MurphyA/hacker-news huggingface dataset:
by znpy | 2025-08-26 14:12:49+00:00
Don't take this as a snarky comment, but that sounds quite literally as "skill issue". Not in you personally, but in the environment you work in.

> PKI isn’t a solved problem.

PKI is largely a solved issue nowadays. Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips) let you create a cryptographically-strong CA and build the automation you need.

It's been out for years now, integrating the root CA shouldn't be much of an issue via group policies (in windows, there are equivalents for mac os and gnu/linux i guess).

> Just because someone’s homelab is fully cert’d through Caddy and LE that they slapped together over a weekend two years ago, doesn’t mean the process is trivial or easy for the masses.

Quite the contrary: it means that the process is technically so trivial the masses can do it in an afternoon and live off it for years with little to no maintenance.

Hence, if a large organization is not able to implement that, the issue is in the organization, not in the technology.
by IAmBroom | 2025-08-26 14:12:53+00:00
> Whether deportation of aliens based on their speech is constitutional is unsettled.

Is it? That would suprise me. The First Amendment does not mention citizenship:

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances."

If free speech of aliens were not protected, neither would their practice of religion. "Americans can be Catholics, but we won't let any non-American Catholics in. We have enough of them."
by rickdeckard | 2025-08-26 14:14:21+00:00
I frankly look forward to see whether the US will actually CARE how Intel will conduct its business, instead of simply trying to just reap benefits from it.

Everything can for now be put under the umbrella of "US semiconductor sovereignty", but actually making this happen involves much more strategic planning and investment from the government.

For example, I doubt that Intel has sufficient experience as a foundry to support design-finalization for ARM, they are JUST starting NOW with this.

So who will pay for closing such gaps? Would they force e.g. Apple to use Intel as foundry and swallow all the associated cost, or would they rather accept Apple to source from a TSMC fab (which is built in US for the big customers like Apple and nVidia)
by tpoacher | 2025-08-26 14:14:24+00:00
> all sales come from a sense of urgency

all coerced sales come from a sense of urgency. Not the same thing.

> That doesn't mean that urgency has to come from a place of in-authenticity

In-authenticity is a subjective term here, but are there competing incentives against offering a "use only once" price alongside the full product or a subscription model? You bet.
by RickJWagner | 2025-08-26 14:14:46+00:00
Not in my household.

I recently retired, one of my pastimes is reading. My wife has been a voracious reader already, so we’re getting some good quality reading time.

The best discovery: instead of going to Goodwill to find good books, I’ve been using our local library’s online services. ( Libby and Hoopla. ) These provide an endless supply of reading material, all stored neatly on my iPad and with adjustable fonts and background. This is a golden age of leisure reading!
by sleepyguy | 2025-08-26 14:14:50+00:00
Imagine a 12 year old who thinks they know everything. Their attention span can be measured in seconds and every time they they see something shiny they go into a daze or on a tangent. This is the Presidency of the USA at the moment. He lacks any coherent thought or strategy. Even those he has placed in powerful positions are in over their heads (Tulsi, Hegseth, etc).

I see China as a threat and in no way side with them but, my take is he can threaten China as much as he wants, yeah they've got problems but they also can respond. Can you imagine if they stopped selling the chemicals required for the pharma industry to India and others? Half the US would drop dead in about 6 months. If I were them, I would encourage his 200% tariff that Americans would end up paying for. Lets see how it works out for Trump.

We are on the cusp of the tariffs already in place starting to bite, for wealthy people it won't matter, but for the middle class and poor it is going to suck.
by tialaramex | 2025-08-26 14:14:51+00:00
This is what fascinated me too.

FWIW the idea of inspecting the certificate "for typos" or similar doesn't make sense. What you're getting from the CA wasn't really the certificate but the act of signing it, which they've already done. Except in some very niche situations your certificate is always already publicly available when you receive it, what you've got back is in some sense a courtesy copy. So it's too late to "approve" this document or not, the thing worth approving already happened.

Also the issuing CA was required by the rules to have done a whole bunch of automated checks far beyond what a human would reasonably do by hand. They're going to have checked your public keys don't have any of a set of undesirable mathematical properties (especially for RSA keys) for example and don't match various "known bad" keys. Can you do better? With good tooling yeah, by hand, not a chance.

But then beyond this, modern "SSL certificates" are just really boring. They're 10% boilerplate 90% random numbers. It's like tasking a child with keeping a tally of what colour cars they saw. "Another red one? Wow".
by simonask | 2025-08-26 14:14:55+00:00
It's pretty clearly an attempt to establish a clear chain of trust. If you are making a malicious app, the first thing you want to do is hide your identity. It is incredibly important that users can know whose code they are running, and who is responsible for the behavior of the malicious app that destroyed their life.

