MurphyA/hacker-news huggingface dataset:
by sholladay | 2025-08-07 15:46:21+00:00
From a design perspective, the reason this flaw exists is because the code can be typed on any machine and sent through any intermediary. More secure schemes are possible without much effort. Magic links have some pros/cons but overall I think they are better.

Here is what I do when the user logs in and email verification is needed:

1. Generate a UUID on the server.

2. Save the UUID on the client using the Set-Cookie response header.

- The cookie value is symmetrically encrypted and authenticated via HMAC or AES-GCM by the server before it is set, such that it can only be decrypted by the server, and only if the cookie value has not been tampered with. This is very easy to do in hapi.js and any other framework that has encrypted cookies.

- Use all the tricks to safeguard the cookie from being intercepted and cloned. For example, use a name with the __Host- prefix and these attributes: Secure; HttpOnly; SameSite=Lax;

3. The server sends an email to the user with a link like https://site.com/verify?code=1234, where 1234 is the UUID.

4. The user clicks the link and has their email verified.

- When the link is clicked, the browser sends the Cookie header automatically, the server decrypts it and compares it to the UUID in the URL and if that succeeds, the email has been verified. Again, this is very easy in hapi.js, as it handles the decryption step.

- Including the UUID in the magic link signals that there is _supposed_ to be a cookie present, so if the cookie is missing or it doesn't match, we can alert the user. It also proves knowledge of the email, since only the email has access to the UUID in unencrypted form.

5. The server unsets the cookie, by responding with a Set-Cookie header that marks it as expired.

6. The server begins a session and logs the user in, either on the page that was opened via the link or the original page that triggered the verification flow (whichever you think is less likely to be an attacker, probably the former).

Note that there are some tradeoffs here. The upside is that the user doesn't need to remember or type anything, making it harder to make mistakes or be taken advantage of. The downside is that the friction of having to use the same device for email and login may be a problem in some situations. Also, some email software may open a different browser when the link is clicked, which will cause the cookie to be missing. I handle this by detecting the missing cookie and showing a message suggesting the user may need to copy-paste the link to their already open browser, which will work even if they open a new tab to do it (except for incognito mode, where some browsers use a per-tab cookie jar).

Lastly, no cookie is 100% safe from being stolen and cloned. For example, a social engineering attack could involve tricking the user into sharing their link and Set-Cookie header. But we've made it much more difficult. They need two pieces of information, each of which generally can't be intercepted, or used even if intercepted, by intermediary sites.
by paulrpotts | 2025-08-07 15:46:29+00:00
I will not forget Argo AI trying to convince me that if I stayed with the company for four years, by then my equity would be worth an estimated $700,000. I made it just over a year in stressful, high-pressure environment, with a toxic manager; I knew it was time for my weekly one-on-one because my heart rate monitor would start giving me warnings. He loved to humiliate individual employees in our scrum team meetings; at one point I called him out on it and demanded that he apologize for his unprofessional bullying. He actually did, but our working relationship was never good after that.

Anyway, my enormous efforts and long hours got me a "meets expectations" review. The company imploded just after I completed that first year, and so my equity was worth nothing. Good times!
by bigstrat2003 | 2025-08-07 15:46:38+00:00
That argument seems to have been proven basically correct, given that a ton of open source development happens only because companies with deep pockets pay for the developers' time. Which makes perfect sense - no matter how altruistic a person is, they have to pay rent and buy food just like everyone else, and a lot of people aren't going to have time/energy to develop software for free after they get home from their 9-5.
by dspillett | 2025-08-07 15:46:57+00:00
That is an odd case.

