 document consumes 700Mb of memory, in Automerge 3 it only consumes 1.3Mb!

> Finally, for documents with large histories load times can be much much faster (we recently had an example of a document which hadn't loaded after 17 hours loading in 9 seconds!).
by Alupis | 2025-08-06 18:38:31+00:00
Some highlights from this release are listed here[1].

The best part of Gleam in my opinion is the language's design. It's just so elegant to read and write. Take this example code snippet from the release notes:

pub fn find_book() -> Result(Book, LibraryError) { case ask_for_isbn() { Error(error) -> Error(error) Ok(isbn) -> load_book(isbn) } }

It's a trivial code snippet, but I'm finding this kind of "first class" pattern matching produces very readable, elegant-looking, well organized code.

There was a discussion the other day about the pipe operator being added to PHP 8.x. Gleam was my first language which included a pipe operator. Now, having used it a bit, I feel every language should have something like it.

pub fn hello_test() { telephone.ring() |> should.equal("Hello, Joe!") }

The pipe skips so much boilerplate and clearly communicates intent. Absolutely love it.

[1] https://gleam.run/news/no-more-dependency-management-headach...
by hn_throwaway_99 | 2025-08-06 18:38:37+00:00
> Y'all act like the administration didn't rename the Gulf of Mexico like it changes the physical gulf or ownership status. Or direct museums about how to portray history...

No, we aren't. Those are two different things - heck, I literally said "which, to be clear, I think the current US administration has done or at least attempted to do", and I was referring to specific instances of stuff like this, https://www.npr.org/2025/02/05/nx-s1-5286299/nsa-museum-dei-....

My whole point is that raising your pitchforks over obvious clerical errors makes it that much harder to identify real attempts of deception. I think tptacek hit the nail on the head with his "I think you may be arguing with people who are disappointed that this is benign" comment.
by maleldil | 2025-08-06 18:39:07+00:00
> Are libraries typically designed to accept an optional input to store potential errors?

Yes. Stdlib's JSON module has a separate diagnostics object [1]. IMO, this is the weakest part of Zig's error handling story, although the reasons for this are understandable.

[1] https://ziglang.org/documentation/master/std/#std.json.Scann...
by maxmcd | 2025-08-06 18:39:13+00:00
For what it's worth I think Go's MVS somewhat meets the desire here. It does not require lockfiles, but also doesn't allow use of multiple different minor/patch versions of a library: https://research.swtch.com/vgo-mvs

I believe Zig is also considering adopting it.

If there are any dependencies with the same major version the algorithm simply picks the newest one of them all (but not the newest in the package registry), so you don't need a lockfile to track version decisions.

Go's go.sum contains checksums to validate content, but is not required for version selection decisions.
by brokencode | 2025-08-06 18:39:24+00:00
And if they jack up their prices, then it’s a greater incentive for other players to build their own capacity.

This really isn’t that hard of a concept. There is no barrier other than access to capital. Nvidia and Dell will sell to anybody.

The major players will always be competing not only with each other, but also the possibility that customers will invest in their own hardware.
by nonameiguess | 2025-08-06 18:39:25+00:00
Not advocating for or against, but US federal information systems have a very specific way of dealing with the possibility of data leaks like this. It clearly isn't perfect and non-classified data is breached electronically all the time. To my knowledge, no classified system has ever been breached remotely, but data can be and is exfiltrated by compromised or malicious insiders.

In any case, data at impact-level (IL) 2-4 is considered sensitive enough that it has to reside at least in a FedRamp certified data center that is only available to the government and not shared with any other tenants. IL5 also has to have access gated behind some sort of smart card-based identify verification system in which human users can only have credentials issued in-person after being vouched for by an agency sponsor. Anything higher-impact than that is classified and kept on completely segregated networks with no two-way comms capabilities with the public Internet. Top-secret networks are also segregated physically from secret networks. The data centers housing classified data are all located on military installations.

It doesn't mean by any stretch there are no concerns or even that none of your specific concerns are wrong-headed, but it at least means OpenAI itself is never going to see classified data. They don't provide the level of detail needed to know how they're implementing this in a press release, but my sense reading this is that there is no self-hosted version of ChatGPT available for IL5 or classified networks, so this is apparently providing access to workstations connected only to public networks, which are already not allowed to store or process higher-IL data.

It might still make it possible for workers to copy in some level of PII that doesn't reach the threshold to qualify for IL5, but the field is evolving so rapidly that I doubt anyone on Hacker News even knows. CMMC 2.0 compliance requirements are only going into effect later this year and are a pretty radical departure and far more strict than previous certifications that information systems needed to process government data of any kind. Anybody speaking to what the requirements or restrictions are from even just a few months ago are already out-of-date and that includes me. I'm talking about restrictions as I knew them, but they'll be even more restrictive in the very near future.
by inanutshellus | 2025-08-06 18:39:47+00:00
... to follow myself up...

I went ahead and looked in my .vimrc and lo and behold there's a "security issue" in it:

if $USER != 'root' " Modelines let you specify format rules for a file within the file set modeline modelines=5 " e.g. "// vim: tabstop=20 : shiftwidth=20" (or something actually reasonable) else " They can be a security vulnerability (unlikely) so we don't enable for root set nomodeline endif

... so yeah... I guess there's some concepts worth being extra sensitive about... but even still, surely y'all can handle this stuff.
I built an Android app, how do I gauge if I am too expensive or not?
by menes58 | 2025-08-06 18:39:50+00:00
Hi, I built an Android app and released it. People are downloading but not subscribing. There is no free trial but there is a 30-day money-back guarantee.

The thing is I have very little data. It is new, I cannot market it efficiently, yet.

How do I know if it is too expensive? Like how many people downloading but not subscribing, despite the launch video and money back guarantee is enough to know that it is too expensive?