MurphyA/hacker-news huggingface dataset:
Show HN: I Built Logstalgia for the Web
by arondeparon | 2025-09-08 23:39:26+00:00
I built a real-time HTTP log visualizer; think Logstalgia, but web-based.

Stream logs from nginx/k8s/etc and watch animated particles represent requests. Each particle is color-coded by status, sized by response bytes, with speed based on response time.

It has multiple view modes / themes: group by hostname, status codes, or source -> destination flows. Added replay timeline, and a TV mode. Using SSE for streaming.

Tech stack: Laravel backend, React frontend, Redis for buffering, Postgres with Timescaledb for long-term storage.

Would love feedback; still experimenting with different visualizations and tweaking things as I go.
by kadonoishi | 2025-09-08 23:40:05+00:00
[0] A summary on ACX of a debate between nuclear and solar proponents; and

[1] The video of the debate itself.

I thought solar won.

[0] https://www.astralcodexten.com/p/notes-from-the-progress-stu...

[1] https://www.youtube.com/watch?v=gbypyd7HFPE
by socalgal2 | 2025-09-08 23:40:05+00:00
I just imagine this going really wrong. My chain of thought would be something like: "Let's see, I need to rotate this image so I need to loop over rows then columns, .. gawd fuck this code base is shit designed, there are no units on these fields, this could be so much cleaner, ... for each row ... I wonder what's for lunch today? I hope it's good ... for each column ... Dang that response on HN really pissed me off, I'd better go check it ... read pixel from source ... tonight I meeting up with a friend, I'd better remember to confirm, ... write pixel to dest ...."
by jiggawatts | 2025-09-08 23:40:39+00:00
> every three years the people get swapped out

That's because they are being "replaced", in a sense!

When an industry doubles every 5 years like web dev was for a long time, that by the mathematical definition means that the average developer has 5 years or less experience. Sure, the old guard eventually get to 10 or 15 years of experience, but they're simply outnumbered by an exponentially growing influx of total neophytes.

Hence the childish attitude and behaviour with everything to do with JavaScript.
by DontBreakAlex | 2025-09-08 23:40:57+00:00
Apparently that is Anti-social Behaviour Crime and Policing Act 2014. Article regarding the claim: https://adfinternational.org/en-gb/news/guilty-army-vet-conv...

> In its decision, the court reasoned that his prayer amounted to “disapproval of abortion” because at one point his head was seen slightly bowed and his hands were clasped.

I'm all for women's rights, but that's not how to do it
by CyberDildonics | 2025-09-08 23:41:17+00:00
One reason it's slower is because your stack doesn't reserve any memory and grows to 40441 at its max size then shrinks back down again. Stack uses a dequeue by default which stores elements in chunks which likely causes lots of memory allocations (and deallocations) which don't happen in the recursive version. Also at n=80,000 your recursive version blows the stack.

https://en.cppreference.com/w/cpp/container/deque.html

The stack arithmetic is handled in hardware increasing IPC significantly, and the 'frame' you are talking about it almost the same same size as a single value in the happy path when all the relevant optimizations work out.

The program stack isn't magically special, it isn't going to beat writing a single value to memory, especially if that memory is some constant sized array already on the stack.

Debugging recursive programs is pretty neat with most debuggers. No, you don't unwind through anything manually, just generate a backtrace.

No matter what kind of debugger it is you're still going to be looking at a lot of information that contains the values you're looking for instead of just looking at the values directly in an array.

Recursion gets used because it's quick, dirty and clever, not because it's the best way to do it.
by zack4ai | 2025-09-08 23:41:22+00:00
We’re excited to share a milestone: Nexa SDK is the first edge inference engine to run full multimodal Gemma-3n locally on GPU.

Since Google DeepMind released Gemma-3n, developers have asked for multimodal support in runtimes like llama.cpp and Ollama. But both remain text-only — leaving builders without real multimodal pipelines. Nexa SDK closes that gap. With one line of code, you can now build true multimodal apps with Gemma-3n at the edge.

