MurphyA/hacker-news huggingface dataset:
by fragmede | 2025-09-16 22:29:07+00:00
Do you remember calling dispatch and never having a car show up? Do you remember credit card machines that mysteriously started working? Do you remember the last minute fees just as you were getting out of the car? Do you remember the regulatory capture that led to the taxi cab medallion system in NYC, where the medallions would cost up to $1,000,000?

Do you know that it's the existence of taxi laws that make it largely illegal for, after a concert or other large event lets out, it's illegal for Uber to just have a line of cars and for people to line up and just get into the next available car? So instead the parking lot right after is this ridiculous madhouse of everyone waiting around for "their" car.

Taxis did themselves in. Somehow, they've still not managed to catch up. Just a month ago I was in Vegas and got ripped off by a taxi. Took Uber/Lyft the rest of my time there.
by respondo2134 | 2025-09-16 22:29:07+00:00
Reductio ad Absurdum may be what you're thinking of, but Straw Man might also apply. Funny enough the responder didn't actually do what you said. They stated of the 600+ dependencies they counted there was only one they felt comfortable implementing themselves. Your accusation of them taking your statement to the extreme is reverse straw man rhetoric; you're misrepresenting their argument as extreme or absurd when it’s actually not.
by kafrofrite | 2025-09-16 22:29:29+00:00
It's probably not trivial to implement and there's already a bunch of problems that need solving (e.g., trusting keys etc.) but... I think that if we had some sort of lightweight code provenance (on top of my head commits are signed from known/trusted keys, releases are signed by known keys, installing signed packages requires verification), we could probably make it somewhat harder to introduce malicious changes.

Edit: It looks like there's already something similar using sigstore in npm https://docs.npmjs.com/generating-provenance-statements#abou.... My understanding is that its use is not widespread though and it's mostly used to verify the publisher.
by Fade_Dance | 2025-09-16 22:29:40+00:00
>Banning it entirely is the best way to avoid these problems.

Too popular to ban. Political constraints.

>Will they be able to change the algorithms or censorship or amplification on TikTok?

"An Asia-based investor of ByteDance said the new US TikTok entity would use at least part of the Chinese algorithm but train it in the US on American user data."

________________

I'm not sure you're looking at this the right way though. This isn't some conclusion of a search for the optimal way to address the situation (which would probably be an actual digital privacy framework). The ban couldn't go through because the app was too popular and Trump liked the attention he was getting on it. So if the ban has to be backed out of, what's the second best option? A "deal" of course, from the world's best deal maker. It's no more complicated than that.

The Intel stake is the same - barely thought out. If you haven't noticed, this has been a common theme in many policy decisions lately.
by ratorx | 2025-09-16 22:30:31+00:00
Hmm, I see what you mean, although technically this is still a 2 factor compromise (Google account password + 2FA code). Just having one or the other wouldn’t have done anything. The bigger issue is the contagion from compromising a set of less related two factors (the email account, not the actual login).

Specifically, the most problematic is SSO + Google authenticator. Just @gmail + authenticator is not enough, you need to also store passwords in the Google account too and sync them.

Although, this is functionally the same as using a completely unrelated password manager and storing authenticator codes there (a fairly common feature) - a password manager compromise leads to a total compromise of everything.
by signatoremo | 2025-09-16 22:31:02+00:00
I don’t doubt that Waymo car is more advanced than FSD, but that comparison isn’t as impressive as it sounds. The numbers of FSD equipped Teslas dwarfs that of Waymos, and they are available everywhere, not just selective cities. You have to take that into account.

Teslas is also much cheaper, and easier to scale. Tesla has better growth potential even if their tech is less impressive.
by ViewTrick1002 | 2025-09-16 22:31:07+00:00
> However, Third World is still used as a (pejorative) term for the traditionally less-developed world (e.g. Africa)

So now the entire west, NATO and other US allies should with blinded conviction approve of the genocide?

This seems like you are afraid of isolation and the fallout of the ongoing genocide.

