MurphyA/hacker-news huggingface dataset:
Show HN: Phofee – Photography social platform built with Svelte 5
by LandenLove | 2025-08-18 13:18:27+00:00
Hello everyone! For the past few months I have been working on Phofee, a social platform for sharing high quality photos.

The goal: Make a website that allows users to easily upload, share, and discover photos without having to sacrifice quality or mangle their images.

Phofee allows users to upload multiple images of varying aspect ratios. All sub images in a single post are displayed in a small photo gallery, so all your photos can be seen at a glance.

One of Phofee's unique features is the automatic extraction of photo metadata. When a user uploads a photo, metadata such as Camera Model, Lens, Aperture, ISO, and shutter speed are displayed under your photo. This way, other photographers can gain better insight into your creation process and learn from it.

For this project, I took privacy very seriously. - All metadata is deleted from user's photos before posting. - We store minimal user information. - We don't store user passwords (by using Google OAuth). - We don't use Google Analytics. (We do use Google Search Console)

Please feel free to ask any questions or leave feedback and I will try my best to respond.

Thank you.

p.s., I made an effort to follow the 'progressive enhancement' methodology of Svelte. So most of Phofee should be usable without JavaScript.
by lillecarl | 2025-08-18 13:18:32+00:00
I've been reading through how many NixOS modules use systemd units and there's a lot of scripts being executed, the final line execs the service (if there is one, NixOS uses systemd for maintenance tasks, refreshing certificates and many more things). While NixOS doesn't speak for the broader community what I'm trying to say is that it can execute anything, if that's a script or a daemon doesn't matter as long as it works for you.

Thanks for the sysV explanation, it sounds worse to me.
by brabel | 2025-08-18 13:18:34+00:00
Do you have any open source code you can share that demonstrates the kind of application you wouldn't be able to get the desired performance in Go/OCaml/Dart?

I ask because I've seen Dart beat Java/Go/D (very high memory throughput, no idea what Dart is doing differently but it's amazingly good at it)... but I can imagine that if you only perform numerical computation, Dart may miss optimisations that will make it slower (normally, it will be optimised to approximately the same as you'd written in C, but in some cases it can hit the "slow path" - those are getting less and less every release, and if you provide an example the Dart team would likely be happy to fix that).
by xnorswap | 2025-08-18 13:19:22+00:00
I've been watching a twitch streamer vibe-code a game.

Very quickly he went straight to, "Fuck it, the LLM can execute anything, anywhere, anytime, full YOLO".

Part of that is his risk-appetite, but it's also partly because anything else is just really furstrating.

Someone who doesn't themselves code isn't going to understand what they're being asked to allow or deny anyway.

To the pure vibe-coder, who doesn't just not read the code, they couldn't read the code if they tried, there's no difference between "Can I execute grep -e foo */*.ts" and "Can I execute rm -rf /".

Both are meaningless to them. How do you communicate real risk? Asking vibe-coders to understand the commands isn't going to cut it.

So people just full allow all and pray.

That's a security nightmare, it's back to a default-allow permissive environment that we haven't really seen in mass-use, general purpose internet connected devices since windows 98.

The wider PC industry has got very good at UX to the point where most people don't need to worry themselves about how their computer works at all and still successfully hide most of the security trappings and keep it secure.

Meanwhile the AI/LLM side is so rough it basically forces the layperson to open a huge hole they don't understand to make it work.
by marcusfrex | 2025-08-18 13:19:23+00:00
Switchborn is a captivating weekly podcast hosted by Harun Esur (aka Marcus Frex), a cybersecurity expert and underground persona who emerged from decades of anonymity to share his unfiltered memories.

Blending cyberpunk introspection, rebellious wisdom, and raw storytelling, Switchborn invites listeners to explore the hacker ethos: walk to the edge of the post-quantum desert, follow the star, and let the challenges forge you or not.

Perfect for thinkers, and rebels seeking depth beyond the screen. Tune in for Marcus's evolving tales of control, chaos, and digital freedom.
by gherkinnn | 2025-08-18 13:19:30+00:00
Agents execute code locally and can be very enthusiastic. All it takes is bad access control and a --prod flag to wipe a production DB.

