MurphyA/hacker-news huggingface dataset:
by yjftsjthsd-h | 2025-09-14 16:11:57+00:00
Quoting inline since parent has been rewritten multiple times now...

> If you have the UI layer able to grant root access, it has root access itself and is not sandboxed. If the UI layer can grant it, an attacker gaining slight control over it has root access. An accessibility service trivially has root access. A keyboard can probably get root access, and so on. Instead of a tiny little portion of the OS having root access, a massive portion of it does.

Android has an established way to handle permission dialogs that require the user to confirm their approval, including use of fingerprint/PIN/password to authenticate. If it's good enough to unlock and decrypt the device, it's good enough to control root access. Besides which, I think

> An accessibility service trivially has root access.

is hitting https://xkcd.com/1200/ ; an a11y service already has access to everything inside the sandbox (including all your sensitive data), and the system settings that control permissions and sandboxing.

> In the verified boot threat model, an attacker controls persistent state. If you have persistent root access as a possibility then verified boot doesn't work since persistent state is entirely trusted.

I'm tentatively willing to agree, but I don't see the point? 1. If an attacker controls persistent state, don't they already control all the other permissions, including what security domains exist and what permissions are given to apps. 2. You don't have to persist it; even just one-off root access is quite useful.

> A userdebug build of AOSP or GrapheneOS has a su binary and an adb root command providing root access via the Android Debug Bridge via physical access using USB. This does still significantly reduce security, particularly since ADB has a network mode that can be enabled. Most of the security model is still intact. This is not what people are referring to when they talk about rooting on Android, they are referring to granting root access to apps via the UI not using it via a shell.

Agreed, that's not what I want.
by w10-1 | 2025-09-14 16:12:07+00:00
Taking responsibility for inner dialog is the key.

As for what actually "works", one measure is not whether one produces journal entries (however insightful), but how journalling helps with minding one's life -- in the same way that anticipating a dialog with a therapist or friend might lead one to temper one's own dialog (or conversely, how worrying about what people think might be inhibiting).

I do think that imagining oneself in a constant dialog with Socrates could be illuminating.

Some interlocutors are direct, correcting faults or encouraging you. But the best teachers use indirection, setting you a challenge that should break you of a bad habit or push you to realize a mistake or integrate some insight (Nietzsche intimated that enemies can be better than friends in this regard). People who posit that everything happens for a reason (or, as Thales said, the world is intelligible) do a reflexive form of this, challenging themselves to find that insight or truth.

Similarly, some interlocutors are careful to not inject their own positive bias, but eager to protect against errors; e.g., "the unexamined life is not worth living" says little about what kind of examination helps. That creates essential space for one's own agency.

Ultimately, you create your world, even if you have no choice, so be at least as kind and forgiving as you are critical and diligent.
by hollerith | 2025-09-14 16:12:21+00:00
>They just don’t believe in a society that cares for the weak and needy.

There is some truth to that, but I don't think that explains their position on PFAS because too much PFAS will disable even a strong healthy person. In this particular, it's more that they think that the harm is being exaggerated and that the actual, non-exaggerated degree of harm does not justify putting restrictions on business and commerce.
Show HN: Discover and share things to look forward to
by oan | 2025-09-14 16:12:26+00:00
LookingForwardTo.com is a platform to discover, track and share things to look forward to. Movies, shows games, your own events and more.

I've been close to the concept of having things to look forward to ever since it basically got me out of a very dark time of my life back in 2017 (that and my late dog).

Last year I decided to try and combine that with some of my biggest passions and this platform is the result. I'm currently curating all content by myself, except for the release dates, which are automated. It's built with a Next.js frontend and Node.js + express.js + MongoDB with Mongoose backend. Feedback would be much appreciated!
by estearum | 2025-09-14 16:12:59+00:00
Correct, which as I said: "At least a SCOTUS decision," where "amend the Constitution" is a significantly higher bar to meet.

If you think we're going to amend the Constitution to ban gender affirming care for inmates you're living in outerspace, but I suppose your position is that politicians are supposed to just say shit that has the correct hate-valence and then it's as-good-as-accomplished?

