MurphyA/hacker-news huggingface dataset:
by cornholio | 2025-08-07 11:45:16+00:00
That's unnecessarily harsh. Patent pools exist to promote collaboration in a world with aggressive IP legislation, they are an answer to a specific environment and they incentivize participants to share their IP at a reasonable price to third parties. The incentive being that you will be left out of the pool, the other members will work around your patents while not licensing their own patents to you, so your own IP is now worthless since you can't work around theirs.

As long as IP law continues in the same form, the alternative to that is completely closed agreements among major companies that will push their own proprietary formats and aggressively enforce their patents.

The fair world where everyone is free to create a new thing, improve upon the frontier codecs, and get a fair reward for their efforts, is simply a fantasy without patent law reform. In the current geopolitical climate, it's very very unlikely for nations where these developments traditionally happened, such as US and western Europe, to weaken their IP laws.
by znpy | 2025-08-07 11:45:17+00:00
I was sensing that the article is written by a woman, i went and check and yes, it is (the author is Elaine Moore).

The article is basically the female point of view of the issue (raise in conservatism and abstinence, the easy availability of porn) and basically ignores the male point of view in this, which is ironic as the article seems centered around young men rather than young women.
by cipherboy | 2025-08-07 11:45:49+00:00
I do not speak for HashiCorp, but they have published information on this CVE here: https://discuss.hashicorp.com/t/hcsec-2025-21-vault-user-enu...

OpenBao is reasonably confident in our fix: https://github.com/openbao/openbao/pull/1628

We had earlier pulled support for pre-Vault-1.0 userpass pre-bcrypt hashing (so there's no longer a timing difference there that could be used for enumeration) and using cache busting on lookup should also ensure consistency across storage layers. Plus, normalizing the remaining error messages through when the user's credential is fully validated as correct.
by ManlyBread | 2025-08-07 11:46:12+00:00
The author couldn't even be bothered to write about the supposed examples of these practices being wrong. The whole thing lacks detail and actual arguments, instead we get "please stop" like it's some sort of a reddit or twitter shitpost.

Look at this - https://news.ycombinator.com/item?id=44822267 - is this what this site is supposed to be now? Writing the article in the place of the author because the author couldn't be bothered to even form their own argument correctly? What the fuck?

The fact that this has been upvoted so high and allowed to stay on the front page is also a clear signal to others that this low-effort garbage is welcome here, which will only encourage others to post similarly worthless blogposts, lowering the overall quality of this site.

There are multiple comments in this very thread that are longer than this "article". My own comment is longer!
by unlord | 2025-08-07 11:46:44+00:00
> People don’t develop video codecs for fun like they do with software. And the reason is that it’s almost impossible to do without support from the industry.

As someone who lead an open source team (of majority volunteers) for nearly a decade at Mozilla, I can tell you that people do work on video codecs for fun, see https://github.com/xiph/daala

Working with fine people from Xiph.Org and the IETF (and later AOM) on royalty free formats Theora, Opus, Daala and AV1 was by far the most fun, interesting and fulfilling work I've had as professional engineer.
Show HN: Stasher – Burn-after-read secrets from the CLI, no server, no trust
by stasher-dev | 2025-08-07 11:48:11+00:00
Stasher is a tiny CLI tool that lets you share encrypted secrets that burn after reading — no accounts, no logins, no servers to trust.

I built it because I just wanted to share a password. Not spin up infra. Not register for some "secure" web app. Not trust Slack threads. Just send a secret.

Secrets are encrypted client-side with AES-256-GCM. You get a `uuid:key` token to share. Once someone reads it, it's gone. If they don't read it in 10 minutes, it expires and deleted.

Everything is verifiable. Every release is signed, SLSA-attested, SBOM-included, and logged in the Rekor transparency log. Every line of code is public.

There's also a browser-based companion: https://app.stasher.dev — works in a sandboxed popup using the same encrypted model. Share from the terminal, pick up in the browser.

No data stored unencrypted. No metadata. No logs. No surveillance.

