MurphyA/hacker-news huggingface dataset:
by throw0101d | 2025-09-09 17:55:31+00:00
> I wouldn't put it past the US to coerce Microsoft into injecting malicious payloads into these types of projects. EFF is putting complete trust in Microsoft's infrastructure: there's no out-of-band verification not served up by Microsoft itself

Isn't a git commit trail basically a Merkle tree of checksums? If any developer tried to do a pull or fetch they'd suddenly get a bunch of strange commit messages, wouldn't they?

Also: code signing is / can become a thing.
by jghn | 2025-09-09 17:55:44+00:00
I don't think this is what you're saying but when I've seen debates over choice the pattern I've sen is:

1) The people who feel more engaged at home can stay home, those who feel more engaged at work can go there 2) The latter group fails to feel engaged at work due to everyone being home. They complain.

In other words, they weren't missing being in the office. They were missing being in the office *with others*. Which requires everyone else to either want to work in the office.
by toomuchtodo | 2025-09-09 17:55:58+00:00
Can you expound on this? What regulation? What "preconceived notions on what work day, weeks, and lives have to look like"? Unions and higher wages enable people to afford families, and I am an aggressive proponent of a 4 day work week at 100% pay considering productivity gains over the last half century, but I'd be interested in your thoughts.
by gethly | 2025-09-09 17:56:08+00:00
This V2 is still pushing forward the retarded behavior from v1 when it comes to handling nil for maps, slices and pointers. I am so sick and tired of this crap. I had to fork the v1 to make it behave properly and they still manage to fuck up completely new version just as well(by pushing omitempty and ignoring omitnil behavior as a standalone case) which means I will be stuck with the snale-pace slow v1 for ever.
by FloorEgg | 2025-09-09 17:56:35+00:00
In any market if you increase demand without increasing supply, prices will increase.

For something like housing there are a lot of factors; construction supply chain, construction labor, permitting processes, zoning, private equity/speculation, tax rates, inter-state immigration, inter-country immigration, etc.

If you have people immigrating into a localized area faster than housing supply increases, it will increase the price of housing.

If you have vacant homes somewhere else in the country than the places people want to be (or where the immigrants are going) then it will have no downward pressure on pricing. There is nothing meaningful in a point that assumes the entire country is one market, as if supply/demand isn't tightly coupled specific locations.
by SAI_Peregrinus | 2025-09-09 17:56:37+00:00
Then you owe the contracted rate for the storage. These massive bills are almost never for storage, they're almost always for some sort of compute or transport left unrestricted. If you store 500TB you'll get an $11k/month bill, but the vast majority of the services can simply cut off usage at a limit. Even storage could prevent adding new data if you hit a pre-specified limit, so you'd only pay for the data you already had.

If I know my service should never use more than 1TB total I'd like to be able to set a limit at (say) 2TB total with warnings at 0.6TB & 1TB, thus limiting spend to $46/month on storage. Sure, my service will fail if I hit the limit, but if it's using double the storage I expect it to use something went wrong & I want to require manual action to resolve it instead of allowing it to leak storage unbounded.

This is not a particularly difficult problem to make significant improvements on. There are some edge cases (there always are) but even if spending limits were only implemented for non-storage services it'd still be better for customers than the status quo.
by xxpor | 2025-09-09 17:56:37+00:00
There's a theory that changing regulation Q to uncap interest rates on savings accounts had more to do with ending stagflation than the fed funds rate hikes.

I'm not smart enough to fully evaluate if that's true, but it was an interesting theory to me at least.

https://cepr.org/voxeu/columns/what-really-drives-inflation
by darepublic | 2025-09-09 17:56:49+00:00
> Formatting text with colors for use in the terminal ... > These kinds of dependencies are everywhere and nobody would even think that they could be harmful.

The first article I ever read discussing the possibility of npm supply chain attacks actually used coloured text in terminal as the example package to poison. And ever since then I have always been associated coloured terminal in text with supply chain attack
by graemep | 2025-09-09 17:56:56+00:00
Its obviously the first.

They always had different standards in different countries and in different circumstances.

