MurphyA/hacker-news huggingface dataset:
by pragma_x | 2025-09-17 16:56:26+00:00
It would take labor, that's for sure. Manual review of everything JS is just too massive a landscape to cover. Automation is the way to go here, for sure.

I think the bare minimum is heavy use of auditjs (or Snyk, or anything else that works this way), and maybe a mandatory waiting period (2-4 weeks?) before allowing new packages in. That should help wave off the brunt of package churn and give auditjs enough time to catch up to new package vulnerabilities. The key is to not wait too long so folks can address CVE's in their software, but also not be 100% at the bleeding edge.
by LorenPechtel | 2025-09-17 16:56:36+00:00
The original criteria was for people who had not already been exposed.

And over 45s that engage in casual sex have almost certainly been exposed. Those who don't have prior exposure probably have few or one partner in a marriage or marriage-like situation and thus are not likely to be exposed. Yes, they could be cheated on or the like but exposure is not expected so effectiveness can not be measured.
by sarchertech | 2025-09-17 16:57:06+00:00
This is exactly the kind of thing, I’m talking about. Open source has mostly been captured by large corporations because purists refuse to recognize the gradient between proprietary and completely free.

If I license my software as MIT but with an exception that you can’t use it for commercial purposes if you make more than $100 million a year in revenue, that’s a lot closer to open source than proprietary.

We should be normalizing licenses that place restrictions on large corporations.

I think the world would be a much better place if we just changed the definition of open source to include such licenses. We don’t even really need to change the definition because normal everyday use of the term would already include them.
by jraph | 2025-09-17 16:57:45+00:00
Clipboard managers help a lot there.

I just use KDE's default one, Klipper, and I raise the max entry number.

If something bad replaces your copy, you can get the good one back from the history.

There are nice features like QR code generation for your copied text if you want to quickly share something with someone else's phone as well.
by bigyabai | 2025-09-17 16:57:58+00:00
> There's no other word for it but "insane". They can engineer their A-series and M-series microchips

There are certainly other words for it. Lazy, anticompetitive, disinterested, any of those are more plausible than all of Apple being insane. They sold you a microchip that you knew you wanted, now they are beholden to little else. For over a decade, Apple didn't even offer the iOS APIs for third-parties to implement cloud storage. They know you need their software services, regardless of how shit they are.

Insanity would be a pretty satisfying explanation. Fickleness fits a lot better with Apple's track record though.
by tene80i | 2025-09-17 16:58:43+00:00
I didn’t try creating a twin myself - I watched your YouTube demo (or most of it). Creating a twin via LinkedIn profile URL doesn’t feel like something I’d use for CRO because in B2C I’m not thinking in terms of LinkedIn profiles, and I don’t have them to work with.

Seems like a very powerful tool - for someone in B2C like me it would just want a different pitch / setup to get me to try it out.
by thunky | 2025-09-17 16:59:12+00:00
I'm glad to see this topic discussed here. The world should know what's going on even if Israel and it's supporters doesn't want us to see.

Israel just bombed residential Qatar the other day, killing and injuring civilians. Israel celebrated. They seem to be completely unrestrained.

So even if you're personally ok with Gazans being eliminated, there are other reasons we should be paying attention. Speaking of nuance.
by phendrenad2 | 2025-09-17 16:59:15+00:00
I think the lifecycle of a Linux user often goes like this:

1) I don't understand this

2) I'm starting to understand it!

3) Now that I understand it, I can play around

4) I will tweak it to be the ultimate system for me, that works exactly how I want, and (often) it will look like I'm hacking while using it

5) I'm starting to feel the limitations of the system. The hackerish GUI no longer appeals to me, because I see it as just some OpenGL and Ncurses commands

6) The Mac Mini is looking rather nice...