---

GitHub (CLI): https://github.com/stasher-dev/stasher-cli GitHub (App): https://github.com/stasher-dev/stasher-app API (Cloudflare Worker): https://github.com/stasher-dev/stasher-api CI/CD (Open): https://github.com/stasher-dev/stasher-ci NPM: https://www.npmjs.com/package/stasher-cli Website: https://stasher.dev Browser App: https://app.stasher.dev (runs in sandbox from https://dev.stasher)

Built with Cloudflare Workers, KV, and Durable Objects. All code open, auditable, and signed.

Try it:

```bash npx enstash "vault code is 1234#" npx destash "uuid:base64key"

thanks for reading
by amelius | 2025-08-07 11:48:19+00:00
A few decades ago I thought that the first person to create AGI would instantly receive a Nobel prize/Turing award.

But my opinion on this has shifted a lot. The underlying technology is pretty lame. And improvements are incremental. Yes, someone will be the first, but they will be closely followed by others.

Anyway, I don't like the "impending doom" feeling that these companies create. I think we should tax them for it. If you throw together enough money, yeah, you can do crazy things. Doesn't mean you should be able to harass people with it.
by rco8786 | 2025-08-07 11:49:03+00:00
The cost angle is interesting, I'm not close enough to the industry to say for sure. But from what I'm reading inference and tokens are only getting cheaper.

Regarding usage - I don't think LLMs are going away. I think LLMs are going to be what finally topples Google search. Even my less technical friends and acquaintances are frequently reaching for ChatGPT for things they would have Googled in the past.

I also think we'll see the equivalent of Google Adwords start to pop up in free consumer LLMs.
by themk | 2025-08-07 11:49:45+00:00
I've run Vault for a long time, and none of this surprises me. I've even reported some of these to Hashicorp in the past, along with other equally shocking bugs.

The code base is an absolute mess.

The number of bugs and weird edge cases I've found with my quickcheck property testing of their API is shocking, and makes me think their test suites are woefully inadequate.
by ardd | 2025-08-07 11:51:02+00:00
Hey everyone, I’ve been working on a small side project to solve a common pain point, sharing sensitive data securely.

Introducing SecureShare - Your Secret, Your Key, Our Link

- Client-side encryption: Your data is encrypted in your browser using AES-256.

- Zero-knowledge: The encryption key never touches the server.

- Self-destruction: Choose between single-use or limited multiple views.

Get started: https://secure.ardd.cloud
by thecupisblue | 2025-08-07 11:51:19+00:00
That is so, but the problem this causes is more than just customer confusion - it is a lack of integration and responsibility. There is no "let's polish this and see if it works based on real user feedback", but it's "let's throw this out and shut it down if it doesn't work".

And if it isn't shut down, it is left in that terrible half-documented state, with confusing integrations and terribly integrated into the rest of the product.

Considering I'm confused both as a customer, user and a shareholder, I'd say the tactic isn't working.
by IshKebab | 2025-08-07 11:52:08+00:00
It's definitely not that complicated. It's just one of those bits of software that is paid for and managed by people that aren't actually using it, so you get Jira shit.

I used to work for Dyson and they moved to Teamcenter for CAD management (basically a shitty VCS for CAD). Similarly to Jira it had all the features you'd ever want in its white paper, but it was abysmal to use - even worse than Jira.

Anyway the nicest bug tracking software I've used so far is Phabricator. Quite a lot nicer than anything else, but it is tightly integrated, and I wouldn't really recommend Phabricator these days because a) no integrated CI system, b) it's semi abandoned, and c) PHP. And yes that does matter. (Though TBF it beats Ruby.)
by WJW | 2025-08-07 11:52:43+00:00
Interesting statement, and I think this shows how different the viewpoints are on both sides of the pond. First off obviously, the EU absolutely doesn't see its pledges as "empty". If anything, the amount of weapons being used in Ukraine are by now 80+% produced either in Ukraine itself or somewhere in Europe. Artillery shell production has increased fourfold over 2022 and will double again this year. US weapons deliveries are nice and everything is welcome, but it's mostly (Patriot) air defenses that Europe cannot yet produce at sufficient scale. There are huge training missions for Ukrainian soldiers in eg France and the UK where the US has basically zero input. American drones are crap compared to what the Ukrainians build themselves, to the point that the US is importing drone knowledge from there these days. All new fighter jets for Ukraine have been donated from EU countries, not a single one by the US. The Ukraine collapsing without the US is simply not true, and that is why so many of Trumps diplomatic advances have failed so far: he doesn't hold the leverage he thinks he does.