FB has been showing lots of dog-whistle racism, occasionally even outright overt racism for many years. The one occasion on which reported a blatantly racist comment they said it was not against "community standards".

They want money, and they want engagement, and they want governments to remove competition.
by onlyrealcuzzo | 2025-09-09 17:57:01+00:00
Why can't Apple produce a watch that you don't have to use with an iPhone?

There's not a shot in hell I'm ever switching from Android to iOS. People rarely do this.

Theoretically, I might buy an Apple Watch or Air Pods or Apple TV if they didn't go out of their way to make them either impossible to use without an iPhone or a living nightmare.
by LEDThereBeLight | 2025-09-09 17:57:05+00:00
Great point, one that I think gets missed when you write code for a living and are comfortable with the ecosystem. But I remember when I was getting started making projects - even figuring out what I needed to google to get unblocked could feel impossible. I think AI will help bring a lot of people who are “on the border” between building something with code or giving up on the idea the boost over that line.
by tialaramex | 2025-09-09 17:58:02+00:00
This seems like a loss of separation of concerns. As a result Odin's compiler is full of completely unrelated stuff because it takes on this far larger role supervising everything about a project not just being a compiler.

Both Zig and Rust supply all of what you needed in the box, so all that Odin is doing here is commingling these features inside a single executable - there's no end user benefit that I can see.
by const_cast | 2025-09-09 17:58:05+00:00
> Wanting everyone to play by your rules is selfish and doesn't acknowledge the needs of others.

I'm not wanting anything, I'm telling you literally they are playing by my rules.

They are requesting to run scripts on my computer. It is my computer. If I say no, then the answer is no.

This is merely a request from them. I can abide, and I often will, but I have absolutely no moral, technical, or legal obligation to do so.

> I's also like stealing a TV from Costco.

No, because that's illegal.

You are REQUESTING to run advertisement scripts on my computer. I can deny that request.

If you don't like that, then don't allow me access. It is my responsibility, solely, to decide what scripts are running on my computer.

If Google asked you to download heartbleed and run it, you wouldn't do it, would you? Great, so you understand the concept.

The disconnect here is you believe I am entitled. And I am - I am entitled to deciding what runs on my computer.

You are not entitled to run arbitrary code on my computer because your business model requires it. I'm not your accountant, figure it out.
by SilverElfin | 2025-09-09 17:58:06+00:00
It’s not any more selfish than wanting subsidy for childcare. A voucher system is about choice. Parents get to have some financial assistance to make it possible for them to stay at home and be with their kids, or to provide their children with experiences that aren’t just sitting in the daycare center’s room. If they want to do things differently, why shouldn’t they be able to? Why does providing assistance have to mean centralized control of what assistance looks like?

> the mom, who is probably qualified in some other field

Parents are plenty qualified to take care of their kids. And their qualifications in some other field doesn’t mean that working that field is better for them or their kids or the country. Having strong family structures and time together is pretty valuable.
by buu700 | 2025-09-09 17:58:15+00:00
Agreed. I think we're all relieved at the harm that wasn't caused by this, but the attacker was almost certainly more motivated by profit than harm. Having a bunch of credentials stolen en masse would be a pain in the butt for the rest of us, but from the attacker's perspective your SSH key is just more work and opsec risk compared to a clean crypto theft.

Putting it another way: if I'm a random small-time burglar who happens to find himself in Walter White's vault, I'm stuffing as much cash as I can fit into my bag and ignoring the barrel of methylamine.
by sugarpimpdorsey | 2025-09-09 17:58:20+00:00
> Having done years in both settings, random non-work related discussions were always more prevalent in office type atmospheres.

Whether you realize it or not, these are team-building exercises. It brings people closer, sometimes too close (I slept with one of them lol), but overall this is a net plus for team dynamics.

It's really hard to bond with people exclusively through chat. Especially if you hide behind an anime avatar or refuse to switch on your video.
by tptacek | 2025-09-09 17:58:35+00:00
I have no idea what the first paragraph you wrote means. I don't have a moral issue with embryo selection. Select them for eye color for all I care.

