MurphyA/hacker-news huggingface dataset:
by SOLAR_FIELDS | 2025-09-09 17:49:40+00:00
Are you not around hardware that much? This is stuff people who work in tech deal with every day, it's too hard to keep track of the names of the three different ports that you use ubiquitously? When someone asks you what charging port you need, do you just say "big square one" or "the iphone one"? Do you then have to clarify "the old iphone one, not the new one"?
by sigmoid10 | 2025-09-09 17:50:16+00:00
At least the VCs seem to be back from holiday. But I always think about this twitter story from Jack Morris when I hear about AI startups in Europe:

> their plan. to be the first to market with a certain type of multilingual model

> early in year: incorporate. start building

> hired an awesome team by march

> scraped / acquired all the data by june

> critical infra almost ready by july

> then comes august

> entire team goes on vacation for the entire month

> while they're gone, at least three competitors launch models

> team returns in september

> office vibe completely dead

> startup pivots to consulting
by crdrost | 2025-09-09 17:50:23+00:00
This was one of Doug Crockford's big bugaboos since The Good Parts and JSLint and Yahoo days—the idea that lexical scope aka closures give you an unprecedented ability to actually control I/O because you can say

function main(io) { const result = somethingThatRequiresHttp(io.fetch); // ... }

and as long as you don't put I/O in global scope (i.e. window.fetch) but do an injection into the main entrypoint, that entrypoint gets to control what everyone else can do. I could for example do

function main(io) { const result = something(readonlyFetch(onlyOurAPI(io.fetch)) } function onlyOurAPI(fetch) { return (...args) => { const test = /^https:\/\/api.mydomain.example\//.exec(args[0]); if (test == null) { throw new ValueError("must only communicate with our API"); } return fetch(..args); } } function readonlyFetch(fetch) { /* similar but allowlist only GET/HEAD methods */ }

I vaguely remember him being really passionate about "JavaScript lets you do this, we should all program in JavaScript" at the time... these days he's much more likely to say "JavaScript doesn't have any way to force you to do this and close off all the exploits from the now-leaked global scope, we should never program in JavaScript."

Shoutout to Ryan Dahl and Deno, where you write `#!/usr/bin/env deno --allow-net=api.mydomain.example` at the start of your shell script to accomplish something similar.

In my amateur programming-conlang hobby that will probably never produce anything joyful to anyone other than me, one of those programming languages has a notion of sending messages to "message-spaces" and I shamelessly steal Doug's idea -- message-spaces have handles that you can use to communicate with them, your I/O is a message sent to your main m-space containing a bunch of handles, you can then pattern-match on that message and make a new handle for a new m-space, provisioned with a pattern-matcher that only listens for, say, HTTP GET/HEAD events directed at the API, and forwards only those to the I/O handle. So then when I give this new handle to someone, they have no way of knowing that it's not fully I/O capable, requests they make to the not-API just sit there blackholed until you get an alert "there are too many unread messages in this m-space" and peek in to see why.
by adabyron | 2025-09-09 17:50:36+00:00
> 3. Having in person chit-chat - working

Having done years in both settings, random non-work related discussions were always more prevalent in office type atmospheres.

Only semi-related but in office at a cubicle is the least productive environment I've ever seen for companies. I cannot personally take a leadership team serious if they care about productivity & fiscal responsibility when they have cubicle farms of more than 10 people in an area.
by hombre_fatal | 2025-09-09 17:50:44+00:00
You give an example of an incredibly targeted attack of snooping around manually on someone's machine so you can exfiltrate yet more sensitive information like credit card numbers (how, and then what?)

But (1) how do you do that with hundreds or thousands of SSH/API keys and (2) how do you actually make money from it?

So you get a list of SSH or specific API keys and then write a crawler that can hopefully gather more secrets from them, like credit card details (how would that work btw?) and then what, you google "how to sell credentials" and register on some forum to broker a deal like they do in movies?

Sure sounds a hell of a lot more complicated and precarious than swapping out crypto addresses in flight.
by 1718627440 | 2025-09-09 17:50:56+00:00
My suggestion was for C where types are for example not encoded in the name, so I thought it only matters for type checking and optimization.

