MurphyA/hacker-news huggingface dataset:
by petsfed | 2025-08-05 20:17:39+00:00
>The porthole design was poor, the carbon fiber had tons of defects, the controller, everything was cobbled together, yet it held up until it didn't.

Emphasis mine.

Everybody hammers on the controller like using a gaming controller was somehow more indicative of the unseriousness of the endeavor than, you know, the firing of the guy who said the hull was unsafe. Based on what I've read, that was one of the few authentically competent design decisions of the whole bloody thing. Why waste time and resources building, designing, and most importantly lifetime testing something that you can buy off the shelf for $30 US?

The US Navy has been using off-the-shelf game controllers for years now[0], because they work. And as a bonus, the submarine designers can be confident that if Stockton Rush or Seaman Manchild or whoever throws his controller in a fit of rage when his submarine doesn't work right, the controller will still work afterwards.

Absolutely, there were problems with the control scheme (reportedly, the motors were wired into the control board wrong, so the x- and y-axes were reversed). But that's not the fault of some usb controller communicating with the control box. That's the fault of the people working on the actually bespoke portions of the submarine.

0. https://www.cnet.com/science/us-navy-launches-submarine-mane...
Show HN: Far Manager theme and palette configurator
by deejayy | 2025-08-05 20:17:49+00:00
Some of you may use or remember FAR (File-and-ARchive) Manager. I have no doubt it is the most productive file manager ever made. :) But I found that the theme configurator inside FAR is a bit cumbersome, so I made a web-based alternative for theming and I also extended with palette configuration (useful if you combine FAR with ConEmu - but you can configure the standard windows command line palette by hand).

You can load and save themes and palettes, browse from existing ones or adjust colors in the loaded one.

It supports the basic 16 color, ANSI 256 or even RGB.

I'm planning to add file highlight adjustment and FarColorer (syntax highlighter in editor) configuration as well later.
by zzo38computer | 2025-08-05 20:18:10+00:00
I also think client certificates is a better solution. However, it does not have to be single per-user.

For example, a service that you register an account on can issue a certificate to you; you could use it directly or you could use that certificate to issue another certificate to yourself, with a different key, and storing the private key of the original certificate on a separate computer that is not connected to the internet, making it less likely to compromise (if the certificate actually used is compromised, it could be revoked and you can issue a new one to yourself).

If the service defines an extension for the authorization granted by the certificate, then you could issue a certificate to yourself that has an extension to restrict the authorization, therefore allowing partial delegation of authorization. (Some operation would be authorized only if all of the certificates in the chain authorize that operation.)

The partial delegation of authorization can also be used to issue certificates to others, perhaps for a limited time (by setting the expiry date). For example, if one service can access another service to do some operation on your behalf, you can issue a certificate to the first service (this is one case where a client issues a certificate to a server), with the limited authorization that is required, and then that first service will use that certificate to authenticate with the second service, to do the operation.

A service that wants someone to be able to use their account from another service to log in to their own one can also do so (although usually this should not be required, since someone might not want the other service).

The private keys can optionally be passworded for additional security, and the server doesn't know nor care about this. (Passworded private keys is probably not useful for server certificates, but it is useful for client certificates.)

The use of mutual TLS authentication has other security benefit as well.
by andix | 2025-08-05 20:18:15+00:00
It used to be much more modular back in dotnet core 2.x. It was just too complex for most people to wire up everything themselves. You needed to install a lot of nuget packages, add a lot of middlewares. In the end 95% of the projects added everything anyway, but always with some little mistakes and weird errors.

Starting with 3.0 (or 5.0?) they ditched the Startup class and just added in everything by default. Much easier for the regular web application. The modular approach is still everywhere though. You can just pick the components you need, most of them also run without DI, it's just a bit of a hassle to manage all those dependencies manually.
by dust42 | 2025-08-05 20:18:22+00:00
The 120B model badly hallucinates facts on the level of a 0.6B model.

My go to test for checking hallucinations is 'Tell me about Mercantour park' (a national park in south eastern France).

