MurphyA/hacker-news huggingface dataset:
by IncreasePosts | 2025-08-19 18:25:11+00:00
If you have a Chromecast on your tv, you can generally just cast a whole tab using chrome. But the frame rate will be awful and I don't think audio gets cast.

If there isn't a cast button within the video player itself, i would download them, and then use something local to cast the actual video content to your tv (vlc has this feature)
by adrianmonk | 2025-08-19 18:25:15+00:00
I'm no historian, but looking at a map, Turkey seems geographically prone to getting trampled over and over.

It's basically the hub that connects Europe, Africa, the Middle East, and Asia together. If someone builds an empire in any of those areas and tries to expand to another one, they're going to want to control the territory that connects them. Even if they don't want Turkey for its own sake, it's a stepping stone.

In other words, if you want to not get invaded, it really helps to be off in a corner that's not on anybody's way from anything to anything. Turkey is the opposite.
by danaris | 2025-08-19 18:25:58+00:00
[citation needed]

Where is the evidence that it is bad for people?

Where is the evidence that it is bad for children?

Where is the evidence that it is addictive?

Where is the evidence that it causes ED?

These things are commonly believed by "traditionally-minded" people, but I have yet to see a reputable study that shows any of this. Indeed, recent studies have shown that "porn addiction" is effectively a myth: it's basically just people who think that using porn is bad, still using porn (because they have normal, healthy, human urges), and feeling guilty about it.

Your entire argument rests on that "I think so".
by appease7727 | 2025-08-19 18:26:09+00:00
So you think the USA should interfere in a sovereign nation to intentionally and drastically damage their economy, industry, and quality of life?

Because the US can't get their collective heads out of their asses to build a competitive industry?

The USA is losing this imagined fight with China, and the solution is not to destroy an entire nation, but to actually become competitive.

Sure, let's just fucking nuke every country that's more successful than us. That'll show them!

Americans are absolutely fucking insane.
by elpakal | 2025-08-19 18:26:13+00:00
> Sandboxing: All Cloud Run instances are sandboxed with two layers of sandboxing and can be configured to have minimal IAM permissions via dedicated service identity. In addition, CodeRabbit is leveraging Cloud Run's second generation execution environment, a microVM providing full Linux cgroup functionality. Within each Cloud Run instance, CodeRabbit uses Jailkit to create isolated processes and cgroups to further restrict the privileges of the jailed process.

In case you don't want to read through the PR
by wging | 2025-08-19 18:26:55+00:00
The article seems to imply that something of the sort had actually been attempted prior to the incident, but was either incomplete or buggy. I'm not sure the details would be entirely exculpatory, but unless you want to flatly disbelieve their statements, "not considered" isn't quite right.

> After responsibly disclosing this critical vulnerability to the CodeRabbit team, we learned from them that they had an isolation mechanism in place, but Rubocop somehow was not running inside it.
by eric-burel | 2025-08-19 18:27:02+00:00
I think LLM vendors papers entertain such confusions, the lack of peer reviewing tends to favour grandiose but barely defined wording as such. At least author seems to have checked a few papers that do some empirical validation (which is still different from establishing any kind of theory of prompt engineering, there is no other way than cutting the model up to do that).
by frankfrank13 | 2025-08-19 18:27:26+00:00
Reading this, its not clear how your blog posts relates:

1. You run git clone inside the GCR function, so, you have at the very least a user token for the git provider

2. RCE exploit basically used the external tools, like a static analysis checker, which again, is inside your GCR function

3. As a contrived example, if I could RCE `console.log(process.env)` then seemingly I could do `fetch(mywebsite....`

I get it, you can hand wave some amount of "VPC" and "sandbox" here. But, you're still executing code, explicitly labeling it "untrusted" and "sandboxed" doesn't excuse it.
by bilbo0s | 2025-08-19 18:27:32+00:00
What gets me is that people keep voting in favor of this stuff?

It's clear that the HN crowd is a bit of an echo chamber. Somehow, these messages of warning are not getting to people who need to hear them in order to stop voting against their own interests.