I'd still call it a 32-bit CPU as it had 32-bit registers and instructions (and not just a few special case 32-bit instructions IIRC). Like the 386SX it had a 16-bit external data bus, but some of its internal data routes were 16-bit also (where the 386SX had the full 32-bit core of a 386, later renamed 386DX, with the changes needed to change the external data bus) as were some of its ALUs hence the confusion abaout its bit-ness.
by accrual | 2025-08-07 15:46:57+00:00
Yep. No web search. No ads or news or weather or links to apps that aren't actually installed. Opens virtually instantly. Lots of stock customization options (icon size, icon order, pinned icons, classic vs XP style, all shortcuts toggleable).

The only thing I miss is the search bar - I became quite used to that with Windows 7.
by ratelimitsteve | 2025-08-07 15:47:01+00:00
I suppose I assumed you were defending the position when you were merely defining it. My mistake there. As a USican we also have really weird age of consent laws where it's like "16 is okay for everything, but you have to be 18 to document it, and if one of you is over 18 then the other has to be over 18 unless you're close to over 18 (the definition of "close to" being something that varies state by state) or my personal favorite which is that in many states there are no age restrictions to marriage if the minor's parents consent.

I just wanted to focus on this one because at the bottom of it is an effort to make it illegal to follow the law but in a cheeky way. That, I think, is the part that UK culture has that US doesn't. As a rule we're generally encouraged to find ways to adhere to the letter of the law but not the spirit, it's considered clever.
by FrankWilhoit | 2025-08-07 15:47:16+00:00
This phenomenon has nothing to do with the details of the anecdotes and everything to do with Coase's ceiling. This is the threshold above which an organization is paralyzed by internal friction and can no longer execute any mission; all it can do is just be an organization. The anecdotes follow from the realization that everything the organization does is meaningless, therefore "LOL nothing matters".
by gus_massa | 2025-08-07 15:47:56+00:00
Hi from Argentina! Is that close enough?

If you put one of these here in Buenos Aires, I expect it to dissapear in an hour.

But a long time ago I went with my wife for a few weeks to a small town in the mountais in the Cordoba(AR) province. We left the bikes unchained an unatended for hours. I expect a honesty box to be possible there. Except during weekends, when it get's full of turists.
by seanhunter | 2025-08-07 15:49:16+00:00
Cool article.

A couple of things which might not be obvious to people who haven't used monte carlo simulators in practise.

1) The fact that a prng is weak[1] and that the MC is deterministic given a particular seed is almost always a good thing. You want the thing to be as fast as possible and you're going to run a lot of paths. Secondly you very often need repeated runs to give the same result. For example say you're using an MC method to price something, you want exactly the same price every time otherwise you'll get some p&l noise every day arising purely from the difference in the random sequence. That's not what you want.

2) Low-discrepancy sequences like Sobol sequences take this one step further because they don't even pretend to be random, because they give better coverage of the search space for a given number of paths so you can use fewer paths. However, if your path evaluation is cheaper than generating the Sobol sequence then you probably just want to use a normal PRNG and more paths rather than a Sobol sequence. Say there is a bullseye hidden somewhere in a circle and to find the circle you need to throw a dart at it and if the dart lands near to the bullseye you get some feedback. One approach would be to precisely divide the circle into squares and carefully aim each dart to land in a different square (this is a low-discrepancy sequence). But another way is just to throw a lot of darts quickly and not really care where they go (this is the lots of paths approach).

[1] in the Cryptographic sense. Generating even weak random variates is slow especially if you need them to satisfy some property like being distributed in a particular way. Say you're trying to simulate the path of the snp 500. For each path you're simulating 500 stocks so you might be running say a million paths and each path will need 500*x random numbers. That computation time adds up pretty quickly. Cryptographically random numbers are extremely expensive computationally and you don't care about any of the strong cryptographic properties for this.
by jhp123 | 2025-08-07 15:49:33+00:00
> I don’t even know what to call someone who thinks the government should give private parties discretionary grants and contracts, but shouldn’t be able to use those to influence private actors.