Easily half of the facts are invented. Non-existing mountain summits, brown bears (no, there are none), villages that are elsewhere, wrong advice ('dogs allowed' - no they are not).
by RRWagner | 2025-08-05 20:18:31+00:00
+1 and more to this. Democrats are not good at all at letting voters know what they have done for them. In California that Republicans love to hate, we have clean air, free beaches, more protections from corporate predation, and so much more. Republicans are better at complaining and spreading fear, which sadly is a lower-energy and more effective method for getting votes.
by alexjplant | 2025-08-05 20:18:51+00:00
"Scrum" is one of those terms like "jam band" or "martini" or "DevOps" that people apply way too liberally to describe things that they think are similar but are actually completely different. If you try and get people to do real Scrum ceremonies and roles as written you'll run into a host of excuses as to why they can't (or, as is more often the case, just don't want to). This is how you end up with a "daily stand-up" that only happens when Jupiter isn't in declination, is attended by between 0 and n + 3 people where n is the actual team size, and lasts up to an hour and a half with a strong possibility of not everybody giving their required status. Oh, and everybody is sitting down. At a stand-up.

Scrum might not be perfect for every situation but it's a damn sight better than a swirling miasma of agenda-less quasi-recurring meeting invites buttressed by orphaned Google Docs and Slack threads. I've worked on exactly one team where we pretty much did Scrum to the letter and it was great. Meetings were short and sweet and we always knew what we had to build or fix. I was just a kid and we were using a super-janky tech stack but it was among the most productive, low-stress times in my career.
by fullstop | 2025-08-05 20:19:13+00:00
> In August of 2017, a supervisor discovered what the employee was doing only "after the supervisor noticed that the male employee was only viewing videos of 'pretty girls,'" the complaint alleges. That employee was terminated, the filing says.

Phew -- I am definitely not a "pretty girl".

Seriously, though, I'm glad that I ditched Ring and that it only pointed at my walkway.
Show HN:Secure deployment platform for AI-generated code and internal tools
by citizensinan | 2025-08-05 20:19:27+00:00
We got tired of the authentication nightmare that comes with deploying AI-generated apps. Every time we'd generate a cool mini app with Claude/GPT, deploying it securely meant choosing between "completely open" or "spend days implementing OAuth." The problem: No easy way exists to deploy AI-generated apps privately with proper authentication. Current solutions are complex to implement and vulnerable to tech debt, insecure code, and secret leakage. What we built: A deployment platform designed for the AI coding workflow. Your AI-generated app doesn't need to know about auth, SSL, or security - the platform handles it automatically.

OAuth integration (GitHub, no rolling your own crypto) Automatic SSL (Let's Encrypt + Traefik) JWT-based SSO with proper security headers Centralized secret management Container hardening (distroless images, read-only filesystems)

The AI coding workflow now:

Generate your app with LLM (focus on the actual logic) Push to git App is live with proper authentication and SSL

Tech stack:

Go/Fiber backend with security middleware PostgreSQL + Redis for sessions Preact frontend (3kb) Traefik for reverse proxy + SSL

We can now deploy dozens of AI-generated tools without thinking about the infrastructure layer. LLM mini apps go from generation to secure deployment in minutes instead of days. What's next:

LDAP/SAML integration (enterprise teams are asking for this) LLM-powered deployment agent (auto-generate Dockerfile/config from codebase) Enterprise SSO and compliance features Better monitoring and CI/CD integration

The codebase is early but functional. We've been using it to deploy ~15 AI-generated internal apps without security headaches. Perfect for teams that want to rapidly deploy AI-generated mini apps without compromising on security. Enterprise-ready architecture with startup simplicity. Would love feedback on the approach - is this solving a real problem in the AI coding workflow?

https://github.com/citizenteam/citizen
by leidenfrost | 2025-08-05 20:19:38+00:00
But it's not.

What you're referring to, is the basic concept of thermodynamic calorie in/calorie out. Yes, you can "just" reduce food and lose weight if you hit deficit numbers.