Well, now I think about it, people vote against their own interests on all kinds of issues. So I suppose this one doesn't have to be any different?
by stockresearcher | 2025-08-19 18:28:32+00:00
There was a time - prior to the 1990s? - when computers were very expensive compared to corporate drone salaries. A lot of techniques were developed to design and implement large-scale systems.

At some point, people will rediscover this literature and realize that the LLM can take the place of the corporate drones and that you can design systems that are arbitrarily large yet at any particular layer and component, the necessary context is small enough that an LLM can succeed.

Of course, at that point the question is going to be one of self-disciple and not falling asleep from the boredom.
by csa | 2025-08-19 18:28:33+00:00
> It's always a combo of vibe coding + automation tools like n8n/zapier that does some simple data plumbing or just calls an API.

I agree with all that you said, however…

I have found that doing stuff that could be done with code with the automation tools/services that you mentioned above (plus excel) is often preferable for small businesses and certain orgs precisely so that a programmer doesn’t have to be called on every time a change is needed.

Not knocking programmers (I’ve been programming since age 10), but programmers aren’t always easy to hire and evaluate, and their cost (at least until recently) has been extremely high.

These automation tools allow for business to make a tech leap with much lower execution cost and risk.

So while I agree that a lot of the “vibe coding” stuff being promoted is drivel, that doesn’t mean that the tools themselves are not empowering in the right hands.
by bpcrd | 2025-08-19 18:29:37+00:00
This is something we're constantly updating, upgrading, iterating, and improving on. Every. Single. Day.

Whether it's introducing new models, deprecating old ones, or improving existing ones, there is an element of both staying current but also looking ahead at research. Many of the new models generating hyperreal content we catch on day one because they're based on existing technology and/or research.
by zevon | 2025-08-19 18:29:40+00:00
Debatable. I use Obsidian specifically because it can be relatively minimalist and it's easy to get the view I want and use 99% of the time: List of files on the left, main note window (sometimes with tabs and/or split) in the middle and a calendar that can jump me to a daily note on click on the right. You can't make such relatively small UI adjustments in the more minimalist note-taking apps, so even if you may not use all of the functions and plugins, Obsidian can still be a relevant choice.
by JumpCrisscross | 2025-08-19 18:30:12+00:00
> Trump told Americas latinos that he was going to deport them en mass and that got him +20 points shift in latino voting patterns in 4 years

American politics is racially depolarising. Democrats absolutely missed this. Pretending a gay business owner and Catholic construction worker will vote the same because they share a skin color and language is not informative.
by jerf | 2025-08-19 18:30:25+00:00
Honestly, your chance to impact this decision was when you decided what technologies to use on your website, and then statistically speaking [1], chose not to use XSLT in the browser. If the web used it like crazy we would not be having this conversation.

Your other opportunity is to put together a credible plan to resource the XSLT implementations in the various browsers. I underline, highlight, bold, and italicize the word "credible" here. You are facing an extremely uphill battle from the visible lack of support for the development; any truly credible offer should have come many years ago. Big projects are well aware of the utility of last-minute, emotionally-driven offers of support in the midst of a burst of publicity, viz, effectively zero.

I don't know that the power is as imbalanced as people think here so much as a very long and drawn out conversation has been had by the web as a whole, on the whole the web has agreed this is not a terribly useful technology by vast bulk of implementation work, and this is the final closing chapter where the browsers are basically implementing the will of the web. The standard for removal isn't "literally 0 usage in the entire world", and whatever the standard is, if XSLT isn't on the "remove" side of it, that would just be a sign it needs to be tuned up because XSLT is a complete non-entity on the web. If you are not feeling like your voice is being respected it's because it's one of literally millions upon millions; what do you expect?

[1]: I know exceptions are reading this post, but you are exceptions. And not terribly common ones.
by xarcolade | 2025-08-19 18:30:27+00:00
Insightful! I have had the same issue with forgetting where exactly I need the cursor. I did not know you could run script/commands on text selection, I will definitely look into this. The extent of my vimscript journey so far is directly making system() calls to external scripts, and I've been using the ability to Ctrl-R while entering a :command to dump yanked text as a crutch. Your approach sounds much more sensible.
by cube00 | 2025-08-19 18:30:29+00:00
I can't say I'm surprised they didn't pay a bounty when they couldn't even own up to this on their own blog [1].

