MurphyA/hacker-news huggingface dataset:
by clickety_clack | 2025-09-08 18:49:24+00:00
A better analogue then would be that the developer who built your house insists on a specific type of lock.

There’s a whole repairability movement going on to maintain access to third party replacement parts for cars and appliances. This is a recent design choice that is being enforced by manufacturers. Historically, people have been able to repair everything they owned. Locking everything down is bad for consumers.
by CuriouslyC | 2025-09-08 18:49:38+00:00
I'm a legit postgres fanboy, my comment history will back this up, but the ops overhead and performance implications of trying to run PGvector as your core vector store for everything is just silly, you're going to be doing all sorts of postgres replication gymnastics to make up for the fact that you're using the wrong tool for the job. It's good for prototyping and small/non-core workloads, use it outside that scope at your own peril.
by 0xbadcafebee | 2025-09-08 18:49:49+00:00
Here we are again. 12 days ago (https://news.ycombinator.com/item?id=45039764) I commented how a similar compromise of Nx was totally preventable.

Again, this is not the failure of a single person. This is a failure of the software industry. Supply chain attacks have gigantic impacts. Yet these are all solved problems. Somebody has to just implement the standard security measures that prevents these compromises. We're software developers... we're the ones to implement them.

Every software packaging platform on the planet should already require code signing, artifact signing, user account attacker access detection heuristics, 2FA, etc. If they don't, it's not because they can't, it's because nobody has forced them to.

These attacks will not stop. With AI (and continuous proof that they work) they will now get worse. Mandate software building codes now.
by rolph | 2025-09-08 18:50:11+00:00
thats right, no AI queries, means exactly that.

just like signs such as no trespassing: active shooting range; or apiary[bee] yard; or open shaft mines, means that exactly, and in my region, signage is sufficient no gate or fence required.

every so often someone thinks they are too important for that to apply and they find out the signage is no joke when they encounter the target line, and backstop being hit from somewhere uprange; or violate the space of a bee hive; or fall into a shaft. some even have the nerve to complain this is a threat.

robots.txt == no trespassing == stay out unless invited
by don_esteban | 2025-09-08 18:50:21+00:00
Lobbying to create laws that benefit rich people/big corporations and make the life of ordinary people tougher directly exacerbate the socio-economic divide.

Telling the poor/weak to use the tools designed for rich/powerful is just obscuring the reality.

The reality being that the system is designed by rich, for rich, to maintain and improve their position.

"People willingly choose to exacerbate the social divide" What do you mean by that? People willing choose to be poor and powerless?

"Colonialism is a form of centralized planning" - no, colonialism (and neocolonialism) is a form of institutionalized looting, historically highly successful (see the graph of the GDP (as a percentage of the whole world GDP) of Great Britain vs India for a nice example)

No, the worst part of capitalism is unlimited accumulation of power, by the way of wealth buying/subverting the state. I suspect one of the reasons China was able to maintain its upward trajectory was their ability to separate the political power from the wealth (see the case of Jack Ma what happens if the wealth starts to impinge on political power in China). From the point of view of West, they did some highly questionable decisions that costed them trillions (squashing the blockchain miners, bursting property bubble, going hard after excessive gaming and internet time by kids) and would not be conceivable in the west, but overall might be net positive for the society at all.
by Ericson2314 | 2025-09-08 18:50:45+00:00
That's great they are doing a paid feature, but I really just want my desktop to back up my phone.

They clearly think people have bad desktop security, and still don't want this to happen. Patronizing...

Edit on

> Our future plans include letting you save a secure backup archive to the location of your choosing, alongside features that let you transfer your encrypted message history between Android, iOS, and Desktop devices.