I don't know what any of the rest of this has to do with what I said. I ask again: are you writing all this by way of declaring that "heritability == DNA"? That's a straightforward discussion we can have. Why avoid it?
by mxuribe | 2025-09-09 17:58:36+00:00
I'm not a top-level expert in cybersecurity nor email infra....but the little that i know has taught me that i merely have to create a similar-looking domain name...

Let's say there's a company named Awesome...and i register the domain name of AwesomeSupport.com. I could be a total dark hat/evil hacker/neverdoweller....and this domain may not be infringing on any trademark, etc. And, then i can start using all the encryption you noted...which merely means that *my domain name* (the bad one) is "technically sound"...but of course, all that use of encryption fails to convey that i am not the legitimate Awesome company. So, how is the victim supposed to know which of the domains is legit or not? Especially considering that some departments of the real, legit Awesome company might register their own domain name to use for actual, real reasons - like the marketing department might register MyAwesome.com...for managing customer accounts, etc.

Is encryption necessary in digital life? Hellz yeah! Does it solve *all issues*? Hellz no! :-)
by herval | 2025-09-09 17:59:45+00:00
The way Apple is iterating slower and slower on all product lines is kinda sad. It's not like there's a shortage of things to do - it just feels like they got in the habit of small increments to cut costs everywhere (keep the design exactly the same to reuse the same machines, minor software tweaks, etc). The updates are so minor, they don't even bother to put on a show (like this one - a major product, launched as a release note).

I guess even that saves some money too...
by logifail | 2025-09-09 17:59:54+00:00
> Are you reporting on this breaking news scandal that predictions about future events are not always perfectly accurate?

If the predictions are always (or mostly) wrong but always in one direction then wouldn't one begin to suspect that either a) the model is flawed, or b) that there's goal-seeking behind the scenes?

If there's a recent revision of BLS figures showing a correction of PLUS 900k jobs, I'd love to see it.
by valdezm | 2025-09-09 17:59:55+00:00
Location: San Francisco, CA

Remote: Yes

Willing to relocate: No, staying in Bay Area

Technologies: 15 years full stack - react and ruby -- but very broad bleeding edge. Build 0-1 products with Founders for 10+ years. Built geosite.io first year beta/foundation before entering Y-Combinator in 2019. Building AI in 2025 - competed and won Hacking Agents Hackathon put on by Datastax (Langflow) at Cloudflare in March 1st 2025. Spent the last 4 months building an POC AI marketplace, https://goodbruce.com Open to contract roles @ http://sharedfounders.com/ Open to FTE Founding Engineering roles

Résumé/CV: https://valdezm.com https://www.linkedin.com/in/markavaldez/

Email: hello@valdezm.com
by SilverElfin | 2025-09-09 18:00:08+00:00
Why would providing vouchers turn parenting into a profit center? That’s a cynical way to portray one side of this when you probably don’t take the same harsh view of the other side. The point of subsidizing care isn’t to get parents “back into work”. It’s to help people raise children. That’s it. You’re gatekeeping what this is for as a way to justify unnecessary centralization and a lack of choice where choice is possible.
by roadside_picnic | 2025-09-09 18:00:10+00:00
> play video games and jackin' off during work hours.

Most of the hardest working remote people I've known, and I've worked remote at over 5 companies across two decades, often don't work standard hours. I honestly don't see the problem with someone gaming at 2pm if they're also making sure shit gets deployed at midnight.

I also have found that anytime I show up in an actual office it's hilarious how little work actually happens.

The people who get nothing done remote, also tend to get nothing done in an office they just create the illusion of it.
by gethly | 2025-09-09 18:00:30+00:00
Those numbers look similar to goccy. I used to use it in the past, even Kubernetes uses it as direct dependency, but the amount of issues have been stockpiling for quite some time so I no longer trust it.

So it seems both are operating at the edge of Go's capabilities.

