MurphyA/hacker-news huggingface dataset:
by formerly_proven | 2025-09-16 20:33:57+00:00
A lesson learned over and over again is that you can build amazing things with tightly coupled plugins, but once you have about three of them upgrading or changing anything gets kind of impossible - Hyrum's law. On the other hand, loosely coupled out-of-process plugins are a lot less flexible, but tend to work a lot better and more reliably, at the cost of more up-front engineering and overall investment. Assuming that what they can do is sufficient to work.

Consider that e.g. kubernetes has basically just one actual core component (the API server) and everything else is loosely-coupled plugins. Alternatively, consider any of the projects stuck for 15 years on Python 2 because that's what their plugin system was in 2009. These are two points on a spectrum.
by shadowgovt | 2025-09-16 20:34:02+00:00
True. And in the interest of balancing the claims of the critics, I offer up the observation that UN Watch is "a lobby group with strong ties to Israel" (AFP article: Capella, Peter. "UN Gaza probe chief underlines balanced approach." 7-Jul-2009. https://web.archive.org/web/20111222162658/https://www.googl...).
by LtWorf | 2025-09-16 20:34:03+00:00
Download counters are completely useless. I could download your package 2 million times in under a minute and cause you to need the 2FA.

And true 2FA means you can't automate publishing from github's CI. Python is going the other direction. There is a fake 2FA that is just used to generate tokens and there is a preferential channel to upload to pypi via github's CI.

But in my opinion none of this helps with security. But it does help to de-anonymise the developers, which is probably what they really want to do, without caring if those developers get hacked and someone else uses their identity to do uploads.
by authleap | 2025-09-16 20:34:07+00:00
Effective latency optimization in complex distributed systems hinges on a simple principle: you can’t improve what you can’t measure. Having a comprehensive, multi-layered measurement baseline that offers a granular, end-to-end view of the request path helps isolate whether delays originate at the client, the network, the CDN, the load balancer, or deep within origin services. At DevRev, we track how much latency each hop from the end user to the origin services contributes, and this allows us to consistently refine our system and deliver the best value to our customers. Today, we’ve accumulated over 10 billion latency records across different APIs, giving us unparalleled visibility into performance.

By analyzing these latency datasets, we’ve uncovered patterns that aren’t always visible in small-scale tests like hidden queuing delays under burst traffic, cross-region routing inefficiencies, or subtle inconsistencies introduced by third-party dependencies. More importantly, we’ve learned that latency issues often don’t come from a single bottleneck, but from the compounded effect of several small inefficiencies across layers. In this blog, we delve into the lessons we learned while uncovering blind spots in improving end-to-end latency across DevRev API traffic.
by Noumenon72 | 2025-09-16 20:34:19+00:00
This letter makes perfect sense to me if he had sent it as his first reply to a fascist in 1946. Why did he correspond with him over 43 previous letters from 1946 and only in 1962 act as though he had principled objections to corresponding with fascists? The tone is not "this time you've gone too far", or "I have decided we're not getting anywhere", but "We have nothing in common and could never converse". I wonder if he realized it was the same guy, or was submitting this to some public forum.
by quesera | 2025-09-16 20:34:24+00:00
I was there too, and that is not what I saw.

(Caveat: I'm thinking of the 1997-2000 period. Netscape IPOed in mid 1995, the bust was early 2000, so that covers the last 2/3rds of the first wave, but not all of it.)

My observations at the time: dotcom-1.0 was split pretty evenly between SF and SV, but there were clear differences in focus. Hardware and legacy stuff was all in SV, software/web/media was substantially all in SF.

Dotcom-2.0 (social media/SaaS/etc) was entirely in SF.

I'd agree that SF owned 2.0 and shared 1.0, but 1.0 in the city was extremely busy with founders, employees, launches, leases, and money.

I worked up and down the peninsula. Investors and data centers (VCs and DCs) were down south -- the latter with one exception: 200 Paul Ave, although itself at the extreme southern edge of SF.

Founders, staff, offices, and everything else were in the city.