That's good, but they've said that before. I feel a bit burnt on this.
Show HN: Production Manager App – Offline Payroll and Job Tracker (.exe)
by autoinnoai | 2025-09-08 18:50:51+00:00
I built a secure offline app to modernize fiberglass insulation workflows. Most construction companies—especially in fiberglass insulation—still rely on paper forms and manual data entry to process installer payroll. It’s slow, error-prone, and wastes time, energy, and paper. The Production Manager App is a closed-source Windows .exe that runs locally, enforces license keys via Gumroad, and auto-generates Excel reports based on job entries. No cloud sync, no external dependencies—just hardened logic built for real-world use. Key features: • Weekly payroll calculation based on square footage, bags installed, or hourly wage • Auto-splitting pay across up to four employees per job • Full job entry interface with builder, model, lot/block, and optional insulation specs • Secure login with salted + hashed credentials • Auto-export to Excel with per-employee sheets grouped by week • Local SQLite database with smart cleanup and de-duplication • Auto-update support (checks for new versions) The app is designed for non-technical users—fullscreen interface, no setup required beyond Excel. Once installed, it handles everything locally and auto-generates payroll reports two days after the pay period ends. License enforcement is hardened: the .exe is encrypted and only unlocks after validating a Gumroad key. No open APIs, no cloud sync, no shortcuts. Architecture & Documentation: https://github.com/BirdDawg305/production-manager-app Website & Contact: https://automatinginnovatingai.com Would love feedback on the architecture, UX, or anything that feels off. Thanks for reading!
by xorcist | 2025-09-08 18:51:07+00:00
Why is it reasonable? I understand that it would be financially reasonable for a commercial endeavour, but isn't Firefox more like an open source project?

Debian supports MIPS and SPARC still. Last I checked OpenSSL is kept buildable on OpenVMS. Surely there must be a handful of people out there who cares about good old x86?

If your numbers are correct, there are millions if not tens of millions of Firefox users on 32-bit. If none of them are willing to keep Firefox buildable, there must be something more to it.
by ktosobcy | 2025-09-08 18:51:20+00:00
Uhm. I set the email app to check for mail every 30 minutes. But also I don't get that many messages (and mailinglists and whatnot are filtered away to subfolders that don't trigger the notification) so when I get the notification is for something I actually need.

Apart from that I only have notifications for IM (telegram/whatsapp) and the phone is in constant DND mode (with sound allowed only for calls).
by antipaul | 2025-09-08 18:52:00+00:00
A more lightweight option, though easier to bypass, is to disable apps, App Store, even Safari, with "Content & Privacy Restrictions".

See Settings – Screen Time.

You can use a passcode to lock it. It seems primarily meant for blocking things from your kids.

But it can help turn your iPhone more into a dumb phone

(Blocking safari was the key, for me)
by lokar | 2025-09-08 18:52:09+00:00
Remember: Broadcoms’ (the non-chip part of it) business model is to buy tech companies in long term decline (VMware: check) that have a significant locked in customer base (VMware: check), slash development and support while raising prices.

They extract as much cash out of the decaying corpse as they can, and then discard it.

They were actually fairly open about this to investors when they bought VMware .
by jimmydddd | 2025-09-08 18:52:10+00:00
Thanks for the reminder of that! This girl who sat behind me in second grade was great with clackers. Also, my memory is a bit foggy, but I don't think the jart ban was until eigth grade. So no causality there. Pop Rocks causing internal explosions and spider eggs in Bubble Yum occured somewhere between Clackers and Jarts. :-)
by audunw | 2025-09-08 18:52:26+00:00
I don’t feel like this article addresses the question of whether we’re seeing an AI bubble or not at all.

To me this is very simple: certain companies have invested billions upon billions in AI data centres that need to see a very high return on investment in the years ahead to avoid a “pop”. I think nvidia is also being valued is if it’s a certainty that we will continue to build many such data centres every year for the foreseeable future.

These expectations are now being faced with the reality that AI isn’t making us that much more productive, and the improvements in LLMs are slowing down, so it’s not clear there will be a continued will to pay expensive subscription for these AIs, and certainly not clear that companies are willing to accept higher prices that may be need to get ROI.

There’s another way this could go down: I have a sneaking suspicion that we can get 90% of the productivity benefits of LLMs with models that can run locally. A combination of an algorithm breakthrough, better tuned models, better software tooling around them, and better hardware in the hands of end users, may get us to that 90%. That could end up making a lot of AI companies redundant.
by raw_anon_1111 | 2025-09-08 18:52:29+00:00
YouTube hasn’t been an included app on iPhone since 2010 and Google Maps hasn’t been included since 2012. Even then, the Google Maps app wasn’t included. Even from the first version of iOS, the Google app wasn’t included. It was the Apple Maps app using Google for the back end. When Apple started using their own data, they still kept your search history and favorites from the earlier version.