Personally, I think JSON should be in Go's core and highly optimised simd c code and not in the Go's std library as standard Go code. As JSON is such an important part of the web nowadays, it deserves to be treated with more care.
by ohdeargodno | 2025-09-09 18:00:33+00:00
>maybe we shouldn't let registrars sell npm.<TLD> regardless of the TLD

Cool, get big enough, become friends with the right people and you can squat an entire name on the internet. What, you're the Nepalese Party for Marxists, you've existed for 70 years and you want to buy npm.np ? Nope, tough luck, some random dude pushes shitty javascript packages over there. Sorry for the existing npm.org address too, we're going to expropriate the National Association of Pastoral Musicians. Dare I remind you that the whole left-pad situation was because Kik, the company, stole (with NPM's assistance because they were big enough and friends with the right people) the kik package ?

At least they're paying dozens of millions to buy a shitty ass .google that noone cares about because more and more browsers are hiding the URL bar. I'm glad ICANN can use it to buy drinks, hookers instead of being useful.
by ameliaquining | 2025-09-09 18:01:01+00:00
I mean, real deadlines do exist. The better heuristic is that, if a message seems to be deliberately trying to spur you into immediate action through fear of missing a deadline, it's probably some kind of trick. In this respect, the phishing message that was used here was brilliantly executed; it calmly, without using panic-inducing language, explains that action is required and that there's a deadline (that doesn't appear artificially short but in fact is coming up soon), in a way quite similar to what a legitimate action-required email would look like. Even a savvy user is likely to think "oh, I didn't realize the deadline was that soon, I must have just not paid attention to the earlier emails about it".
by acdha | 2025-09-09 18:01:08+00:00
It was software on Intel but they presumably added instructions with the intention of using them:

https://asahilinux.org/docs/hw/cpu/apple-instructions/

> You seem to be under the mistaken impression that Microsoft cannot gear Windows to act differently based on the installed hardware (or processor).

Definitely not - my point is simply that all of these things are harder and take longer if they have to support multiple implementations and get other companies to ship quality implementations.
by Izikiel43 | 2025-09-09 18:01:09+00:00
> What is it that is being incentivized here?

Getting all children early education, which has been shown to have huge effects later on in academic performance (better) and criminality (less).

Let's say college is optional for the individual, as the child/teen decides.

Why is primary/middle/secondary school free and public, but daycare/preschool not? The child can't decide for itself, and there is data showing that having early education benefits everyone.
by mikestorrent | 2025-09-09 18:01:32+00:00
Well, consider that a lot of these functions that were exploited are simple things. We use a library to spare ourselves the drugdery of rewriting them, but now that we have AI, what's it to me if I end up with my own string-colouring functions for output in some file under my own control, vs. bringing in an external dependency that puts me on a permanent upgrade treadmill and opens the risk to supply chain attacks?

Leftpad as a library? Let it all burn down; but then, it's Javascript, it's always been on fire.
by glenstein | 2025-09-09 18:01:34+00:00
It's amazing how much of the opposition isn't a specific conceptual problem with the rightness or wrongness of the ideal behind the policy but re-litigating assumptions that are already accepted and baked into routine investments we already make to service and infrastructure.

The way that the Gell-Man Amnesia effect is the term for instantly forgetting what you know about the gulf between popular narrative and expert familiarity, there should be a name for the phenomenon of newly re-discovering and re-litigating the social compact that undergirds basic services as if it was being proposed for the first time.
by kube-system | 2025-09-09 18:01:46+00:00
>> keyless entry, 360 cameras, nor level 2 ADAS

> It's the only non-luxury brand I'm aware of with all of those features. Who are you thinking about?

Most non-luxury brands offer these features today. Toyota Camry, for instance.

> Also you're misdirecting: "keyless entry" isn't remotely the same as "your phone is your key".

1. You didn't say anything about doing it with a phone. 2. If you do want to do it with a phone, for whatever reason, other automakers also offer this, e.g.:

https://connected-mobility.hyundai.com/what-we-do/connected-...

https://www.ford.com/support/how-tos/fordpass/phone-as-a-key...

> And the "level 2 ADAS" business is a transparent attempt to troll an FSD argument to which won't engage except to say, again, that the user experience of letting your car drive a 200 mile leg of a long road trip is also not remotely the same as always bouncing around and stomping on brakes experience of the lanekeeping offered elsewhere.