But if you don't do it correctly, you'll feel like trash, you'll suffer bad cravings, and put yourself in a stressful mental situation for days, possibly putting your job at risk.

You have to:

- Eat less than what you're already eating

- But enough to nourish yourself so you keep being in good shape for your work and hobbies

- Manage hunger

- Make the change sustainable so you can keep doing it for the rest of your life.

It's specially hard when your work is entirely sedentary, you live alone and, ironically, when you have a salary that let's you order food every day.

A lot of people don't have it hard. Maybe because they have someone cooking for them at home, because they meal prep the entire week, or because their work is so physically intensive they can just wing it and burn everything with what they need to do for a living anyway.
by duskwuff | 2025-08-05 20:19:44+00:00
> Why can’t extensions be a standalone thing in the store?

1) Because then you need a whole parallel set of processes for configuring, updating, and uninstalling those things, distinct from the existing processes for apps. And you need to make that process accessible to users who may be used to everything being an app.

2) A nontrivial number of browser extensions on iOS are part of standalone apps anyway, like password managers or bookmarking tools. It'd be very strange to have both app-with-browser-extensions and browser-only-extensions, or to require some extensions to be installed and updated in tandem with a companion app for expected functionality.
by Levitz | 2025-08-05 20:19:46+00:00
Not every boundary is worth pushing.

I'm hoping it will eventually become better, or maybe I haven't quite seen stuff prompted properly yet, but all I've heard coming from an AI feels aggressively mediocre and average, not in a "bad" way but in the "optimizing towards being palatable to the average person" way. Like the perfect McDonalds meal that the algorithm has found out can be 30% sawdust and still feel appetizing. I don't want that boundary being pushed. I feel we will live in a worse world if we do.
by albertzeyer | 2025-08-05 20:19:55+00:00
> Once someone hits AGI/SGI

I don't think there will be such a unique event. There is no clear boundary. This is a continuous process. Modells get slightly better than before.

Also, another dimension is the inference cost to run those models. It has to be cheap enough to really take advantage of it.

Also, I wonder, what would be a good target to make profit, to develop new things? There is Isomorphic Labs, which seems like a good target. This company already exists now, and people are working on it. What else?
by jaredklewis | 2025-08-05 20:20:03+00:00
I think we agree, just I would stipulate that I have to see a an abstraction a lot to internalize it (internalize is a great word for this btw).

Like way more than the rule of 3. Even a dozen uses (if it’s only going to be local to just that particular project) is not enough for me.

Edit: and maybe this just says more about the kinda of languages I use at work, but I feel the conventional, widely understood, idiomatic way to do lots of things is often heavy on boilerplate. If these languages were rewritten from the ground up I imagine with hindsight the core languages and standard libraries would look pretty different and be more ergonomic.
by nosignono | 2025-08-05 20:20:06+00:00
> Do people play video games to look at pretty scenery?

Yes.

> No most people are testing skills in video games

That's not mutually exclusive with playing for scenery.

Games, like all art, have different communities that enjoy them for different reasons. Some people do not want their skills tested at all by a game. Some people want the maximum skill testing. Some want to experience novel fantasy places, some people want to experience real places. Some people want to tell complex weaving narratives, some people want to optimize logistics.

A game like Flower is absolutely a game about looking at pretty scenery and not one about testing skill.
by chowells | 2025-08-05 20:20:06+00:00
Once again... The instruments reported the hull was no longer safe for use before the start of the last dive. That was well before the implosion. You keep ignoring this part to focus on how there was no engineering that would suggest that those instruments would actually give early warning. I'm halfway there with you. It is actually a surprise that they reported it was unsafe before the dive. But they did, and that makes the subsequent human failures even more egregious.
by Dylan16807 | 2025-08-05 20:20:16+00:00
> You still didn’t answer the question. Do you want to make it illegal for:

Perhaps telling Google they can do one or the other but not both. Or not both unless they want to treat it like an acquisition.

