MurphyA/hacker-news huggingface dataset:
by 999900000999 | 2025-09-17 11:10:30+00:00
The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages.

THEN use artifactory on top of that.

That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope.

Some 19 year old hacked together a new front end framework last week, better use it in prod because why not.

Occasionally I want to turn off my brain and just buy some shoes. The Timberland website made that nearly impossible last week. When I gave up on logging in for free shipping and just paid full price, I get an email a few days later saying they ran out of shoes.

Alright. I guess Amazon is dominant for a reason.
by p_l | 2025-09-17 11:11:14+00:00
Dunno about 2024, but 2023 G14 explicitly documents it can't work at full power when powered by USB-C, because it's USB-C PD supports only 100W compared to the >200W draw of the system. So it throttles just like macbooks with i9 (but those throttled always because one of the problems was overheating VRMs)
by IgorPartola | 2025-09-17 11:11:25+00:00
I have a 3D printer I bought a few years ago and I keep it in my office. It was quite loud as is and I sent through the process of quieting it down. Fans were a big part of it. It has four of them: power supply, main board, and two on the hot end/extruder. Noctua was what was mostly recommended, but (a) price and (b) at the time I believe they mostly or only had 12 volt fans and this printer ran on 24V so each fan would need a voltage converter board.

Well turns out you can get quieter and cheaper fans on e.g. Mouser or Newark that are 24V compatible. They let you sort and filter by size, voltage, noise level, and volume per minute so I found the quietest possible fans that still move roughly the same volume of air as the stock ones. The price was half to a quarter of equivalent Noctua fans (excluding converters) at that time.

From what I hear (pun intended) Noctua makes a great product both functionally and aesthetically, but don’t overlook industrial suppliers either.
by nickslaughter02 | 2025-09-17 11:11:29+00:00
> "I find it extremely worrying that the German government is so shirking its responsibility to take a position on this," said Left Party MP Donata Vogtschmidt, who chairs her group's digital committee. "Because in the Council of the EU, the current blocking minority against chat control depends directly on Germany." If the German government does not stick to the position of its predecessor, "the dam could break and the largest surveillance package the EU has ever seen could become reality."

> Jeanne Dillschneider, Green Party spokesperson on the committee, wrote to netzpolitik.org about her impression of the meeting: "The CDU/CSU, in particular, has often shown in the past how little the protection of fundamental digital rights means to them. I fear the same thing will happen now, even more so, with the CDU/CSU-led Ministry of the Interior." She therefore considers it "all the more crucial whether the Ministry of Justice upholds our fundamental digital rights during this legislative period."

> "I'm cautiously hopeful that some colleagues from the coalition parties apparently share my criticism of chat control," Dillschneider continues. "The question now will be whether they can actually bring themselves to reject chat control. However, I'm not particularly optimistic here."

> Dillschneider's committee colleague, Vogtschmidt, wants to ensure that the Bundestag is forced to take a position on the issue beyond statements made in committee meetings. This is permitted by Article 23 of the Basic Law, which allows parliament to adopt European policy statements. The government must then consider these in negotiations. Vogtschmidt believes: "Now I think chat control will have to be brought back to the Bundestag plenary session to raise awareness of this monstrous danger among a wider public. I will work towards this in the coming days!"
by rel_ic | 2025-09-17 11:11:32+00:00
> we can apply the rule, "-A cannot follow from A", etc. regardless of the A

You can't think of any domains where we are unable to apply this rule? I feel like I'm surrounded by people claiming "A, therefore -A!!"

And if I'm one of them, and this were a reasoning dead-zone for me, I wouldn't be able to tell!
by h4ch1 | 2025-09-17 11:11:35+00:00
Can't comment for others but for me I find zoc or in that regard, a SSH client useful for the following

1. Remembering multiple hostnames and keys in a centralized location

I manage a fleet of VPSs, whose hostnames, credentials I don't always remember off the top of my head. Writing ssh -i <identity> <hostname> gets tedious when I'm wrangling multiple of them over a single session

2. Faithful terminal emulation

Zoc does a great job at emulating a plethora of terminals; it's not a do or die feature, but nice to have.