The nature of code reviews has changed too. Up until recently I could expect the PR to be mostly understood by the author. Now the code is littered with odd patterns, making it almost adversarial.

Both can be minimised in a solid culture.
by vlaaad | 2025-08-18 13:20:29+00:00
Not true, structured outputs enforce output formats with 100% reliability, e.g., https://platform.openai.com/docs/guides/structured-outputs says "Structured Outputs is a feature that ensures the model will always generate responses that adhere to your supplied JSON Schema, so you don't need to worry about the model omitting a required key, or hallucinating an invalid enum value"
Show HN: A machine diary of a city that learns from errors
by line-27 | 2025-08-18 13:20:32+00:00
Premise: a fork-city that runs itself with invariants (unchangeable rules), quorums for any risky action, and a civic “Museum of Errors” (postmortems as exhibits). It’s told as a machine’s diary (short time-stamped logs).

Core ideas: • Reversibility > heroics • Blameless postmortems as a civic ritual • zk-audit windows for trust without oversharing

Looking for critique: what breaks first? which invariants are non-negotiable?

Links:

Landing: https://ilyacl.github.io/line27-site/

Chapter 1 jump: https://ilyacl.github.io/line27-site/Line27_Season1_EN.pdf?v...

Full PDF: https://ilyacl.github.io/line27-site/Line27_Season1_EN.pdf?v...
by panny | 2025-08-18 13:20:55+00:00
>Data mining doesn't mean the model is instantly updated

I'm not expecting instant. Even next week it won't be there. It's like how AI never learned to count how many times the letter r appears in strawberry. Like sure, now if you ask brave, it will tell you three, but that is only because that question went viral. It didn't "learn" anything, it was just hard coded for that particular answer. Ask it how many times the letter l appears in smallville and it will get it wrong again.
by pmarreck | 2025-08-18 13:21:19+00:00
I too have an odd obsession with keeping everything in 1 file.

I recently (as an experiment) exclusively vibe-coded an Asteroids clone (with a couple of nifty additions), all in a single HTML file, including a unit test suite, which also works on either desktop or mobile: https://github.com/pmarreck/vibesteroids/blob/yolo/docs/inde...

Playable version (deployed via github docs) is here: https://pmarreck.github.io/vibesteroids/ Hit Esc to pause and see instructions (pause should be automatic on mobile; can re-pause by tapping top center area).

Type shift-B (or shake mobile device... you also would have had to approve its ability to sense that on iOS) to activate the "secret" ability (1 per life)

No enemy UFO's to shoot (yet) but the pace does quicken on each level which feels fun.

It doesn't update itself, however... (and I just noticed it has a test fail, and a test rendering bug... LOL, well at least the tests are valid!)
by novoreorx | 2025-08-18 13:21:32+00:00
Thank you for bringing this issue to my attention. I forgot to publish it to GitHub Pages, which caused the reorx.github.io/asciitreeman link to be inactive (I've just fixed that). However, the main link for this news should be working, as it is deployed on Cloudflare. If you cannot see it, it is likely an edge CDN problem with Cloudflare.
by dangus | 2025-08-18 13:22:47+00:00
> you and GP don't mention any evidence for why that is due to specifically using next token prediction as a mechanism.

Again, inverted burden of proof. We don’t have to prove that next token prediction is unable to do things that it currently cannot do and has no compelling roadmap that would lead us to believe it will do those things.

It’s perhaps a lot like Tesla’s “we can do robocars with just cameras” manifesto. They are just saying that they can do it because humans use eyes and nothing else. But they haven’t actually shown their technology working as well as even impaired human driving, so the burden of proof is on them to prove naysayers wrong. Put up or shut up, their system is approaching a decade late from their promises.

To my knowledge Tesla is still failing simple collision avoidance tests while their competitors are operating revenue service.

https://www.carscoops.com/2025/06/teslas-fsd-botches-another...