> In general though, the compiler can't optimize across the translation unit boundary

Which is why I would put it in the function signature, so it is available in both translation units. Making the code match the function signature is currently generally the responsibility of the caller. For example when I declare an argument of type double and write an integer in the call, the compiler will convert it to a double on the callers side. I think the safety story will be similar to a printf-call today. A dumb compiler does nothing, the smart compiler adds a warning/error, when the precondition fails.

My understanding is, that on the callee's side this case is simply undefined behaviour. Much like it is today for example, that you can't pass a NULL everywhere, it might be declared to be UB, but currently this is only documented and internal to the callee and not documented in the function signature.

PS: This does not conflict with my other comment (https://news.ycombinator.com/user?id=1718627440), that this can't be implemented as a macro that invokes UB:

callee (void * p, [...]) contract_assume (nonnull (p), "p can't be NULL!") { p[0] = foo; -> UB }

The access through p simply becomes UB like it always was. But the contract_assume, can't be UB, since then the check and diagnostic is omitted or reordered.
by maxglute | 2025-09-09 17:51:11+00:00
GFW is another word for "sovereign internet", which is what world is likely trending towards. IMO probably only matter of time before PRC offers turnkey SaaS to try to replace western platforms like they do security state packages / secure city. Wechat isn't going to take over the world but there's a chance Whatsapp can be replaced by fragmented but federated local alternatives. That's probably ultimate strategic vision for digital silkroad to erode US software dominance. Would be pretty easy sales pitch once a few pilot countries rolling, buy PRC stack, we help you secure your population, you squeeze out western platforms with local alternatives under your control that also adds high-end jobs to economy, win-win. More countries that sign up more network effects of US platforms diminish.
Show HN: ZeroAds – AI removes podcast ads and gives you a clean RSS
by fxuniverse | 2025-09-09 17:51:25+00:00
Built ZeroAds to stop manually skipping podcast ads. Paste any public RSS, we transcribe (Whisper), detect sponsor reads, cut with FFmpeg, and publish a clean RSS you can add to Apple Podcasts/Overcast/Pocket Casts. Typical run time: ~5 min for a 60-min episode on current infra. Accuracy is ~90%+ on host reads/dynamic insertions in our tests. Hard cases: ad-like mentions blended with content. Founding price: $5.99/mo (covers infra + a creator compensation pool). Would love feedback on edge cases, false positives, and pricing.
by ta1243 | 2025-09-09 17:51:27+00:00
If a new face can reverse policy on a dime, then that reversal can be reversed a couple of years later.

It's amazing how few people seem to understand this. Countries are oil tankers, they take years to turn even a little - and that's a good thing. In 2000 the world broadly knew what was going to happen, Gore and BushII would implement pretty much the same policies. Same thing in 2008 when it was McCain and Obama.

Sure you get some minor tweaks to policies which don't really affect much in aggregate.

Even in 2016 Trump was unable to make massive changes, because the state is built to prevent that from happening. The US does not elect a monarch. Things take forever by design, and it's really frustrating when you want it, but it also means one person or one administration can't make a major impact, it takes a generation of pushing the overton window in the direction.

Once you break that, you have a jetski zipping around, then you can't rely on stability, it becomes riskier to invest than investing in a country with a dictator.
by HL33tibCe7 | 2025-09-09 17:51:33+00:00
Most phishing emails are so bad, it’s quite terrifying when you see a convincing one like this.

Email is such an utter shitfest. Even tech-savvy people fall for phishing emails, what hope do normal people have.

I recommend people save URLs in their password managers, and get in the habit of auto-filling. That way, you’ll at least notice if you’re trying to log into a malicious site. Unfortunately, it’s not foolproof, because plenty of sites ask you to randomly sign into different URLs. Sigh…
by dmix | 2025-09-09 17:52:20+00:00
They wouldn't necessarily be targeting the whole protest, the IMSI catcher would work broadly and from that the warrant would require them to narrow down to one and ignore rest. Unless I misunderstood the technical details the parent comment posted.