Inmates received this care under Trump 1 (because USG is obligated to provide it, Constitutionally): https://www.nytimes.com/2024/10/16/us/politics/trump-prisons...

They've tried stopping it in Trump 2 but have been enjoined by courts (because USG is obligated to provide it, Constitutionally): https://www.aclu.org/press-releases/federal-judge-temporaril...
Show HN: Mirenku – local/offline anime tracker
by Aeturnis | 2025-09-14 16:13:15+00:00
Hello HN - solo dev and first timer, here.

Mirenku is a small desktop app to track what you’re watching. It’s local-first (runs offline, no telemetry) and meant to complement, not replace, MAL.

v0.3.2 highlights: quick add/+/– episodes, search/filter, JSON/CSV import/export, MAL OAuth2 (PKCE) + sync via protocol handler. Windows is primary; macOS/Linux builds are experimental.

Security notes: tokens are envelope-encrypted (Fernet AEAD DEK wrapped by the OS keyring); timestamped OAuth state; TLS 1.2+ only. SHA-256 checksums provided.

Links: - Download / landing: https://mirenku.app - Docs & security policy: https://mirenku.org - Source / license details: https://github.com/Aeturnis-Development-Labs-LLC/mirenku

Feedback I’m looking for: - Install friction on Win/mac/Linux - Import/Export edge cases - UI paper cuts (least clicks to update an episode?) - Concerns with the token storage approach

Happy to answer questions and fix rough edges quickly.
by avazhi | 2025-09-14 16:13:16+00:00
If I run a business that produces pollution through a pair of smokestacks, and I know that the pollution is harmful and will give a few of the surrounding residents lung cancer, is that the same thing as intending that they will get the cancer? Or would it be reasonable for me to see the harm as an unfortunate externality that I wish could be avoided but can't be given whatever technological limitations there are currently.

So no, it's not 'exactly that'. You guys hate corporations so much that you are going a step beyond mere negligence and pretending that they are actually out to harm people as the very raison d'etre for their products, as opposed to the harm being a byproduct of their business. I'm not saying PFAS should be legal (they definitely shouldn't be); I'm saying it's lazy thinking that lacks evidence to suggest the harm itself is somehow the motivation, which is what the original commenter suggested.

Do you guys also think all the old asbestos manufacturers hoped/intended that their miners and others working with their sheeting would get mesothelioma?
by walterbell | 2025-09-14 16:13:21+00:00
September 14th, https://www.thailandnews.co/2025/09/bank-of-thailand-seeks-f...

> Bank of Thailand (BOT) will meet with commercial banks and the Anti-Online Scam Operations Centre (AOC) on Monday to address growing complaints about the wrongful freezing of bank accounts.. after small retailers and individuals reported being abruptly cut off from their funds without warning or recourse.. Assistant BOT Governor.. acknowledged that current procedures for identifying and freezing suspected “mule accounts” need refinement to prevent harming innocent customers. Many account holders have taken to social media to express frustration over being unable to access their money or conduct business after transfers from unknown sources triggered automated freezes.
by kilroy123 | 2025-09-14 16:13:31+00:00
It's called anacyclosis. A long cycle that has repeated throughout history. The US is the final step before the cycle repeats, Ochlocracy or "mob rule".

It blows my mind that people refuse to accept modern countries and societies still don't go through this cycle.

I truly think the US will have a Putin like dictator by 20230. (I don't think this is good or want that)
by close04 | 2025-09-14 16:13:36+00:00
> I can only see gains here.