There’s cracks showing and you know when they open Israel will lose its privileged position.
by ibejoeb | 2025-09-16 22:31:29+00:00
NPM needs some kind of attestation mechanism. There needs to be an independent third party that that has the fingerprint, and then npm must verify it before a change is published. It could even be just DNS or well-known URI that, if changed, triggers lockdown. Then, even in the case of a successful compromise of an NPM account or source control, whether via phishing like the last one or token exfiltration like this one, it will remain unpublished.
by scythe | 2025-09-16 22:32:13+00:00
>Did this giant dike work? Did the 143 miles of dikes work? Let’s see what Wikipedia says:

>>The enlarged water control structures around Lake Okeechobee and in the Everglades did not prevent either frequent floods or dry spells in which cattle died for lack of water and fires burned in the peat of the Everglades.

>So yeah, that’s a no. A big ol’ drought (technical term) ensued!

This is a good example of how a little knowledge can be a dangerous thing. We actually do know that the Hoover Dike worked: it survived Hurricanes Andrew, Francis, Wilma, Milton, and several others I probably forgot to mention.
by mdaniel | 2025-09-16 22:32:25+00:00
I don't think "was always" is an accurate statement

However, above and beyond free, it is also a collection of ECMA standards https://learn.microsoft.com/en-us/dotnet/fundamentals/standa...

Now, don't get me wrong: I have grave suspicions there is currently only one actual implementation of them (I don't count hobby, or abandonware, ones) but IMHO "actual standard" combined with "for real reference implementation" is way better than just reference implementation

---

since I'm still within the edit window, the MAUI referenced by the sibling comment is MIT licensed https://github.com/dotnet/maui

https://github.com/dotnet/blazor (Apache 2) is marked an archived, and points to https://github.com/dotnet/aspnetcore (MIT) but command-f blazor on its readme is nothing so :shrug:
by burntsushi | 2025-09-16 22:32:39+00:00
Also, that lock file includes development dependencies and dependencies for opt-in features like PCRE2. A normal `cargo build` will use quite a bit fewer than 65 dependencies.

I would actually say ripgrep is not especially typical here. I put a lot of energy into keeping my dependency tree slim. Many Rust applications have hundreds of dependencies.

We aren't quite at thousands of dependencies yet though.
by FreakLegion | 2025-09-16 22:32:47+00:00
That list seems to be limited to political targets. If we widen the net to political motivations:

https://en.wikipedia.org/wiki/Charleston_church_shooting

https://en.wikipedia.org/wiki/Pittsburgh_synagogue_shooting

https://en.wikipedia.org/wiki/2019_El_Paso_Walmart_shooting

https://en.wikipedia.org/wiki/2022_Buffalo_shooting

And many more, including the Evergreen High School shooting that happened the same day Kirk was killed: https://en.wikipedia.org/wiki/Evergreen_High_School_(Colorad...

The only recent-ish example I can think of from the left is https://en.wikipedia.org/wiki/Congressional_baseball_practic...
by dottjt | 2025-09-16 22:32:58+00:00
Perhaps this is an aside, but for my anniversary my partner bought me a pair of JBL glasses that also act as headphones.

Absolutely love them. They're not absolutely essential, but they're a nice-to-have and they're a lot more convenient than putting in ear buds.

The problem though is that I would never have thought to ever buy them myself. I feel this way about these AR glasses.
by deanCommie | 2025-09-16 22:33:16+00:00
And that was always known to have been a counter-productive protest. There's nothing ironic about this. They were told. They didn't care.

It was unambiguously clear that no matter how bad you felt Obama/Biden/Harris were on Israel, Trump was/would be worse.

If every single human life is worth saving (and it is), it's indisputable that Trump is worse for Gaza than Harris would have been.

It was the ultimate Trolley Problem, and a bunch of progressives acted like pulling the switch on move the trolley is NEVER acceptable regardless of how many lives it saves...
by runarberg | 2025-09-16 22:33:26+00:00
United Nations General Assembly Resolution ES-10/21 (Oct. 27th 2023):

> Condemning all acts of violence aimed at Palestinian and Israeli civilians, including all acts of terrorism and indiscriminate attacks, as well as all acts of provocation, incitement and destruction

https://docs.un.org/en/A/ES-10/L.25

The UN has been condemning the Hamas terrorist attacks from the start.
by LelouBil | 2025-09-16 22:33:35+00:00
I'm also wondering why huge scale attacks like this don't happen for other package managers.