> I can't tell you EXACTLY which sites aren't blocked by your domain based adblocker, I'm not an adblock developer.

So in other words you just threw something out there without any evidence…

> If you believe Google doesn't deserve antitrust measures for their duopoly with Apple you're free to do so, you're still arguing against things you interpret freely to make your points.

The case was never about mobile and Google doesn’t have even 50% of the market in the US in mobile. Unless you have some evidence that Apple and Google illegally colluded in the mobile market, there is no law against being part of a “duopoly”.

And you still haven’t said why an iPhone user needs Google or default of having YouTube and using Google Maos data over a decade ago is relevant in 2025.
by andrewla | 2025-09-08 18:52:45+00:00
Have not read the underlying study but given that it is a generic nutrition and vision study, this seems like a clear case of p-hacking. At best it could be a "here is something that might merit future research".

They find that one of the nutrient factors studied is positively correlated with improved vision at p=0.01. https://xkcd.com/882/
by arusahni | 2025-09-08 18:53:01+00:00
From the tail end of the blog post:

> The technology that underpins this initial version of secure backups will also serve as the foundation for more secure backup options in the near future. Our future plans include letting you save a secure backup archive to the location of your choosing, alongside features that let you transfer your encrypted message history between Android, iOS, and Desktop devices.
by specproc | 2025-09-08 18:53:28+00:00
I'm a real app minimalist, only basic stuff for day to day living, but the browser is what sucks my life away.

I've tried things like Leechblock, but they don't stick.

The only thing that's really worked is turning the damn thing off and sticking it in a drawer. I managed it for a week once. Hard to keep to though.
by thaumasiotes | 2025-09-08 18:53:55+00:00
They still do it; it's still very important to them. They maintain their own test, the ASVAB ("Armed Services Vocational Aptitude Battery").

https://en.wikipedia.org/wiki/Armed_Services_Vocational_Apti...

For a vivid picture of why the military is so insistent on IQ tests despite overwhelming political pressure to stop using them, you might like reading https://www.amazon.com/McNamaras-Folly-Hamilton-Gregory/dp/1... .
by asdff | 2025-09-08 18:54:04+00:00
I find the mobile web is doing a great job of destroying the addictiveness of the browser. I use an se2 so not terribly old. new reddit doesn't really work at all on it. old reddit just barely. Most other websites seem to hang after trying to load all the adware and never return the full content anymore. Some mobile websites just flat out don't load at all anymore, just a white screen like the phone rolled over and gave up.

Hacker news is about the only website that works. But, once you find a couple threads you are interested in you are rate limited from replying before long and that frustration kicks me off it until days later potentially.
by krior | 2025-09-08 18:54:17+00:00
afaik the key material is regenerated for every message. new keys can be derived for every subsequent message you send, but only until you get a reply, then a new key exchange takes place. And the key material for message m1 cannot derive keys for the messages that came before m1. If the old key material gets properly deleted then there is only a very small window of compromise. backing up those keys would defeat the purpose of the ratchet.
by dylan604 | 2025-09-08 18:54:19+00:00
I really wish these bon voyage articles about Voyager would talk more about science learned after the planet flybys. There were plenty of unknowns regarding the heliopause and the readings before and after crossing it[0]. The readings showed it wasn't just a fade to black kind of experience, and proved to be quiet a bit of activity going on there.

[0]https://www.jpl.nasa.gov/news/voyager-1-2-discovers-evidence...
by layman51 | 2025-09-08 18:54:22+00:00
I have some issues with this guide. I find it very odd how the very first step of the guide is to “erase all content and settings” but it doesn’t really mention all the caveats around this. There really should be warnings or a separate guide about doing this safely because if some people do that, they could lock themselves out of MFA-protected accounts.