I worked at one company who opened an office in the valley, but we literally couldn't hire people down there (Santa Clara), and couldn't get people to move there. All the action was in SF, for a software/web/media business.
by alariccole | 2025-09-16 20:34:31+00:00
Yeah, when I started I actually had no intention of doing a chat app, but it was a good way to learn how it works. Eventual goal with this is a sort of hybrid notes app. Not an llm bolted into Notes, either, but kind of a mix. Find myself using the llm app as a knowledge repo and it’s just not built for that. I’ll post a TestFlight link later if you want to try it out.
by iLemming | 2025-09-16 20:34:43+00:00
> I can come back to a Clojure program I wrote ten years ago and it runs great

Is that thanks to JVM or due to the way how Clojure works? Because I can share the same anecdotes for my Clojurescript projects. I can grab any old nbb script and things just work off the bat - sometimes I have to update some npm dependency, but most of the time, things simply aren't horribly broken. Meanwhile, I just spent half a day jumping around for weird Python dependency and venv magic dance, just for the sake of running five interdependent scripts.
by okanat | 2025-09-16 20:35:41+00:00
This is quite the "I have never lived anywhere else other than North America" take.

Rail and other public transport in pretty much everywhere in the world are designed to serve commute first, tourist stuff second or third.

Public transport isn't just having some trains, or having only trains between major cities. It is designing whole commute routes from various urban and suburban areas to workplace. There needs to be regional and suburban links that arrive to metro and tram stations. Metro and tram have to operate very frequently to handle commuters. The frequency of the trains should adapt to the commuters in the morning and evening. They need to be convenient, clean and safe too.

Cities around the world are also much better balanced than NA ones. The workplaces and living areas are almost always mixed rather than having a "downtown" area where every office worker travels to. My area has many buildings with a supermarket, apartments and small offices in the same building. There are two car factories in the city next to one of the biggest urban parks.
by edm0nd | 2025-09-16 20:35:58+00:00
IMO the takeaway is the author had very poor security.

You can literally tie a yubi key to your Coinbase account and no one can withdraw funds unless a yubi key is physically plugged in and pressed.

One can also use the Coinbase Vault system where it would be impossible to steal any funds from his account had he enabled it.

You should also never use cloud sync for Google Authenticator as evidence here as why.
by komali2 | 2025-09-16 20:36:08+00:00
What I'm learning is that some people don't keep a stock of what I would consider "bare minimums" in their cupboard.

First of all, properly stored flour, sugar, and cocoa powder doesn't attract bugs. Glass jars that seal well, done. Hell even plastic tubs. It expires pretty rarely as well, surely you can just bang out a couple of loaves of bread before that happens?

Anyway, yeah, is it not like, a very normal thing to keep flour, sugar, baking soda, cocoa powder, salt, perhaps yeast on hand? Butter, oil, some pasta, maybe some rice? Like, how do you cook otherwise, just buy small batches of these things every time?
by eastbound | 2025-09-16 20:36:23+00:00
In height, they have a 24m limit because it’s a common threshold in airports from which special studies must be done. Funny thing: The A380 was 24.1m (its other dimensions also required extra studies, let alone the catering difficulties related to its huge passenger count).

Maybe wind turbines will cause larger planes which will cause an A380 come back ;)
by keeda | 2025-09-16 20:36:36+00:00
Interestingly, the authors do at least acknowledge the alternative hypotheses that we wonder about (including this thread) in studies like this:

> Some observers have also linked AI to recent labor market trends: since late 2022, unemployment among recent college graduates has risen sharply, even as the unemploy-ment rate for young workers overall has remained steady (Appendix Figure A.1). Others, however, question the importance of AI in these developments, pointing to alternative factors such as economic uncertainty, post-Covid retrenchment, and increased offshoring (e.g., Financial Times, 2025).

(No mention of ZIRP. Also, they used LLMs to classify data, so there's that.)

I only had a quick look, and IANAE, but while the study does not discuss these factors any further, their methodology may implicitly account for them. Briefly, the study looks at employment of junior employees vs senior employees over the last 2 years across a bunch of companies that it categorizes as AI adopters vs non-adopters (based on an admittedly very narrow definition of "adoption".)

