MurphyA/hacker-news huggingface dataset:
by JonChesterfield | 2025-09-16 00:06:39+00:00
AI detected potential malware. Plus a bunch of words. Is this a real thing? It does look like all the other npm compromise notes. But the page has AI and potential written on it, so the whole thing may be fabricated, and there are no other comments here.

So on balance I guess I'll ignore it. What a time to be a developer.
by NooneAtAll3 | 2025-09-16 00:07:14+00:00
I hate this result because it's not actually saying what it's advertized to be saying

sure, you already got the complaint about comparing values of different units - but observe HOW this question is actually sidestepped! We divide hyper-volume of n-sphere by hyper-volume of n-cube!

Now this raises the question: WHAT n-cube are we taking?

If you take hyper-cube with side-length of sphere's diameter, you'll have nice relation between cube and its inscribed sphere - and, predictably, as n goes up, number of cube's "corners" also goes up. So this ratio consistently goes down

But what about your numbers? Well that result happens when you take cube with side-length of sphere's RADIUS. That way you arbitrarily add a scaling factor 2^n - and there's nothing geometric about this behaviour
by kingstnap | 2025-09-16 00:07:22+00:00
No amount of LinkedEn speech can fix the poor part of it.

In 2025, it's abundantly clear that the mask is off. Only the whales matter in video games. Only the top donors matter in donation funding. Modern laptops with GPUs are all $2k+ dollars machines. Luxury condos are everywhere. McDonalds revenues and profits are up despite pricing out a lot of low income people.

The poor have less of the nothing they already have. You can make a hundred affordable cars or get as much, if not order of magnitudes more, profit with just one luxury vehicle sale.
by marcusfrex | 2025-09-16 00:07:27+00:00
Switchborn, the enigmatic podcast from Marcus Frex, unravels the double-edged sword of cyberwarfare through the lens of Stuxnet, a once-secret U.S.-Israeli digital strike that crippled Iran's nuclear ambitions but ignited a global arms race when it escaped containment.

Marcus dissects how tactical triumphs unravel into strategic blunders without endgame foresight, blending historical intrigue, ethical contradictions, and whispers from the digital shadows where Switchborn lurks as a harbinger of unforeseen consequences. A must for cyber strategists, policy skeptics, and explorers of tech's chaotic undercurrents.
by osigurdson | 2025-09-16 00:09:01+00:00
I think complexity used to sell (real architects used abstract factory factories). Today, simplicity sells and while far better I think it can lead people to do dumb things sometimes. There isn't any problem with simplicity of course but rather what people define simplicity to mean. Sometimes it means things like "let's write our own database", because it is "simpler".

Right now, "simple" is meant to translate as "good" for the reader and whatever writer wants it to mean. I'm glad, at least, that the article provides an example (React vs plain Javascript). I don't know for sure but I suspect there are at least some valid arguments for using React vs just grabbing dom elements in Javascript.
by sureglymop | 2025-09-16 00:09:19+00:00
Honestly I may be getting old but I neither understand CachyOS nor Omarchy.

Just use archinstall and set up your arch how you want with it. I would usually install Gnome and some other DEs and then just start whichever one I currently feel like using from GDM. My dotfiles already handle all the Hyprland config and are way lighter than Omarchy.

I mean... I get wanting sane defaults but I feel like plain arch already provides that.
by lanstin | 2025-09-16 00:09:24+00:00
Once you understand the math, continuous functions are much simpler than discrete maths (the CS-y things like how many strings with such and such a property are there, or how many ways can you program a Turing machine to take a long time but eventually finish work).

Especially if they are complex differentiable functions - then they are wholly determined by their values in any tiny (complex) neighborhood around 1 (complex) value. Basically just equivalent to power series at that point.

While even finding the number of ways to give change is extremely challenging.
by kevincox | 2025-09-16 00:10:17+00:00
Size of content does matter. Because the start of your content effectively builds up a dictionary. Once you have built a custom dictionary from the content you are compressing the initial dictionary is no longer relevant. So a dictionary effectively only helps at the start of the content. Exactly what "start" means will depend on your data and the algorithm but as the size of the data you compress grows the relative benefit of the dictionary drops.