All of your points are correct. But so many companies/employers keep abusing this power that I have to assume they see some value. Some of the things you mentioned are even short term gains for some companies. For some of Boeing’s execs, employees hiding flaws was a win until it wasn’t and it became someone else’s problem.
by chrismorgan | 2025-09-14 16:14:18+00:00
The page is old enough that it wouldn’t surprise me if Google and Bing used to index it and are capable of indexing it, but no longer do. A lot of older stuff where you know exactly what’s there just can’t be found any more.

https://www.google.com/search?q=svg.nicubunu.ro seems to surface it, with text; https://www.google.com/search?q=site:svg.nicubunu.ro gets the title, but no more text. I’m curious how it decided what the title was. I wonder if they have some kind of “choose the largest text” heuristic if a title is missing.

https://duckduckgo.com/?q=svg.nicubunu.ro and https://duckduckgo.com/?q=site:svg.nicubunu.ro don’t show a result.
by californical | 2025-09-14 16:14:24+00:00
> you can't impute intention without more evidence

If I’m aware that eating too much chocolate will kill my dog.

But it’s annoying for me to get up and walk to the trash can.

So I just throw the chocolate scraps to my dog to avoid inconveniencing myself.

Is this the same as wanting my dog to die? Being completely unbothered by the fact that I’m killing my dog sounds about equivalent to wanting it to die. I’m choosing to harm it to avoid a small inconvenience.

Maybe I would prefer it not to die, but I’m actively making a choice to do something that kills it, so really there’s not such a difference.
by 3036e4 | 2025-09-14 16:14:34+00:00
I shut down my server the other day after people on HN were sharing horror stories about runaway bandwidth bills. I could not find a good (easy) way to ensure that my gemini server shuts down if hit by DDOS. I want to set it up again, but need to find some place to host it that has a guaranteed maximum bandwidth cost.
by qwezxcrty | 2025-09-14 16:14:51+00:00
Yes, but even for people eligible for EB1A (it usually has a higher bar in practice, EB2/NIW is easier but way worse backlog), filing a (or according to some lesser stringent interpretation, having an approved) I-140, will make you have immigration intent and thus illegible for extension of any nonimmigration visa.

So you apply for green card and if you don't immediately get it (particularly because of the backlog for some countries), you have to leave the US.

(I'm not an immigration lawyer and these are only my personal interpretation).
by ninetyninenine | 2025-09-14 16:14:57+00:00
Svgs are capable of anything. You can draw anything with it as it’s just a format for vector graphics. The vectors can be manipulated so you can even make a 3D game engine from it if you wanted.

The only thing that separates it from html and css is that html and css biases towards website styled stuff. HTML is designed for text boxes and that kind of stuff while svgs bias more towards a neutral drawing medium: shapes and vectors.

So because it’s more neutral you can even make a html engine from svg if you so wanted.
by wslh | 2025-09-14 16:15:29+00:00
For the web you can now use Cocos2d-x[1], Godot Engine[2], PixiJS[3], and/or Phaser[4].

[1] https://www.cocos.com/en/cocos2d-x

[2] https://godotengine.org/

[3] https://pixijs.com/

[4] https://phaser.io/
Lost $300 due to an API key leak from "vibe coding" – Learn from my mistake
by liulanggoukk | 2025-09-14 16:16:00+00:00
I just learned an expensive lesson and wanted to share it here so others don’t make the same mistake.

I recently lost $300 because of an API key leak. It started with a surprise $200 charge from Google Cloud, and when I looked into it, I found another $100 charge from the day before. Both were for Gemini API usage that I never intentionally set up.

After digging, I discovered the issue: I had hard-coded an API key in a script that was part of a feature I ended up deprecating. The file was only in the codebase for two days, but that was enough for the key to leak. Google actually sent me alerts about unusual activity, but I missed them because they went to a less-frequently-checked email account.

Here’s what I learned:

Never hardcode API keys - Use environment variables or a .env file, even for temporary code.

Set up billing alerts - Google Cloud (and other providers) let you set up alerts for unexpected charges.

Check all linked emails - Don’t ignore notifications, even if they’re sent to secondary accounts.

Don’t rely solely on GitHub’s secret scanning - It’s useful, but renaming variables can bypass it.

This happened while I was experimenting with "vibe coding" (letting AI generate code quickly), but I realized too late that human oversight is still crucial, especially for security.

Hope this helps someone avoid the same costly mistake!

