MurphyA/hacker-news huggingface dataset:
by javcasas | 2025-09-16 13:31:34+00:00
> How much smaller is the data encoded as JSON than the same data encoded as an HTML table? Particularly if compression is enabled?

Well, as many things in life, it depends. If the cells are just text, there is no much difference. But, if the cells are components (for example, popover things or custom buttons that redirect to other parts of the site), the difference of not shipping all those components per cell and rendering them on the frontend starts to become noticeable.
by 1970-01-01 | 2025-09-16 13:31:36+00:00
It's very important to get the official source on this one. Husband was legally restricted and being monitored by the FBI, so he decided to go install a VM to bypass the monitoring. It's not so much bravery against authority as it is hubris that got him 3 years.

https://rockenhaus.com/wp-content/uploads/2025/09/U.S.-v.-Ro...
by cddotdotslash | 2025-09-16 13:31:37+00:00
I wonder who actually discovered this attack? Can we credit them? The phrasing in these posts is interesting, with some taking direct credit and others just acknowledging the incident.

Aikido says: > We were alerted to a large-scale attack against npm...

Socket says: > Socket.dev found compromised various CrowdStrike npm packages...

Ox says: > Attackers slipped malicious code into new releases...

Safety says: > The Safety research team has identified an attack on the NPM ecosystem...

Phoenix says: > Another supply chain and NPM maintainer compromised...

Semgrep says: > We are aware of a number of compromised npm packages
by ahdanggit | 2025-09-16 13:32:07+00:00
> The simple alternative is just around the corner: sprinkle vanilla JavaScript where it’s needed and don’t build your identity around a framework. That mindset is hard to swallow, though (especially when companies have spent millions convincing developers their stack is the only way forward).

I worked with a front-end developer (React) who needed help integrating with a payment processor. I looked at the docs and hopped on a video call with them to get them unblocked. I ended up having to explain how to POST hidden inputs via an HTML form to them, and their reply was something along the lines of "Oh, HTML is obsolete." They didn't understand the basics because they only new React.
by iLoveOncall | 2025-09-16 13:32:22+00:00
You forgot to mention that in the hearing linked on the Reddit post it is shown that he made a search about a pedophile association as well right before downloading Spice.

Page 28, lines 3 to 8 on https://rockenhaus.com/wp-content/uploads/2025/09/U.S.-v.-Ro...
by saxon_ai | 2025-09-16 13:32:48+00:00
AI pilots were everywhere in 2025, but most workflows didn’t really transform. Teams are still stuck juggling spreadsheets, chasing approvals, and switching between systems. The real ROI comes when AI is context-aware, embedded in ERP, CRM, or EHR, governed properly, and tuned to each industry. That’s the 2026 shift: from efficiency to revenue enablement. When AI is built for specific industries, like banking, healthcare, or manufacturing—it stops being just an efficiency tool and becomes a revenue enabler. To read our full take on the AI trends shaping 2026, check out the blog here
by sschueller | 2025-09-16 13:33:12+00:00
You can record your own property and you can submit this to the police. However you need to put up notice on your property that you are recording.

Dash-cam footage is a gray area since the video is generally deleted automatically and not publicized. If the crime is severe enough the footage is permitted in court.

Criminals do not just get away just like that. There is a lot of public cameras run by for example the SBB (national train company). These cameras have strict rules as to how long the footage is stored and who has access. The footage will not be posted publicly unless in very very rare cases where the severity of the crime outweighs the privacy of the criminal.

How many innocent people have faced the wrath of the public because of false identification in the US when some grand event occurs? Does anyone remember Richard Jewell[1]?

[1] https://en.wikipedia.org/wiki/Richard_Jewell
by dreadnip | 2025-09-16 13:33:14+00:00
How can you ever trust validation on the client side though? The user can just mess with it and submit anything they want anyway.

Why not validate on the server and return a response or error as HTML?

