MurphyA/hacker-news huggingface dataset:
by pimterry | 2025-09-09 13:39:12+00:00
This attack is pretty bad, but as shown by the tiny ROI for the attacker mentioned in this article (about $500 so far: https://intel.arkm.com/explorer/entity/61fbc095-f19b-479d-a0...) this really isn't quite as ecosystem-catastrophic as it sounds, for a few reasons:

* Major attacks on large packages like this are caught fairly quickly - a few hours in this case - making the vulnerable window _relatively_ small.

* NPM locks installed dependencies by default, against both the version & a hash of the content, so you'll only install the new malicious version if you happen to be adding or updating this dependency specifically within the window this version is still live. It's effectively sort-of TOFU. If even you ran `npm install` in a project already using this dependency in the specific window it was live, you will not normally install the malicious version.

* There's quite a few tools to help mitigate the risk here, like https://socket.dev and npq (https://github.com/lirantal/npq).

As one datapoint, look at the download stats for the affected Chalk package for example (https://www.npmjs.com/package/chalk?activeTab=versions) - the vast majority of installs were not installing the latest version anyway.

There are caveats to this: e.g. you can use npm without a lockfile, in which case a fresh local install can pull down unexpected versions, or you could be manually updating/adding a different package which happens to depend on an affected package (which might trigger a lockfile update, which might then fetch the latest version of the subdependency) during the vulnerable window, or of course it's totally possible you might install the package for the first time at the precisely wrong moment, etc etc.

This is definitely bad, and could have been extremely disastrous if it wasn't caught. But in practice, npm & the ecosystem have put in quite a few protections that do help to _mostly_ mitigate these kind of risks in typical use cases (but not completely, and there's definitely plenty more work to do!) and it's certainly not the case that millions of JS developers & projects were all catastrophically pwned today.
by Moomoomoo309 | 2025-09-09 13:39:18+00:00
Something I think people don't realize is why there's a runback. Primarily, it's there to teach you how to counter enemy attacks, especially common ones, and it helps you stockpile money so you don't need to farm for it. Usually, on the runback, there's enemies that drop rosaries. If you kill them every time, you'll get really good at fighting them and you'll get money each time, so the more you die to the boss, the more money you build up, which means when you do finally beat the boss, you'll have lots of money saved up, and can buy some stuff.

And don't feel bad if you are at 1 health and you have tons of money and you save scum and quit to go back to the bench and try again so you don't lose the money - it's okay, having to grind that money again is silly.
by simpaticoder | 2025-09-09 13:39:22+00:00
>We've gone from "Demonstrate the value of our product" to "Create an illusion of our lifestyle"

Scott Galloway occasionally mentions that he thinks most consumer spending is irrational and marketing spends purpose is to make people buy irrationally. Anecdotal observation supports his observation, most strikingly in fashion, where people buy the branded item that costs 100x (or more) than the equally useful unbranded item. Many other examples exist, of course, in almost every market. I tend to agree with Galloway that the goals haven't changed, only the marketing tools (and their effectiveness). Any increase in irrational behavior can be linked to tool efficacy and not to the motivation of the firm, which has remained constant.
by MathMonkeyMan | 2025-09-09 13:39:34+00:00
Nevermind the fake stuff, the real stuff is scammy enough.

When you select an app to install on Google Play, it takes you to another screen confirming the install. But that install button on top is not for the app you selected, it's for a different, advertised app. You have to scroll down to find the confirmation button for the app you already instructed the store to install.

This isn't going to ruin any lives, but it's gross.
by triceratops | 2025-09-09 13:39:38+00:00
Gonna have to see more numbers for "storage is more expensive than nuclear". And not the unit cost of SMRs with the assumption that mass manufacturing is solved, certified, and permitted. You have to account for those costs too. And time, of course. The climate crisis is here now. We can't wait 10 years for cheap SMRs to be ready (though we'll gladly take them when they are).
by npteljes | 2025-09-09 13:39:38+00:00
Yeah... you're right. Ultimately it's not that my time is precious, it's that I get no satisfaction of beating a boss. I hate how overpowered are with scripted stuff, for example, and how they break most game mechanics introduced so far. And so, my time spent seems to be wasted.