TL;DR: Hard-coded an API key in a deprecated script, key leaked, and I got charged $300. Always use environment variables and set up billing alerts!
by bee_rider | 2025-09-14 16:16:15+00:00
Left wing politicians and media figures try to impact the media narrative (just like all media figures and politicians). It is part of the skill set. Like yeah, it would always be better for an engineer to get better at quickly understanding large codebases. Better for a soccer player to get better at aiming the ball. But that’s the game they are all playing, they are doing it as well as they can (in the case of left wing politicians, either they are bad at it or they are at some systemic disadvantage).
by scottyeager | 2025-09-14 16:16:18+00:00
I just did some code to display digits on my APC Mini's 8x8 light grid: https://github.com/scottyeager/pressed/blob/main/controllers...

By using the three available colors on my older model, I was able to render numbers up to 199 in a readable way. Two digits on the right are 8x3 and one on the left is 8x2. I quickly abandoned two pixels of width as impossible for making legible text for all digits, so seeing a full font at two pixels wide is a fun surprise.

Thanks for the tip on Mystrix—looks neat.
by contrarian1234 | 2025-09-14 16:16:51+00:00
What a muddled video

For the first half he seems to constantly mix up C8 and Teflon. After a long section explaining that C8 is some carrier molecule used to make Teflon - he then explain C8 is used in factories and kills cows. But it's not clear C8 is anywhere other than the factory and the town around it

They then extrapolate from two chemical (C8 and C6) to just anything that remotely similar (PFAS)

Later they walk it back and say it's only a few chemicals. Actually your Teflon pan is safe. But then say thing "Blah blah was used to make waterproof..." is it in the final product? or is it part of the chemical procedure to make the product?

Is the problem the final consumer goods? Or is the problem the chemical manufacturing? (and subsequent dumping in the environment) Is this residue from after making the Teflon-like material?

The last parts I couldn't follow at all b/c it was a acronym soup of a ton of chemicals that aren't really explained. At this point I'd lost all faith in the presenters impartiality. Seems like he's just trying to stoke outrage for engagement

(the central point may still be right!)
by shiomiru | 2025-09-14 16:17:57+00:00
I had to work around this recently - it involved reimplementing my poll wrapper on top of select(), with the proprietary macOS extension that makes it support unlimited fds. (Of course -D_DARWIN_UNLIMITED_SELECT is completely unportable, so I still need poll too.)

Meanwhile poll() just works on Linux and the BSDs, certified or not.
by kijin | 2025-09-14 16:18:05+00:00
We've been having a similar fraud issue here in South Korea as well. These criminals call vulnerable people, impersonate bankers or government officials, and social-engineer them into trasferring money. Some even pretend to have kidnapped your child, play AI-generated voice of a sobbing kid, and demand ransom.

Fraud has always been around, but I think a few recent developments have exacerbated the problem. KYC has been relaxed a lot since Covid, so you can open a whole bunch of accounts with just an image of an ID card. Lots of elderly people now have access to mobile banking, so they don't have to visit a physical branch where a clerk can flag suspicious transfer requests.

Bank accounts in South Korea now start with a daily transfer limit of 1 million won (about $700), even lower than the 50k bhat limit that the Thai government has instituted.
by jkeel | 2025-09-14 16:18:33+00:00
I agree. I wish there was a more organized "left" but from what I've seen it's just many many random groups that are not on the "right". If there was an organized left, then they should focus only on improving the well being of the average US family through improving the economy and healthcare to work for everyone. The left let's itself get baited into these culture wars. If everyone's lives improved then I believe a lot of these culture war issues would improve as a byproduct of a happier populace who would be more forgiving to those around them.
by lithocarpus | 2025-09-14 16:19:50+00:00
No, such human rcts haven't been done.

The mechanism for how refined linoleic acid if heated would create higher amounts of free radicals that are known to cause oxidative stress / inflammation is well understood.