I’m not trying to argue in bad faith here. I know client side validation is necessary in some cases, but IMO it’s only an augmentation for UX purposes on top of server side validation.
by cmdr2 | 2025-09-16 13:33:16+00:00
> Google is acting here as the owner and maintainer of a services ecosystem... > they increasingly experience difficulty to contain issues within that ecosystem and prevent them from spreading (piracy, malware, hacking,...)

I wonder if the smartphone app industry is big enough now that allowing just two corporates to govern them is no longer fair or democratic.

It has outgrown the "ecosystem" word a long time ago. It's a genuine industry now.

Apps are such a fundamental part of most people's lives now (whether they like it or not), and these two companies have a disproportionate amount of power over an entire industry.
by thehyperflux | 2025-09-16 13:33:24+00:00
iPhone 14 to 17 is still a solid step up. +10 hours battery. 120hz display. 48mp cameras vs 12, way better front camera... and USB-C. But if this is too minor a bump for you then just hold onto the 14? One of the great things about these recent phones is how long they last if looked after. I'm getting 17 after skipping 6 generations with my XR and it's been great this whole time. Only really upgrading now due to crappy battery life and no longer getting the latest OS versions, which I need to run. And with 6 generations skipped the step up seems major.
by tptacek | 2025-09-16 13:33:57+00:00
OK, I think I found the original thing Rockenhaus was convicted of.

Back in 2014, Rockenhaus worked for a travel booking company. He was fired. He used stale VPN access to connect back to the company's infrastructure, and then detached a SCSI LUN from the server cluster, crashing it. The company, not knowing he was involved, retained him to help diagnose and fix the problem. During the investigation, the company figured out he caused the crash, and terminated him again. He then somehow gained access to their disaster recovery facility and physically fucked up a bunch of servers. They were down a total of about 30 days and incurred $500k in losses.

(He plead this case out, so these are I guess uncontested claims).
by coneonthefloor | 2025-09-16 13:34:37+00:00
> What seems wasteful to me is to have the server spend CPU cycles rendering data into JSON, only to have the front-end decode from JSON into internal JS representation, then back into HTML (which is then decoded back into an internal browser representation before being painted on the screen). Seems better to just render it into HTML on the server side, if you know what it's going to look like.

Well put. I think the main issue is that we have a generation of "front end engineers" who have only ever worked with javascript apps. They have no experience of how easy it is to write html and send it via a server. The same html works now, worked 20 years ago, and will work 20 years from now.
by NikxDa | 2025-09-16 13:34:46+00:00
The suggestion to have the server return the table directly starts bringing presentational concerns into the backend, which I am not a big fan of.

Having the server return plain JSON means the APIs can be reused across products effortlessly and also means that all style changes can be done in the same codebase.

I get reminded of how important this is every time I get to work on an old project that has APIs return HTML that is then being inserted into the DOM by something like jQuery. Figuring it out and updating it is typically a huge mess.
Show HN: My wife and I built MagicCV.ai, a 100% free online resume builder
by KalanaPerera | 2025-09-16 13:34:58+00:00
Hello HN,

My wife and I have been working on this project for quite some time. It’s an online resume and career tools platform called Magic CV. She has been handling the backend development, while I’ve been working on the frontend side.

Yesterday evening, we decided to make our platform 100% free for everyone. It currently includes:

- Up to 10 resumes - Up to 10 cover letters - Unlimited PDF downloads (no watermarks, no paywalls) - Limited AI features

Roadmap

- Word format downloads (in progress) - Job Tracker (in progress) - Targeted resumes for specific jobs - Custom prompts + ability to use your own AI API keys (stay free forever) - Personal website builder - Plus a few new ideas we’re exploring

Data* DB data is encrypted. No sign-in required to try out the resume builder.

Monetization

Right now, most of the key features are completely free. If users need more resumes, targeted resumes, or extra AI usage, we offer one-time payment options.

We’re also considering enabling Google AdSense for free users (currently no ads). Not yet decided, would love HN’s feedback on this.

I’d really appreciate your thoughts, suggestions, feature requests.

GitHub issues are open here: https://github.com/KalanaPerera/magiccv.ai

Ask any questions you may have - happy to answer :)

Thanks!
by gf000 | 2025-09-16 13:35:10+00:00
I would argue that the legacy OS and app architecture we have on desktop OSs doesn't make sense there, either.