Again I'm taking it as a given that it's fine to restrict company actions. If you dislike that entire concept then take it up with the people that put FTC in charge of acquisitions, not me. Not every willing transaction should be legal.

> The reason that this shit show happened in the first place is because overzealous lawmakers and regulators put policies in place without thinking through the consequences.

Only if they allow this to succeed. If they slap it down then no company will attempt it again. They'll just file for acquisition.

> What exact policies and guidelines should they put in place?

I refuse. You're asking an unreasonable amount of detail from me.

> Figma/Adobe’s case

If they want to make individual job offers and not try to negotiate group things or talk to figma at all then they can go ahead and try.

I'd be surprised if they didn't already do that.

> In the current political environment, the best way to get FTC to approve a merger is to bribe the President (see Paramount). The way to make sure it doesn’t get approved is to do something the President doesn’t like. Do you really want to give this government mire power?

Even with the risk of corruption I prefer regulating acquisitions to allowing everything.
by xg15 | 2025-08-05 20:20:48+00:00
> Passkeys takes the view that social engineering and malware attacks cannot be prevented so long as the secret is retrievable from the HSM into an unmanaged file, clipboard, etc.

Yeah, I know that Passkeys takes that view. I'm questioning that view.

We have precedent in form of SSH, PGP, S/MIME, TLS client certificates (or actually even just regular TLS certificates) and all kinds of crypto wallets. Have there been any actual studies how many private keys in those systems were sucessfully exfiltrated through phishing?

Because this justification sounds an awful lot like an excuse for lock-in and control creep - like the mandatory auto-updates that were also promoted in the name of security and now are frequently used to push through anti-features that go against the interests of the users.
by theamk | 2025-08-05 20:20:50+00:00
That's because finding out the mistakes in OP is one of the biggest benefits of the public comment section. Let's say I read a post about how NEW-TECH is so much better that the current state of the art. I may now be convinced to try it, but how do I know what's written in OP is not omitting serious downsides? That's where the HN (and other fora) comes in: read the comments and see if there are any problems with it.

And according to the golden rule, this means I should also focus on negative comments. If someone told me an important NEW-TECH-1 downside in the past, and I see NEW-TECH-2 and I know its downside (maybe because I had to try it at work, maybe because I am an expert in the area), then I better hop in and post that.

Positive experiences are also useful, but they feel redundant: after all, if OP is positive about NEW-TECH, it likely already mentions all the good things already.

(note that "OP" is original post, not original poster. Arguing against people on internet is almost always a bad idea. Arguing against specific posts is much better.)
by mchiang | 2025-08-05 20:21:30+00:00
Thanks for the kind words.

Since the new multimodal engine, Ollama has moved off of llama.cpp as a wrapper. We do continue to use the GGML library, and ask hardware partners to help optimize it.

Ollama might look like a toy and what looks trivial to build. I can say, to keep its simplicity, we go through a deep amount of struggles to make it work with the experience we want.

Simplicity is often overlooked, but we want to build the world we want to see.
by hvb2 | 2025-08-05 20:22:03+00:00
Just to state a fact.

Article 5 of NATO (an attack on one is an attack on all) has only been invoked once, by the US. So why did NATO members send their militaries to Afghanistan?

The real reason is that most conflicts never happen. Or are resolved before ending in a full war. Either the US or a European NATO country sending in troops would muddy the conflict so much that the risk of escalation is huge.
by staplung | 2025-08-05 20:22:44+00:00
As others have pointed out, this is as much about learning C as it is about making a Lisp.

If you're interested in the latter, Peter Norvig has a little project that builds a stripped down Scheme interpreter in python. Takes some shortcuts, provides only a few functions (about 30) to its environment and only recognizes 5 special forms (`quote`, `if`, `define`, `set!`, and `lambda`) but the whole thing is less than 150 lines and very informative if you're new to that kind of thing.

https://norvig.com/lispy.html
by derefr | 2025-08-05 20:22:54+00:00
> It'd be nice if something like protobuf was easier to write and read in a schemeless fashion.