This other article critical of the test methodology actually still points out (defends?) the Tesla system by saying that it’s not reasonable to expect Tesla to train the system on unrealistic scenarios:

https://www.forbes.com/sites/bradtempleton/2025/03/17/youtub...

That really gets back to my exact point: AI implemented the way it is today (e.g. next token prediction) can’t handle anything it has no training data for while the human brain is amazingly good at making new connections without taking a ton of time to be fed thousands of examples of that new discovery.
by cluckindan | 2025-08-18 13:22:55+00:00
A significant hindrance for generator-type apps is that only pages loaded via HTTPS have access to the clipboard API, so ”copy to clipboard” does not work via file:///.

You can have a zero-build zero-dependency offline-only app which users could theoretically just save as a page, but copy buttons will not work, so you have to detect the API not being available and replace buttons with popover textareas. Clunky.

As for running a local server, VS Code devcontainers are the solution. Open your workspace, it runs the devcontainer, and you have a server up without extra hassle. Add a command to generate certs and you can have HTTPS locally.
by aaronbaugher | 2025-08-18 13:23:51+00:00
It's unlikely that the people in that rural subdivision are driving two hours a day for work. In the US Midwest, you're rarely more than 30 minutes from a town large enough to have some jobs. For instance, there's a town of 1100 near me that has a veterinarian, general store, post office, gas station, auto mechanic, school, a couple bank branches, and so on, which all employ people, some at pretty good salaries. And within ten miles of that town, there are a couple of those little blocks of suburb-looking houses like you describe.

Or the people living in them might be retired, or work from home, or work on local farms. Whatever the case, they're not driving a long way for work.
by dogemurder | 2025-08-18 13:23:53+00:00
I really like this. If you ever plan an AMI with this, deploying hyperclay on maybe a t3 instance, installing Node.js via the package manager (https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-...), and then setting up the Hyperclay server using npm to handle requests, I think a lot of startups could be users. Would it be fair to say that Hyperclay could offer a lean way to rapidly prototype and iterate on MVPs, like landing pages, dashboards, or user-feedback-driven tools, where frontend changes (e.g., A/B testing UI elements) automatically update the underlying HTML source for instant deployment??

If it was marketed to startups to reduce development overhead by eliminating separate build pipelines or servers, allowing small teams to focus on core features rather than infrastructure, definite winner. Not sure how much your into AWS but this made me think of an AWS partner we use HostJane could use Hyperclay to help bundle cost-optimized spot instances for testing (mainly tech startup clients - https://www.hostjane.com), then push out a seamless CI/CD via CodePipeline, global distribution through CloudFront, Hyperclay could enable clients to scale from proof-of-concept to production affordably while maintaining full control over their app's evolution without vendor lock-in. Potentially doing away with complex databases or backend frameworks... amazing, well done!
by IAmBroom | 2025-08-18 13:24:01+00:00
I've deeply studied the apprentice programs in medieval Europe; your claims don't align with guild law, nor the motivations of the guilds themselves (to create protective but longterm market-satisfying services and goods; i.e. to stay in business and prevent cheap knockoffs, at the cost of inhibiting innovation).

Apprenticeships certainly weren't more abusive than the typical alternatives: serf labor, or servant jobs. (One of the key differences between servants and apprentices in medieval England, for instance, was that you weren't allowed to beat your apprentices.)

Often exploitative? Sure. Most power structures are. But it absolutely was a system that guaranteed rights to the worker, which made it rise far above most employment situations of that time.
by bluGill | 2025-08-18 13:24:08+00:00
What you are not wrong, this is misleading. We can say on hindsight what happened, but there is no way to know in advance it would have happened that way. There have been many times when equities have done very poorly for a short period of time. Any money you plan to spend in the near future should not be in equities, it should be in lower return investments like treasury bills, money market funds, or other similar investments that while they don't offer as good a return on investment also don't suddenly crash losing significant value for a few years.

Their real mistake was thinking the housing market would crash, which while not impossible seemed unlikely to most observers.
by altairprime | 2025-08-18 13:24:10+00:00
Editing it and replacing with “removed” or “.” is fine in these cases, since you can’t delete it once replied to; if the two hour edit window is closed, email the mods (footer contact) and ask them to autocollapse it for you.