Meet Gemma-3n (E4B-IT):

4B-parameter multimodal model, optimized for laptops, desktops, mobile, and embedded.

MatFormer (nested sub-models) for dynamic compute scaling.

Per-Layer Embedding caching to reduce memory footprint.

Conditional parameter loading (skip audio/vision weights in text-only).

MobileNet-V5 vision encoder for fast image inference.

Supports text, images (≤768×768), audio, video, 32K context, and 140+ languages.

The gap:

llama.cpp: no Gemma-3n image/audio pipeline, no MobileNet-V5 support.

Ollama: exposes Gemma-3n, but only for text. → Developers can’t build screenshot analyzers, chart interpreters, or multi-image apps.

The solution — Nexa SDK:

First full Gemma-3n multimodal runtime.

Single + multi-image input, grounded and cross-referenced.

Runs fully local on Windows, macOS, Linux.

GPU-accelerated, responsive inference.

Simple APIs: one-liner CLI.
by tptacek | 2025-09-08 23:41:26+00:00
I'm directionally with Micah Lee on this in that I think all of these kinds of applications are activism theater, and I would hate for anything I say to sound like I'm getting the "ICEBlock" guy's back --- I'm sure it's bad and you shouldn't use it (though: Micah Lee's previous takedown of ICEBlock more or less comes down to "anybody can claim they saw ICE anywhere and also they don't have warrant canaries", which is... not interesting).

But I'm struck that Lee reported CVE-2024-38476 to the author, with a simple link to the NVD site, based on a banner grab.

For those unfamiliar, 2024-38476 is part of a batch of vulnerabilities Orange Tsai announced at Black Hat that year. You can (and very much should) read more about them here:

https://blog.orange.tw/posts/2024-08-confusion-attacks-en/ [†]

This is extremely good (and elegant) vulnerability research. It's also very situational. Lee reports that 38476 "could take over your server". Could it? Did Lee check? 38476 is a second-order vulnerability that pivots CRLF injection in another vulnerable application to an Apache handler override (just read it, it's fucking awesome). If you've got `mod_proxy` enabled, you've got a decent shot at SSRF with it --- SSRF is game-over on a corporate network, but situational when the target is a hobby server. Otherwise, the most likely outcome of it is being able to dump source code (by rewiring the request handling of something from, say, PHP back to HTML). The RCE's on these vulnerabilities are things like "if you were running Redmine, which installs into /usr/share on Ubuntu, you can pull the Rails signing key". Is... that happening here?

Or is this report basically "I did a banner grab, then Googled that version, then made a whole big thing about it to embarrass the author of ICEBlock"?

Which I mean if that's the goal, mazel tov, I don't like these things either, but let's just be clear on what's actually happening here. If not: it would be super interesting to hear a real-world exploitation scenario of Orange Tsai's rewrite bugs against ICEBlock, and Lee should keep on writing.

[†] I wrote about this at the time here: https://news.ycombinator.com/item?id=41199205
by zensavona | 2025-09-08 23:41:35+00:00
AFAIK Bemotrizinol is the only(?) chemical sunscreen active which is shown to not be an endocrine disruptor (this chemical https://pubmed.ncbi.nlm.nih.gov/36738872/)

It's hard/impossible to find in US formulations but in AU and EU some higher end brands use it. I like the La Roche Posay Anthelios series of sunscreen - I believe they all use Bemotrizinol as the active but I am 100% sure this one does: https://www.laroche-posay.com.au/sun-protection/face-sunscre... - Note that the formulation for the specific product is different in different regions, this is the Australian version.
by jjk166 | 2025-09-08 23:41:43+00:00
Imagine I built a machine that allowed you to see colors exactly how another person perceived them. You look through Bob's eyes and see that his blue is your blue.

Then I notice a loose screw and tighten it. Now you see Bob's blue as orange.

Was the machine properly functioning with the screw loose or tightened? Was it properly functioning in either configuration? How would you prove it?
by magicalhippo | 2025-09-08 23:41:50+00:00
> I handle subtitles in my ingestion pipeline

What do you do? Separate file? Not sure if I've noticed a pattern other than "mostly doesn't work well".