Lastly, about Apple Configurator, it seems like it only works on macOS, so probably this won’t work if you have an iPhone but no macOS device, right?
by ohdeargodno | 2025-09-08 18:55:19+00:00
Congratulations, you now need to make sure your on-launch detector is compatible with the lowest common denominator, while at the same time being able to detect modern architectures. You also now carry 10 different instances of firefox.exe to support people eventually running on Itanium, people that will open support requests and expect you to fix their abandoned platform.

For what reason, exactly ?

You want 32b x86 support: pay for it. You want <obscure architecture> support: pay for it. If you're ok with it being a fork, then maintain it.
by bighead1 | 2025-09-08 18:55:42+00:00
i've been using the blank spaces launcher for this. it has its flaws for sure, but the feature most useful for the scenario you describe is the "Lock Distractions" feature. In order to use safari, you have to go through a "mindfulness" exercise, and then you can unlock safari for a small amount of time (1 minute, 5 minutes, up to 20). I find this is just enough to keep me out of random wikipedia pages all day, but still allows me to pull up a webpage when i need to do some very specific task (like unsubscribe from an email list).
by tomjakubowski | 2025-09-08 18:56:30+00:00
I observed the same thing around the time online ordering became more popular. It used to be that at a lunch spot, cashiers or phone operators could restrict the order flow a bit to keep the kitchen from getting overwhelmed with orders. DoorDash et al. have no interest in that, they only want to take as many orders as possible, as quickly as possible; they have an incentive to obfuscate the real wait time from customers.

Waiting in line to order your lunch is skin in the game. Even the sight of a long line is enough to help load balance lunch orders between restaurants. I do wonder though that if restaurants could feed back to DoorDash and limit the order flow with online-only "surge pricing", if that would help in the same way to forestall kitchen overwhelm.
by foepys | 2025-09-08 18:56:40+00:00
OpenWISP states in its docs that you should be running at least 20 devices to make it worth it. [1] So it's not supposed to be a easy way to manage a few devices for home users.

> However, OpenWISP may not be the best fit for very small networks (fewer than 20 devices), organizations lacking IT expertise, or enterprises seeking open-source alternatives solely for cost-saving purposes.

1: https://openwisp.org/faq/#suitable
by neilv | 2025-09-08 18:56:50+00:00
Seems reasonable by Mozilla, to me, given precedents like the new Debian release not doing 32-bit release builds.

And doing security updates on ESR for a year is decent. (Though people using non-ESR stream builds of Firefox will much sooner have to downgrade to ESR, or be running with known vulnerabilities.)

If it turns out there's a significant number of people who really want Firefox on 32-bit x86, would it be viable for non-Mozilla volunteers to fork the current ESR or main stream, do bugfixes, backport security fixes, and distribute that unofficial or rebranded build?

What about volunteers trying to keep the main stream development backported? Or is that likely to become prohibitively hard at some point? (And if likely to become too hard, is it better to use that as a baseline going forward with maintenance, or to use the ESR as that baseline?)
by martin-t | 2025-09-08 18:56:54+00:00
> You described a “primitive” legal system

I didn't describe a legal system at all. But it is certainly a modern way of thinking that one always needs some higher "authority" to resolve disputes or to defend against injustice.

> What?

secede /sĭ-sēd′/

To withdraw formally from membership in a state, union, or other political entity.

Note, this is a low effort reply to a low effort reply from you.

If you wish to discuss this politely, we can discuss which states have a legal mechanism by which a land-owning individual, a town or region can legally vote to gain independence. I don't know of any.

---

Victimhood is perceived harm (by yourself or others). But I don't understand why you focus on separating victimhood from demonstrating harm so much. See my other replies on this article, I explained my views in more depth there.
by derefr | 2025-09-08 18:56:57+00:00
@Signal devs: any reason that the only two options for backup are now "locally" (flexible, but only solves for some use-cases) or "to Signal's special servers" (not flexible; might be legally impossible for many users to enable)?

Because it seems to me that, for much of Signal's (often paranoid) audience, they'd much rather use one of the backup/sync providers they've already verified trust of, than have to additionally trust some new backup service provider.