Like, for rust, you can have a build.rs file that gets executed when your crate is compiled, I don't think it's sandboxed.

Or also on other languages that will get run on development machines, like python packages (which can trigger code only on import), java libraries, etc...

Like, there is the post install script issue or course, but I feel like these attacks could have been just as (or almost as) effective in other programming languages, but I feel like we always only hear about npm packages.
by giobox | 2025-09-16 22:34:15+00:00
I think it is quite high, especially for newcomers to the ecosystem. The popular sdkman CLI tool for managing JDK installations provides 17 different JDKs to install:

https://sdkman.io/jdks/

With the DotNet SDK for comparisons sake, there is but one provider, and package management is provided as first class citizen in the compiler CLI, removing the need to even pick a "gradle" or "maven" style build tool in the first place for almost any project.
by dmix | 2025-09-16 22:34:42+00:00
Agreed, UN doesn't have a great reputation in America, I'm skeptical many people will care about this outside the media news cycle

Pew says only 52% percent of Americans had a favorable opinion of UN in 2024 https://www.pewresearch.org/short-reads/2024/09/05/most-peop...

On a political or legal level for Israel it might have more implications though, that is impossible for them to ignore, but ICJ will focus on the leaders who can avoid visiting certain countries...just like Putin.
by burntsushi | 2025-09-16 22:34:50+00:00
That doesn't make sense. The most it could be is 3: regex 0.1.x, regex 0.2.y and regex 1.a.b. You can't have more because Cargo unifies on semver compatible versions and regex only has 3 semver incompatible releases. Plus, regex 1.0 has been out for eons. Pretty much everyone has moved off of 0.1 and 0.2.
by bigglywiggler | 2025-09-16 22:34:54+00:00
I get what you're saying but anyone who falls for that one is beyond help. There are many red flags. I know that some people out there are not 'savvy' but this one is really obvious. The developer name is a strong red flag. If I was going to get LastPass I'd go on their website direct and click their appstore link from there.
by fragmede | 2025-09-16 22:35:03+00:00
Uber took 14 years to make it to profitability. Money's frequently characterized as impatient, unable to look past the next quarter, but when it wants to be, it can wait.

Waymo's older than Uber, but they hold many key patents by this point. Now that they've started running a taxi service, it seems straightforwards to scale up, assuming that is the business they want to be in. Then it's just a matter of charging more than it costs to run the service, and wait.
by nostrademons | 2025-09-16 22:35:24+00:00
npm shrinkwrap and then check in your node_modules folder. Don't have each developer (or worse, user) individually run npm install.

It's common among grizzled software engineering veterans to say "Check in the source code to all of your dependencies, and treat it as if it were your own source code." When you do that, version upgrades are actual projects. There's a full audit trail of who did what. Every build is reproducible. You have full visibility into all code that goes into your binary, and you can run any security or code maintenance tools on all of it. You control when upgrades happen, so you don't have a critical dependency break your upcoming project.
by HackerThemAll | 2025-09-16 22:35:49+00:00
This conspiracy theory would explain not only success of Rust, but also Go language and C#/.NET, and any other Java competitor.

I'd say it's 90% because of Oracle and its lawyer-driven business, and 10% because the language is just ugly, and existing libraries are super-ugly and unreadable, with all these Factories and AbstractFactories, and all design patterns forced like a religion whether they're useful or not in a specific context.
by wkat4242 | 2025-09-16 22:36:56+00:00
> Do you really suppose it's been 70 years since people thought that "[giving agency] back to the community and caring about our neighbors and bettering ourselves, exercising, sleeping" were good ideas? Or that holding those values is backwards at all, let alone by that much?

That's just some virtue signalling for his republican backers. Family and community values, we could leave our doors unlocked, country life, tech evil blablah

And no, I don't want him forcing conservative values on everyone but shutting down social media or even the internet as he seems to propose.