Instead they took it as an opportunity to market their new sandboxing on Google's blog [2] again with no mention of why their hand was forced into building the sandboxing they should have had before they rushed to onboard thousands of customers.

I have no idea what their plan was. They had to have known the researchers would eventually publish this. Perhaps they were hoping it wouldn't get the same amount of attention it would if they posted it on their own blog.

[1]: https://news.ycombinator.com/item?id=44954560

[2]: https://news.ycombinator.com/item?id=44954242
by dogman144 | 2025-08-19 18:30:39+00:00
Well the detesting trawling angle is valid but similar to how you could detect coal mining in West Virginia the mountains/sea bottom is gone either way.

I believe the single most important policy change for fishiers would be to end trawling, second being sort out international regs.

Both very hard, both bad news for kings. But at some point people are going to see the outcomes in their grocery stores and maybe that’ll start change.
by JdeBP | 2025-08-19 18:32:23+00:00
See https://news.ycombinator.com/item?id=44954517

They're giving Google Public DNS as example of a failure here. Whereas what happens in my testing is that it's a cache miss for Google Public DNS, which takes a little over 1 second to look everything up from cold in my part of the world for ~.www.example.com .

And in that second they have more than enough time, at LAN speeds (since they are injecting the forged responses from the dnsmasq client machine), to send a tonne of forged DNS/UDP responses which are only around a hundred bytes long each.
by zahlman | 2025-08-19 18:32:26+00:00
Since I have showdead on I might as well offer a bit of advice.

> We’re excited to announce

Part of what goes wrong when you let LLMs write everything (not just the code which itself leverages AI) is that nobody has a reason to care about the developers. If you don't review things like this for style you end up creating the impression that you don't care about making yourselves known, either. That's not a good look for Show HN.

If you're trying to apply restrictions on commercial use, I'd have a qualified lawyer look over your LLM-generated additional license terms, too. Preferably one with specific knowledge of intellectual property law and of open source in general. Ideally also have a human review whether these terms are compatible with the OSI definition of open source.

Oh, and the offsite documentation should probably repeat the installation instructions.
by overfeed | 2025-08-19 18:32:26+00:00
Germany (WWII), Japan (WWII), and US (Vietnam war) all had pacifist movements spring up in the aftermath of conflict. See also the aftermath of the regimes of Franco, Mussolini,and Ceausescu for domestic resets, just from the 20th century.

All in the 20th century. I attribute the fact that the US and Russia didn't head into a hot war post-WWII to the clear-headedness of witnessing WWII.
by Zobat | 2025-08-19 18:32:47+00:00
This is impressive, but (and probably because I'm not the intended audience for this post) I don't get it, I kind of want to get it though. With "it" I mean making Emacs do X, where X is something far from editing text files. It always seems to me like playing Doom on a pregnancy test. Sure you can do it, sure it's impressive, but should you?

n.b. I'm a C# developer that has accepted my fate and use Visual Studio to earn a living, though I've made sure I know my tool, flaws and merits, better than most developers I've met/worked with. My first job as a programmer was writing C++ code in Emacs and can't remember anything negative about that experience (other than getting used to ctrl+x, ctrl+s for saving and, by reflex, doing the same in Excel, and losing a big part of the document that I had just selected to move, because Excel couldn't undo past last save).

Reading the (at the time I'm writing this) 13 comments on this post I see mentions of at least three lightweight programs that does this. What other than "the mountain is there" makes someone think Emacs would be the tool for this? As a Resolve user I know what tool I'd reach for even if using a multi GB, Hollywood grade, non linear editor, compositor and color grader for trimming a short video clip is about as ridiculously overpowered as using a sledge hammer to press a key (and I did exactly that just a few days ago).