The relative strength of the combined armies in Europe is also something that we apparently think very different about. There are certainly strategic deficiencies: we'd prefer to have a more robust domestic nuclear umbrella for example, and the US has an advantage in things like intel satellites. In terms of regular weaponry though, we have more than enough "stuff" to win, especially with Russia severely depleted by several years of attritional warfare in Ukraine. The numbers gap is already big enough, but most of the Russian stuff is decades old by now while the European countries are mostly rocking up with extremely modern equipment.
by cloudbonsai | 2025-08-07 11:53:13+00:00
I was surprised by that part too. I always assumed that Craig was a young techy person.

My takeaway from this article:

- Craiglist was launched by a 40-year old, ex-IBM enginner. It started out as an online list for his circle of friends.

- The main competitor then was "Classifieds" section in newspapers. Craigslist out-competed them by simply being a better medium (No word-count limit + photo support).

- Meanwhile, newspaper executives failed to respond in a meaning manner. By 2010, 70% of their classified ad business was gone.

Craig seems to be fully retired by now, focusing on his philanthropy work, which I think is awesome.
by bko | 2025-08-07 11:53:22+00:00
Please spend 30 seconds to search whether the fda budget has actually been cut over time (hint: it hasn’t)

The fda budget much like every other agency has grown incredibly in the last 50 years ( <1bnin 1992 to >6bn today). You can look at more recent numbers and see it’s still rising. When you hear cuts I’m spending it’s often cuts in proposed increases in spending which are often double digits. So you can grow an agency 10% a year for decades and then a single slow down or reversion to levels from just a year or two ago is seen as drastic cuts that will result in poison into our water.

https://www.google.com/search?hl=en&q=fda%20budget
by account42 | 2025-08-07 11:53:22+00:00
A measly factor 16 doesn't really make it worth having to deal with non-power of two sizes. You're also assuming that everything would have used the same number of bites when most sizes are chosen based on how much was needed at the time or in the foreseeable future - with 9 bit bytes that would just have meant that we're just going to run out earlier for different things than with 8 bit bytes.

> IPv4: Everyone knows the story: IPv4 had 32-bit addresses, so about 4 billion total.44 Less due to various reserved subnets. That's not enough in a world with 8 billion humans, and that's lead to NATs, more active network middleware, and the impossibly glacial pace of IPv6 roll-out. It's 2025 and Github—Github!—doesn't support IPv6. But in a world with 9-bit bytes IPv4 would have had 36-bit addresses, about 64 billion total. That would still be enough right now, and even with continuing growth in India and Africa it would probably be enough for about a decade more.

Only if you assume there is only one device per human, which is ridiculous.

> Unicode: In our universe, there are 65 thousand 16-bit characters, which looked like maybe enough for all the world's languages, assuming you're really careful about which Chinese characters you let in.77 Known as CJK unification, a real design flaw in Unicode that we're stuck with. With 9-bit bytes we'd have 262 thousand 18-bit characters instead, which would totally be enough—there are only 155 thousand Unicode characters today, and that's with all the cat smileys and emojis we can dream of. UTF-9 would be thought of more as a compression format and largely sidelined by GZip.

Which would be a lot worse than the current situation because most text like data only uses 8 bits per character. Text isn't just what humans type and includes tons of computer generated ASCII constructs.

Not to mention that now it becomes an active process to upgrade ASCII data to Unicode, which would have the argument of increased size against it for many files and thus files and formats without Unicode support would have stuck around for much longer.

UTF-8 might have been an accident of history in many ways but we really couldn't have wished for something better.
by bmacho | 2025-08-07 11:54:02+00:00
I think GP has the following in mind:

- user has an account on GOOD.COM - user has saved her password in her browser - user navigates to BAD.COM