And it also seems to me that, now that Signal has the architecture to support this, it'd be pretty easy to add additional backup-sync providers.

E.g. in the codebase for the iOS Signal client, you could implement a provider that does incremental backup sync against iCloud (i.e. CloudKit for messages + iCloud Drive for attachments) — allowing the user to use their (perhaps already paid-tier) iCloud account storage.

Same with Android and Google Drive (though Google Drive doesn't have an equivalent to CloudKit, so this might be fiddly; to get good amortized write costs, you might have to e.g. buffer row-like writes in a local replication journal, and then flush them through bulk local key inserts in a locally-partial-fetch-cached set of LevelDB files, where the updated files in the set then get flushed as single whole-file overwrites to GDrive.)

---

Note that in all cases, Signal could/should still fully encrypt this data before pushing it to the provider; the backup wouldn't be expected to be "legible" to the user.

But where, with backups synced to Signal's servers, users need to trust that Signal's E2E backups encryption works perfectly to be able to believe that Signal themselves can't then have access to your backed-up data; it's much less scary to sync to literally any other provider, who won't specifically know that they've got chat data on their hands / won't have any potential to (perhaps after a bad acquisition by a PE firm) begin thinking of themselves as a "data company" who would love to have "chat data" as an asset.
by stego-tech | 2025-09-08 18:57:01+00:00
For homelabs and SMBs, that is definitely an opportunity. Other areas I’d like to see more growth in:

* “No-Code Kubernetes”, that lets staff design basic (or even not-so-basic) deployments using a web-based GUI. We’re seeing more of this from a “understand how things work while they run” perspective, but I haven’t personally come across any “here’s your building blocks and explainers of the environment variables, go build” solutions.

* An “ESXi-ified” K8s. Talos comes so, so close to this, but I’d love something that was as easy to deploy into production as ESXi was on SD cards. Deploy as an appliance on bare metal or as a VM, and voila, Control Plane with an IP schema, network layer, AD CA/ACME support (including Let’s Encrypt), and a basic load balancer/ingress. Changing the setup is as simple as adding a basic text file with the control plane IP and join string (worker nodes), with a simple flag to add it as another control plane node for HA.

* Renewed focus on etcd management ease. A lot of the cert track focuses extensively on etcd management through kubectl, which is an unnecessary abstraction layer for things like backups, failovers, and redundancies in smaller IT departments.

* Automated migrations. The K8s evangelists hype it as being able to manage VMs, which would be great if kube-virt was standard (it’s an add-on). I’d like to see K8s either formally integrate it into the baseline or more distros make it a checkbox option at cluster creation. Part of that should also be support for automatic deployment creations for existing VMs in a hypervisor, by analyzing current settings and suggesting the YAML or JSON to replicate that VM in K8s with appropriate IP address, current storage, and ACLs

From a tech standpoint, the foundations for K8s success have long been polished into a mirror shine. At this point it’s usability and accessibility that remain broadly unaddressed, especially if we want more people and companies using iterative, composable infrastructure.
by aeturnum | 2025-09-08 18:57:37+00:00
I find it useful to open the code in an editor and make running notes in the comments about what I think the state should be. As long as the code has good tests you can use debugging statements to confirm your understanding.

As a bonus you can just send that whole block of code - notes and all - to a colleague if you get stuck. They can read through the code and your thoughts and give feedback.
by don_esteban | 2025-09-08 18:58:01+00:00
"As a result, they end up having access to most of the collective wealth as well." Umm, it does not work like that, look at the Scandinavian-type socialism.

The collective wealth is in the functioning education & health system, social support net, working public transport and such. Not a type of wealth that the government can usurp for themselves, to the detriment/exclusion of the remainder of the society.

Too much ideological argumentation here...
by dragonwriter | 2025-09-08 18:58:09+00:00
That...doesn’t contradict what I said. If you meant “I’ll have to tune in late 2027 in case he gets the nod”, then, yes that would be the relevant criteria.

But what you said, and I responded to, was “I’ll have to tune in late 2027 if he gets the nod”, which is conditioning a decision at a particular point in time on an event which almost certainly would occur later.