It's a model that worked fine in multi-user setups where you ran a single executable, so that the security per user was meaningful, but today it just sucks.

Android is quite elegant in reusing the Linux kernel's permission system, but on a granularity that actually makes sense (apps are started as separate users, and they just elevated their concept of user a level higher).
by potato3732842 | 2025-09-16 13:35:16+00:00
You, you are an instance of the problem.

For any given issue, subject, industry or niche there is always a you. And you are the enablers. Multiply by every equivalent idiot and niche and that's how you get the world in which some guy gets whacked for running a tor node.

If not that it would be some other niche, maybe some guy importing gray market power equipment to the chagrin of the branded dealers would be getting whacked. If not that then it's the amish farmers getting whacked over one of their many "in letter but not spirit" compliance measures.

Yeah, in every case the letters of the law are broad enough to nail these sorts of people but that's not an outcome the general public wants except for the occasional zealot on any given subject. And the equivalent enablers would be endorsing it just as you are now.

And at the end of the day your behavior (you plural) undermines the legitimacy of these institutions and the government they serve because these are outcomes that nobody wants, but single industry enforcement enough of a back burner issue that elections mostly don't get won and lost over them so the fire just keeps smoldering year after year (fed by our tax dollars, of course).

>As someone who works in this industry

Perfect illustrative example for one of HN's favorite quotes:

"It is difficult to get a man to understand something, when his salary depends on his not understanding it"

>Our products all align with all required emissions regulation...the relationship, therefore, is not adversarial.

You might as well compare a medium company with an encrypted file share service to some 1-man package maintainer for software that does the same. Who is law enforcement gonna try and abuse?

>While we're at it, fuck coal rollers with a cactus.

A bunch of reactionary yokels are a symptom of the degree to which your ilk has undermined the legitimacy of the laws they violate and enforcement agencies they thumb their nose at, not the root cause. If society solves people like you the yokels will mostly go away on their own. That is what I seek.
by palmotea | 2025-09-16 13:35:33+00:00
> Ghost kitchens promised lower costs. The math never worked. Delivery apps charge restaurants up to 30% commission fees5. Ghost kitchen operators add rent plus percentage fees on top. Equipment repairs and maintenance create constant expenses. Marketing costs multiply when you have no storefront presence.

> Layering these costs together, restaurants discovered a devastating truth: there wasn't enough money left for anyone to make a profit.

So is that true of working with delivery apps, generally? All of those points are also are true of regular restaurants with a storefront, except the last one about marketing expenses. Are the delivery apps just surviving parasitically on restaurants that would be better off without them?
by jamesberthoty | 2025-09-16 13:35:43+00:00
Several individual developers seem to have noticed it at around the same time with Step and Socket pointing to different people in their blogs.

And then vendors from Socket, Aikido, and Step all seem to have detected it via their upstream malware detection feeds - Socket and Aikido do AI code analysis, and Step does eBPF monitoring of build pipelines. I think this was widespread enough it was noticed by several people.
by scotty79 | 2025-09-16 13:35:46+00:00
The fact that somebody doesn't want afterlife doesn't imply that death is a special moment for them that separates wanting to exist from not wanting.

They could have "picked" another moment. It might be next New Year or a moment in the past or even a moment before they were born. The moment of death is simply the "earliest convenience" to end unwanted existence.
by braum | 2025-09-16 13:35:47+00:00
just a few days ago I had an idea for a shirt and sent it to a designer on fiverr. I was very pleased with what I got back. "Secrets are Power" was my nod to one of my favorite movies Sneakers! Rest in Piece Mr. Redford.

http://bit.ly/3Ip3tr3 link to the shirt if you want to look at it. there is a message encoding in the background.
by AlexandrB | 2025-09-16 13:35:52+00:00
As a rule almost any UI redesign of just about any product in the last decade will increase padding and reduce information density. I don't know if it's because the average designer/user is getting older or large screens are more common so it seems like there's lots of room available thus it can be wasted.