This broad dragnet nature of Stingray collection has always been why it's been a major privacy issue. Like doing a wiretap by tapping the whole neighbourhood and filtering phone calls for a certain address.
by Izikiel43 | 2025-09-09 17:52:22+00:00
> Higher birth rate??? (probably not but this one is interesting regardless)

Why probably not? Childcare before primary school is a huge expense in the US, I think the largest for a healthy kid, around 24k$ per year where I live, so basically every other child is another 24k$ to the budget, or one parent not working. With this approach, having 2 or 3 children is more feasible, and the money saved from universal childcare could be in part invested for college or the child's future.
by loeg | 2025-09-09 17:52:36+00:00
IMO you don't need to be particularly careful to avoid insider trading if you were never at risk of doing it. It's pretty obvious when you have a duty of confidentiality and when you don't (again, in the US). The hypothetical scenario upthread just doesn't have any of the elements.

> As an example, if you were an employee of a listed company (not such an unlikely scenario given the capital requirements to pull this off) that was about to engage in the proposed scheme (publishing pro-adblock adverts) and it wasn't yet publicly known (which would be necessary if you want the scheme to be fully effective), and you shorted Google shares, you could easily fall foul of insider trading.

Yeah, that isn't the scenario described earlier at all. Here's what was proposed:

> I wonder if you could spend a few million on promoting adblockers to justify a short position on Google or Meta.

In this sentence, the entity performing the short and performing the advertising are one and the same.
by const_cast | 2025-09-09 17:52:40+00:00
Stealing is illegal, blocking ads isn't. The FBI recommends you use an ad blocker.

If anything, ads steal from YOU. They take your time and attempt to get you to part with your money.

You're not obligated to support a business model based on theft, if you want to consider it that. You're not obligated to support any business model.

If it's allowed, then go for it. They can always switch to another business model.
by seanmcdirmid | 2025-09-09 17:52:45+00:00
Yes, the USA is a PITA for foreign countries to setup factories in, as the Japanese and the Germans learned before, the Taiwanese are learning now, and that's why they prefer to just do setup factories in China instead.

I'm also pretty sure we are screwed in manufacturing because our labor is just too expensive and unskilled/unproductive to justify the price. But that is another issue entirely.
by mempko | 2025-09-09 17:52:45+00:00
People who don't do statistics and don't understand how the BLS gets their data think there must be corruption when they correct previous reports. Think of it this way, if they correct their previous estimates with new data, isn't that a sign they are NOT corrupt? Why would a corrupt organization correct their previous reports?

I advise you to do a little reading on how these reports are corrected. People relying on them understand how they work. People freaking out about them don't.
by quotemstr | 2025-09-09 17:52:46+00:00
It's interesting: to the extent the orthodox position acknowledges that genetically mediated trait inheritance exists, it cases it in terms of "disease" and "treatment". It's morally wrong to select an embryo for height, but acceptable, even imperative, to use genetics to screen for "shortism".

I'm sure you've read Gwern's essay on polygenic trait inheritance. I'm not sure repeating the literature would be productive here. We have every reason to believe that embryo selection and genetic engineering more generally won't just "cure disease" but make us taller, smarter, more beautiful, and longer lived -- and there's nothing wrong with that.

Of course there's a lot of variability. At some point technology will improve to the point that denying the effect exists will seem ridiculous, although I'm sure plenty will try.

I will say, though, that downplaying trait inheritance and the way genetics is the mechanism for this inheritance produces models that don't predict reality nearly as well as models that incorporate hereditary via genetics, and especially when it comes to education, we're throwing public money down the toilet as long as we make policy using inaccurate models.
by nomel | 2025-09-09 17:52:53+00:00
No. It’s not “decreasing”, it’s decreasing.

We’re in the realm of math here, not your opinion or imagination.

The second derivative is negative for all data shown (except 2018). That means, factually, objectively, in reality, as measured, the rate of growth decreased.

If you need help understanding this, I can provide a spreadsheet with the calculation and plots.
by fxuniverse | 2025-09-09 17:52:57+00:00
Hey HN - I built ZeroAds because I was tired of skipping minutes of ads while driving and working out.