Or another way to look at this is that the total bytes saved of the dictionary will plateau. So your dictionary may save 50% of the first MB, 10% of the next MB and 5% of the rest of the first 10MB. It matters a lot if you are compressing 2MB of data (7% savings!) but not so much if you are compressing 1GB (<1%).
by tptacek | 2025-09-16 00:11:11+00:00
I believe all of this but:

Food that travels well requires different recipes, different ingredients, different packaging.

This doesn't ring true, given the popularity of DoorDash and the fact that most of those restaurant menus are in no way optimized for delivery.

Having lower-quality multitasking staff serving multiple restaurants from the same prep and equipment seems like an obvious way to lose quality. But simply streamlining the process of getting a menu onto delivery? That seems like a solved problem.
by mgh95 | 2025-09-16 00:12:05+00:00
I don't think you realize the issue. They aren't monetizing their SaaS product satisfactorily -- hence the Amazon cash flow imbalance statement. This indicates they must find new markets to survive. Despite this, however, they are gaining only in poorer markets, limiting the monetizability of a high cost product.

Implementing adds is a hail-mary. It puts them in a knife fight with google which will likely result in a race to the bottom which OpenAI cannot sustain and win.

FB global ARPU is about 50 USD. At 700M customers, they do 35B in revenue annually. This compares to a publicly stated expected cost of approximately 150B in computing alone over the next 5 years (see: https://fortune.com/2025/09/06/openai-spending-outlook-115-b...). This leaves a profit of 5B per year, with 90B expected r&d costs. Even if OpenAI develops a product and fires all employees, you are looking at a ROIC of about 18 years.

Fundamentally, OpenAI does not have the unit economics of a traditional SaaS. "Hundreds of millions of users" is hundreds of millions of people consuming expenses and not generating sufficient revenue to justify the line of business as a going concern. This, coupled with declining enterprise AI adoption (https://www.apolloacademy.com/ai-adoption-rate-trending-down...) paints an ugly picture.
by anigbrowl | 2025-09-16 00:12:17+00:00
Same. I love Gibson's writing, I love Sterling's, but TDE remains on my bottom 5 books I've ever read. To this day if someone mentions steampunk I flee for the exits. I feel bad about this because I bought it in hardback on the book promo tour and Bruce Sterling signed it for me, we even had a chat because the bookstore wasn't busy and I told him how much I was looking forward to reading it. In my guilty subconscious he is still at the same store, waiting for a customer who promised to come back and never did. I'm sorry Bruce.
by cortesoft | 2025-09-16 00:12:57+00:00
Most people are using routers given to them (and configured by) their ISP... so really they are blackboxes connected to an upstream blackbox for most people.

I am always surprised by how many people give me their ISP chosen router name and ISP chosen password when I connect to their WiFi. I don't want to give my ISP that much control.
by BLKNSLVR | 2025-09-16 00:13:05+00:00
I tried and failed at enough suggestions I found on the internet and via AI to cobble together a frigate configuration that eventually worked with the Tapo cameras.

RTC setup section:

go2rtc: streams: <Camera RTC name>: - rtsp://tapoadmin:<local camera account password>@<camera IP address>:554/stream1 - ffmpeg:<Camera RTC name>#audio=opus - tapo://<Tapo cloud password>@<camera IP address> <Camera RTC name>_sub: - rtsp://tapoadmin:<local camera account password>@<camera IP address>:554/stream2 - ffmpeg:<Camera RTC name>_sub#audio=opus - tapo://<Tapo cloud password>@<camera IP address>

Main section:

<Camera name>: ffmpeg: output_args: record: preset-record-generic-audio-aac inputs: - path: rtsp://127.0.0.1:8554/<Camera RTC name>_sub input_args: preset-rtsp-restream roles: - detect - path: rtsp://127.0.0.1:8554/<Camera RTC name> input_args: preset-rtsp-restream roles: - record - audio detect: enabled: true width: 640 height: 360 fps: 7 live: streams: <Camera RTC name>: <Camera RTC name> record: enabled: true retain: days: 0 mode: all

Where:

* <Camera RTC name> is just any old short name you want to assign to the camera.