Looking at how other people describe their experience, it seems like the figuring out part brings them joy. I usually have that with the core game mechanics themselves. The "knowledge" I get seems useful here, because I get to apply it to the rest of the game, but learning the boss mechanics seems like a throwaway thing, and I think this bothers me.

I also don't enjoy replaying parts of the game, especially as a punishment, especially when the replayed part had nothing to do with the my failure itself - like clearing the trash before a boss, or replaying parts of the bossfight before the crucial part, or getting back to the boss' place from a checkpoint. Such a slog!
by bluGill | 2025-09-09 13:39:43+00:00
Competition is possible, it just is rarely worth it. NYC subways worked fairly well as a competitive system until the city started passing maximum price laws (which in turn meant they couldn't maintain the system and eventually the city took it over). However the competition meant redundant service to the dense areas as each built there, at the expense of less dense areas that should have got service. It also meant that where lines did cross each other (a complex task even in 3d) they generally didn't built transfers even though a single system would have.

The claim competition is not possible is therefor false. We can debate if we want it, but it is incorrect to claim it cannot work.
by neutronicus | 2025-09-09 13:39:52+00:00
I don't think that's achievable with all the science fiction surrounding "AI" specifically. You wouldn't be "reclaiming" the term, you'd be conquering an established cultural principality of emotionally-resonant science fiction.

Which is, of course, the precise reason why stakeholders are so insistent on using "AI" and "LLM" interchangeably.

Personally I think the only reasonable way to get us out of that psycho-linguistic space is just say "LLMs" and "LLM agents" when that's what we mean (am I leaving out some constellation of SotA technology? no, right?)
by simiones | 2025-09-09 13:39:56+00:00
You're not describing an eventually consistent system, you're describing a system that diverges. By definition, eventually consistent means that, after some time, all readers across the entire system are guaranteed to find the same values, even if before that time they may see different values.

Any eventually consistent system has to have a strategy for ensuring that all nodes eventually agree on a final value. R1 and R2 need to communicate their respective states, and agree to a single one of them - maybe using timestamps if R2's value is newer, R1 will replace its own value when they communicate), maybe using a quorum (say there is also an R3 which agrees with R1, then R2 will change its value to match the other two), maybe using an explicit priority list (say, R1's value is assumed better than R2's).
by dotnet00 | 2025-09-09 13:40:05+00:00
Reddit has this thing where, if someone reports your comment for self-harm, regardless of validity, they send you an automated (and IMO useless at best, harmful at worst) "we're here for you" DM.

It's often used as a way to anonymously imply that you should kill yourself, so I wonder if this sort of thing would affect that and how.

Though, overall, I think the censoring of self-harm stuff is already beyond ridiculous. Terms like "self-unalive", "self-terminate", "sewerslide" make a very serious issue sound like a joke. Blinding ourselves to isn't going to make these problems go away.
by elric | 2025-09-09 13:40:56+00:00
SPF & DKIM are all but worthless in practice, because so many companies send emails from garbage domains, or add large scale marketing platforms (like mailchimp) to their SPF records.

Like Citroen sends software update notifications for their cars from mmy-customerportal.com. That URL looks and sounds like a phisher's paradise. But somehow, it's legit. How can we expect any user to make the right decision when we push this kind of garbage in their face?
by jerf | 2025-09-09 13:41:01+00:00
High school, and even more particularly, the stuff we serve up to everyone, hence my reference to STEM-specific specialization for matrices.

In university you have the specialization to do as you need to do, e.g., serve up matrices to those who need them, serve up real analysis to those who need that, etc. And while HN is obviously fairly STEM-focused, a lot of majors in University won't get any math at all if you think about it, only just enough to have the fig leaf of a liberal education.
by gingerBill | 2025-09-09 13:41:02+00:00
> My general view is that package managers (and not the things I made distinctions about) are probably in general a net-negative for the entire programming landscape, and should be avoided if possible.