What it does

• Subscribe to shows in ZeroAds (paste a public RSS). • We transcribe the episode (Whisper) and detect sponsor reads/insertions. • We cut those spans with FFmpeg and publish a clean RSS you can add to Apple Podcasts, Overcast, Pocket Casts, etc.

Tech

• OpenSaaS stack (React + Node + Stripe), Python flask microservice, Postgres (Neon), Fly.io • Whisper for transcription; an LLM pass over timestamps to classify segments; surgical splices with FFmpeg • Typical run time: ~5 minutes for a 60-minute episode on current infra

Accuracy & limits

• ~90%+ on host-reads/dynamic insertions/network promos in our tests • Hard cases: sponsor shoutouts blended into content, very short bumpers, or poor audio • We bias toward avoiding content loss over aggressive cutting

Pricing

• Founding members: $5.99/mo (planned $7.99). Covers API/hosting and a creator compensation pool.

Privacy

• Server-side processing only; no user data sharing; works from publicly available RSS/audio.

Looking for feedback on

• False positives you’d worry about • Specific shows/episodes we should test • Whether pricing feels fair for the value/costs • What would make setup clearer/faster

Happy to dig into technical details and take tough questions - thanks!
by everybodyknows | 2025-09-09 17:53:09+00:00
> We named the package hello_test instead of hello. This is possible and it allows for writing tests that use only the public API (identifiers starting with a capital letter) of the tested package as a real user would.

Would be good to highlight here that *_test packages are the sole exception from Go's standard rule of one-package-only per source directory -- special cases being always an unfortunate additional heightening of the beginner's learning curve.
by AtlasBarfed | 2025-09-09 17:53:41+00:00
I just don't think smrs work without figuring out Lftrs. Because lifters can use almost all the fuel, are inherently meltdown proof, you basically take away the two worst dangers of nuclear.

The issue with degradation of the piping and everything from the molten salts can probably be solved by a replacement cycle.

But to be fair, I have no idea how China's MSR is going
by chlodwig | 2025-09-09 17:53:55+00:00
- Extra-staffing of floaters to be able to give staff breaks or handle staff sick days or workers quitting - Taxes - Insurance - Administrative staff to handle billing and compliance - Facilities -- Rent, maintenance, HVAC. Adding to this, the facility might have to use expensive first floor space because the regulation requires them to be able to easily evacuate kids who can't down stairs on their own. - Profits/Owner-operator salary (anyone who can own and operate a successful high-quality day-care with five classrooms could command 6 figures salary on the private market)
by mdhb | 2025-09-09 17:54:23+00:00
No phone actually stands out a lot in real life surveillance systems and will very quickly get you a bunch of additional attention because it’s so unusual.

Not usually that I’m aware of as a single data point in any system but if there are other reasons to thing you’re trying to act surreptitiously you are going to be very close to the top of the list of people of interest.

There’s a lot to be said in 2025 for appearing uninteresting to anyone who might be watching.
by ameliaquining | 2025-09-09 17:54:24+00:00
A browser-integrated password manager is only phishing-proof if it's 100% reliable. If it ever fails to detect a credential field, it trains users that they sometimes need to work around this problem by copy-pasting the credential from the password manager UI, and then phishers can exploit that. AFAIK all existing password manager extensions have this problem, as do all browsers' native password-management features.
by tgv | 2025-09-09 17:54:34+00:00
It's stated in the article: "The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent."

However, it's obvious that protection-ware like this is essentially spyware with alerts. My company uses a similar service, and it includes a remote desktop tool, which I immediately blocked from auto-startup. But the whatever scanner sends things to some central service. All in the name of security.
by stordoff | 2025-09-09 17:54:38+00:00
It looks like Google Maps is using old imagery for some reason. If you look on Google Earth, the image used appears to be from 12 Jan 2016[1]. The more recent imagery (2022 onwards) shows the new build, and you can see glimpses of it in Street View on Google Maps.