3. Separation of concerns

This is a personal reason, but I like having two different applications while I am doing something that needs me to SSH to multiple VPSs, my main terminal will have local commands, local file editing, etc while my SSH client will only be used for remote connections and management. Just helps me keep things tidy for myself.

Also as I mentioned in the parent I primarily use my main terminal to SSH; but for the cases mentioned it's nice to use a separate client.
by slightwinder | 2025-09-17 11:11:53+00:00
> If you google "Paddington prison" you'll see a similar striped outfit.

Horizontal Stripes were common in US-Prisons until the early 20th Century [1]. While vertical Stripes were common in Nazi-Camps. It's a very distinct difference, and I would think the source-material has more data about the horizontal than the vertical stripes. So it's fair to ask which specific prompt they had to get pictures from Nazi-labour-camps.

[1] https://en.wikipedia.org/wiki/Auburn_system
by ricardobeat | 2025-09-17 11:12:04+00:00
I find this perspective harmful to OSS as a whole. It is completely fine to release free software that other companies can use without restrictions, if you desire to do so. It is not meant to be a transaction. You share some, you take some.

It’s also ok to release paid free software, or closed software, restrictive licenses, commercial licenses, and sell support contracts. It’s a choice.
by diordiderot | 2025-09-17 11:12:18+00:00
It's a bit of a catch-22.

Sending food wherever, leads to it being captured by Hamas / local militias (for lack of a better word) so you have to distribute where you can protect it.

But of course where you have soldiers is where you'll take fire.

Maybe she cared about your own people, you wouldn't engage in places where humanitarian aid was being distributed
by yrro | 2025-09-17 11:12:29+00:00
Have a look at the SSD Statistics page of the device statistics log (-l smart). This has one "Percentage Used Endurance Indicator" value, which is 5 for three of these disks, and 6 for one of them. So based on that, the drives still have ~95% of their useful life left.

As I understand it, the values in the device statistics log have standardized meanings that apply to any drive model, whereas any details about SMART attributes (as in the meaning of a particular attribute or any interpretation of its value apart from comparing the current value with the threshold) are not. So absent a data sheet for this particular drive documenting how to interpret attribute 177, I would not feel confident interpreting the normalized value as a percentage; all you can say is that the current value is > the threshold so the drive is healthy.
by zelphirkalt | 2025-09-17 11:13:41+00:00
If you are going to be that specific, then it would be good to post an example. If I remember correctly, lodash has some functions, that would be table stakes in functional languages, or easily built in functional languages. If such a function is difficult to extract, then it might be a good candidate to write in JS itself, which does have some of the typical tools, like map, reduce, and things like compose are easy to write oneself and part of every FP beginner tutorial. If such a function is difficult to extract, then perhaps lodash's design is not all that great. Maybe one could also copy them from elsewhere, where the code is more modular.

But again, if the discussion is going to be that specific, then you would need to provide actual examples, so that we could judge, whether we would implement that ourselves or it would be difficult to do so. Note, that often it is also not required for ones use-case, to have a 100% matching behavior either. The goal is not to duplicate lodash. The purpose of the extracted or reimplemented function would still be ones own project, where the job of that function might be much more limited.
by alerighi | 2025-09-17 11:13:45+00:00
What I like about Tabby is the fact that it has also options to connect to serial ports.

I know that is not something useful to everyone, but working in an embedded using serial ports is something I do everyday. And I know there is Putty or Kitty or Teraterm or another serial connection tools, but most of them are either only for Windows, and don't allow all the options that I need (e.g. option to enable local line editing with history).

The fact that it uses Electron... whatever, we are still full of Electron applications anyway, it's not an issue to me, I have enough RAM.