The idea that the sovereign should be limited to follow law, due process, and the advice of experts in the administration of grants goes back at least to the magna carta and is so widespread that you would use a more specific term — a "constitutional monarchist", "republican", "democrat", or "democratic socialist", etc., would all agree on this point. The opposite point of view however, has a name — authoritarian — so you could call such a person "anti-authoritarian".
by drivers99 | 2025-08-07 15:49:41+00:00
"minute" is also "small"

pars minuta prima (first small part) -> minute (1/60th of a circle, or of an hour)

secunda minuta -> second (1/60 of a minute)

minutus -> minute (adj), "very small in size or degree, diminutive or limited, petty"

source: etymonline
by thewebguyd | 2025-08-07 15:50:05+00:00
> More people subscribe to/play with a $20/m service than own/admin state-of-the-art machines?! Say it ain't so /s

The problem is, $20/m isn't going to be profitable without better hardware, or more optimized models. Even the $200/month plan isn't making money for OpenAI. These companies are still in the "sell at a loss to capture marketshare" stage.

We don't even know if being an "AI Company" is viable in the first place - just developing models and selling access. Models will become a commodity, and if hardware costs ever come down, open models will win.

What happens when OpenAI, Anthropic, etc. can't be profitable without charging a price that consumers won't/can't afford to pay?
by mock-possum | 2025-08-07 15:50:20+00:00
You are basically dead wrong about adult men not being able to live together. I don’t know where you’re getting your information from, but I am an adult man who has lived most of his adult life with other adult men, and I have fucking loved it. I spent my 20s living with two of my best male friends and those were some of the best years of my life!

Plus, I know you probably don’t mean it this way, but - your phrasing basically invalidates every same-sex partnership. Again, here I have spent the last ten years living with my partner, and we are both of us adult men. Clearly adult men can live together.

I think that maybe you just need to meet better men - your beliefs about gender stink.
by owenversteeg | 2025-08-07 15:50:30+00:00
This drug is for presbyopia (near things blurry) not myopia (far things blurry) but as these threads tend to discuss both, I will share something I read on HN many years ago that reversed my myopia: near-far focusing while outdoors. Just focus on something at >50 foot distance, focus on your finger right in front of your eye, near, far, near, far focusing just a few times. This completely reversed my early-stage myopia and my eyesight has been 20/20 for years since.

I (and others) make this comment on HN from time to time: https://news.ycombinator.com/item?id=38794682 - hopefully it helps others.
by salemh | 2025-08-07 15:51:01+00:00
https://blackrockvanguardwatch.com/

"the Big Three do exert the voting rights attached to these shares. Therefore, they have to be perceived as de facto owners by corporate executives. These companies have, in fact, publicly declared that they seek to exert influence. William McNabb, chairman and CEO of Vanguard, said in 2015 that, 'In the past, some have mistakenly assumed that our predominantly passive management style suggests a passive attitude with respect to corporate governance. Nothing could be further from the truth.' When we analysed the voting behaviour of the Big Three, we found that they coordinate it through centralised corporate governance departments. Hence, just three companies wield an enormous potential power over corporate America." (source, also this). In effect Vanguard and Blackrock forgo taking large fees in exchange for having enormous ability to exert power over the economy through influence on corporate boards and leadership. This power that is subject to little public awareness or accountability. This page gives a quick visual overview of it.

https://archive.ph/bFE8h

Larry Fink: "The behavior is going to have to change… this is something we’re asking companies. You have to force behavior. At BlackRock, we are forcing behaviors.”

https://theconversation.com/these-three-firms-own-corporate-...