[1] https://earth.google.com/web/search/%22Robin+Masters+Estate%...
by kiratp | 2025-09-09 17:54:46+00:00
> Importantly, we never intentionally degrade model quality as a result of demand or other factors, and the issues mentioned above stem from unrelated bugs.

Things they could do that would not technically contradict that:

- Quantize KV cache

- Data aware model quantization where their own evals will show "equivalent perf" but the overall model quality suffers.

Simple fact is that it takes longer to deploy physical compute but somehow they are able to serve more and more inference from a slowly growing pool of hardware. Something has to give...
by vkou | 2025-09-09 17:54:53+00:00
When you treat with someone you know to be a compulsive liar, the onus of proof is on them.

If this government has not proven that they had one, you'd be mad to trust that they did.

There are no consequences to it for lying, or for not following the law, or not acting in good faith. It has a well-documented history of doing all three, and is headed by a convicted criminal.
by bruce511 | 2025-09-09 17:54:57+00:00
You're looking at this from the consumer point of view. But consumers provide income, not capital.

Consumers may, or may not, have a choice of power providers. They can choose to "accept" what is on offer, or remove themselves from the grid. But they have very little negotiating power.

Actually it's pretty easy for (residential and office consumers to spend their own capital on batteries and inverters. Most homes consume (or can be set to consume) reasonably low power at night. A 20 kw/h battery will cover most homes easily.

(Solar panels aren't necessary for this.)

The capital cost, and savings therefrom, put a hard limit on what suppliers can charge for night time power. And of course storage is just as attractive to suppliers. (More capital-attractive than say a nuclear plant.)

As consumers we are used to simply announcing our needs. And assuming companies will expend any capital necessary to meet those needs. In practice it doesn't work that way, as rural phone/internet/cable consumers will testify.

Once you see electricity generation as a capital issue, not a consumer issue, things get clearer.
by TheAceOfHearts | 2025-09-09 17:54:57+00:00
This post is about the Twitter algorithm. He originally said it would be open source, but he just did a source dump 2 years ago. Now they did a new source dump with updated but heavily redacted code for the For You feed.

As for his claims about opening up Grok: Elon said that they would publish the n-1 weights for Grok. However, he dragged his feet and only recently released the weights for Grok 2. So now we're up to Grok 4 but he has yet to release the weights for Grok 3 despite his claims.

I think the problem with Elon is that he doesn't fully hold himself accountable for his words. If he decided that it was no longer economically viable to share Grok's weights then he should post an update about that. You cannot expect to win the goodwill of claiming to support open source and then continuously drag your feet while refusing to communicate your intentions clearly.
by the8472 | 2025-09-09 17:55:22+00:00
At least at $employer a good portion of those systems are intended to stop attacks on management and the average office worker. The process is not geared towards securing dev(arbitrary code execution)-ops(infra creds). They're not even handing out hardware security keys for admin accounts. I use my own, some other devs just use TOTP authenticator apps on their private phones.

All their EDR crud runs on Windows, but as a dev I'm allowed to run WSL but the tools do not reach inside WSL so if that gets compromised they would be none the wiser.

There is some instrumentation for linux servers and cloud machines, but that too is full of blind spots.

And as a sibling comment says, a lot of the policies are executed without anyone being able to explain their purpose, being able to grant "functionally equivalent security" exceptions or them even making sense in certain contexts. It feels like dealing with mindless automatons, even though humans are involved. For example a thing that happened a while ago: We were using scrypt as KDF, but their scanning flagged it as unknown password encryption and insisted that we should use SHA2 as a modern, secure hashing function. Weeks of long email threads, escalation and several managers suggesting "just change it to satisfy them" followed. That's a clear example of mindless rule-following making a system less secure.

Blocking remote desktop forwarding of security keys also is a fun one.
by onlypassingthru | 2025-09-09 17:55:28+00:00
Just as a general aside - The amount of hubris when it comes to Early Childhood Education is always astounding to me. So many people assume they are experts because they were a toddler once or can become an expert just by reading a couple books. How many people on HN are even aware there is an entire specialty in Education devoted to preschoolers for very good reason? ANY program that attempts to put kids in a good daycare with trained professionals is a win for everyone.