> Skipping, do you mean skipping intros and such?

Sorry, I meant jumping back and forth. On Plex I can just press left/right arrows on the remote, and it jumps a few seconds. On Jellyfin I have to press ok/confirm to actually do the jump. Very annoying.
by shoo | 2025-09-08 23:42:02+00:00
re: Why are The Economist’s writers anonymous?, Frqy3 had a good take on this back in 2017:

> From an economic viewpoint, this also means that the brand value of the articles remains with the masthead rather than the individual authors. This commodifies the authors and makes then more fungible.

> Being The Economist, I am sure they are aware of this.

https://news.ycombinator.com/item?id=14016517
by ggm | 2025-09-08 23:42:50+00:00
For the investment of one image, maybe a second image might have made your point. I don't like curved displays either, but I observe many widescreen photos offer a distorted view of the scene taken on a large flat monitor, since the lens is a compromise as is printing on flat media, and so the image as presented from a wide-angle is NOT accurate, any more than a curved screen of a 55mm lens would be. The problem here is horses-for-courses: if you have a wide curved screen then you should ask your digital devices to render images as if they are being displayed on a curved surface, not as if they are flat.

Anamorphic lenses should be projected/presented on curved surfaces and packages like Hugin will render images which should look pretty good on a curved surface of a known radius, assembled from sets of non-curved flat images put together in a panorama. Or apps like Bimostitch on android, which looks to use the same algorithms.

I don't like curved screens because I haven't learned to rotate my head the way needed to deal with content on the edge. I like dual monitors in a V more than a single wide-screen because they can be independently desktop-panned, only some widescreens do this (by s/w rendering it as two heads)

For some work (Audacity - audio editing, and related video work) a wide screen is fantastic. Horses for courses.
by const_cast | 2025-09-08 23:44:01+00:00
A lot of these security measures have trade offs, particularly when we start looking at heuristics or attestation-like controls.

These can exclude a lot of common systems and software, including automations. If your heuristic is quite naive like "is using Linux" or "is using Firefox" or "has an IP not in the US" you run into huge issues. These sound stupid, because they are, but they're actually pretty common across a lot of software.

Similar thing with 2FA. Sms isn't very secure, email primes you to phishing, TOTP is good... but it needs to be open standard otherwise we're just doing the "exclude users" thing again. TOTP is still phishable, though. Only hardware attestation isn't, but that's a huge red flag and I don't think NPM could do that.
by utyop22 | 2025-09-08 23:44:06+00:00
I sometimes read posts on here and just laugh.

Its easy to sit in the armchair and say "just be a visionary bro" when they forget Tim worked under Steve for awhile before his death - he has some sense and understanding of what it takes to get a great product out of the door.

Nvidia is generating a lot of revenue, sure - but what is the downstream impact on its customers with the hardware? All they have right now is negative returns to show for their spending. Could this change? Maybe. Is it likely? Not in my view.

As it stands, Apple has made the absolute right choice in not wasting its cash and is demonstrating discipline. Which when all this LLM mania quietens, shareholders will respect.
by avianlyric | 2025-09-08 23:44:32+00:00
Because bigger cars carry more energy, have poorer driver visibility, and are more likely to result in pedestrians going under the vehicle due to higher bonnet lines.

Big cars make drivers feel safer. But the stats are quite clear, they kill more pedestrians, and, ironically, are more likely to kill their drivers due their roll over risk.

The safety features might help, but they’re just compensating for all the additional risk bigger vehicles bring. You simply can’t beat physics.
by toast0 | 2025-09-08 23:45:11+00:00
> In most cases, efficiency and performance are pretty synonymous for CPUs. The faster you can get work done (and turn off the silicon, which is admittedly a higher design priority for mobile CPUs) the more efficient you are.

Somewhat yes, hurry up and wait can be more efficient than running slow the whole time. But at the top end of Intel/AMD performance, you pay a lot of watts to get a little performance. Apple doesn't offer that on their processors, and when they were using Intel processors, they didn't provide thermal support to run in that mode for very long either.