I do agree that social media has net negatives for society but forbidding is not the solution because it has positives too. Regulating the tech companies is. Forbidding engagement-driving algorithms will go a long way (especially since negative emotions are the most powerful drivers of engagement)
by GoatInGrey | 2025-09-16 22:37:21+00:00
Ignoring the thousands of rockets launched from Gaza in the hours before, Hamas telegraphed the October 7 attacks for years. Specifically, planning the attack since at least the 2010's.

Occam's Razor indicates that it was a legitimate operation by Hamas and Israel underestimated their adversary.

https://ctc.westpoint.edu/the-october-7-attack-an-assessment...

https://www.realinstitutoelcano.org/en/analyses/guard-down-d...

https://www.npr.org/2025/03/05/nx-s1-5318591/israel-shin-bet...
by theptip | 2025-09-16 22:37:40+00:00
The setup at SFO is currently quite annoying (Lyft/Uber require you to walk 5 mins to the garage roof, and drivers need to park/wait 5-10 mins away, so there's always a substantial delay). Taxis get the privileged parking spot immediately outside arrivals, but if it's busy you might still need to wait a bit.

I've been wondering for a while why Waymo can't offer a semi-managed solution to SFO to dynamically manage load, have just the right volume of cars inbound, maximize parking utilization, etc. with all of the nice intelligence that an app-based system would enable.

It feels like you should be able to have a buffer of cars waiting right at the curbside, and automatically refill that buffer on short notice depending on observed or predicted demand.
by Andrew_nenakhov | 2025-09-16 22:37:44+00:00
Yeah, an unarmed protester was killed by armed security personnel. Truly, those protesters were the greatest threat to democracy in the history of the US.

But seriously, damage from BLM riots is estimated to be over 1 billion USD and the number of fatalities during those riots was far higher than one Ashley.

Comparing killing of Ashlei Babbitt and Charlie Kirk is highly inappropriate. The former is at worst a voluntary manslaughter (and actually classified as a justifiable use of force), and second is a first degree murder, premeditated and with a deliberate intent to kill.
by zahlman | 2025-09-16 22:38:01+00:00
Pip has changed a lot in the last few years, and there are many new ecosystem standards, along with greater adoption of existing ones.

> I'm often dealing with files with several thousand lines of code and heavily nested functions.

This is the problem. Also, a proper editor can "fold" blocks for you.

> Being able to see the type of data at a glance tells me a LOT about what the code is doing and how it's doing it - and Python doesn't let me see this information.

If you want to use annotations, you can, and have been able to since 3.0. Since 3.5 (see https://peps.python.org/pep-0484/; it's been over a decade now), there's been a standard for understanding annotations as type information, which is recognized by multiple different third-party tools and has been iteratively refined ever since. It just isn't enforced by the language itself.

> Mix other languages in and suddenly it becomes pain.... This isn't always true for compiled->compiled.

Sure, but then you have to understand the assembly that you've stepped into.
by gradientsrneat | 2025-09-16 22:38:17+00:00
What you are describing in paragraph 2 is not specific to autistic people, although it is common. Introverts in particular can also become drained from social activity. There is some overlap.

Masking also is not necessarily the source (or sole source) of social exhaustion and instead the exhaustion may come due to greater sensory sensitivity and/or cognitive processing requirements, which are common in autism. Furthermore; masking has other purposes such as avoiding bullying, social exclusion, and other forms of negative outcomes; the intent and effort varies by the thing being masked and the person.

YMMV; it's a spectrum.
by com2kid | 2025-09-16 22:39:11+00:00
Sing it with me now!

The social contract is dead

The social contract is dead

Work real hard, 9 to 5, can't afford a roof over your head

The social contract is dead

Limited resources, limited hope. The best parents can hope for is to spend a fortune on educating their kids and maybe the kid goes to an elite college and then gets the joy of an engineering job working on improving how well ads perform. Information worker jobs used to have some promise of long term employment, but not anymore. Layoffs happen despite record profits. Layoffs used to be a dirty word in tech, which gave people a feeling of hope and the confidence to plan long term.