In this case autofilled passwords are safe and convenient since they alarm the user that she isn't at GOOD.COM.

A clickable link sent in email mostly works too, it ensures that the user arrives at GOOD.COM. (If BAD sends an email too, then there is a race condition, but it is very visible to the user.)

Pin code sent in email is not very good when the user tries to log in to BAD.COM.
by mike_hearn | 2025-08-07 11:54:57+00:00
Google funding free stuff is not a real social mechanism. It's not something you can point to and say that's how society should work in general.

Our industry has come to take Google's enormous corporate generosity for granted, but there was zero need for it to be as helpful to open computing as it has been. It would have been just as successful with YouTube if Chrome was entirely closed source and they paid for video codec licensing, or if they developed entirely closed codecs just for their own use. In fact nearly all Google's codebase is closed source and it hasn't held them back at all.

Google did give a lot away though, and for that we should be very grateful. They not only released a ton of useful code and algorithms for free, they also inspired a culture where other companies also do that sometimes (e.g. Llama). But we should also recognize that relying on the benevolence of 2-3 idealistic billionaires with a browser fetish is a very time and place specific one-off, it's not a thing that can be demanded or generalized.

In general, R&D is costly and requires incentives. Patent pools aren't perfect, but they do work well enough to always be defining the state-of-the-art and establish global standards too (digital TV, DVDs, streaming.... all patent pool based mechanisms).
by tdullien | 2025-08-07 11:55:31+00:00
Every predictor is a compressor, every compressor is a predictor.

If you're interested in this, it's a good idea reading about the Hutter prize (https://en.wikipedia.org/wiki/Hutter_Prize) and going from there.

In general, lossless compression works by predicting the next (letter/token/frame) and then encoding the difference from the prediction in the data stream succinctly. The better you predict, the less you need to encode, the better you compress.

The flip side of this is that all fields of compression have a lot to gain from progress in AI.
by kuschku | 2025-08-07 11:55:33+00:00
Fun fact: That long s accidentally lead to a new character being created.

In German, we've got words like "dass". Back in the day, every s that wasn't at the end of a word was written as long s, so "dass" would've been written like "daſs", which got turned into ß.

That's why until the recent orthographic reforms of 1996 and 2006 "dass" was written as "daß".

Aside: in some regions, "dass" would've been written like "dasz" / "daſz". That's why the letter is called Eszett (S-Z) even though it's capitalised as two consecutive "s".
by tyleo | 2025-08-07 11:56:00+00:00
Did you even read the article? For the example at the top, all the stuff these kids did was well documented. I don’t understand how having a phone helps here except to add even more distraction in school and another avenue for surveillance.

The kids used a school communication program to say something racist. Schools should monitor school communication platforms.

The only thing I disagree with is the level of punishment (sending a kid to jail for a night).
by xg15 | 2025-08-07 11:57:37+00:00
Because they'd actively have to make their proprietary passkey systems interoperable with password managers. This is fail-closed, not fail-open: If they truly didn't care, they'd also be no incentive for them to implement support.

But I fear it's worse. Based on how past open standards played out, I find it believable they do care - that there won't be an open ecosystem of password managers.

> But they’ve shown no evidence of hating user freedom on principle.

Yes, they did, just see Microsoft's crusade against Linux and the origin of the "embrace-extend-extinguish" term.
by II2II | 2025-08-07 11:57:44+00:00
I hardly ever use gvim. From my understanding, there are a few relatively minor GUI specific settings for the GUI version. Contrast that to emacs. It's possible to present documents with multiple fonts and images in the graphical version. (The irony: vim and gvim are separate binaries, which emacs can have a unified CLI/GUI binary.)

I agree that heavily customized, emacs and vim can be an IDE and that it can be distracting. It is possible to pick and choose the desirable (e.g. non-distracting) elements of an IDE when configuring either editor, but that in itself turns into a distraction.
by omneity | 2025-08-07 11:58:35+00:00
