MurphyA/hacker-news huggingface dataset:
by prmph | 2025-09-16 13:19:33+00:00
One question about this: How do most internet plans work with this?

If someone connects with a request, is that metered as ingress/downloading, and if your server responds, it is metered as an egress/uploading?

If so, that means an unlimited plan is a must, and even then, might ISPs flag you for abuse if large frequent requests/responses are being received/sent by the server?
by quotemstr | 2025-09-16 13:20:16+00:00
Jesus Christ. Another one? What the fuck?

This isn't a JavaScript problem. What, structurally, stops the same thing happening to PyPI? Or the Rust ecosystem? Or Lisp via QuickLisp? Or CPAN?

This whole mess was foreseeable. So what's to be done?

Look. Any serious project needs to start vendoring its dependencies. People should establish big, coarse grained meta-distributions like C++ Boost that come from a trustable authority and that get updated infrequently enough that you can keep up with release notes.
by Blackthorn | 2025-09-16 13:20:18+00:00
Anyone interested in a subject can, if they wish, ask an AI about it and get an answer. Your deep conversation with an AI is something fun and insightful only to yourself. You're welcome to do it, but don't pretend it has meaning to anyone else, because if they want to get the same insight on a topic they can do it themselves for the same amount of effort (none).
by Pxtl | 2025-09-16 13:20:45+00:00
I realize it's a small part of a whole, but it's kind of hard to ignore the broad rejection of environmentalism that happened across-the-board in English-speaking Canada. Green Energy Act was hated and cancelled, eco-fees were hated and got cancelled, carbon pricing was hated and got cancelled, bike lanes are hated and got cancelled.

It seems like voters will reject any attempt to fight climate change if there is cost or inconvenience involved.
by jerf | 2025-09-16 13:22:01+00:00
With some effort, you can train yourself to respond to "You are absolutely right" with being offended at the attempt to manipulate.

It's good training and has been since long before the AIs came along. For instance, the correct emotional response to a highly attractive man/woman on a billboard pitching some product, regardless of your opinions on the various complicated issues that may arise in such a situation, is to be offended that someone is trying to manipulate you through your basic human impulses. The end goal here isn't even the offendedness itself, but to block out as much as is possible the effects of the manipulation. It may not be completely possible, but then, it doesn't need to be, and I'm not averse to a bit of overcompensation here anyhow.

Whether LLMs actually took this up a notch I'd have to think about, but they certainly blindsided a lot of people who had not yet developed defenses against a highly conversational, highly personalized boot licking. Up to this point, the mass media blasted out all sorts of boot licking and chain-yanking and instinct manipulation of every kind they could think of, but the personalization was mostly limited to maybe printing your name on the flyer in your mailbox, and our brains could tell it wasn't actually a conversation we were in. LLMs can tell you exactly how wonderful you personally are.

Best get these defenses in place now. We're single-digit years at best away from LLMs personalizing all kinds of ads to this degree.
by palmotea | 2025-09-16 13:22:37+00:00
> Interesting, Trump administration pardoned Ross William Ulbricht who run drug dealing business specifically because it was done behind Tor using cryptocurrency. So this was a one off?

Didn't Ulbricht get pardoned for being a hero of the cryptocurrency-bros, as kind of a deal to get support from the Libertarians in the election? I think he was a one-off, or at least part of a small category that doesn't extend to cryptography and privacy idealists.
by luismedel | 2025-09-16 13:22:44+00:00
I consider myself a generalist, but, to be honest, I don't remotely think that I "know a lot of everything". In fact, I suffer about the contrary :-)

About the "when do I say 'I know enough'"...well, never. I just follow my curiosity and it's infinite ramifications. I loss/gain interests about very diverse topics in a somewhat short amount of time.
by account42 | 2025-09-16 13:22:54+00:00
Puff pastry is also usually not the main part of whatever you're making but rather just something to hold it together. I see it more as buying pasta to go along my self-made stew - sure I could make it myself but for most dishes I wouldn't notice the difference. The cake mix is much more defining of the taste of the resulting cake so I'd want to have a say as to what goes into it instead of just using someone else's design.
by Joel_Mckay | 2025-09-16 13:22:58+00:00
In my opinion, ideally a well-planned/templated object structure focused around well documented design-patterns without bodged-on/polyglot binary objects.