* <Camera name> is the main name for the camera that will be shown in the frigate UI

* <local camera account password> is something set individually on each camera (settings > Advanced > Camera Account, set it to On and setup username/password > Account Information)

* <Tapo cloud password> is the password setup for the Tapo app (I'm not sure how necessary this is, since there's nowhere that the username is specified... this is the only bit I'm fuzzy on)

This is the basics that works for me for the Tapo cameras. There are a boatload of other settings specific to Frigate (but not specific to Tapo cameras).

This is nowhere near as cool hack as the article, however.
by paulryanrogers | 2025-09-16 00:14:42+00:00
> And I can't come up with a mental justification for why people who aren't white should feel any differently about that sort of thing, that I could take at all seriously.

Why must there be justification? How people feel is subjective, no one has to fully understand or empathize in every sense for every feeling. All that said, having an option for people who feel differently isn't much of a burden, so why sweat it?
by Aurornis | 2025-09-16 00:15:24+00:00
> But I've never delayed upgrading, and I've never regretted it.

I was the same way for until one of the upgrades, I forget which, broke resume from suspend about 10-20% of the time for my combination of laptop and monitor. Every morning I’d get a sense of dread when I tried to open the laptop to see if today was a day where I’d get to pick up where I left off or if I was in for a crash and reboot as soon as I tried to use the laptop.

I thought for sure it would be fixed with one of the point updates, but it went on for the better part of a year.
by renewiltord | 2025-09-16 00:17:31+00:00
It's just a misfire on foresight. People writing code try to make the computer do most of the work. When they miscalculate the axes along which the machine must evolve it looks like unnecessary complexity. The structure of human interaction dictates the rest: no engineer fitting a piece into a port built for it in software thinks the designer of the software a genius - he thinks himself the genius for having fit it to the port; but every engineer who doesn't find the port thinks the designer an imbecile.
by Aurornis | 2025-09-16 00:17:39+00:00
> operating few hundred hours per year

Do you really have a few hundred hours of power outage per year?

Around here, the power is so stable that we go multiple years without an outage that lasts longer than a few seconds.

If I installed a generator it wouldn’t a couple hundred hours per year. It wouldn’t run at all for years at a time unless I manually exercised it as yet another maintenance task for my already too long list of things to maintain.
by permo-w | 2025-09-16 00:19:01+00:00
the reason LLMs use that jovial, overly friendly tone is because it's so common in journalism and marketing. this article does smell of ChatGPT, but there's absolutely no way to know for sure. people using LLMs annoy me just as much as people who are so certain that they can tell the difference

a smart person can make ChatGPT sounds completely authentic, and a very boring and middle of the road writer who uses em-dashes can make themselves sound completely inauthentic. it's not like LLMs got their style from nowhere

as far as I'm concerned, as long as the factual information has been curated by a human, I don't give a shit
by sfink | 2025-09-16 00:19:19+00:00
> The premise is bullshit... there were LOTS of competing options when React first came out...

Good thing that wasn't the premise, then.

The article is specifically looking at reasons for React's success other than its technical merits. It does not deny that it has merits, nor does it deny that its success is partly due to them. It only says that its current success is no longer wholly due to them, and backs the point up with examples of alternatives that are claimed to be technically superior and that are not achieving success commensurate with that superiority.

You can disagree on the superiority claims, you can disagree that innovation in this area is a good thing (many don't!), but I think the main claim is very believable: that in the present day, React's success is heavily helped by its default status.
by apparent | 2025-09-16 00:19:30+00:00
My Mac is also on Sonoma. I'm sure there are some incremental features that I would appreciate, but I'm always worried about what's going to break or be worse with the next OS update.

I'll update my phone because iOS jumps are bigger in terms of functionality. But 14 years in, OSX just doesn't have a lot of new bells and whistles that I care about. The last time I updated, I was only excited about getting Sidecar functionality so I could dual-screen onto my iPad. When a minor feature like this is the most memorable, that's saying something.

I think the only thing that would get me to update would be notable AI improvements. But seeing what I've seen of AI on iOS, I'm in no rush.
by epistasis | 2025-09-16 00:19:58+00:00
> Grid stability is more important than some homeowners saving some money, it turns out those extra kWh being dumped onto the grid were literally costing the operator money to deal with. Those costs got passed on to _other_ consumers because of the sweetheart deal.