In a recently published paper, our CORPNET research project comprehensively mapped the ownership of the Big Three. We found that the Big Three, taken together, have become the largest shareholder in 40% of all publicly listed firms in the United States.
by chipsa | 2025-08-07 15:51:12+00:00
More advanced EVSEs are capable of adjusting the power delivered based on the power available. It does require a sensor on the supply cables to determine how much power is being used, but it's technically capable without a service upgrade. Also, electric companies will frequently upgrade an old 50/100 amp service to 200 amp for low or no cost (because they figure you'll pay off the cost of doing so through more power usage). The panel side of the service upgrade will cost you, but then you'll be able use the toaster oven at the same time as the A/C.
by johnnyjeans | 2025-08-07 15:51:33+00:00
As I understand it, people have a higher priority of maintaining affiliation with social groups (of which, political parties are an example) than they have a commitment to any given personal view. It varies based on context, the person, etc. and is obviously a complex phenomenon. But the default operating mode of the human being is to toe the line and to (genuinely) change their views based on where their self-identified in-groups are heading. Mob mentality, group think, etc. All sides of the same coin.

Rhetoric is empty. Always.
by jeffbee | 2025-08-07 15:51:51+00:00
It only seems like a bubble if you think this is that much of an outlier. $750k a year for 2 years is a lot, but it's not an outrageous grant rate for technical staff. It's high but not like 10x high. If it was actually a $1.5m bonus like the headline suggests, then that would be crazy.
by simoncion | 2025-08-07 15:52:23+00:00
Let's see if surrounding that URL in the URL-surrounding character pair helps the HN linkifier:

<https://www.discogs.com/artist/207714-!!!>

Edit: It does. So, this would be yet another of the squillion-ish examples to support the advice "Please, for the love of god, always enclose your URLs in '<>'.". (And if you're writing a general-purpose URL linkifier, PLEASE just assume that everything between those characters IS part of the URL, rather than assuming you know better than the user.)
by rickdeckard | 2025-08-07 15:52:26+00:00
There is no evidence the CEO was personally responsible, there was a case for that export violation of Cadence Design Systems and the case was closed.

The case details outline pretty well what happened [0], the company supported the investigations and plead guilty to the charges.

The letter from Sen. Tom Cotton [1] is reasonable ("In the interest of transparency and national security, I respectfully request a response to the following questions by August 15, 2025. (..)"),

the Judge/Jury/Executioner approach of the POTUS attacking the entire Intel company is not.

[0] https://www.justice.gov/opa/pr/cadence-design-systems-agrees...

[1] https://www.cotton.senate.gov/news/press-releases/cotton-to-...
by dspillett | 2025-08-07 15:52:58+00:00
> You mean something like a popover preview

That, or a background process that visits links to check for malware before the user even sees the message.

> Isn’t there a way to configure the `a` element so the UA knows that it shouldn’t do that?

If sending just HTML you could include rel="nofollow" in the a tag to discourage such things, bit there is no way of enforcing that and no way of including it at all if you are sending plain text messages. This has been a problem for single-use links of various types also. So yes, but not reliably so effectively no.
by BeFlatXIII | 2025-08-07 15:53:07+00:00
I'm a radicalized intellectual property abolitionist. The ethical issue with scraping is the DDoS-like nature it has on smaller sites and running up the bandwith bill for medium hosts. There's no individual compnay at fault for the flood. Rather, it's an emergent result of each startup attempting to train data that's ever so slightly more up-to-date or broad than its competitors. If they shared a common corpus that updated once per month, scraping traffic would be buried in organic human visitors instead of the other way around. Let them compete on training methodology, not a race for scraping.
by thewebguyd | 2025-08-07 15:53:20+00:00
The problem is there's a huge gap between "We are a small company, and don't care about SSO" and Enterprise.

The company I work for is in the middle - anything where SSO is gated behind "Enterprise" is not even considered by us. We don't need 90% of the other "features" under the Enterprise plans, and most aren't willing to custom quote us for Basic+SSO.

Withhold it from free versions, sure - but definitely don't lock SSO only behind the most expensive option.
by wahern | 2025-08-07 15:53:22+00:00
The Kerch Strait Bridge (aka Crimean Bridge) still stands despite repeated directed hits, albeit occasionally disrupting traffic for extended periods during repairs. The resilience of a bridge during conflict is matter of engineering and defensive tactics. But it does pose the question of whether a large suspension bridge is generally more difficult or easier to defend and repair than a very long box girder bridge.
by GMoromisato | 2025-08-07 15:53:33+00:00
I used to do a 5 year stint working at a software company, saving up money, then 5 years working on my games. Rinse, repeat.