I've jet to find something replacement that either has all the features of tabby (including support for connecting to serial ports) I would be happy to switch.
by goalieca | 2025-09-17 11:14:13+00:00
I don’t think it’s an economic problem. Some rich countries have done great to subsidize childcare and all that. Poor countries and poorer people within rich countries are having more kids.

I think it is a cultural issue and maybe even a health issue due to rising obesity. Some people delay “starting their lives” until nearly 40 at which point it becomes hard and even risky to have a kid. As noted, so many people are single as well. Why is that?
by p_l | 2025-09-17 11:14:20+00:00
The firmware is amalgamated from a bunch of vendors with core solution coming from few common ones.

Sometimes you get hilarious errors, like Intel not having any way to verify if their driver is actually loading a dumped memory image (intel rapid start), so if you forgot to disable Rapid Start and installed anything on a drive in the bay that was specified for rapid start, on boot the intel driver would just... blit it into RAM and be happy dumb
by mrgriscom | 2025-09-17 11:15:26+00:00
A photodiode (BPV23NF iirc) connected straight to the dongle's SMA connector. Yes, I believe it would be operating in photovoltaic mode, where the incident IR light from the remote control will induce a small voltage. Yes, I had direct sampling mode turned on (but the rtl-sdr.com V3 can do this through the normal antenna port). I pointed the remote at the sensor (admittedly quite close) and saw a signal centered on 38 kHz in the waterfall, and was able to export the binary pulses.
by Akronymus | 2025-09-17 11:15:51+00:00
> I found not only incorrect 'reasoning' but also even after being explicit about why a certain deduction was not correct the same incorrect deduction would then appear later, and this happened over and over.

Because its in the context window and a lot of training material refers to earlier stuff for later stuff it is trained to bring up that stuff again and again. Even if it is in the window as a negative.
by candidtim | 2025-09-17 11:15:52+00:00
Shameless plug: https://github.com/candidtim/f2-commander

I've been working on "F2 Commander" on and off for a while now. At first, I wanted a TUI to view the contents of cloud storage buckets (GCS, S3, etc.), but it quickly evolved into an orthodox file manager. The funny thing is, the first version was in Common Lisp, but then I discovered Textual and was instantly sold on it - it's really fun to work with. The app scratches my itch, and although most of the time I myself prefer just using the regular command line, I open it up when I need to quickly navigate or move some files in a complex directory tree.

[1] https://textual.textualize.io/
by ACCount37 | 2025-09-17 11:16:04+00:00
Romanticization of tuberculosis is certainly a fun little historical artifact. When there was no treatment or cure, it was almost elevated - like a proxy for the greater tragedy of human condition.

But once we figured tuberculosis out - figured out the cause, found the treatment, made a vaccine to prevent it? It became yet another disease. The romantic veer was shattered - if you had tuberculosis, it wasn't some great tragedy. It was now a sign that you were a lowlife who couldn't maintain good hygiene or access quality medicine.

Gives me hope that the current romanticization of mental illness or aging will, too, fade - once those diseases are well understood and can be cured reliably.
by matheusmoreira | 2025-09-17 11:16:11+00:00
As a user and programmer, I can only dream of being this knowledgeable about things. There's a ton of domain knowledge embedded in the article, it's pretty amazing.

I managed to reverse engineer a lot of my laptop's features but hit a wall when it came to this ACPI stuff. I dumped the tables and decompiled the code but all I got was stub code. I wanted to be the guy who wrote the Linux drivers for his own laptop but I just didn't manage it. Massive respect for anyone who can do this.
by dsign | 2025-09-17 11:16:22+00:00
I think the surveillance state is gonna stay; we have been slipping into it just so and every electronic system out there wants to spy on us, beginning with our Windows and Mac computers and even the Sonos speaker. Small mystery that police forces want their slice of pie so badly.