Sadly, this often applies to Linux as well, so there's no escape. I guess Xfce is still around at least.
by bnchrch | 2025-09-16 13:35:56+00:00
While you might be right.

It seems like you didn't notice this was about React Native, the cross platform mobile app framework.

So "just write plain html" isn't a valid alternative unless you want to write a Progressive Web App instead. Which means you:

- Forego the App Store and need to ask users to bookmark your website

- Loose ease of access to device features (cameras, sensors, push notifications)
by s_dev | 2025-09-16 13:36:09+00:00
When I was young I loved getting the latest of everything but that was partly because I didn't have to carry certain workflows or older tech along with me. It's the baggage that we accumulate is the problem.

Now I understand why plenty of old timers just leave the OS version on the MacBook that it came with. All you ever really need is the security patches.

Unless there is some specific new feature that you absolutely must need or some push factor, don't upgrade.
by red-iron-pine | 2025-09-16 13:36:41+00:00
presumably this also means the relative value of seniors is now increasing, as the pipeline to replace them is smaller.

its like how the generic "we take anyone" online security degree has poisoned that market -- nothing but hoards of entry level goobers, but no real heavy hitters on the mid-to-high end. put another way, the market is tight but there are still reasonable options for seniors.

then again we live under capitalism
by giancarlostoro | 2025-09-16 13:36:53+00:00
> 1. Old bugs are not fixed.

If Apple would open source some of its OS apps, this would probably be a non-issue, I could see people putting in bugfix PRs the second Apple chooses to open source their core apps.

I don't see them doing this any time soon sadly, but it would make macOS much more stable, and probably secure.

The more I have thought about my views on Open Source vs Commercial software, I strongly feel that infrastructure code (an OS) should be more open source, I dont see Microsoft or Apple open sourcing any time soon, but it would make a world of a difference, imagine a world where Windows XP had been open sourced, and the community took it fully over and maintained its security, you'd have a drastically better version of Windows without all the fluff, or heck even Windows 7, which some argue was the last good version of Windows as well.

I wish ReactOS was drastically more usable.
by HillRat | 2025-09-16 13:37:12+00:00
Sign the package with hard keys and signature.

That's really the core issue. Developer-signed packages (npm's current attack model is "Eve doing a man-in-the-middle attack between npm and you," which is not exactly the most common threat here) and a transparent key registry should be minimal kit for any package manager, even though all, or at least practically all, the ecosystems are bereft of that. Hardening API surfaces with additional MFA isn't enough; you have to divorce "API authentication" from "cryptographic authentication" so that compromising one doesn't affect the other.
by ascagnel_ | 2025-09-16 13:37:31+00:00
They're not on the roof for that scene; they're in his office, using the computer room's air conditioning as a sound mask (and using a Cray Y-MP as a bench). While the movie takes some very early-90s liberties with technology (especially the scene where they use the chip), it's remarkably respectful of hacking -- there's a stronger emphasis on social engineering then the purely technical, and my "head canon" is that the chip itself is a quantum chip capable of breaking any then-known encryption.
by dreamcompiler | 2025-09-16 13:37:34+00:00
I used to love Apple Mail but it was precisely this bug that made me move permanently to Thunderbird. It's hard for me to fathom a bug so severe that it caused data loss on an IMAP server, but Apple created said bug and put it into production.

Thunderbird has the nice advantage of working on both MacOS and Linux with the same UI. It's not quite as nice as Apple Mail's classic UI (which is no longer available -- see (3) above) but it's good enough.
by jMyles | 2025-09-16 13:37:36+00:00
This always happens though. Every time someone is thrown in a cage unjustly, the state tries to redirect us (yes, us, here in this forum and others like it) to look at other details of the situation, whether it's details of the person's political or personality or, in this case, details of this (also seemingly unjust) probation violation.

Who cares if he smoked weed or installed a VM or evaded a government keylogger? Those are all really shitty reasons to put someone in a cage, whether it's couched as "probation terms" or not.
by datadrivenangel | 2025-09-16 13:37:41+00:00
I have a good sense of when I'm ignorant, and google very fast. If I feel the right mix of ignorance and curiosity, I will procure and devour relevant books. The trick is knowing a little bit about a lot of thing.