The M series bakes in a lower clockspeed cap than contemperary intel/amd chips; you can't run in the clock regime where you spend a lot of watts and get a little bit more performance.
by andix | 2025-09-08 23:45:28+00:00
I've posted this idea already last time with the nx incident: we need some mechanism for package managers to ignore new packages for a defined time. Skip all packages that were published less than 24 hours ago.

Most of those attacks are detected and fixed quickly, because a lot of people check newly published packages. Also the owners and contributors notice it quickly. But a lot of consumers of the package just install the newest release. With some grace period those attacks would be less critical.
by ggm | 2025-09-08 23:45:59+00:00
The Tech Dirt story conflates two things. 1) their own experiment that proved no age check applied behind a vpn 2) the astronomical rise in UK originated visits to adults-only sites from VPN and derived a statement of a third thing: this means "more kids" are bypassing and accessing sketchy sites.

In simple arithmetic terms yes: more kids are now probably using VPN. In equally simple absolute terms, probably less kids overall are now accessing sketchy sites because many kids won't do this, and there is a problem latent here for both sides: the number of under-age visitors is an unknown. It's an estimate.

I don't think techdirt did themselves any favours in this story. It doesn't make me think the UK government will reverse course, or that they will see this as a "failure" any more than kids lying about their age to get smokes and booze makes the government stop applying age rules over the counter in dodgy shops.
by w00ds | 2025-09-08 23:46:14+00:00
It's possible the demo is faked, and I'm skeptical. But I also don't think the speed is really the point of a device like this. Getting out a device, pressing keys or tapping on it, and putting it away again, those attentional costs of using some device... I know something like basic notetaking would feel really different to me if I was able to just do the thing in the demo at high accuracy instead. That's a big if, though - the accuracy would have to be high for it to really be useful, and the video is probably best-case clips.
by desireco42 | 2025-09-08 23:46:41+00:00
What I picked up from this vision of the future... we will have mind reading devices to capture out thoughts, but we will still be on a train and commuting to work... dang...

So they came up with this groundbreaking idea but couldn't come up with better use case then typing on a train.

Look, I can't but not appreciate that at least they are doing something interesting as opposed to vibe one shot fork of vs code things that we see.
by PaulHoule | 2025-09-08 23:46:54+00:00
People who were developing "office" programs in the early 1990s were thinking about the problem of serializing arbitrary object graphs into documents to support technologies like

https://en.wikipedia.org/wiki/Object_Linking_and_Embedding

where you could embed an Excel spreadsheet inside a Word document or actually embedded any of a large range of COM objects into a Word document which on one hand is a really appealing vision but on the other hand means you have to have and be able to run all the binaries for all the objects that live in a document which ties the whole thing to Windows.

PDF is a different sort of document format which privileges viewing over editing but it is also really about serializing an object graph when it comes down to it and then having various sorts of filters and transformations and a range of objects defined in the spec as opposed to open ended access to an object library.

This kind of system has a lot of overlap with the serdes problem you get with RPC frameworks that used to be under the files "Sun RPC sucks", "DCOM Sucks", "CORBA Sucks" and "WS-* Sucks" Those things are mostly forgotten these days because well... they sucked, and now the usual complaint is "protobuf sucks" but you rarely hear "JSON sucks" because it gave up on graphs for trees, if you don't have a type system people can't say the type system sucks, and the only thing that really sucks about it is that people won't just use ISO 8601 dates but you can always rise above that by just using ISO 8601 dates without asking for permission. But we all agree YAML sucks.

That points to any flexible document format sucking but also sucks because it has lots of poorly specified and obscure features that amount to "format this the same way Word 95 formatted it if you used a certain obscure option".

From a glass is half empty perspective it sucks because it's close to impossible to make a Microsoft Office replacement that renders 100% of documents 100% correctly.