Thus, people that actually leveraged the OO paradigm properly, and in a way that may be sustainably regression-tested/maintained over many continuous integration cycles. That kind of "clean" code tree usually only needs juniors to study around <5 files to understand even the most complex modules operation, helps mitigate bugs, and team-leads can weed out quality "issues" in minutes.

People that churn teams usually discover a YOLO and OO paradigm are fundamentally incompatible concepts. People won't know everything they need in the first release, and they will have stuff they don't need but now have to live with by the third release.

This is not a Java specific problem... but it does make it easy.

Nothing integration "teams" do will likely matter much compared to a 3.6B user-base policy change. Have a great day =3

"Nor would a wise man, seeing that he was in a hole, go to work and blindly dig it deeper..." ( The Washington Post dated 25 October 1911 )
by fragmede | 2025-09-16 13:23:20+00:00
> you just need capital

The capital itself isn't going to do anything sitting in the bank. It's used to procure a team of PhDs, an team of SWEs, DevOps, business people, HR, marketing, access to a GPU supercomputer (renting a couple of 5090s off Vast.ai ain't gonna cut it). For, say, $50 million, you could get the blueprints to an Android phone and port your choice of Linux userland and get drivers working, and then do a run of 20,000, sell them for $1100. Compared to training GPT5, $50 million is cheap. If we use an estimate of $1 billion for the whole thing, making a Linux phone running a hypervisor with an Android VM to run banking apps seems not-impossible. (Based on AVF.)
by danaris | 2025-09-16 13:23:43+00:00
You and simonask are speaking at different levels of literality.

Yes, literally, "let's" expands to "let us". But idiomatically, "let's/let us <do this thing>" does not mean "allow us to <do this thing>"; it means "I am requesting that we now <do this thing> together".

Now, I'm not entirely sure why simonask felt this level of literality was a useful one to bring up here, but it is true.
by gwd | 2025-09-16 13:24:16+00:00
> Parts can be loaded via separate calls, and it divides something that would be otherwise a monolith into subsequent small calls

He's not saying don't use Javascript; he's saying that instead of having those small calls shipping JSON which is then converted into HTML, just have those small calls ship HTML to begin with.

It's surprising how far you can get with something like HTMX.
by cjonas | 2025-09-16 13:24:34+00:00
So basically react class components? It definitely was not easier in those days.

When your just using vanilla react, I've never had a problem with hooks being that hard to reason about. Once you add in SSR, routers, query caching frameworks, etc the "lifecycle & state" starts to get confusing.

This is mostly a problem with the additional complexity of these frameworks (nextjs, tanstack) and not react at its core. Building an app with just react (and maybe redux) feels so simple and natural once you learn the paradigm.
by afavour | 2025-09-16 13:25:13+00:00
I have a lot of respect for the work the React Native folks do but at the same time the constant reinvention just highlights an inherent weakness in any framework like this: you don’t control the platform, so you’re always always at least one step behind.

Sometimes that tradeoff is worth the cost but other times (particularly in the era of Swift and SwiftUI having replaced Objective C and UIKit) you’ll be better off just biting the bullet and learning a little native code. As a JS developer I found Swift to be a delight.
by tptacek | 2025-09-16 13:26:02+00:00
For whatever it's worth, the Reddit story here says that the federal courts used "fraudulent warrants to jail my husband again". Maybe! The other side of that story, via PACER, is a detailed parole violation warrant (you can hear the marshal refer to it in the video); the violations in that warrant:

1. Admitting to using cannabis during supervised release

2. Failing to make scheduled restitution payments and to cooperate with the financial investigation that sets restitution payment amounts.