Consumer GPUs in theory and by a large margin (10 5090s will eat an H100 lunch with 6 times the bandwidth, 3x VRAM and a relatively similar compute ratio), but your bottleneck is the interconnect and that is intentionally crippled to avoid beowulf GPU clusters eating into their datacenter market.

Last consumer GPU with NVLink was the RTX 3090. Even the workstation-grade GPUs lost it.

https://forums.developer.nvidia.com/t/rtx-a6000-ada-no-more-...
by malwrar | 2025-08-07 12:00:08+00:00
This will condition children to think this sort of surveillance is normal, and when they’re adults the ones who think it kept them safe from mass shootings will try and advocate using our existing mass-surveillance powers to proactively monitor everyone like this. Please, we need to stop terrifying children with this lazy oppression, this is not worth the damage to society we’re causing by conditioning kids this way.
by mike_hearn | 2025-08-07 12:00:22+00:00
The top AI companies don't release their best models under any license. They're not even distributed at all. If you did steal the weights out from underneath Anthropic they would take you to court and probably win. Putting software you develop exclusively behind a network interface is a form of ultra-restrictive DRM. Yes, some places are currently trying to buy mindshare by releasing free models and that's fantastic, thank you, but they can only do that because investors believe the ROI from proprietary firewalled models will more than fund it.

NVIDIA's advantage over AMD is largely in the drivers and CUDA i.e. their software. If it weren't for IP law or if NVIDIA had foolishly made their software fully open source, AMD could have just forked their PTX compiler and NVIDIAs advantage would never have been established. In turn that'd have meant they wouldn't have any special privileges at TSMC.
by AlecSchueler | 2025-08-07 12:00:53+00:00
And would you be in favour of dissolving the national governments in favour of devolving power to even more local governments that are closer to their populations and even held even more effectively accountable? What's the ideal level of "indirection?"

Where do you draw the line/how do you strike balance? And I'm curious if you have an idea of an alternative for the regular coordination efforts that would be needed for the national/sub national governments in the absence of something like the EU.
GoGoGrandparent (YC S16) Is Hiring Back End and Full-Stack Engineers
by davidchl | 2025-08-07 12:01:09+00:00
About Us We're a digital caregiving platform dedicated to helping older and disabled adults live independently and thrive in their own homes—avoiding the need for retirement communities. We adapt on-demand APIs from companies like Uber, Lyft, DoorDash, and Instacart to meet the unique needs of individuals with cognitive, visual, mobility, and dexterity challenges. We're a highly profitable and fast-growing startup. Our team is fully remote, with a total engineering headcount of 12 (including this role).

FULLY REMOTE | , UK, or able to work 4+ hours overlap with mainland US | $120k – $160k (partially location-dependent)

Tech Stack Back-end heavy: Node.js, TypeScript, MySQL, REST + GraphQL Front-end: Vue.js (nice to have) Deployment: AWS, Docker/Kubernetes (nice to have)

Requirements 6+ years of professional experience (primarily in Node.js and Vue.js)

Interview Process 2-stage interview process.

If you're passionate about improving the lives of older adults and people with disabilities, send your LinkedIn or CV (keep it brief) to recruitment@gogograndparent.com, or apply at https://www.ycombinator.com/companies/gogograndparent/jobs
by tyleo | 2025-08-07 12:01:31+00:00
I don’t like this article. It mixes two things together:

1. Schools running and monitoring their own communication platforms. This seems fine.

2. The US government monitoring private communication platforms like Snapchat and arresting kids on school grounds. This seems bad.

The way it’s written though mixes these together and makes it look like schools are monitoring the private communication of students. I think it’s fine for schools to monitor there own platforms but weird for the government to monitor all platforms haphazardly.
by daneel_w | 2025-08-07 12:01:56+00:00
It's not broken. It's just potentially less helpful when it comes to protecting poor guessable passwords. bcrypt isn't the problem, weak password policies/habits are. Like bcrypt, argon2 is just a bandaid, though a tiny bit thicker. It won't save you from absurdly short passwords or silly "correct horse battery staple" advice, and it's no better than bcrypt at protecting proper unguessable passwords.

Also, only developers who have no idea know what they're doing will feed plain-text passwords to their hasher. You should be peppering and pre-digesting the passwords, and at that point bcrypt's 72 character input limit doesn't matter.