I think DHH is on step 4. Will he go to 5&6? Maybe not, because his reason for going to Linux is due to unhappiness with Apple's app store behavior. I hope he finds a new Linux user path I didn't think of.
by bluGill | 2025-09-17 16:59:35+00:00
I wish they would target mass transit not rideshare cars. A bus with this technology could immediately run a lot more frequent with shorter buses, and because the route is fixed they don't have to verify the entire city, only the roads the bus will travel on. Fix route buses running at high frequency is the key to getting people to ride mass transit, but it isn't affordable because drivers are so expensive if you can even find them to hire.
by naasking | 2025-09-17 16:59:36+00:00
> but rather the ability to reason in the general case, which requires the ability to LEARN to solve novel problems, which is what is missing from LLMs.

I don't think it's missing, zero shot prompting is quite successful in many cases. Maybe you find the extent that LLMs can do this to be too limited, but I'm not sure that means they don't reason at all.

> A system that has a fixed set of (reasoning/prediction) rules, but can't learn new ones for itself, seems better regarded as an expert system.

I think expert systems are a lot more limited than LLMs, so I don't agree with that classification. LLMs can generate output that's out of distribution, for instance, which is not something that's classic expert systems can do (even if you think LLM OOD is still limited compared to humans).

I've elaborated in another comment [1] what I think part of the real issue is, and why people keep getting tripped up by saying that pattern matching is not reasoning. I think it's perfectly fine to say that pattern matching is reasoning, but pattern matching has levels of expressive power. First-order pattern matching is limited (and so reasoning is limited), and clearly humans are capable of higher order pattern matching which is Turing complete. Transformers are also Turing complete, and neural networks can learn any function, so it's not a matter of expressive power, in principle.

Aside from issues stemming from tokenization, I think many of these LLM failures are because they aren't trained in higher order pattern matching. Thinking models and the generalization seen from grokking are the first steps on this path, but it's not quite there yet.

[1] https://news.ycombinator.com/item?id=45277098
by palata | 2025-09-17 16:59:39+00:00
> But this is why Debian is so revered: they understand this dynamic and so maintain repositories that can be trusted.

So you do understand my point about AUR. AUR is like adding a third-party repo to your Debian configuration. So it's not a good example if you want to talk about official repositories.

Debian is a good example (it's not the only distribution that has that concept), which proves my point and not yours: this is better than unchecked repositories in terms of security.

> Whereas the solution C/C++ cultists seem to implicitly prefer is having no repositories because dependencies are, at best, a slippery slope.

Nobody says that ever. Either you make up your cult just to win an argument, or you don't understand what C/C++ people say. The whole goddamn point is to have a trusted system repository, and if you need to pull something that is not there, then you do it properly.

Which is better than pulling random stuff from random repositories, again.

> I actually prefer the dependencies-as-git-submodules approach

Oh right. So you do it wrong, it's good to know and it will answer your next complaint:

> Don't you just love it when one or more of your dependencies has a completely different build system to the others

I don't give a damn because I handle dependencies properly (not as git submodules). I don't have a single project where the dependencies all use the same build system. It's just not a problem at all, because I do it properly. What do I do then? Well exactly the same as what your system package manager does.

> this shouldn't be a problem.

I agree with you. Call it a footgun if you wish, you are the one pulling the trigger. It isn't a problem for me.

> why are any and all comments begging for a first-party package manager immediately swamped with strawmans about npm

Where did I do that?

> It's because of the cultism, and every npm exploit further entrenches it.

It's because npm is a good example of what happens when it goes out of control. Pip has the same problem, and Rust as well. But npm seems to be the worse, I guess because it's used by more people?
by cb321 | 2025-09-17 17:00:29+00:00
It's 10x slower than a more specialized command [1] for me, but adding recursion only requires adding one extra asterisk (`**` instead of `*`) and maybe a D if you want to include dot files or triple star if you want to follow symlinks:

$ date; print -rl -- **(om[1].D);date; newest -n4 -r0 $HOME Wed Sep 17 12:48:53 EDT 2025 .config/mozilla/firefox/p9/bounce-tracking-protection.sqlite Wed Sep 17 12:49:25 EDT 2025 /u/p9/.config/mozilla/firefox/p9/permissions.sqlite /u/p9/.config/zsh/history /u/p9/.config/mozilla/firefox/p9/places.sqlite-wal /u/p9/.config/mozilla/firefox/p9/bounce-tracking-protection.sqlite *newest -n4 -r0 $HOME Time: 1.882365 (u) + 1.318166 (s)=3.215131 (99%) mxRSS 139 MiB

Not sure how to change to get most recent 4 or whatever in the Zsh style (since, you know, that'd be 10x slower..)