3. Falling out of contact with his probation officer, who attempted home visits to find him.

4. Opening several new lines of credit.

5. Using an unauthorized iPhone (all his Internet devices apparently have keyloggers as a condition of his release).

These read like kind of standard parole terms? I don't know what the hell happened to get him into this situation in the first place, though.
by CuriouslyC | 2025-09-16 13:26:25+00:00
Nah bro. I have a Claude Code hall of shame, where Sonnet gets derailed by the most trivial shit, and instead of finishing actual research code that's been clearly outlined for it (like, file by file level instructions), it creates a broken toy implementation with fake/simulated output ("XXX isn't working, the user wants me to YYY, let me just try a simpler approach...") and it'll lie about it in the final report, so if you aren't watching the log, sucks to be you.

I have an extensive array of tripwires, provenance chain verifications and variance checks in my code, and I have to treat Claude as adversarial when I let it touch my research. Not a great sign.
by lucideng | 2025-09-16 13:26:44+00:00
I do repair and modernizing of cars/motorcycles/dirtbike/ATVs, that kind of stuff. Fuel injection conversions are something I specialize in. That is why I would like durable/resistant materials as an option. I won't be trying to earn with it intentionally, unless I stumble upon a niche. There are already more than a couple 3d printing services around here, no need to compete there.

I can do what I need to do in CAD, design my own parts, etc. Other than the above, I'll use it for gifts, stuff around the home, rasPi and ESP32 electronic projects with home assistant, misc. enclosures, etc. I have a broad set of use cases but running production 24/7/365 isn't something I see myself doing unless I stumble upon a niche as I mentioned.
by kasey_junk | 2025-09-16 13:27:25+00:00
Oracle is far and away better than any of the open source databases. For a long time it wasn’t particularly close.

Db didn’t get parity with Oracle, they got good enough that you have to justify spending for Oracle and incurring the down sides of its company’s model.

Similarly, no db that competes with Oracle was written by one person, they were and are funded mostly by private companies and foundations.

There is a future where open weight models are good enough and the foundation labs are the truly luxury tier for a small subset of the user base.

That’s before talking about something like productivity software which Google _gives away_ while it’s a main business of Microsoft.

Blindly saying that there is only a future where the foundation llms capture all of the business is hyperbolic and ignores history. The llms look more db shaped to me than they look like car shares. Those truly are network effect dominated.
by rich_sasha | 2025-09-16 13:27:25+00:00
I certainly sympathise, but actually don't find it at all surprising.

Tor is totally used for criminal activity. That doesn't mean it is inherently a bad thing, or that it is this guy's fault, but he can't completely wash his hands off it. If bad guys use the postal service, it's not the postman's fault, but he has to cooperate with law enforcement if they demand that.

I don't know about the US, but contempt of court is a thing in the UK at least. You can't refuse to submit evidence to court, including things like encryption keys or things only stored in your head - or face penalties including unlimited jail time.

Now, I get that this is the US so the arrest was dialled up to 11 and it seems all of this is extra-judicial - no court warrant etc. This is all very disappointing. But, to my non-expert eye running a Tor exit node is in the legal grey zone, and I guess you can't be too surprised when things like this happen.
by Panzerschrek | 2025-09-16 13:27:28+00:00
I presume this is because of compatibility reasons.

Back in 70s and 80s computers didn't contain valuable information to care about and there was no Internet to transmit such information. So, adding some sort of security elements in operating systems had no sense. In these years modern operating system were first developed - Unix, Dos, Windows. Since then many architectural decisions of these operating systems weren't revised in order to avoid breaking backward-compatibility. Even if we need to break it to achieve better security, no one is ready to make such sacrifice.

There are projects of operating systems with focus on security, which are not just Unix-like systems or Windows clones. But they can't replace existing operating systems because of network effects (it's unpractical to use a system nobody else uses).
by znort_ | 2025-09-16 13:27:47+00:00
npm in itself isn't special at all, maybe the userbase is but that's irrelevant because the mitigation is pretty easy and 99.9999% effective, works for every package manager and boils down to:

1- thoroughly and fully analyze any dependency tree you plan to include 2- immediately freeze all its versions 3- never update without very good reason or without repeating 1 and 2

in other words: simply be professional, face logical consequences if you aren't. if you think one package manager is "safer" than others because magic reasons odds are you'll find out the hard way sooner or later.
by jeswin | 2025-09-16 13:27:52+00:00
Traditional JS is actually among the safest environments ever created. Every day, billions of devices run untrusted JS code, and no other platform has seen sandboxed execution at such scale. And in nearly three decades, there have been very few incidents of large successful attacks on browser engines. That makes the JS engine derived from browsers the perfect tool to build a server side framework out of.