(Fwiw, the mods are chill, and you could basically take that entire comment and ask it of them aggrieved-plaintively and they would try to be kind about that, so long as it’s not lashing out at them personally. Never feel like you have to be frustrated at community behavior here silently; either it’s an intentional thing or it’s something they’d like to address or once in a while they’re uncertain too, but you can always ask. I certainly do.)
by padolsey | 2025-08-18 13:25:44+00:00
Most of these attacks succeed because app developers either don’t trust role boundaries or don’t understand them. They assume the model can’t reliably separate trusted instructions (system/developer rules) from untrusted ones (user or retrieved data), so they flippantly pump arbitrary context into the system or developer role.

But alignment work has steadily improved role adherence; a tonne of RLHF work has gone into making sure roles are respected, like kernel vs. user space.

If role separation were treated seriously -- and seen as a vital and winnable benchmark (thus motivate AI labs to make it even tighter) many prompt injection vectors would collapse...

I don't know why these articles don't communicate this as a kind of central pillar.

Fwiw I wrote a while back about the “ROLP” — Role of Least Privilege — as a way to think about this, but the idea doesn't invigorate the senses I guess. So, even with better role adherence in newer models, entrenched developer patterns keep the door open. If they cared tho, the attack vectors would collapse.
by anonzzzies | 2025-08-18 13:25:50+00:00
Does it matter though? Programming was already terrible. There are a few companies doing good things, the rest made garbage already for the past decades. No one cares (well; consumers don't care; companies just have insurance when it happens so they don't really care either; it's just a necessary line item) about their data being exposed etc as long as things are cheap cheap. People daily work with systems that are terrible in every way and then they get hacked (for ransom or not). Now we can just make things cheaper/faster and people will like it. Even at the current level software will be vastly easier and faster to make; sure it will suck, but I'm not sure anyone outside HN cares in any way shape or form (I know our clients don't; they are shipping garbage faster than ever and they see our service as a necessary business expense IF something breaks/messes up). Which means that it won't matter if LLMs get better; it matters that they get a lot cheaper so we can just run massive amounts of them on every device committing code 24/7 and that we keep up our tooling to find possible minefields faster and bandaid them until the next issue pops up.
by immibis | 2025-08-18 13:26:22+00:00
Perhaps that's the reason this is getting misunderstood. The distinction between the government and parliament is technical within the UK political system. To everyone outside that system, the whole system is "the government".

It's the political version of someone pointing to a computer tower and saying "this CPU can hold all of your music" and then you (a computer technician) interject "actually the hard drive can hold all of your music".
by altairprime | 2025-08-18 13:26:29+00:00
It’s certainly how I advise my friends to act with therapists. Get treatment but never forget that they’re an agent of the state rather than your friend, and the state is humiliated by citizens who are suicidal and lashes out at them preemptively to protect its own image. The U.S. health care system is such that being committed is a worse fate guaranteed than the slightly increased risk of losing a friend for not receiving enough therapy. This stance slightly increases the chances of my friends surviving life here, because they’re more likely to confide in me that they need help knowing that I won’t immediately narc on them to the state.
by Topfi | 2025-08-18 13:26:46+00:00
As both Presbyopia and Cataracts come for us all, it is generally not advisable to do laser eye surgery once the former has set in. Both are a result of changes to the lens (and the ciliary muscles to some extend), so long term, a lens exchange, whether partially covered by (public) insurance as part of cataract surgery or as an expensive elective procedure is the only effective surgical option we have currently available.

That brings me to one of my personal pet peeves which is selling pensioners that qualify for cataract surgery on an expensive, but in fact identical but privately paid for IOL.

Same with selling some Myopic+Presbyopic person on laser eye surgery of any kind. At best you get a few short years out of the expense before it catches up with you or you tolerate mono, at worst you spend thousands to suddenly need reading glasses you didn't require before.