The honest answer is that I stop caring if I lose curiosity. The rationalized answer is that expertise requires maintenance, and a low likelihood of using some expertise doesn't justify that maintenance. For example, I am unlikely to ever do advanced financial planning, and I can re-learn / lookup the formulas for doing calculations, or maybe even re-derive them if I really need to. On demand learning!
by GuB-42 | 2025-09-16 13:38:00+00:00
It is not for preventing you from taking screenshots, if you insist, you can do it with another camera. It is to prevent malware and "helpful" AI tools from doing it for you and then uploading the picture to who knows where. Signal does this too, though I think it is optional.

Beyond preventing screenshots, it blacks out the window content in the task switcher, which is useful if someone is looking over your shoulder. This, by the way, is a good way to check if screenshots are allowed. If the window appears black in the task switcher, screenshots won't work.

The idea is similar to the "**" password fields.
by gf000 | 2025-09-16 13:38:18+00:00
But I mean, why not take the 100s of thousands of man-hours that went into making Android this very Linux-Kernel based mobile OS and build on top?

Will you be happy with xeyes and a terminal? Like, even a technically superior solution is completely useless without an ecosystem to make use of it, and desktop GTK/qt apps won't work nicely on mobile without actual porting. Let alone a technically significantly inferior one that is a misfit in this shape for mobile hardware.
by rdtsc | 2025-09-16 13:38:19+00:00
> I can attest as a personal experience in the past that this kind of behavior is not uncommon with feds, and has happened even before the current administration

One the first comments on reddit was actually:

> … in trump's america lmao

Someone had to awkwardly point out it was biden’s america. Which makes it easier and saves keystrokes: it’s just “america, lmao”. Then other countries can be even worse so it’s “lmao”. And soon enough they are just laughing their asses off while the person is stuck in jail.

> "clear hacking tools" I had installed in my computer, e.g CCleaner

I have always wondered if they are primarily that stupid or just evil and pretending to be stupid. I am leaning towards evil.
by neor | 2025-09-16 13:38:35+00:00
Depends on what you're using it for. Windows 11 is the only main stream competition, but for work I've used Pop OS for a few years and was amazed by how stable and usable it is for work.

Back to Mac OS now due to a change of workplace, and while I'm absolutely blown away by the M3 performance and battery life the OS is something I'm still struggling with a bit.
by mrweasel | 2025-09-16 13:38:35+00:00
NPM does seem vastly over represented in these type of compromises, but I don't necessarily think that e.g. pypi is much better in terms of security. So you could very well be correct that NPM is just a nicer, perhaps bigger, target.

If you can sneak malware into a JavaScript application that runs in millions of browsers, that's a lot more useful that getting a some number servers running a module as part of a script, who's environment is a bit unknown.

Javascript really could do with a standard library.
by articsputnik | 2025-09-16 13:38:44+00:00
the same for me (e.g. yabai didn't work anylonger properly with latest update). But for the past 2 months (or so), I couldn't be happier with Omarchy. It's a Linux build that comes with all the Mac specifications out of the box and is set up as a tiling window manager, which is what I used on macOS. But no more bugs, and it just works. Plus I can tweak my own OS, if I need to change something. In case of interest, I wrote a little here: https://www.ssp.sh/blog/macbook-to-arch-linux-omarchy/ (It was also on Hacker News: https://news.ycombinator.com/item?id=44955923)
by NoImmatureAdHom | 2025-09-16 13:39:10+00:00
In the U.S. and much of the rest of the civilized world, you have rights. This includes the right to not self-incriminate (in the U.S. that's the 5th amendment). In general, except for very specific and limited circumstances, U.S. state and federal government actors cannot compel speech (telling your encryption keys is compelled speech).

The U.K. is fast sliding down the slope to being a dystopian police state. The idea that you can be jailed for refusing to provide encryption keys (except for really specific, narrowly-defined circumstances) is something that should induce nausea. I feel for you and your country, you accomplished such great things.