From a glass is half empty perspective it rules because if you want to make a Python script that writes an Excel script with formulas it is easy. If you want to extract the images out of a Word document it is easy because a Word document is just a ZIP file. If you want to do anything with an OOXML document short of writing an Office replacement it's actually a pretty good situation.
by Lammy | 2025-09-08 23:48:21+00:00
I love this screen that shows you exactly why they named it “Office Open” XML: https://i.imgur.com/hnj3sdv.png

It was a pretty big deal when OpenOffice.org's 2.0 release came with OpenDocument as the default file format. Very easy for someone to misread this MSOffice screen and click on OOXML expecting it to mean OO.o.
by dylan604 | 2025-09-08 23:48:48+00:00
.3° at 25B km is still a pretty large distance. Some random calculator online says that would be 1.3090e+8 kilometers or 130,900,000km. The earth-moon distance is roughly 240,000km. 1AU ~= 149,597,900 So .3° is just under 1AU, and essentially to cosmological scales .3° = 1AU. And it's only getting bigger as it continues to get further away. So essentially, just point at the sun and it'll hit earth
by Silhouette | 2025-09-08 23:48:53+00:00
Rational or not, people will feel less safe if all their messages can just be easily exported to plaintext.

IMHO the point is that it's not rational. Signal is as vulnerable to the analogue hole as any other messaging platform that displays the messages on a phone screen. There was never any credible way to prevent someone who has received your message from keeping or passing on the information it contained. The idea is as unrealistic as the "disappearing message/photo" applications when confronted with any cheap phone or camera separate to the one showing that message/photo. Ultimately if you don't trust the recipient of your information to treat it as you would wish then your only choice is not to send them the information in the first place.
by Kodiack | 2025-09-08 23:49:45+00:00
I set up Immich last week and I absolutely love it. Docker is my "happy place" and I found the setup pretty straightforward, though it does have some rough edges that I anticipate will be sorted out as the project continues to mature.

I showed Immich to my partner and they loved it so much that we've ordered significantly more storage for the server to accommodate it. We're currently using both Google Photos and OneDrive, but with this we'll be ditching OneDrive and filling that niche with Immich (as well as expanded network storage in general).

The website and documentation is super clear about not using it as the only source of photos. This is why we'll keep using Google Photos, and why I'll also be backing up Immich and portions of the network storage to B2 via restic. I've used this snapshotting pattern for my general server data for years, and it's even saved me a couple of times. Backups are something you hope to never need to use, but boy are they satisfying when you do need to use them and have them set up properly!
by kevincox | 2025-09-08 23:50:37+00:00
I was using PhotoPrism for a few years and switched over to Immich and am very glad I did.

- There was no good mobile backup story. State-of-the-art was WebDAV sync and import delays which would truncate files and other issues on back connections. It also made deletion risky.

- The UI had lots of things that felt very opinionated for a very specific workflow that seems niche. Things like auto-adding generated titles and other things.

- The face recognition is much worse, especially for non-white faces. Even detection didn't seem to have a good setting that would reliably identify what is a face without way too many false positives.

- Immich's semantic image search is way better than what was on PhotoPrism where it seemed to just find a few tags.

- PhotoPrism had lots of UI quirks like the persistent selection that almost never worked how I wanted it to.

Lots of other odds and ends as well. There isn't anything that I actually miss from PhotoPrism.
by aeonik | 2025-09-08 23:50:37+00:00
This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes.

I'll pay you $10k if you can crack this sha512 hash.

I'd offer a million, but I don't have that kind of money.

5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd

It's technically true that all cryptography is just slowing things down, but we are talking about heat death of the universe lengths of time for most crypto algorithms.

*assuming quantum computing doesn't take off or a fundamental flaw isn't found in the crypto.
by jbjbjbjb | 2025-09-08 23:51:01+00:00
Big caveat that I’ve not read the book but I get that the premise is “legacy code is code that is untested” and I’ve always struggled with that definition. I think a more accepted definition would be that it is not well understood, uses old tooling/languages/runtimes and is usually high stakes code (driving some business that was successful enough to last longer than the staff that coded it up). I’m sure added tests help deal with legacy code under that definition but not sure it’s the panacea, I’ve certainly seen code without tests lots very high coverage that people area afraid to work on due to them being unfamiliar with the domain and codebase.