I can't say whether the specific implementation will be an improvement, but that is clearly the intent.

Meta and Google have not shown themselves to be "malicious" in sense that is relevant to this discussions. Whatever shady practices they may or may not have is very likely entirely within the law, and they are strongly motivated to protect people's personal data, because they will not have users (i.e., their product) if their platforms are insecure.
by micromacrofoot | 2025-08-26 14:15:22+00:00
That's the premise of neoliberalism, you need globalism or the entire idea of capitalism falls apart and every domestic company becomes a crab in a bucket... trying to recapture that lost value with nationalism won't work within the span of political term limits, they're trying to undo something that's been happening for 50 years... we literally don't even have the underlying infrastructure for re-shoring, basics like getting electricity where it needs to go become a problem
by stego-tech | 2025-08-26 14:15:24+00:00
There’s a number of reasons, all of which in concert create the appearance of a performance gap between the two:

* Apple has had decades optimizing its software and hardware stacks to the demands of its majority users, whereas Intel and AMD have to optimize for a much broader scope of use cases.

* Apple was willing to throw out legacy support on a regular basis. Intel and AMD, by comparison, are still expected to run code written for DOS or specific extensions in major Enterprises, which adds to complexity and cost

* The “standard” of x86 (and demand for newly-bolted-on extensions) means effort into optimizations for efficiency or performance meet diminishing returns fairly quickly. The maturity of the platform also means the “easy” gains are long gone/already done, and so it’s a matter of edge cases and smaller tweaks rather than comprehensive redesigns.

* Software in x86 world is not optimized, broadly, because it doesn’t have to be. The demoscene shows what can be achieved in tight performance envelopes, but software companies have never had reason to optimize code or performance when next year has always promised more cores or more GHz.

It boils down to comparing two different products and asking why they can’t be the same. Apple’s hardware is purpose-built for its userbase, operating systems, and software; x86 is not, and never has been. Those of us who remember the 80s and 90s of SPARC/POWER/Itanium/etc recall that specialty designs often performed better than generalist ones in their specialties, but lacked compatibility as a result.

The Apple ARM vs Intel/AMD x86 is the same thing.
by Esrbwt | 2025-08-26 14:15:25+00:00
Creator here. With the SEC and EU mandating real-time, immutable audit trails for AI after the recent Nasdaq crash, I saw a critical need for a simple, open-source standard that anyone can implement. This is a proof-of-concept for a hash-chained log. The idea is to create a deterministic "proof-of-process" for any AI decision. The next step is to integrate zk-STARKs so companies can prove their AI's integrity without revealing the proprietary models or sensitive data. The GitHub repo is linked in the article. Happy to answer any questions and looking for feedback/contributors.
by dpoloncsak | 2025-08-26 14:15:57+00:00
I have two old iPads and an old iPhone in my stack.

The iPads are HomeAssistant Dashboards for me. One connects to a VNC server on the HA host, as the browser is too outdated to properly display the dashboards. The other uses the HA app, and can render just fine.

The iPhone is jailbroken, and used as an AirPlay relay server. Connected via Bluetooth to a speaker, MusicAssistant keeps the audio from the aux on my Mac Mini and the audio streaming to the iPhone in sync, creating surround sound audio.
by bananapub | 2025-08-26 14:16:00+00:00
ah, classic HN, flagged already!

some psychopaths stole a lot of personal data from the US federal government, and we don't know who took it, what they took, what they did with it, or why.

but don't worry, that's Politics, and so we should just ignore the crimes being done in public and talk about how we can enrich the technofascists who might give you some equity if you work hard.
by aperi | 2025-08-26 14:16:12+00:00
Hey hackers!

I'm building a wearable AI for IRL note-taking (now) and voice-control AI (soon) called Rice.

We use SLMs to process the data offline (hence no subscription etc. for now). We are opening our pre-orders and I was curious to see if anyone here wanted it.

I'm building it for doctors and consultants (doctors are a bit later focus tbh) who spend a lot of time meeting clients in person and then getting back home / office to jot down notes.

Seen it first hand so building this. Any support is hugely appreciated <3
by 9dev | 2025-08-26 14:16:16+00:00
> […] that restarting/redeploying/renewing as less as possible is the best way to go instead of fixing the root issue that makes restarting/redeploying/renewing a pain in the ass.

I mean… There's a tradeoff to be sure. I also have a list of things that could be solved properly, but can't justify the time expense to doing so compared to repeating the shortcut every so often.