I got lucky a couple of times, so this won't work for everyone. But working a "real" job to fund your passion projects is as old as DaVinci taking commissions to fund his research.
by paxys | 2025-08-07 15:53:37+00:00
Zuckerberg deserves a mountain of critisism for everything he has done, but one thing I'll give him is that he doesn't hesitate to get out his checkbook and pay absurd amounts of money for engineering talent.

Back when Apple, Google, Adobe, Intel and other big tech companies signed illegal anti-poaching agreements Zuck said no, I'll pay whatever it takes to attract the best talent, no matter where they work.

Facebook/Meta has consistently set the bar for engineering salaries across the industry, and Google and the rest are forced to match it.

Now every AI company is paying millions of dollars for regular engineers just because Zuck is out there throwing out wads of cash from the roof.

When it comes to salaries the man simply does not care about standards and precedents, and I love that.
by ralferoo | 2025-08-07 15:53:40+00:00
Some of these seem iffy. Looking at one at random with a seemingly excessive increase:

Coursera: $399 per u/y -> $49875 per year [7], 12400%

So, I check out the footnote:

[7] Coursera requires a minimum of 125 users to access SSO pricing. As they do not have an Enterprise price listed, this price just scales their lower cost tier up to 125 seats.

Dividing by 125 shows the SSO pricing is $399, so exactly the same as the non-SSO pricing. I fail to see how this is an SSO tax.

It might be that there is an SSO tax as the Enterprise price wasn't available to them, but listing it as 12400% increase seems like a deliberate attempt at deception.
by stubish | 2025-08-07 15:54:43+00:00
Keep employees in the short term. After 2 years, employees can retire comfortably. When the salary becomes irrelevant, you can hang around for more beach homes doing what the boss wants and keeping your work proprietary to the company, or quit and do whatever you want and do whatever you want with it.

Or maybe the golden handcuffs are heavier than what the article makes out.
by pornel | 2025-08-07 15:55:24+00:00
(I've worked on both codecs and compilers. You may be underestimating the difficulty of implementing sound optimizers).

Hardware vendors don't benefit from the patent pools. They usually get nothing from them, and are burdened by having to pass per-unit licensing costs on to their customers.

It's true that designing an ASIC-friendly codec needs special considerations, and benefits from close collaboration with hardware vendors, but it's not magic. The general constraints are well-known to codec designers (in open-source too). The commercial incentives for collaboration are already there — HW vendors will profit from selling the chipsets or licensing the HW design.

The patent situation is completely broken. The commercial codecs "invent" coding features of dubious utility, mostly unnecessary tweaks on old stuff, because everyone wants to have their patent in the pool. It ends up being a political game, because the engineering goal is to make the simplest most effective codec, but the financial incentive is to approve everyone's patented add-ons regardless of whether they're worth the complexity or not.

Meanwhile everything that isn't explicitly covered by a patent needs to be proven to be 20 years old, and this limits MPEG too. Otherwise nobody can prove that there won't be any submarine patent that could be used to set up a competing patent pool and extort MPEG's customers.

So our latest-and-greatest codecs are built on 20-year-old ideas, with or without some bells and whistles added. The ASICs often don't use the bells and whistles anyway, because the extra coding features may not even be suitable for ASICs, and usually have diminishing returns (like 3x slower encode for 1% better quality/filesize ratio).
by georgemcbay | 2025-08-07 15:55:27+00:00
I don't often comment on HN in either of these cases but... I think aspects of both things are true.

There is a serious AI bubble right now and also it is the norm in the startup/VC world to fuck over regular employees.

I'm happy for any normal people who got 1.5M here. But even in this case I believe this has more to do with weird poaching politics (and hype building) than it does being legitimately altruistic.