It finds that starting in 2023 Q1, the hiring of juniors dropped sharply while that of seniors kept growing in firms that adopted AI compared to non-adopters. Given this approach, maybe those confounding factors cancel out? Like, why would economic uncertainty, offshoring, ZIRP or whatever impact only firms adopting AI and not others within the same sector?

Some other interesting findings:

- Juniors who do get hired, get promoted more quickly, likely due to lower competition. Could be yet another mechanism that increases the gap between the haves and the have-nots.

- The biggest effects are in the wholesale / retail trade sector, which is surprising because offhand, I would not have thought this sector to be much impacted by AI.

I follow some labor economists and these findings align a lot with what they've been saying about the job reports over the years.

Another very interesting finding is that graduates of mid-tier colleges are impacted the most, whereas elite and "less selective" institutions are least affected. Something to consider when evaluating the ROI of tuition for a given college...
by karmakaze | 2025-09-16 20:36:47+00:00
Not a generalist--don't even know what that is, Jeopardy contestant? I'd call myself a multi-specialist.

I like to find out what there is to know in an area--get more context than you need. Then I figure out what I need to know now for the task at hand. Always look for alternatives rather than going with the first solution. If you only know one way to do something, how do you know it's the best or even good enough after you've covered all the details.
by tpmoney | 2025-09-16 20:37:09+00:00
> Nate’s article links to a comment in which he says the US has no legal cooperative structure “except for limited state-specific exceptions”. I don’t know why those state-specific laws for cooperatives don’t count - they aren’t in any way restricted to operating within the organizing state.

My guess since he’s talking about IRS rules is because the IRS doesn’t recognize those exemptions specifically and so it’s irrelevant for the federal structure of the company which they also have to have. Technically speaking even LLCs don’t really exist at the federal level. The IRS does note that it is a legal structure that states provide, but also notes that depending on how you’re structured, they will treat you as either a non-entity (basically pass through, like a sole proprietorship), as a partnership (collective pass through, no liability shields) or as a full corporation (S or C corp). There is a little bit in Subchapter T around taxing businesses that operate under a “cooperative basis” but it still seems like you’re still either a corporation or a partnership
by ThrowawayR2 | 2025-09-16 20:37:12+00:00
IMO, one side is openly condescending ("learn to code" / "voting against their own best interests"(sic)) and insulting (e.g. religion) to them on top of not helping them. The other side doesn't help either but at least pretends to listen to their grievances and says things to make them feel powerful. When you're struggling and miserable, a little sympathy goes a long way; far enough to put some very bad people in the White House unfortunately.
by rchaud | 2025-09-16 20:37:22+00:00
I was somewhat shocked when I saw that BL3, a 2019 game, barely even booted on my 2015 gaming desktop. BL1 and 2 were playable on my dirt cheap Dell Vostro laptop with integrated graphics, 4GB RAM and a low power Core i3 processor. I thought it was possible because the BL series' graphics are quite cartoony compared to the ultra-realism of something like Battlefield. But I'm looking at BL4's graphics and they mostly look....the same?
by pragma_x | 2025-09-16 20:37:39+00:00
So, other packaging environments have a tendency to slow down the rate of change that enters the user's system. Partly through the labor of re-packaging other people's software, but also as a deliberate effort. For instance: Ubuntu or RedHat.

Is anyone doing this in a "security as a service" fashion for JavaScript packages? I imagine a kind of package escrow/repository that only serves known secure packages, and actively removes known vulnerable ones.
by noisy_boy | 2025-09-16 20:37:58+00:00
> Do you see anyone that looks like you, doing anything that looks like what you do? I don't and I can't remember the last time I did.

You mean you are not an ethnically interesting person with a head full of colored hair wearing ethically sourced pre-aged linen sipping responsibly grown coffee with a serene smile facetiming even more interesting people without any worry about any real problems in the world?!
by DaveExeter | 2025-09-16 20:38:10+00:00
Isn't that an Israeli "hasbara" site? The Israelis have admitted that they use the false cry of "antisemitism" to attack.