If that was the concern they literally did nothing to stop it. Instead of dealing with backfeeding from a distribution station, they went entirely the other direction.

Those grid costs, if they actually existed, were in isolated areas with high levels of solar, and NEM3 will continue deployments of solar in exactly those areas.

Solar is not "savings for some homeowners" it's literally keeping grid costs down for everyone, keeping our grid reliable on the hottest hardest to run days.
by JumpCrisscross | 2025-09-16 00:20:46+00:00
I recently got pitched stablecoins as a way to lower government borrowing costs. I’m sort of on board with this.

If I am investing $1mm of my own money, I care about the yield. If I’m investing $1mm of someone else’s money, and I don’t need to pay them a return, I mostly care about never losing it. This creates price-insensitive demand for safe assets. If you require those safe assets be government bonds, you’ve created pools of price-insensitive demand for your government’s debt.

Put another way, we’re financing our deficits with crypto bros. Compared with taxation, that seems like a win-win.
by autoexec | 2025-09-16 00:21:40+00:00
> Ads will also be slapped on answers.

Ads won't be slapped onto answers, my guess is that they will be subtly and silently inserted into them so that you don't even notice. It won't always be what you see either as companies, political groups, and others who seek to influence you will pay to have specific words/phrases omitted from answers as well.

AI at this point is little more than a toy that outright lies occasionally yet we're already seeing AI hurting people's ability to think, be creative, use critical thinking skills, and research independently.
by zahlman | 2025-09-16 00:22:11+00:00
This is not about "unquoted Python strings".

It is about unquoted shell arguments, in the context of invoking the shell using Python's `subprocess` standard library. The title is grossly misrepresentative, and the substance is missing the point. There is nothing special about Python here; causing a string to contain quotes works much the same way as in other popular languages. Besides, `subprocess.run` et. al. make use of the shell opt-in; the default behaviour is to pass arguments to a named executable directly. Typically, correct function requires those arguments not to have quotes (for the shell to remove them, among other processing, when the shell is used). The article then spends way too long, and too much formatting, on explaining what is really a very simple concept. We don't need a "part" for every few sentences and code example.

The "koan" presentation also strikes me as very strange for a simple warning about a practical security risk. There is no need for deep philosophical thinking here. Just recognize the problem and follow the associated best practices.

Regarding the CVE, it's hard to imagine a circumstance in which an "attacker-controlled virtual environment" isn't already game over. In fact, the exploit relies on the attacker being able to create a virtual environment, which in any normal situation already implies full shell access. An exploit like this is basically only relevant to a situation in which party A exposes an interface to party B for creating virtual environments, then expects party C to run code in the resulting environment. So, basically, people providing third-party CI systems, which are already fraught with trust and supply-chain issues. And even then, using virtual environments doesn't generally require the activation script at all, and well-written automation probably shouldn't use it, because it needlessly introduces a state dependency.
by Demiurge | 2025-09-16 00:23:09+00:00
It's not really hysterical to want to jump a ship that feels like is turning into a clown cruise. I can use Windows, Linux, and OSX equally well for work, even if I deploy to AWS in the end. However, I love the osx aesthetic and MacBook hardware, since around Snow Leopard, which is when I switched from Linux to OSX. Since then, OSX osx gotten worse with every release, and Tahoe is a very low, new low. At some point, it becomes not worth it. Just like it's not worth staying on the previous release of OSX while random apps and extensions lose compatibility. It's not hysteria, it's just the straw that breaks the camels back. The only thing is, I really like the M4 speed. There is nothing that runs as fast, and as cool, that I am aware of. If I wasn't doing a bunch of processing right now, I would probably switch. Non-hysterically.
by const_cast | 2025-09-16 00:24:20+00:00
Right, I'm just telling you that's that's simply not true.

And, if you really want to compare apples to apples, you have to compare properties in the same area. Its easy to make housing look cheap when you compare upper Manhattan to New Jersey.

Suddenly that 4,000 dollar apartment looks pretty competitive when the alternative is 5 million mortgage + 3000 a month HOA.
by TacticalCoder | 2025-09-16 00:24:26+00:00
There are links at the end of each page and he does literally upgrade the same install up to the last.