[1] https://github.com/c-blake/bu/blob/main/doc/newest.md*
by actinium226 | 2025-09-17 17:00:55+00:00
Usually, though not always, a company will tell you if they're making money on something, and if they're not they beat around the bush like this. Notice how, for example, Gywnne Shotwell never beats around the bush like this when talking about Starlink.

Notice the weird language:

> That’s making progress in terms of unit economics very, very positive.

He says the "progress" is "very, very positive," but if you're not paying close enough attention you might come away thinking that the unit economics are what's very very positive.

All that said, what he's saying makes sense. They're able to charge more for their rides since they offer the convenience of not having to deal with a driver, and they're not paying the driver, who is the most expensive part, so yea, I'm bullish on them.
by stephencelis | 2025-09-17 17:00:57+00:00
I think you're missing the point. iOS 13 is not the value proposition of the library, it's simply one small feature of comparison of many and isn't highlighted beyond a simple mention. The library provides just as much value if you are starting a new app today and choose to target iOS 26+.

> And with Apple's history of source-breaking changes over major platform updates, plus given how even huge libraries/tools like Alamofire, Realm, RxSwift, Cocoapods eventually succumbed to oblivion, I can't think of why an Apple developer with any modicum of discernment would choose PointFree's tools over Apple's own--unless they are themselves caught by the allure of reinventing the wheel.

Isn't this just a blackpilled take in general? You're complaining that Apple software breaks, that other third party software is discontinued, and this somehow leads to the conclusion to avoid this library?
by BeetleB | 2025-09-17 17:01:54+00:00
> It exists: Whatsapp

Whatsapp groups are as terrible as the alternatives. Every group I've been a part of that has more than N people (all who know each other) has devolved into endless memes, political talk etc, and very little connecting.

Give me Whatsapp where I have a setting to simply not show me any forwarded message, and I'll be happy.
by jajuuka | 2025-09-17 17:02:19+00:00
This seems like an empty threat. Okay, so what non-American products do they plan to buy instead? What qualifies something as an American product? Is Apple American because their HQ is there? Are Samsung phones American because they use American Corning Gorilla Glass? Not to mention plenty of other countries have companies that engage in similar practices. As they say, there is no ethical consumption under capitalism.
by siliconc0w | 2025-09-17 17:02:29+00:00
For more intellectual endeavors I find if I'm avoiding working on something it can be because I'm being lazy or just don't like the category of work but often it is a good sign it's not quite the right activity for the moment. It may not be well defined enough, or the highest priority, or doubting it is likely to yield the outcome I want. Time of day matters too, in the morning I feel like doing different things than in the afternoon. I can push through and "just do it" if I have to but often it's worth listening to this feeling and picking a task I am motivated to do instead.
by adastra22 | 2025-09-17 17:02:30+00:00
No it doesn’t, I was just curious. And yeah in the US grade school is just through 5th grade, and 6th grade in most of the rest of the world. Synonymous with elementary school AFAIK.

I think the US is far too slow in introducing algebra, with it standardly being taught in 9th grade. So that made me curious.
by jraph | 2025-09-17 17:02:44+00:00
Do something quick and crappy. And let your perfectionism fix it. And... here you are gotten started!

It can be a single word or a instruction that crashes your program at the location that needs to be worked on.

Leave a syntax error for getting started quick tomorrow.

Write down what needs to be done before it leaves your head (but don't make it perfectly structured and clean, a few words on a paper on your desk will do).

edit: For instance, you'd possibly want to fix the missing "n" in this comment. Make this feeling a tool against your procrastination.

edit2: ah, and get the hell out of HN, too.
by elliotec | 2025-09-17 17:02:48+00:00
Always count on Tenderlove for a detailed technical deep dive! I've missed your blog.