"Calling it antisemitism - it’s a trick we always use." Shulamit Aloni, former Israeli Minister

https://x.com/SuppressedNws/status/1896748975207952758
by nostrademons | 2025-09-16 20:38:18+00:00
It's not linear at all. We had our identity stolen through an insurance scam (somebody used our bank account and somebody else's name to open a policy with Progressive, which apparently does not validate ACH debits). This resulted in premiums of ~$300, $300, ~$500, $1002.96, ~$900, ~$900, and ~$3000 as the attacker presumably racked up huge fraudulent claims on the insurance company. The first 3 bills were reversed by Wells Fargo because their fraud policy covers fraudulent charges under $1000. The 5th and 6th were reimbursed because they were reported within 60 days of being made (and were under the limit anyway). The 7th didn't go through because we had detected the fraud and closed the account by then. But the 4th was just over the $1000 limit that they would reimburse, and so they were like "Sorry, nope, you're on your own for that one." We even filed a police report and waved that at them, and they said "We don't care. Company policy." So the very counterintuitive and non-linear result was that they paid for the $300, $500, $900, $900, and $3000 charges, and stuck us with the $1000 one, just because it was $2.96 over their limit. (Part of me really regrets declining to prosecute, but I had a ton of other stuff going on at the time and the last thing I wanted to do was get involved in a court case.)
by jkaplowitz | 2025-09-16 20:38:38+00:00
Yeah, that part of the blog post wasn’t clear to me either. I assume that’s only clear to people with other context that wasn’t included. Maybe whichever agency oversees the welfare of adopted kids where he lives is more skeptical of the financial responsibility and solvency of tech workers with an illegally misclassified contract with an international client/payor than people with a locally recognized legal employment contract with proof of paying into the system?
by btown | 2025-09-16 20:38:57+00:00
A brief but important point is that this primarily holds true in the context of rewriting/vendoring utilities yourself, not when discussing importing small vs. large dependencies.

Just because dependencies do a lot more than you need, doesn't mean you should automatically reach for the smallest dependency that fits your needs.

If you need 5 of the dozens of Lodash functions, for instance, it might be best to just install Lodash and let your build step shake out any unused code, rather than importing 5 new dependencies, each with far fewer eyes and release-management best practices than the Lodash maintainers have.
by justin66 | 2025-09-16 20:39:02+00:00
Interesting, thanks. In the United States contracting so often just means that we have the same shitty job security as the full-time employees who are a little delusional about how safe they are, we occasionally have to talk about renewing the contract, and we get paid twice as much. There's no logic to it but it's not quite as awful as what's painted above.
by edm0nd | 2025-09-16 20:39:21+00:00
Coinbase offers Vault though. You can lock your funds into a Vault and it takes like 2-3 days to unlock them + you have to get approval from multiple different email accounts to even begin the unlock.

Coinbase has many ways to secure your account if the user enables them

also physical Yubi Keys would prevent anyone from withdrawing or steals funds as it would have to be plugged in and tapped to process them.
by mananaysiempre | 2025-09-16 20:39:22+00:00
Yes, in this particular case, sure. I even find myself in the unusual position of approving of the original CFAA conviction (assuming of course the list of allegations is true as stated), because it does sound like something you might need a separate law for—as opposed to the extra-hard punishment for X-with-a-computer when plain X is already illegal that’s typical of laws involving computers.