It's like that expensive espresso machine I've been drooling over for years—I can go out and grab a lot of great coffee at a barista shop before the machine would have saved me money.

But in this particular instance, sure; once you factor the operational risk in, proper automation often is a no-brainer.
by xyst | 2025-08-26 14:16:41+00:00
dirs maintainer is bit unhinge, maybe the high usage of crate has gotten to their head.

If I ever have time, I would love to fork this repository, patch it to support XDG_*, and actively work to advertise it across the rust ecosystem. If user wants to use different location on file system to store configuration files, then let them. Stop trying to dictate what users want.
by georgeecollins | 2025-08-26 14:16:52+00:00
If most people changed the default they would add steps to make it harder to change. Saying something an option is just a fig leaf if the company is allowed to tip the scales.

That's why a regulator can be effective. You can have a regulation that A has to be as easy to do as B and enforce it. Think of browser choice in on PCs in Europe or (briefly) the rule that it should be as easy to unsubscribe in the US as it is to subscribe. People have different feelings about regulations, but I think in places where everyone converges on a single platform pregulation that is protective of the individual makes sense.
by paulhodge | 2025-08-26 14:17:14+00:00
There’s a magic component to rule breaking that a lot of online advice doesn’t usually talk about: You have to actually be right. Your ideas have to be good. Companies don’t want everyone breaking the rules because a lot of devs don’t have the engineering skill to back it up.

So if you start operating as a rogue agent then make sure you are good. Tom Cruise (stuntman and actor) had a quote I love- “Don’t be careful. Be competant.”
by RajT88 | 2025-08-26 14:17:19+00:00
I think I've seen similar videos of sculpins doing this - who have a suctiony fused set of bottom fins. If sculpins do it, probably some kind of Goby also does it (the two families are very similar in many ways).

ETA: I have it backwards, it's gobies:

https://youtu.be/QYMMf18hZCs

Also Cavefish:

https://www.theverge.com/2016/3/25/11303774/walking-fish-tha...

And yes - as people point out, sea lampreys can do this with their sucky mouths. With with the variety of small fish with sucky mouths, probably there's even more who have learned this trick.

Nature is amazing.
by commandlinefan | 2025-08-26 14:17:27+00:00
I would be ok with all of this if it meant anything. My computer has 151 trusted Certificate Authorities installed on it, including heavy hitters in the CA industry such as TUBITAK, Telia and Sectigo. As a user, I have no idea what sort of actual verification went into verifying the certificates that the site I'm visiting is presenting.
by SquibblesRedux | 2025-08-26 14:17:57+00:00
Has the XDG Base Directory Specification been adopted by an official standards committee? In my previous life, calling something a standard carried a great deal of weight. For example, contracts could mandate compliance with standards.

Having built apps and CLI tools for macOS, the author's post certainly makes sense to me. Calling something a standard without backing from a standards committee seems odd, however.
by watusername | 2025-08-26 14:18:05+00:00
To be frank, the whole post reads like "I hate change" with no convincing argument otherwise. The author even acknowledges the very lenient ramp-up from CAB _and_ the myriad of available tooling, yet still throws his hands up.

> I am responsible for approving SSL certificates for my company. [...] I review and approve each cert. What started out as a quarterly or semi-monthly task has become a monthly-to-weekly task depending on when our certs are expiring.

I don't get the security need for manually approving renewals, and the author makes no attempt to justify this either. It may make sense for some manual process to be in place for initial issuances, as certificates are permanently added to a publicly-available ledger. And to take a step back, do you need public certs to begin with? Can you not have an internal CA? Again, the author makes no attempt to justify this, or demonstrate understanding in the post.

> email-based validation may as well not exist when we need to update a certificate for test.lab.corp.example.com because there is no webmaster@test.lab.corp.example.com.

I know that this is an example, but as a developer it would be a pain to have to go through a manual, multi-day process for my `test.lab.corp.example.com` to work. And the rest of the post seems to imply that this is actually the case at OP's org.

> Which resource-starved team will manage the client and the infrastructure it needs? It will need time to undergo code review and/or supplier review if it’s sold by a company. There will be a requirement for secrets management. There will be a need for monitoring and alerting. It’s not as painless as the certificate approval workflow I have now.

There are additional costs and new processes to be made, yes, but even from a non-technical POV this appears to be a good time to lead and take ownership.

> Any platforms that offer or include certificate management bundled with the actual services we pay for will win our business by default. [...] What is obvious to me is that my stakeholders and I are hurrying to offload certificate management to our vendors and platforms and not to our CA.

That's okay. If you hate change and don't want to take ownership, pay someone else to take ownership.
by wowczarek | 2025-08-26 14:18:20+00:00
Yes, I saw those PTP posts and where the methodology lacks a bit.