You shouldn't be taking your hands off the wheel while using systems that require your hands to be on the wheel. Other automakers have hands-free level 2 systems. Here's the list of brands that currently offer a hand-free level 2 system: BMW, Ford, Lincoln, Buick, Cadillac, Chevrolet, GMC, Jeep, Ram, Mercedes-Benz, Nissan, Infiniti, Toyota, Lexus

> You know both of these truths, which is why you want to redefine the features to make them false.

I think maybe you're just not aware of what is on the market right now.
by moepstar | 2025-09-09 18:01:59+00:00
>I'm also curious who the market is for a thinner phone

Hm, i'd consider it (if i was upgrading yet again).

Why? My 15 Pro (not-Max) gets way too hot way too fast doing basically nothing and it p*sses me off - so, i'd rather not (yet?) take a bet if the new 17 Pro (Max) does better with an entire new thermal design - considering _something_ is _always_ off with new Apple hardware designs, starting with the iPhone 4...
by kragen | 2025-09-09 18:02:12+00:00
I've definitely read a lot of books that wouldn't exist without WYSIWYG word processors, although MacWrite would have done just as well. Heck, NaNoWriMo probably wouldn't.

I've been reading Darwen & Date lately, and they seem to have done the typesetting for the whole damn book in Word—which suggests they couldn't get anyone else to do it for them and didn't know how to do a good job of it. But they almost certainly couldn't have gotten a major publisher to publish it as a mimeographed typewriter manuscript.

Your turn.
by WhyNotHugo | 2025-09-09 18:02:17+00:00
The pushed payload didn't generate any new traffic. It merely replaced the recipient of a crypto transaction to a different account. It would have been really hard to detect. Ex-filtrating API keys would have been picked up a lot faster.

OTOH, this modus operandi is completely inconsistent with the way they published the injected code: by taking over a developer's account. This was going to be noticed quickly.

If the payload had been injected in a more subtle way, it might have taken a long time to figure out. Especially with all the levenshtein logic that might convince a victim they'd somehow screwed up.
by jacobsenscott | 2025-09-09 18:02:24+00:00
This phishing email is full of red flags. Here are example red flags from that email:

- Update your 2FA credentials

What does that even mean? That's not something that can be updated - that's kind of the point of 2FA.

- It's been over 12 months since you last 2FA update

Again - meaningless nonsense. There's no such thing as a 2FA update. Maybe the recipient was thinking "password update" - but updating passwords regularly is also bad practice.

- "Kindly ask ..."

It would be very unusual to write like that in a formal security notification.

- "your credentials will be temporarily locked ..."

What does "temporarily locked" mean? That's not a thing. Also creating a sense of urgency is a classic phishing technique and a red flag.

- A link to change your credentials

A legit security email should never contains a link to change your credentials.

- It comes from a weird domain - .help

Any nonstandard domain is a red flag.

I don't use NPM, and if this actually looks like an email NPM would send, NPM has serious problems. However security ignorant companies do send emails like this. That's why the second layer of defense if you receive an email like this and think it might be real is to just log directly into (in this case) NPM and update your account settings without clicking links in the email.

NEVER EVER EVER click links in any kind of security alert email.

I don't blame the people who fell for this, but it is also concerning that there's such limited security awareness/training among people with publish access to such widely used packages.
by chlodwig | 2025-09-09 18:02:29+00:00
I dislike the perversity of taxing people than only giving the money back to them if they arrange their life in a way that policy-makers prefer (two income family). I especially dislike it when the subsidized choice of institutional childcare is more inefficient (paying for a lot of overhead), worse for the environment (extra people commuting), and worse for the kids (kids in groups that are classes that are too large for their age, taken care of by a rotating cast of minimum wage workers instead of by their own parent). And yes, I think parents who successfully home-school their children should be given the money that government schools would have cost them.
by burnerthrow008 | 2025-09-09 18:02:39+00:00
> Garmins easily last a week.

Oh, really?

https://www8.garmin.com/manuals/webhelp/GUID-EECCAC99-90D6-4...

Looks like they last dramatically less than that if you buy an Garmin with comparable display and actually use the advertised features.