I am arguing that their "benefits" are only very short-term, if there is actually benefit for them in the first place. The strawman that you present has been repeated already and is not considering that all of those other things are actually useful and good alternatives.
by ecshafer | 2025-09-09 13:41:57+00:00
> Normally they're full of spelling mistakes and unprofessional grammar.

This is the case when you are doing mass phishing attacks trying to get the dumbest person you can. In these cases, they want the person that will jump through multiple loops one after another that keeps giving them money. A more technical audience you wouldn't want to do so, if you want one smart person to make one mistake.
by PaulHoule | 2025-09-09 13:42:04+00:00
We're not seeing a lot of realistic numbers published for the cost of a 100% renewables + storage grid because there is the X factor of "How many outages can you tolerate?"

Storage over a 24 hour period is one thing, the economics don't look difficult at all. In places like Upstate NY, however, usable insolation can vary by a factor of 3x between summer and winter. You can overbuild solar panels by 3x or you can add a few months of storage which costs a lot more than a few hours or days worth of storage. There is also the issue of

https://en.wikipedia.org/wiki/Dunkelflaute

It would be great to have a backup energy source which is fully and economically dispatchable and environmentally benign but it's not there. I suspect there is some point of required reliability where adding nuclear baseload makes the grid more reliable economically compared to building months worth of storage. See

https://www.sciencedirect.com/science/article/pii/S136403212...

also nuclear power plants are capable of load-following

https://www.oecd-nea.org/nea-news/2011/29-2/nea-news-29-2-lo...

it's just not an optimal use of the capital. The Gates foundation has been researching LMFBRs that use thermal batteries to improve load following abilities.

You might think dispatchable natural gas fired plants with some kind of carbon capture would help but with amine-based carbon capture the capital cost is high, just like with nuclear, so you are looking at a high multiple of what it would cost to add carbon capture to a coal plant that runs continuously. Calcium-based chemical cycling, metal-organic-frameworks and such offer some hope for lowering costs but probably not enough for those scenarios.

The real criticism of nuclear at this point in time is that any new plants are a decade out. It's a reason to start early, but no matter how you slice when the next NPP goes online in the US the amount of solar and wind added to the grid between here and now will dwarf it.
by ManlyBread | 2025-09-09 13:42:15+00:00
This book is extremely overrated because the whole thing can be summed up in two bullet points:

* write your new code somewhere outside the main solution and call it from the old solution

* automated tests are pretty cool and you should write these whenever possible

I found the book to be close to useless when I was working with actual legacy code. How do I write an unit test for an application that has an embedded Visual Basic script support with dozens of scripts that are thousands of lines long? The book does not answer this question at all because the author assumed I have the luxury of working with Java or an another language that supports the object-oriented paradigm and can be endlessly extended with no limitations whatsoever.
by dylan604 | 2025-09-09 13:42:30+00:00
Isn't that kind of the default position for these types of builds? Nobody wants to be the team that built a thing that died on day 101 when the mission was designed for 100 days. Everyone wants the science to stop not because the platform stopped working but because bean counters shut it down. Everyone wants to be the team that built Curiosity long outliving its mission duration while continuing to do science. Otherwise, the bids will go to the teams that build Voyagers or Curiosity and never come to the team that builds systems that last exactly mission duration
by tyleo | 2025-09-09 13:42:36+00:00
There’s a dead comment by oldpersonintx which is a bit negative. I can’t comment on it but I want to reiterate the argument with more positivity because I believe there is a kernel of truth.

At least part of the decline of US education has been caused by pandering to unions. As a specific example teachers unions were against in-person learning during COVID even when parents were actively observing bad outcomes for their children.

In the interest of improving education the Democratic Party partnered with teachers decades ago. There were real improvements during this period. More recently though I believe the party has become captured by teachers more than accountable for outcomes.