I agree a large scale rct for this would be great, but I doubt anyone would fund it and if it does get done I'd be surprised if it wasn't designed to meet the biases of the side that funds it.
by DrewADesign | 2025-09-14 16:19:58+00:00
You think vibe coding web apps, and by proxy most other coding, will pay anything more than whatever the cheapest developer in Vietnam is willing to charge for it? I definitely don’t think so. AI is killing the labor market for all of these skills. Right now it can only actually replace the lowest end of both fields, but as people upskill trying to outrun it (and then those above them, and then those above them,) and the tools get better, most of the market will get flooded and all of our pay will drop off a cliff. If ideas are so cheap to execute that anyone can do it, and everything is apparently fair use if you pass it through an NN somehow, then anyone can copy it, just as easily, and that will be a FAR more profitable business model. If that’s true, then once again, the only people with successful products are the ones that have the money for giant marketing expenditures. So pretty much exactly like today except a fraction as many people get paid to do it.

I haven’t spoken to a single developer that doesn’t believe they’re too special to have to worry about that. There’s going to be a lot of people that think they’re in the top 5% of coders at their totally safe company that suddenly realize door dash is their best bet for income.

The idea that having more web apps is always a benefit to people assumes a never-ending demand for more web apps. The economy and job market aren’t jibing with that assessment at the moment. Fewer people getting paid for this stuff is just going to mean that the people on top will just get paid more.
by catlikesshrimp | 2025-09-14 16:20:44+00:00
Criminals always find a way Decades ago, there was a popular activity called "Paseos Millonarios" (More or less, Millionare Rides) where criminals at night picked up a victim coming out of an ATM, and took him to several other ATMs around, everytime drawing non-suspicious amounts of money. The criminals didn't even need the PIN. They neither entered the ATM hut because only the card holder was sent in.

The final solution was disabling the ATM network durimg night, except the ones located in safe places. Showing you are drawing money in a hurry in a lone hut in the night was a bad idea, anyways.
by locococo | 2025-09-14 16:20:55+00:00
Survival of the fittest should apply to businesses above anything. If a business can't handle the regulations to not pollute water then it's a clear cut case.

This is all the symptom of laziness of the mind. There is resistance to change, adapt and make the world a better place not just for this, but future generations.

There is no leadership in the US, no vision, no drive. The excessive wealth has created a leading class that happily rests on the laurels of prior generations while squandering the future.

This problem extends to all citizens, beyond the weak and needy, and permeates all levels of government from small to big.

I live in one of the best school districts in the US, and when I see the food the children are served I am surprised this is acceptable.

But this is what the US is, extract as much money from people while providing sub standard service. All in-the name of the free market and shareholder value.

People are an exploitable reaource.
by sirn | 2025-09-14 16:22:00+00:00
> How is it that people were able to create so many mule accounts in the first place? What sort of KYC was going on?

They pay a low-income/no-income person a small fee (possibly monthly) to let them borrow their account. Sadly, people who would fall into this are not hard to find in Thailand.

> What sort of KYC was going on?

There are accounts that are grandfathered in and don’t require KYC but have been able to access online banking, etc. Mine is such, and my bank (BAY) is discontinuing that particular loophole at the end of this month. (I'm in Thailand right now to do this KYC, despite having not come back here for the last 6 years.)
by trimethylpurine | 2025-09-14 16:22:26+00:00
The correlation between lower crime and gun laws is very weak and disproven by countless other examples. The two countries given as proof aren't exceptions to that. Instead they are examples of how lower poverty correlates with lower crime rate.

Race isn't a factor, just as gun laws aren't. Pointing out that race isn't a factor is the opposite of racism.

Read carefully.
by upofadown | 2025-09-14 16:22:26+00:00
From the linked page:

> Notably, pass fails both of these requirements, ... , and the files themselves do not use authenticated encryption.

With pass you can turn authentication on by setting an option to sign the files by default. That comes at the cost of requiring an extra entry of the passphrase so most do not turn this on. Few people are concerned with the idea that an attacker might modify their passwords so they don't work. There is no real benefit to an attacker. They could just delete the files.

Even if signatures are not turned on the regular PGP integrity protection would still be in effect so in the unlikely event that an attacker changed the file an error would be generated and presumably passed on to the user.