Now days? No job is safe, no industry is immune. When we replaced manufacturing jobs with service industry jobs the nation replaced reliable 9-5 jobs with benefits and a retirement package with jobs that have dynamically determined shifts and no benefits! Has anyone here looked into the life of a retail worker? In some businesses you don't even know when you'll be working until the shift schedule is posted each week, and even then you can be called in at any time! Can't really raise a kid under those circumstances, getting a baby sitter can take weeks notice and baby sitters love to cancel. Not that anyone can afford a baby sitter.

Well I can, because many tech jobs include baby sitters as a job perk, but, the people who really need one can't get one.

So naturally people aren't having kids. Houses are too expensive, food is too expensive, and because the last generation of families was small, support networks don't exist. We are supposed to raise kids in large groups, with aunts, uncles, cousins, nieces and nephews all there to help. Heck even preparing and eating dinner as a small family unit is really abnormal, historically people cooked together and ate together in groups of N > 4.

Many hands make for light work, including taking care of kids. The hardest part of having kids in modern day America is that you just don't have any time off, no time to relax. You never get to sleep in ever again, you never get any downtime. Friends with large families all living locally don't have this issue, kids are passed around from household to household, all playing with each other, a self organizing ball of chaos and noise and occasional bumps and bruises, but it is so much easier than trying to schedule play dates as often as possible.

And then there is the Next Best Alternative. Daycare costs between 30k-40k a year in major cities. Even if someone can afford 30k a year for daycare, they could also just spend that money on 3 amazing international trips each year! You aren't flying first class, but you can sure as heck stay in some nice resorts!

As most people "so, kid, or, at least twice a year you get to spend a couple weeks in any country you want", a lot of people are going to choose a life of leisure.
by dakiol | 2025-09-16 22:39:30+00:00
I'm not sure, but that's still happening. At least it happened to me this year. I consider myself a decent developer (in every job I have landed, I was always considered the "best" in the team after not much time in the job). I'm not faang-silicon-valley level, though. I haven't written a compiler or an OS, or contributed to the linux kernel. I have read all the popular tech books out there, I do more or less know what companies (and interviewers) want to hear, and I'm easy to work with.

I'm in western europe. I think the situation in the US is way different, though. Also, for juniors (or people with less than 8-10 years of experience) is much harder, that's true.
by vbezhenar | 2025-09-16 22:40:15+00:00
You can bind your application to 127.0.0.2 for one container and to 127.0.0.3 for another container. Both can listen on port 80 and both can communicate with each other. And you can run another container, binding to 1.2.3.4:80 and using it as reverse-router. You can use iptables/nftables to prevent undesired connections and manually (or with some scripting) crafted /etc/hosts for named hosts to point to those loopback addresses. Or just DNS server. It's all doable.

The only thing that you need is the ability to configure a target application to choose address to bind to. But any sane application have that configuration knob.

Of course things are much easier with network namespaces, but you can go pretty far with host network (and I'd say it might be easier to understand and manage).
by Night_Thastus | 2025-09-16 22:40:21+00:00
>This is the problem. Also, a proper editor can "fold" blocks for you.

I can't fix that. I just work here. I've got to deal with the code I've got to deal with. And for old legacy code that's sprawling, I find braces help a LOT with keeping track of scope.

>Sure, but then you have to understand the assembly that you've stepped into.

Assembly? I haven't touched raw assembly since college.
by vlovich123 | 2025-09-16 22:40:49+00:00
Regardless of the algorithm, antithesis specifically can make sure your implementation is correct. You started this thread by claiming that that’s needed less in Rust because the type system helps you avoid bugs. I’m highlighting classes of problems that Antithesis is targeting to help you test and Rust’s type system cannot help you with. Raft vs Paxos doesn’t matter
by Slow_Hand | 2025-09-16 22:40:54+00:00
It's interesting to see the announcement of Robert's approval before the act itself.

I'm happy to see that Robert is the one choosing to discuss this. If that information was being disclosed without his consent I'd be mortified. Let's hope that doesn't become a regular thing.

I wonder what potential such an announcement may bring to the process of dying. Announcing your intentions for assisted death opens the door to public expressions of gratitude and reflection before they have passed. Not just after.

It seems that there's a lot of grace and love to be had in announcing the time and manner of our passing. This feels like a positive development.