However, processes and practices around NodeJS and npm are in dire need of a security overhaul. leftpad is a cultural problem that needs to be addressed. To start with, snippets don't need to be on npm.
by phil21 | 2025-09-16 13:28:07+00:00
I stop when the immediate business need is fulfilled.

I see it a lot like tools in your toolbox. You start buy buying the cheapest of whatever it is you need. If you end up either using a particular tool a lot and a nicer/more expensive version of it will make your life better you then upgrade. If you end up breaking the cheaper one you also invest the money into upgrading. You generally find that you are only upgrading a small fraction of your toolbox this way, and save quite a bit of money vs. buying an entire set of expensive professional grade gear.

I see that for skillsets as well. Why waste time on knowing the nitty gritty deep level of something if I will rarely come back to use it again. If I can cargo-cult my way into getting the thing done and moving on I will. If I end up coming back to the thing on a constant basis I will then invest the time into learning the deeper internals/details/tricks etc.
by cassepipe | 2025-09-16 13:28:14+00:00
a) I think I have a (a bit under?)average IQ but I have no idea. I have done ok in school but I have always needed more time, I am pretty slow. My chess ELO is between 1350-1450 but I learned the moves when I was 8 and started playing casually everyday for 3 years now.

b) 1 cigarette a day or none depending on the period. But rises significantly when drinking and partying

c) I am in good health and overheating is generally a problem that arises sooner that breath issues when exercising Almost never sick. I get between 0 to 2 illnesses a year depending on how much I find myself with lots of people in a room

d) Hard to tell. I feel smarter than a lot of people but I only feel it's because I am much more curious. On the other hand, I am pretty slow. I have self-confidence/laziness issues that prevent me to actually look for a dev job.

Started smoking at 19, first occasionally, then regularly, now occasionally again What do you say, doc ?
by IlikeKitties | 2025-09-16 13:28:38+00:00
> This is exactly the argument for privacy to people who say "I have nothing to hide"

People who say this will not be swayed by any argument. What they are really saying is "I don't want to think about this".

There's a truth I've come to accept in recent times: The vast majority of people are not able to extrapolate from their immediate personal situation. If they are not effected by something right now in a way they personally feel, they do not and will never care.

Once you accept that fact, so many things make so much more sense in this world. The whole MAGA movement explains itself, the complete disregard of climate change or even local environmental issues make sense and the complete ignorance of privacy issues. The only way to sway these people is when they are personally affected. So consider this Truth the next time you find out a service has been collecting private information in an unsecured S3 Bucket.
by lo_zamoyski | 2025-09-16 13:29:15+00:00
Practicality puts bounds on how much to rabbit hole.

A theoretician in the purest sense is removed from practical constraints and timelines. He can, in principle, keep pursuing a subject until the day he dies.

A practitioner is aiming for a practical result within a time frame. Because he has to deliver, he cannot afford to focus on developing a deep or exhaustive grasp of any particular thing. His focus isn't knowledge, after all, but the practical result. He will lean more on what he already knows, however limited, rather than pursuing new knowledge. He is less concerned with verifying the truth of claims himself and more concerned with trusting claims tactically by knowing whom to trust and when.

So, in the capacity of practitioner, you must learn prudence, which is the virtue of knowing what should be done in a given situation. It is the basis for the moral life, as morality concerns itself with right action and right decision making.
by ivape | 2025-09-16 13:29:27+00:00
We have to consider that crime on the internet is as real as crime in real life. Funny to say it out loud. Criminals move a certain way and just because you are a nerdy tech dude doesn’t also mean you’re not a gangster.

Edit:

Reminds me a lot of the lives of people in this saga:

https://www.amazon.com/gp/aw/d/B01L8C4WBG/

The poor wife, “can you stop being a criminal for like, one month, please?”.
by bob1029 | 2025-09-16 13:29:41+00:00
My favorite TV of all time was a 65" Panasonic plasma.