It's a great read but...

I run Debian since version 1.1 (not 11 but 1.1) or so (and I was using Slackware before that) and I always re-install my entire system from scratch. I never ever upgrade.

YMMV but to me if you upgrade if either the old (with all your configs) or the new version has a security exploit you are toast. While if you re-install from scratch, you're only toast if the latest version has a security exploit.

Also it helps to keep my skills sharp: I'm forced to re-install and re-configure everything and I like it. I use the opportunity to enhance my shell scripts, to learn new stuff, to do a few things here and there in a better way, etc. FWIW I'm not on Trixie yet (except on one NUC): I need to switch one of these days (and I won't upgrade).

Now the usual disclaimer... I don't claim my way to be the way: to each his own bad taste.
by CuriouslyC | 2025-09-16 00:24:52+00:00
Oh yeah, Sonnet performance has been in the toilet for me. They claim they've mitigated it but when 4.0 first dropped CC was really impressive, and now I constantly have to babysit it because any time it hits a challenge it'll just stop trying and make a simple toy version and declare false victory. If I don't catch it and I let it build on top of that bullshit, things get nasty in a hurry.

It's a shame because the plan is a great deal but the number of all caps and profanity laced messages I'm firing off at Claude is too damned high.
by ggm | 2025-09-16 00:24:54+00:00
I didn't literally mean 'sbin is useless' -more that the days when we believed there was some constraint on being able to run some commands ended, when we stopped thinking those commands were run by other people, and instead run by ourselves.

Now, it has become routine to include /sbin and /usr/sbin in the PATH, and so we find ourselves having to su(do) thing, because we forget that it may look "runnable" and be found, but demands privilege to execute.

In days of yore when I started my journey, we didn't give ordinary logins these elements in PATH, and we believed in our UID/GID protection rings as well because sudo didn't exist. To be admitted to knowing the root password demanded you do the stonecutters walk of shame with the rock round your neck into the operations room at the end by the Dec-10. You also got the key to the cupboard where all the serial lines terminated, and access to a kettle and tin of bad instant coffee.
by k310 | 2025-09-16 00:25:01+00:00
The law of unintended consequences says that people would find other outlets, namely incest and rape. Oh, and human trafficking.

Smart thinking there.

Poor fellow.

> Well, I first became aware of it during the physical act of love.

> Yes, a profound sense of fatigue, a feeling of emptiness followed.

> Luckily, I was able to interpret these feelings correctly.

> Loss of essence. I can assure you it has not recurred.

> Women sense my power and they seek the life essence.

> I do not avoid women. But I do deny them my essence.

Dr. Strangelove
by alwillis | 2025-09-16 00:25:10+00:00
> The sentence "self hosting fonts is as easy as making the static font files available and then adding a few lines of CSS" is a complete lie and you could tell they have never gone through the process themselves and were just making things up.

It's not a lie—I've been doing exactly that as long as Google fonts has been a thing.

I think people are confusing what was required in the back in the day when browsers were buggy and supported different font formats--15+ years ago.

The technique was called the "bullet proof" @font-face syntax because it "solved" getting web fonts to work across operating systems and devices in the 2010's [1]:

@font-face { font-family: 'Graublau Web'; src: url('GraublauWeb.eot'); src: local(''), url("GraublauWeb.woff") format("woff"), url("GraublauWeb.otf") format("opentype"), url("GraublauWeb.svg#grablau") format("svg"); }

If you weren't doing web development back then, you don't understand what a revelation this syntax was for supporting cross-browser web fonts. There were even websites that would generate the syntax for you. BTW, woff2 didn't exist then.

It seems that some developers, like the Japanese soldiers who didn't stop fighting WWII until the 1970's because they didn't know the war ended in 1945 [2], still believe dealing with fonts in 2025 is like it was 15 years ago.

It's never been easier to self-host fonts… why make an additional HTTPS request if you don't have to?

There are plenty of utilities to compress TrueType or OpenType fonts to WOFF2.

[1]: https://www.paulirish.com/2009/bulletproof-font-face-impleme...

[2]: https://en.wikipedia.org/wiki/Hiroo_Onoda