Freedom of expression has been of a limited nature already for some years (just cast Israel in a bad light in USA and see what happens). With the coming wave of AI-powered surveillance, which may be even powerful enough to read your sexual orientation from examining direction and duration of glances in survtech feeds, we just need a small misstep (say, another twin towers-type catastrophe) for even freedom of thought to become a privilege to be had in isolated and protected places.

Source: I write dystopias on the subject. https://w.ouzu.im
by zeuch | 2025-09-17 11:16:33+00:00
Reading through this thread, it feels like there are two main camps:

1. Those who see this as mostly macroeconomics + hype (high interest rates, weak economy, AI as a convenient excuse).

2. Those who believe AI is genuinely reshaping the work structure (seniors + AI can cover more ground, making juniors less necessary).

Maybe it’s both. The economy explains why companies are cautious now, but AI explains where they are cutting first — the “bottom rungs.”

The bigger question, then, is: even if AI isn’t the sole cause, what happens when a whole generation of juniors doesn’t get trained? That’s not just a company-level problem, it’s an industry-wide pipeline issue.

How do we avoid a tragedy of the commons here — where everyone optimizes short-term and we end up with fewer capable seniors in 10 years?
by homebrewer | 2025-09-17 11:16:47+00:00
Here's a short recap of what you can do right now, because changing the ecosystem will take years, even if "we" bother to try doing it.

1. Switch to pnpm, it's not only faster and more space efficient, but also disables post-install scripts by default. Very few packages actually need those to function, most use it for spam and analytics. When you install packages into the project for the first time, it tells you what post-install scripts were skipped, and tells you how to whitelist only those you need. In most projects I don't enable any, and everything works fine. The "worst" projects required allowing two scripts, out of a couple dozen or so.

They also added this recently, which lets you introduce delays for new versions when updating packages. Combined with `pnpm audit`, I think it can replace the last suggestion of setting up a helper dependency bot with zero reliance on additional services, commercial or not:

https://pnpm.io/settings#minimumreleaseage

2. If you're on Linux, wrap your package managers into bubblewrap, which is a lightweight sandbox that will block access to almost all of your system, including sensitive files like ~/.ssh, and prevent anything running under it from escalating privileges. It's used by flatpak and Steam. A fully working & slightly improved version was posted here:

https://news.ycombinator.com/item?id=45271988

I posted the original here, but it was somewhat broken because some flags were sorted incorrectly (mea culpa). I still prefer using a separate cache directory instead of sharing the "global" ~/.cache because sensitive information might also end up there.

https://news.ycombinator.com/item?id=45041798

3. Setup renovate or any similar bot to introduce artificial delays into your supply chain, but also to fast-track fixes for publicly known vulnerabilities. This suggestion caused some unhappiness in the previous discussion for some reason — I really don't care which service you're using, this is not an ad, just setup something to track your dependencies because you will forget it. You can fully self-host it, I don't use their commercial offering — never has, don't plan to.

https://docs.renovatebot.com/configuration-options/#minimumr...

https://docs.renovatebot.com/presets-default/#enablevulnerab...

4. For those truly paranoid or working on very juicy targets, you can always stick your work into a virtual machine, keeping secrets out of there, maybe with one virtual machine per project.
by sylens | 2025-09-17 11:17:07+00:00
It's an interesting proposal because they correctly call out that segmenting state files by workspace/environment in a very judicious way causes its own issues as you approach scale or have to work across environments. There is an entire industry of tools and services that help to streamline this process for you, but it still feels very hacky.

I'm curious if this will be compatible with tools like Spacelift or Env Zero, or if they are going to build their own runner/agent to compete in that space.
by brookst | 2025-09-17 11:17:34+00:00
Phone makers (and even their supply chain partners) operate their own in-building cell networks with carrier-type hardware, and extensive debugging and observability, including simulation of multiple towers and location.