4k OLED looks really good in dark scenes, but something about turning that plasma up to its full 800 watt+ vivid mode is a completely different universe.

Practically unusable during the summer in Texas though. The efficiency is really bad and you essentially need a custom hvac solution if you want to put it in a proper "theater" room. The noises it made in high brightness scenes were also a bit distracting. It had to move a lot of power very quickly.
by Zak | 2025-09-16 13:29:44+00:00
I've been unimpressed with Google's commitment to making the fundamentals of Android great. They seem to prefer doing the minimum required there and putting all their efforts into something more sexy, like generating fake photos that look like they were taken with a 2400mm lens.

I don't want my phone to generate fake photos; I do want it to always let me manually take screenshots, but require turning on a permission that's a little awkward to find to allow an app to do so.
by sfn42 | 2025-09-16 13:29:48+00:00
I was hyped for wasm because i thought it was supposed to solve this problem, allowing any programming language to be compiled to run in browsers.

But apparently they only made it do like 95% of what JS does so you can't actually replace js with it. To me it seems like a huge blunder. I don't give a crap about making niche applications a bit faster, but freeing the web from the curse of JS would be absolutely huge. And they basically did it except not quite. It's so strange to me, why not just go the extra 5%?
by yomismoaqui | 2025-09-16 13:30:14+00:00
The only constant in mobile development is churn.

I had apps on Google Play and every year I had to upgrade libs, recompile and loose and afternoon (or two) to not win anything, just churn for the sake of churn.

Compare this to plain HTML, CSS & vanilla JS. You can deploy a webapp today and if you are not using any beta JS Chrome API you will be able to use that site in 10 years without touching a line.
Show HN: StripeMeter – pre-invoice parity for Stripe usage billing
by coryli | 2025-09-16 13:30:19+00:00
I’m a contributor to StripeMeter, a tiny open-source tool to prove Stripe usage invoices are correct before they finalize. What it does (small surface):

- POST /v1/replay — reconcile late/duplicate events (dry-run or apply)

- GET /v1/reconciliation/summary — see drift and counters before/after

- GET /v1/usage/history — time-series to visualize the effect

Why: real systems have retries, late events, and dupes. StripeMeter sits beside your billing/pricing layer to ensure the numbers are exact pre-invoice.

Not: a pricing/plan/entitlement system or a warehouse.

Scope & limits: aimed at early/mid-stage SaaS on Stripe usage billing; local target ~10k late-event replay in ≤ ~2s (queue/workers recommended at scale).

Contributors & Feedback wanted: docs polish, SDKs (Node/Python), replay worker improvements, minimal visualizer, observability (Prom/Grafana), integrations. Check Good First Issues and our pinned Design Partners thread if you want to run a quick parity session.

If you haven't already, would you mind reading about HN's approach to comments and site guidelines?
by crazypyro | 2025-09-16 13:30:36+00:00
He was also placed under electronic monitoring program and immediately went about installing a VM to allegedly circumvent the monitoring software along with searching for a very controversial website relating to pedophilia...

He also lied about using his computer, his wife told on him to his parole officer, according to the court documents.

He was on parole for DDOSing* a former employer...

*Ah, I see your update, guess it was less distributed and more direct denial of service with the physical destruction and all.
by CrulesAll | 2025-09-16 13:30:38+00:00
A friend of mine that was in Desert Storm taught me this. Of course, he was on the other side

One of my favourites. Great cast.

Kingsley and Redford on the roof: "There's a war out there, old friend. A world war. And it's not about who's got the most bullets. It's about who controls the information. What we see and hear, how we work, what we think... it's all about the information"
by WD-42 | 2025-09-16 13:30:58+00:00
I mostly agree. But NPM is special, in that the exposure is so much higher. The hypothetical python+htmx web app might have 10s of dependencies (including transitive) whereas your typical Javascript/React will have 1000s. All an attacker needs to do is find one of many packages like TinyColor or Leftpad or whatever and now loads of projects are compromised.