Like I said, I'm most likely not "getting it", on multiple levels. Please educate me, why would I use Emacs for this or any of the page upon page of "strange" use cases you find if you search for "Emacs" here on HN. I know Emacs is a powerful editor but I can't for the life of me understand why I would use it to trim video clips.
by tonymet | 2025-08-19 18:33:29+00:00
there are easily 300m+ installs of dnsmasq that will never be updated, because they are buried in forked , unmaintained firmwares on consumer routers.

We truly need a "right to repair" for IOT & consumer networking devices. Any device not receiving monthly security updates should have the firmware keys & source published so the community can take over.
by dc396 | 2025-08-19 18:33:59+00:00
I guess you and I were at different meetings. I was at meetings at NSF with TIS folks that resulted in funding for DNSSEC implementation in BIND where the presentation focused on the 16-bit transaction field (and included a live demonstration), so I'll stand by my view that the point of DNSSEC was to address that particular flaw.

In any event, that's a nice site that provides useful stats.
by lucb1e | 2025-08-19 18:34:09+00:00
Huh! I'm learning a lot here today. Trying to find more info, indeed the top answer on stackoverflow on the "XSLT equivalent for JSON" is XSLT itself: https://stackoverflow.com/a/49011455/. Hard to find how you'd actually use it though, basically all results I get for "xslt json" are about different tools that convert between JSON and XML
by pegasus | 2025-08-19 18:34:35+00:00
The dichotomy you describe only works with a rudimentary notion of faith, which might be better referred to as belief or superstition. It goes along with the image of God as a being, when God is better understood as Being itself. A deeper understanding of faith implies trust, a trust which one might not be conscious of but necessarily underlies and sustains any genuine love. The "you" of God cannot be put in opposition to "me", since God is our true nature, the real "me".

To get a better understanding of these things, I recommend checking out "The Experience of God" by D.B. Hart or the works of C.S. Lewis.
by sedatk | 2025-08-19 18:35:04+00:00
I love XSLT. I released a client-side XSLT-based PWA last year (https://github.com/ssg/eksi-yedek - in Turkish). The reason I had picked XSLT was that the input was in XML, and browser-based XSLT was the most suitable candidate for a PWA.

Two years ago, I created a book in memory of a late friend to create a compilation of her posts on social media. Again, thanks to XSLT, it was a breeze.

XSLT has been orphaned on the browser-side for the last quarter century, but the story on the server-side isn't better either. I think that the only modern and comprehensive implementation comes with Saxon-JS which is bloated and has an unwieldy API for JavaScript.

Were XSLT dropped next year, what would be the course of action for us who rely on browser-based XSLT APIs?

XSLT, especially 3.0, is immensely powerful, and not having good solutions on JS ecosystem would make the aftermath of this decision look bleaker.
by logifail | 2025-08-19 18:35:37+00:00
> in general Google satellite offices often house the engineers of acquired startups who don't want to move to the mothership

Would it be unfair to ask if (in this instance the UK's) satellite country taxpayers are subsidising corporate offices when the overall structures are arranged such that any overall corporation tax payable will be paid in the lowest-possible jurisdiction?

See - for instance - https://en.wikipedia.org/wiki/Corporation_tax_in_the_Republi...
by trentnix | 2025-08-19 18:36:17+00:00
And when they can't suppress visionaries within the organization, the ruling class finds other ways to preserve their power. Today the entrenched companies, organizations, and government bureaucracies collaborate to write the laws and regulations and pursue predatory competitive strategies that suppress new competitors and preserve their power.

There are always good reasons for why X law or Y regulation exists or why Z company is given preferences and even subsidies. But the visionaries are undermined all the same.
by numpad0 | 2025-08-19 18:36:24+00:00
That's beyond naive. Nothing will happen to bots because they're not human (and/or) individuals from first world nations. Bot farm runners can either print IDs, post from unrestricted locations, or through bulk posting APIs offered behind doors. Social media operators has less issues with cooperative spams than actually organically trending posts because contents are less original.