Teachers know the most here and they deserve to be a big voice, but they aren’t the only voice. Frankly parents also aren’t the be-all-end-all here. I believe the best way to improve outcomes would be more cooperation between both groups instead of devolving into us-vs-then dynamics.
by gingerBill | 2025-09-09 13:42:50+00:00
It is a build system in the technical sense but it's hard to explain to people because they expect it to be separate from the language entirely. If I said Odin had a build system, they'd be expecting an external build script. And when you say you don't need that, they usually get really confused.

So how do you explain such a system to someone? This is a genuine question I am not sure how to answer.
by jerf | 2025-09-09 13:43:23+00:00
Despite my personal STEM focus I'd lean into that. I'm more interested in teaching mathematical modes of thought and some forms of mathematical intuition. I suspect grinding on symbolic computations is intrinsically necessary for that, but at the same time, I don't think it's sufficient, and that's what's missing from our curriculum right now. As evidenced by the people who come out of high school with all sorts of symbolic manipulation ability and still effectively no mathematical intuition or thought patterns to speak of. Then the symbolic manipulation abilities, unsupported by intuition or thought patterns, simply fade away with minimal impact on the person's life.
by haversine02 | 2025-09-09 13:43:39+00:00
I've always wished the planet descriptions weren't so dry, the RNG generates some pretty compelling combinations sometimes. So I spared an hour or so and vibecoded this quick tampermonkey extension for the game. It scrapes the page and assembles a prompt from planet stats for AI image generators. Try it out if you wanna give it a try, it supports both Gemini and OpenAI API, or you can just copy the prompt it generates and input it manually: https://pastebin.com/tGcJTBQw Example of what it does - https://imgur.com/uIpthQS

I'd say Gemini(Nano Banana) definitely generates more interesting stuff than gpt-image. It's output is less realistic and it messes up often, but it actually manages to synthesize some pretty neat novel environments.
by dismalaf | 2025-09-09 13:44:05+00:00
I mean, is a "build system" even real? Or does it just exist because of a shortcoming with a compiler? All "compilers" have multiple steps usually invoking other programs at some point: parsing, actual code transformation, linking, etc..., some also find packages, some rely on an external tool or long command line invocations.

But yes, Odin builds it into their compiler. Rust doesn't but does have Cargo. Both are easy, as far as typical usage goes. Rust automates dependency management, Odin doesn't automate it per se but does make it easy. Which is what the whole discussion is about. A bunch of HNers whining that Odin makes it too hard, even though everyone sane uses Git anyway, and you can add dependencies using Git, and Odin will compile them without a build tool.

So for a Rust project you use Cargo + Git, for an Odin project you use Odin + Git, for a C/C++ project you use Meson (or something else if you hate life) + Git. In the end it's mostly the same, Bill just doesn't seem to want to deal with an NPM or Crates.io situation (and fair enough!).
by yboris | 2025-09-09 13:44:07+00:00
Variety of reasons, not all fitting everyone. For my preference I like the minimalist MPC-BE interface at full screen on a separate monitor; others might prefer GridPlayer or something else. I feel like external player gives everyone the customization they prefer.

Embedded player would require making a tremendous number of design options: where does it reside in the interface, what does it cover up when open? and if it can pop out as a separate window, what value does it bring over an external player?
Show HN: Prediction Market for Trump's likelihood of pedophilia
by Trevor_Gillan | 2025-09-09 13:44:11+00:00
Hey HN, I have been working on using the info-gathering and truth-seeking properties of the markets to get more honest reporting on all sort of things. The idea is to have a market game where people can wager a fake currency on what think is true and then, the citizen reviews the crowd-sourced information and makes a judgement about which position has the best case. It is crowd-sourced journalism with a market game. Please let me know what you think and my email is trevorgillan1@gmail.com, if you have any questions.
by cosmic_cheese | 2025-09-09 13:44:12+00:00
> the launcher developer deciding for you what's best for you.