Re. asymmetries canceling out, OK, I oversimplified, and this is true in theory and often in practice, but for example, having done this with nearly all generations of enterprise type Broadcom ASICs sort of 2008 onwards I know that there are so many variations to this behaviour that the only way to know is to precisely measure latencies in one direction and the other for a variety of speed, CT vs. S&F and frame sizes, and even bandwidth combinations and see. I used to characterise switches for this, build test harnesses, measurement tools etc., and I saw everything ranging from: CT one way, S&F the other way, but not for all speed combinations, then CT behaviour regardless of enabling or disabling it, finally even things like latency having quantised step characteristics in increments of say X bytes because internally the switching fabric used X-byte cells, and then CT only behaving like CT above certain frame sizes. There's just a lot to take into account. There are even cases where a certain level of background traffic _improves_ latency fairness and symmetry, an equivalent of keeping the caches hot.

The author's best bet at reliable numbers would be to get himself a Latte Panda Mu or another platform with TGPIO and measure against 1PPS straight from the CPU. That would be the ultimate answer. Failing that, at least a PTM NIC synced to the OS clock, but that will alter the noise profile of the OS clock.

But you and me know all this because we've been digging deep into the hardware and software guts of those things for years, and have done this for a job, and what's a home lab user to do. It's a never-ending learning exercise and the key is to acknowledge the possible unknowns, and by that I don't mean scientific unknowns but that we don't know what we don't know, and bloggers sometimes don't do this.
by ameliaquining | 2025-08-26 14:18:25+00:00
What would it look like for the Web PKI to "not survive that change"? Is the idea that companies stop having websites and tell all their users to switch to Gopher or something, because the burden of certificate management is too much?

> In our case, we'll be spending the next couple years reducing our use of PKI certificates to the bare functional minimum.

Good. A certificate being publicly trusted is a liability, which is why there are all these stringent requirements around it. If your certificates do not in fact need to be trusted by random internet users, then the CA/B wants you to stop relying on the Web PKI, because that reduces the extent to which your maintenance costs have to be balanced against everybody else's security.

As I said in another comment, private CAs aren't that popular right now in the kinds of organizations that have a hard time keeping up with these changes, because configuring clients is too painful. But if you can do it, then by all means, do!
by notachatbot123 | 2025-08-26 14:19:11+00:00
I used pestering for OP's "I and others have brought this up (...) but they refuse to see it this way (...). It's very frustrating."

Suggest it once, discuss it, get refused, move on. Instead there are tens of comments and above is a complaint about an additional ticket for the same issue.

I am not saying that maintainers are necessarily right, but they are in their right to build their project how they like it. It is a bad pressure and force if people continue to ask for things that a maintainer has already ruled out. What's the goal otherwise, caving in due to pressure and stress?
by Thorrez | 2025-08-26 14:19:22+00:00
If everyone uses that with 1 minute or 1 second expirations, I could certainly see a case where an outage in 1 CA causes traffic migration to another, causing performance issues on the fallback CA too.

>If you need a stronger guarantee of uptime, reach for the paid options.

We don't. If we had 1 minute or 1 second lifetimes, we would.
by jasona123 | 2025-08-26 14:19:31+00:00
I think the challenge is going to be software, software tuning, and (until everyone builds for both ARM and x64) - translation/emulation. I’ll admit that I haven’t had much experience on the Windows side but I made the leap pretty quickly from the early 2015 MBP to an M1 MBA (like maybe a month after the M1 Macs came out) and it very much was seamless, whereas it still sounds like on the Windows on ARM side it’s been languishing even to this day.
by xtracto | 2025-08-26 14:19:43+00:00
It's a sad state of affairs when a guy born in 1953 and a 70+ years old is our reference for freedom.

What happened to GenX, Millenials and GenZ ? Why aren't there any more vocal activists doing something? The internet fuked us up. We're full of armchair experts "fighting" the cause laying in our coach.
by glenstein | 2025-08-26 14:20:11+00:00
The Youtube liason statement is truly something to behold. It's not "upscaling" it's "unblurring". There's no genai, just "traditional machine learning". Oh, phew! I wouldn't want to have misidentified post-processing as unblurring when it was really upscaling.

I think we may see more of this which, to be blunt, I would say are stupid equivocations that are orthogonal to the actual concern, namely that it violates a fundamental trust that images represent something that really happened. We saw this already with Samsung's headspinning justification of their post-processing a fake moon.

Strap in for more JV debate team level "gosh what is reality anyway" equivocations, which I suspect will become increasingly prevalent.