It wouldn’t get you 100% E2{ for 911 testing, but it does let you develop and test the stack extensively before taking it to the real world and scheduled testing coordinated with 911 call centers.
by andrewl-hn | 2025-09-17 11:17:43+00:00
TBF it does happen to other package managers, too. There were similar attacks on PyPI and Rubygems (and maybe others). However, since npm is the largest one and has the most packages released, updated, and downloaded, it became the primary target. Similar to how computer viruses used to target Windows first and foremost due to its popularity.

Also, smaller package managers tend to learn from these attacks on npm, and by the time the malware authors try to use similar types of attacks on them the registries already have mitigations in place.
by pcrh | 2025-09-17 11:17:49+00:00
Agreed.

Targeted surveillance of individuals under suspicion can be legitimate, however it surprises me that such mass surveillance continues to be promoted again and again, despite it being demonstrably harmful. Along with breaking encryption, which would introduce risks of large financial and commercial harm.

I often wonder what arguments are actually deployed behind closed doors in favor of mass surveillance, apart from the ever-present "think of the children" argument. It can't be the case that the downsides of such surveillance are unknown to those supporting it (or maybe it can?).
by patates | 2025-09-17 11:17:53+00:00
I didn't think this was even possible. Can EU laws actually override the constitutional rights of member states? I was under the impression that the principle of supremacy isn't absolute and doesn't extend to overriding a country's fundamental constitutional rights. If that's not the case, the danger isn't limited to just Germany. With authoritarian regimes gaining power everywhere, it would only take a few of them working together to pass an EU law that makes everything fair game.
by kalberg6429 | 2025-09-17 11:18:53+00:00
>The terrorist attack of 2023 had such magnitude that Israel was allowed to do 50 times worse with no immediate punishment, but this pretence is getting old and they're in too deep

Huh? Israel is literally founded upon "Jewish-Zionist Terrorism" as in "Jewish-Zionist Terrorism And The Establishment Of Israel" - https://web.archive.org/web/20231029055310/ojp.gov/ncjrs/vir...

Israel has always been allowed to commit any crime it wants "with no immediate punishment", no sanctions, but maybe a few mean words. Sometimes certain governments would impose a symbolic sanctions on specific individual lunatic settlers as a form of "see we did some thing", but otherwise Israel's history is the history of impunity.
by sarchertech | 2025-09-17 11:20:20+00:00
Just because you can do something doesn’t mean you should.

There’s also lot of pressure for devs not to use licenses that restrict use by large companies. Try adding something to your license that says companies making over $10 million per year in revenue have to pay, and half of the comments on show HN will be open source warriors either asking why you didn’t use a standard license or telling you that this isn’t open source and you have brought dishonor to your family.
by xyzelement | 2025-09-17 11:20:28+00:00
I think there's something to the IQ comment I made earlier. If adversary A claims the adversary B is doing a terrible thing, that thing doesn't materialize, the smart money isn't to be like "oh well B is only not doing it because they are sinister."

Or say another way - if "they are evil" whether they do X or opposite of X, whoever is setting up that story for you is full of shit.
by Hikikomori | 2025-09-17 11:20:49+00:00
They shot a building with a tank where Hamas was holding hostages, maybe there wasn't a good solution but blowing up their own citizens without trying is pretty bad. And we don't really know the extent of what happened that day as no independent people were allowed and Zaka cleaned it up quickly. Zaka is an ultra orthodox right wing volunteer organisation and its probably who started the false burned babies story. And then we have the Hannibal directive so its not like Israel is not accustomed to killing their own.
by Quarrel | 2025-09-17 11:21:05+00:00
I'm not a fan, but in what was is this, or any other topic, undemocratic to have debates and votes on?

The sanctions politicians should face for bringing up unpopular topics should be that they don't get voted for.

> These EU politicians endangering freedom, justice and democracy must be held accountable, with the most powerful punishments available.

Yes. Vote them out. Keep raising it.