Course, if you are financially solid and Presbyopia is starting, getting a high quality lens exchange can be a very neat luxury, with the added benefit of not needing Cataract surgery later in life. Do note though that artificial lenses, while incredibly advanced, still cannot accommodate as well as the real deal as of now.
Ask HN: Are LLMs changing how you use and contribute to open source?
by nzach | 2025-08-18 13:26:56+00:00
I used to try a few OSS projects before building anything myself. Recently, with LLM coding assistants/agents, I’m spinning up small, single-purpose tools tailored to my workflow. They’re not “better” than mature OSS (in fact they are often brittle and narrowly scoped) but they solve my exact problem faster than learning how to install, configure and use a new tool.

And it got me thinking, if more developers do this what happens to OSS?

Do incentives to file issues, write docs, or contribute upstream drop when it’s so easy to build a bespoke tool?

Do we risk fragmentation into many private one-offs instead of shared libraries?

For maintainers: are you seeing fewer users, less feedback, or different kinds of contributions?

Curious to hear both individual and maintainer perspectives, and what you’re actually observing in 2025.
by jjice | 2025-08-18 13:27:25+00:00
LLMs still blow my mind. I just can't comprehend how a prompt like

> Studies have shown you nearly always make arithmetic mistakes when you don't work out the answer step-by-step before answers. Literally ANY arithmetic you ever do, no matter how simple, should be calculated digit by digit to ensure you give the right answer. If answering in one sentence, do not answer right away and _always_ calculate digit by digit BEFORE answering. Treat decimals, fractions, and comparisons very precisely.

actually works. Just telling the LLM to "pay more attention" or "try harder", and then it does it. It generally works in my experience too, which blows my mind (coming from a traditional deterministic computation perspective). Is it because now the text prediction next tokens are more likely to be related to a source that followed those guidelines too?

The fact that so much can be controlled about a model's personality by its system prompt will never not amaze me.
by jampekka | 2025-08-18 13:27:30+00:00
> How is it fair? I would think if two parties commit the same crime they should be charged the same. Isn't fairness in law defined as being blind to the perpetrator?

The purpose of a fine is not supposed to be a fee for a crime but a penalty that has deterrent effects. A flat fine is not an equal deterrent for people of different financial means.

In Finland the system is called "day fine", meaning it should match approximately a day of labor/income. In some situations you can even go to sit in prison for time proportional to the day fines, although this is nowadays rare.
by raxxorraxor | 2025-08-18 13:27:54+00:00
In Germany police illegally accessed contact list from apps verifying your vaccination status for corona. I don't see it differently here and it is no use for victims if the courts are included later.

The simple reality is that no state is adult enough to handle this responsibility.

Why should I accept the berlin internet wall anywhere? Any ecosystem should fight back against such ambitions.

If it really is about protecting kids, there could be some easy laws improving their privacy. These are not wanted. As well as there is no political will to restrict tracking for advertising and gambling.
by HankStallone | 2025-08-18 13:27:55+00:00
My place is actually rural, but there's one of those little cornfield subdivisions (I like that term) a few miles from me. I don't really get it either. I like living in the country, but they don't seem to, since they bring their town ways with them, landscaping their places to a T like they're competing with each other, calling the police on stray dogs, and stuff like that. They don't seem to live any differently than they did in town, so I guess it's about the presumably cheaper land and the distance from noise and crime that makes up for having to drive 20-30 miles to town for work and groceries.
by input_sh | 2025-08-18 13:27:57+00:00
You're absolutely right, we shouldn't pick on just Google. We should pick on basically every company that owns over 50% of its market share, as I'm sure how they got there is by abusing their power in one way or the other.

A healthy economy is the one where you have 50 smaller companies each with 2.5% market share, not one with over 80% and everyone else being called a failure like you just did. Hope that clears things up!
by foldr | 2025-08-18 13:28:36+00:00
You’re quoting what they said about the article, not what they said about Micro Men. If you thought the OP’s first paragraph was about Micro Men then maybe that’s the source of the confusion.

I am not accusing anyone of any transgressions. I think you’ve just misinterpreted the OP’s comment as being about gender (as they’ve now confirmed here: https://news.ycombinator.com/item?id=44939643)