Tangential story - 12-13 years ago I was a burgeoning and super eager software dev that moved to Seattle to be closer to "the scene." tenderlove's content was a major reason for me going there and I poured through his posts learning way too much about Nokogiri, Active Record, and much much more.

I went to every Ruby meetup I could get to out there and I remember one in particular, a Seattle RB meetup, in the Substantial office. It was a pretty small group, at most 15-20 people.

I was with a coder buddy but knew nobody else. We were all just drinking pints of Manny's beer and eating pizza from Big Mario's or something. Ryan Davis (the creator of minitest among other things) was doing a presentation on Unicode.

Aaron Patterson (tenderlove) was cracking jokes at every opportunity. At one point I asked a relatively naive question and Aaron _tenderly_ answered in joke-form response. I felt such a _part_ of the scene then. Aja Hammerly was super engaged in the presentation, I think even Ryan Bates and/or Geoffrey Grosenbach were there.

It was quite surreal to be in this dream-like state around giants and heroes just doing what they were doing and being so inclusive. It seemed so normal but became a core memory.

Thanks for everything Aaron, you've truly been an inspiration!
by Nifty3929 | 2025-09-17 17:03:06+00:00
I'll disagree slightly, though clearly you are correct that if your goal is to offset calories, then eating a donut negates the benefits of the exercise activity.

My disagreement is that I think exercise should not primarily be about calories - it should be about fitness. And almost all of the fitness gains from exercise persist even if you replace the calories with a donut.

Exercising for 30min and then relacing those spent calories with donuts is FAR better than not exercising and forgoing those extra calories.
by ndriscoll | 2025-09-17 17:03:10+00:00
It should be possible to have a firewall rule to default deny outgoing connections and a DNS resolver that tells the firewall to allow a connection only after it has resolved it, but I don't know that there's anything off-the-shelf to do this yet. I imagine DoH providers are also either using known SNIs or ESNI, so you could block both of those.

The former approach is where we need to go with security IMO. If you don't have some auditability for why a computer on your network is making an outgoing connection (and ability to inspect/refuse it before it happens), then it should just be blocked. There's no reason for computers you own to reach out to random IPs you don't understand and can't inspect at your gateway. Most computing devices are preloaded with malware these days and need to be treated as untrustworthy by default.
by pornel | 2025-09-17 17:03:13+00:00
Checking of whole-program invariants can be accurate and done basically for free if the language has suitable semantics.

For example, if a language has non-nullable types, then you get this information locally for free everywhere, even from 3rd party code. When the language doesn't track it, then you need a linter that can do symbolic execution, construct call graphs, data flows, find every possible assignment, and still end up with a lot of unknowns and waste your time on false positives and false negatives.

Linters can't fix language semantics that create dead-ends for static analysis. It's not a matter of trying harder to make a better linter. If a language doesn't have clear-enough aliasing, immutability, ownership, thread-safety, etc. then a lot of analysis falls apart. Recovering required information from arbitrary code may be literally impossible (Rice's theorem), and getting even approximate results quickly ends up requiring whole-program analysis and prohibitively expensive algorithms.

And it's not even an either-or choice. You can have robust checks for fundamental invariants built into the language/compiler, and still use additional linters for detecting less clear-cut issues.
by trjordan | 2025-09-17 17:03:18+00:00
Everybody is different, but the biggest reason I struggle with this right now is the pace of modern life.

Doing hard things is hard, and that means I won't be thinking about the other stuff I have to do. I'm more apt to miss a text from my family when I'm running or writing a document than when I'm vibe coding, because the effort is all-encompassing. Subconsciously, that's stressful, so I steer away from it.

Habits help here, because with enough repetition, I learn that it's OK to disappear for an hour to do the thing. But the real issue is getting the meta-organization of my life right enough that I'm not scared to shut down my ambient executive function for that hour. This shows up as both "I'm too busy to do the hard thing" and "I'm too tired to do the hard thing."

Slowing down isn't the answer, but it's been pretty transformative to notice that that's what I'm worried about.
by summerlight | 2025-09-17 17:03:36+00:00
Agreed that template itself is not the problem but people are. It is still arguable that template is much more of fun to write clever codes because of its meta programming capability as well as its runtime performance advantages.