It only hurts real users.
by thewisenerd | 2025-08-19 18:36:30+00:00
even if they did not have the PEM file left in the environment, the token is still widely scoped and has the same scope as the PEM

what i'm clearly mis-remembering is being able to exchange the token for a smaller scope e.g., hey~ sign this jwt, with scopes=[org/repo1, org/repo2, permissions=write]
by IAmBroom | 2025-08-19 18:37:06+00:00
Not just flickering; smoking badly as the underheated, unburnt parts roasted outside the flame.

Weirdly, the trick wasn't in changing the wick material to burn better, but changing their shape so they curled over (and remained marginally in the flame until burnt) instead of just sticking straight out: rectangular instead of circular braided string.
by chanon | 2025-08-19 18:37:25+00:00
I'm starting to think these 'Github Apps' are a bad idea. Even if CodeRabbit didn't have this vulnerability, what guarantee do we have that they will always be good actors? That their internal security measures will ensure that none of their employees may do any malicious things?

Taking care of private user data in a typical SaaS is one thing, but here you have the keys to make targetted supply chain attacks that could really wreak havoc.
by immibis | 2025-08-19 18:37:47+00:00
If you run outside your apartment in Germany and shout to the German government you will be arrested and you will not be treated kindly. They come down very very harshly on critics of Israel. Entire institutions have been destroyed (as in removal of 100% of funding, bank account closed, raided by police, electricity disconnected (during the police raid), building forcibly sold to real estate developers, etc) for stuff as simple as hosting one single one-hour speech by a native Palestinian. You can look up what happened to the Oyoun cultural center, or the Berlin Palestine Conference in 2024.

The police justification? "There is a risk that a speaker will repeatedly be shown via video who in the past made antisemitic remarks and glorified violence. For this reason, the gathering was ended and banned on Saturday and Sunday as well." - nothing that actually happened, but rather for a suspicion that words might be said later, the entire conference was immediately terminated, banned, and violently evicted. There is not much video of the eviction since filming private gatherings is generally illegal in Germany. https://mondoweiss.net/2024/04/police-raid-berlin-conference...

No sane resident of Germany would risk it. You comply with the government or else, no different than Russia or China.
by alnwlsn | 2025-08-19 18:38:11+00:00
>I would love to be able to specify a chamfer or fillet along a contact edge of two other shapes

Yes, this is how the big cad programs work, they are 'constraint based'. You pick points and lines from other features (or other parts) and add whatever new geometry you want, and a solver fills in the rest. Features build off each other in this way. In OpenSCAD, you are the solver. But, the big programs have a ton of buttons, and scripting, while there, is usually hidden.

It's kind of like the difference between <insert image library> and Photoshop. Photoshop has a ton of useful tools inside, but if all you want to do is crop the bottom 30px from 2000 images, it's better to have a script do that. The scripts can technically do everything that Photoshop can do, but for other things it's easier just to click a few buttons and be done than reinvent the wheel from the ground up each time.
by zahlman | 2025-08-19 18:38:47+00:00
It should be a capital I, not lowercase l in the organization name. They have it right consistently within the article, but not in its title or slug. They're also reposting it from "the hacker news" which to me looks much more interested in SEO than reputation (although they did get the spelling right).

I think PyPI's own announcement is a better source for this: https://blog.pypi.org/posts/2025-08-18-preventing-domain-res...

It was also shared on the official forums: https://discuss.python.org/t/announcement-pypi-prevents-doma...
by bee_rider | 2025-08-19 18:38:51+00:00
Sounds like an unpleasant task, done for users that don’t really want it, and don’t have much incentive or ability to contribute back to the community.

It sort of feels like we’re talking past each-other. I’ve been trying to point out that, due to the community nature of these open source projects, development tends to follow the interests of the people who tend to contribute open source code to the projects. You’ve listed a number of challenges or thresholds that you think are important. However, after reading your comments, I can’t articulate who those thresholds are important to or why they are worth following. I don’t need another litmus test, I need some reason to care about testing.

The idea of “Linux on the desktop” was a popular meme for a while, but I think it is a short-hand expression for a collection of things, some of which were achieved a decade ago, some of which weren’t, where there’s a strong correlation between “things that were accomplished” and “things that open source community contributors cared about,” and the remainder… were ignored because nobody wanted to do them.