If you just want a generic, binary, hierarchical type-length-value encoding, have you considered https://en.wikipedia.org/wiki/Interchange_File_Format ?

It's not that there are widely-supported IFF libraries, per se; but rather that the format is so simple that as long as your language has a byte-array type, you can code a bug-free IFF encoder/decoder in said language about five minutes.

(And this is why there are no generic IFF metaformat libraries, ala JSON or XML libraries; it's "too simple to bother everyone depending on my library with a transitive dependency", so everyone just implements IFF encoding/decoding as part of the parser + generator for their IFF-based concrete file format.)

What's IFF used in? AIFF; RIFF (and therefore WAV, AVI, ANI, and — perhaps surprisingly — WebP); JPEG2000; PNG [with tweaks]...

• There's also a descendant metaformat, the ISO Base Media File Format ("BMFF"), which in turn means that MP4, MOV, and HEIF/HEIC can all be parsed by a generic IFF parser (though you'll miss breaking some per-leaf-chunk metadata fields out from the chunk body if you don't use a BMFF-specific parser.)

• And, as an alternative, there's https://en.wikipedia.org/wiki/Extensible_Binary_Meta_Languag... ("EBML"), which is basically IFF but with varint-encoding of the "type" and "length" parts of TLV (see https://matroska-org.github.io/libebml/specs.html). This is mostly currently used as the metaformat of the Matroska (MKV) format. It's also just complex enough to have a standalone generic codec library (https://github.com/Matroska-Org/libebml).

My personal recommendation, if you have some structured binary data to dump to disk, is to just hand-generate IFF chunks inline in your dump/export/send logic, the same way one would e.g. hand-emit CSV inline in a printf call. Just say "this is an IFF-based format" or put an .iff extension on it or send it as application/x-iff, and an ecosystem should be able to run with that. (And just like with JSON, if you give the IFF chunks descriptive names, people will probably be able to suss out what the chunks "mean" from context, without any kind of schema docs being necessary.)
by skeledrew | 2025-08-05 20:23:21+00:00
Oh there's also part c where, once a or b happens, it'll clear the way for quality non-SEO content by creators who just want to share with 0 expectation of any return, which will finally see light once the return-optimized stuff has died or been walled away. The internet will be back to how it was before and meant to be with content shared for fun and/or interest, not profit, taking the front scene.
by rglover | 2025-08-05 20:23:22+00:00
Well, considering that the drug was originally developed not for weight loss but for type 2 diabetes management, it's not terribly radical to be skeptical or outright dismissive of it as some miracle weight loss drug (even if that is a consistent side-effect).

The whole rush to get people on the thing feels like an opportunistic pharma grab (because it is). The outcome of those sorts of things is never in favor of the individual or their well being.
by matthewfcarlson | 2025-08-05 20:24:08+00:00
> Created in collaboration with labels, publishers, and artists, Eleven Music is cleared for nearly all commercial uses, from film and television to podcasts and social media videos, and from advertisements to gaming. For more information on supported usage across our different plans, head here.

Not sure what that actually means but it suggests they at least tried to get their training material legally.
by Quarrelsome | 2025-08-05 20:24:12+00:00
I think its more effective at lowering the floor. The amount of people that can't code at all but can now slap something together makes it a huge step forward. Albeit one that mostly steps on a pile of dogshit after it hits any sort of production reality.

Its like Wordpress all over again but with people even less able to code. There's going to be vast amounts of opportunities for people to get into the industry via this route but its not going to be a very nice route for many of them. Lots of people who understand software even less than c-suite holding the purse-strings.
Ask HN: Theoretical Strategies for Mitigating GEO?
by ptrhvns | 2025-08-05 20:24:27+00:00
Since GEO (Generative Engine Optimization) is already becoming a thing, I figure it's time to start thinking about countermeasures. I'm curious on a personal level (I have things I do to try and avoid SEO sites with low value), but interested in hearing about bigger ideas too. What are your thoughts?