With a pure virtual interface you can at least track down the execution path as long as you can spot down where the object is created, but with template black magics? Good luck. Static dispatch with all those type traits and SFINAE practically makes it impossible to know before running it. Concept was supposed to solve this but this won't automatically solve all those problems lurking in legacy codes.
by rasengan | 2025-09-17 17:04:11+00:00
You do need to trust Intel as it relates to deterministic and verifiable SGX hardware. SGX has had issues, but these are fixed pretty quickly [1]. Creating the isolated layer like SGX gives you verification of what is running on VP.NET's servers though, and the code is available to review and compile yourself so you can verify it is the same [2].

From a defense in depth standpoint, the more layered and isolated securities, the better.

[1] https://sgx.fail

[2] https://github.com/vpdotnet/vpnetd-sgx
by thomastjeffery | 2025-09-17 17:04:23+00:00
Learn how? Almost definitely.

Actually do it? That's a lot less certain than you would expect.

I would probably start. Since this hypothetical is a pretty simple one-off, I might even manage to generate enough executive functioning to follow through.

What I can tell you for certain is that I am still very excited to work on a custom keyboard project that I started 4 years ago. I have all the parts and equipment readily available at home, and plenty of free time. I have not worked on it at all over the past 4 years.
by naasking | 2025-09-17 17:04:40+00:00
The difference between ML models and computers since the 1960s is that the ML models weren't programmed with predicates, they "learned" them from analyzing data, and can continue to learn in various ways from further data. That's a meaningful difference, and why the former may qualify as intelligent and the latter cannot.

But I agree in principle that LLMs can be distilled into large IF/THEN/ELSE trees, that's the lesson of BitNet 1-bit LLMs. The predicate tree being learned from data is the important qualifier for intelligence though.

Edit: in case I wasn't clear, I agree that a specific chain of IF/THEN/ELSE statements in a loop can be generally intelligent. How could it not, specific kinds of these chains are Turing complete after all, so unless you think the brain has some kind of magic, it too is reducible to such a program, in principle. We just haven't yet discovered what kind of chain this is, just like we didn't understand what kind of chain could produce distributed consensus before PAXOS.
by pyuser583 | 2025-09-17 17:04:40+00:00
Ivermectin is also used to treat COVID in countries that have endemic parasite outbreaks. COVID responds well to steroids, but so do parasites. Giving steroids to someone with parasites causes the parasites to become much stronger, and trigger reactions from the immune system: fever, etc.

I ideally you could test for parasites, but time and resources don't allow for that in many countries. So if it's generally safe to just give ivermectin along with steroids when treating COVID - in countries where parasites are common.

Maybe I'm wrong about this. Maybe I'm making it up. Don't listen to what I say. Listen to your doctor.
by eldaisfish | 2025-09-17 17:04:44+00:00
you're shouting at a wall here. This site is absolutely infested with US techbros who believe that the solution to any problem is zero regulation and more computers.

This is why self-driving cars appeal to this crowd. You and i seem to be from a world where public infrastructure like clean, affordable transit is the goal. This raises the floor for everyone. Many here would rather think solely of their own comfort, which is fine, but despite repeatedly being told that they are short-sighted, they refuse to change.
by crdrost | 2025-09-17 17:04:52+00:00
Like I haven't run Coq but I assume that in this particular instance, the answer is a rather trivial "yes"? You'd think about, creating this proof is a gigantic research slog and publishable result; verifying it is just looking at the notes you wrote down about what worked (this turing machine doesn't halt and here's the input and here's the repetitive sequence it generates, that turing machine always halts and here's the way we proved it...).

But taken more generally, not for this specific instance, your question is actually a Millenium Prize problem worth a million dollars.
by quickthrowman | 2025-09-17 17:05:11+00:00
Short form video is basically worthless outside of comedy and cute animal videos. The format does not allow enough information to determine whether the information provided is accurate or not, for videos that have facts in them. Every time I watch a short form video I feel an overwhelming urge not to trust what I saw and verify it elsewhere, now I just don’t want short form videos at all.