I don’t understand how I would be deciding what’s best for users?

The only reason why third party launchers wouldn’t support live wallpapers is if Google didn’t give devs the tools to render them. All they’d need to do is include a WallpaperView the dev can add to their view hierarchy that supports live wallpapers. Boom, the dev can do fancy effects and the user loses nothing.
by throw4847285 | 2025-09-09 13:44:57+00:00
I guess somebody found a way to get the Silksong controversy onto Hackernews. Can't say I'm surprised.

My take is, it's a good game and I'm enjoying it. I suspect the only reason it's generating so many takes is that it was so spectacularly overhyped that it cannot possibly live up to how much it has been built up. And that enthusiasm, which started within a specific niche fanbase, has spilled out onto the internet at large in such a way that that is unsustainable.

I bet if we all wait a year, the back and forth will die down and we'll be left with a game that gets similar acclaim to Hollow Knight. People subconsciously think about hype on the same 1-10 scale as a review, but hype can drive a video game score well into the teens or 20s. Then even a 10 feels like a disappointment.
by Konnstann | 2025-09-09 13:45:00+00:00
Elden Ring is a great example of a game where the difficulty is largely self-imposed, if you play using all the tools the devs give you like summons, magic, certain weapons, etc the game becomes almost trivialized. Not saying that's a bad thing necessarily, in fact the opposite, I think FromSoft's "difficulty slider" replacement is one of the best ways of going about it, however I think the difficulty overall is overstated by the "real souls players" who hamper themselves so as to experience all of the mechanics.
by somenameforme | 2025-09-09 13:45:40+00:00
You're simply describing unconscious competence - and there's no real secret to it besides lots of training in something. For instance you are unconsciously competent at reading. When you read the words I'm writing here you're not thinking at all - you just look at the text and the meaning instantly enters your mind. Yet think about all of the processing that somebody new to a language would have to go through - trying to recognize each letter in a word, combine those using whatever rules and quirks that exist in the language, think about the meaning of that word, and then repeat recursively to process a single sentence. The idea of being able to process 10 words a second (as a decent speed reader can) would seem superhuman, but it's not at all.

And how did you become unconsciously competent? By practicing reading and writing, a lot. FWIW you also probably have plenty of unconscious competence in mathematics as well. For instance what is 9x7? 63 probably enters into your mind with absolutely zero effort. Now what's 5x4? Again, it's the same thing. And in his situation it's made even easier because he knows what of the numbers will be to start with so it's like a series of 5x4, 4x3, 3x7, 7x2, etc. But the part you (and I) lack is the unconscious competence such that if we see 374 + 9, we have to think for that fraction of a second '374 + 10 - 1' to get 383, but instead need to see the answer literally instantly with no conscious thought whatsoever, and all that is is training.
by makeitdouble | 2025-09-09 13:45:48+00:00
YouTube has been in the red at least until 2010 under most estimations.

For reference that's around the point Vimeo started pivoting to different strategies and blocking long content as they couldn't pay for the infra.

That's also around that time that Dailymotion went down the pipes with the French gov stepping in to save the remains.

YouTube thrived from there as creators and advertisers had nowhere else to go at that point. That's the dumping part.
Tell HN: I found a typo in Sequoia 15.6.1
by keepamovin | 2025-09-09 13:46:00+00:00
I was investigating a system extension and looked to the info panel on the right. There's two little buttons in a section under it, "Hide dock during focus" and "Hide Dokc"

See: https://imgur.com/gallery/typo-macos-98OqoKT
by lilwobbles | 2025-09-09 13:46:51+00:00
Trump has backed down on most of the outrageous tariffs (200% tarriff on China). The alternative was a false reality that the EU believed because they are scared of Trump and bad at negotiating.

I'm glad the American people at least know how weak the EU is, we should elect someone next time that will bring those tariffs up to 100%, and the EU will have to take it because it's better than a 200% tariff alternative. That's just being realistic, right?