I guess what I’m trying to understand is why that particular part is on the boilerplate to begin with, and more importantly whether it’s doing any good there rather than putting people in prison that otherwise wouldn’t need to be. (I pretty much immediately guessed it’s boilerplate, because that’s the only way it makes sense for it to be among the parole conditions for, essentially, a disgruntled sysadmin that took it out on their ex-employer.) It just trips my righteousness alarm, for things that sound right and proper rather than actually helping. And thus the justification of it being there because it’s how we’ve always done it this way annoyed me especially hard.
by labrador | 2025-09-16 20:39:23+00:00
I drove for Uber/Lyft back in 2020 and let me tell you, SFO is a nightmare. I missed a turn once and had a passenger trying to make a flight furious at me. I quickly figured out there were a group of drivers who specialized in SFO and amatuers like me should avoid the place. When Waymo announced San Jose I thought ok, that makes sense because SJC is easy, but SFO? Wow, I'm impressed. I hope it goes to plan.
by adgjlsfhk1 | 2025-09-16 20:39:29+00:00
there are adaptive order ODE solvers that can adapt to arbitrarily high order. For example, e.g. https://arxiv.org/abs/2412.14362 (which I'm a co-author on) can get to ~200th order which should be enough to efficiently solve an ODE into 10s of thousands of digits.
by unethical_ban | 2025-09-16 20:39:31+00:00
I remember this being a big controversy in Texas in the 2000s. Our Republican governor, forcing girls to get the vaccine! What does he think Texan girls are, lusty?

Not like disease prevention is a universally good thing and some people tend to have sex.

At the end of the day, religious radicals like STDs because it enforces their worldview that having multiple sexual partners in a lifetime is a sin.
by everdrive | 2025-09-16 20:39:48+00:00
That's really interesting, and from that I would assume that the risk of cervical (or other cancers) from HPV is associated with how often someone is reinfected? ie, someone who got HPV once in college doesn't have HPV their whole life? And potentially has a lower cancer risk than someone who is repeatedly re-infected?

Am I understanding that correctly?
by nerdsniper | 2025-09-16 20:40:11+00:00
As with 'craftkiller, I've noticed that I do need to make some kind of noise. I've settled on subtle light coughs or grunts (nothing anyone would think twice about, but which will definitely trigger a "oh this is a human!"). I figure it might still fool some percentage of automated systems which detect whether a human (and which human) is actually there or not based on automated transcription.
by cced | 2025-09-16 20:40:11+00:00
They should have users receive the code and then submit said code into the application for verification, with clear instructions that this code is produced as a result of a support call, and to confirm you are on an existing call when submitting the code.

Doing so would not force users to divulge codes over the phone, and enable support staff to verify identity all without training users that reading codes over the phone is acceptable.

Thoughts on that?
by duped | 2025-09-16 20:40:21+00:00
Personally, I go further than this and just never update dependencies unless the dependency has a bug that affects my usage of it. Vulnerabilities are included.

It is insane to me how many developers update dependencies in a project regularly. You should almost never be updating dependencies, when you do it should be because it fixes a bug (including a security issue) that you have in your project, or a new feature that you need to use.

The only time this philosophy has bitten me was in an older project where I had to convince a PM who built some node project on their machine that the vulnerability warnings were not actually issues that affected our project.

Edit: because I don't want to reply to three things with the same comment - what are you using for dependencies where a) you require frequent updates and b) those updates are really hard?

Like for example, I've avoided updating node dependencies that have "vulnerabilities" because I know the vuln doesn't affect me. Rarely do I need to update to support new features because the dependency I pick has the features I need when I choose to use it (and if it only supports partial usage, you write it yourself!). If I see that a dependency frequently has bugs or breakages across updates then I stop using it, or freeze my usage of it.
by jpetso | 2025-09-16 20:40:22+00:00
No. Jonathan was co-maintaining KDE neon, which now has one developer left and is about to be joined by KDE Linux, another take on a Plasma-based distro. He also handled release manager duties, which have been transferred and running smoothly for a few months now.

He may have contributed in other ways that I'm not aware of, but overall KDE is in a very good spot with many more developers working on stuff.
by davidscoville | 2025-09-16 20:40:39+00:00
The code I read to them was a Google account recovery code. That’s how they accessed my Google account. I, mistakenly, believed they needed to confirm I was still alive and the rightful owner of the account.

Then the attacker used Google SSO to perform the initial log in to my coinbase account. Then they opened Google Authenticator, signed in as me, to get the coinbase auth code so they could complete coinbase’s 2fac.