MurphyA/hacker-news huggingface dataset:
by lisbbb | 2025-09-17 02:06:13+00:00
I disagree. That has not been my experience whatsoever. Every company I helped, and it's been dozens, had struggles moving to a new versions of the JVM. Every single time there were major issues that required a lot of re-work and re-testing. I bailed around Java 17 or 18, but it didn't matter because NOBODY I was working with was actually even using that version! On one particularly bad project in 2022, a client had a security imperative to update the JVM from 1.5 on a major internal system and my role was to determine efficacy. I quickly found out that several key libraries had ceased support long ago around Java 1.7 and there was no path forward for those. They were simply deprecated products. My team tried getting the source code and re-compiling those 3rd party jars, with the idea of taking ownership of that code, but it was spiraling in terms of scope. They would not listen to me that even getting them to 1.7 was going to be problematic. Worse, some drive-by manager would not believe my appraisal and brought another guy to prove me wrong. It turned into this big pissing contest, which I resented. The other resource wasn't anywhere near as experienced as me, just kind of arrogant and overly confident. I decided to fire that client, which sucked because they were the tippy top of the Fortune 10. Last I heard, they had not made any progress with that upgrade and were still using it on 1.5.
by tbyehl | 2025-09-17 02:07:51+00:00
> Maybe drain it, replace it with different animals that are friendly, and then refill it. I’m only sort of joking.

It's not a zoo. Jungle Island might be more your speed. Staff have chastised me for rubbing the kangaroos' bellies, saying they really don't like that, but in my defense he rolled over for me to do it. YMMV.

What lead me to appreciating the Everglades was randomly deciding to go to Shark Valley / Bobcat Boardwalk Trail on some cold day in February. The annoying bugs were mostly gone to wherever they go when it's cold, the 'gators were lounging around trying to catch some warmth, and the anhingas and other water birds were quite active. I caught a guided walking tour somewhere and what really stuck with me was how every tiny rise in elevation up to a few feet completely changes the ecosystem. I'd lived in Florida practically my whole life until then and never really "seen" that but from then on I could never not see it. I left 15 years ago and whenever I drive home for a visit, crossing that threshold into southern Florida where I start seeing it again brings me comfort.

https://en.wikipedia.org/wiki/Everglades#Ecosystems
by sterlind | 2025-09-17 02:08:26+00:00
> People here seem to think this is some sort of Orwellian attempt to control them, but the reasons are more mundane and technical - many of them (mine included, from two countries) use security facilities on the phone to secure your accounts.

My GrapheneOS phone fully supports such facilities. I trust your app works on it?

here's all you need to do, if not: https://grapheneos.org/articles/attestation-compatibility-gu...
by pabs3 | 2025-09-17 02:09:36+00:00
To be clear, Debian does not audit code like you might be suggesting they do. There are checks for licensing, source code being missing, build reproducibility, tests and other things. There is some static analysis with lintian, but not systematically at the source code level with tools like cppcheck or rust-analyzer or similar. Auditing the entirety of the code for security issues just isn't feasible for package maintainers. Malware might be noticed while looking for other issues, that isn't guaranteed though, the XZ backdoor wasn't picked up by Debian.

https://lintian.debian.org/
by hedora | 2025-09-17 02:09:43+00:00
This line of reasoning helped get Trump in.

It’s hard to say what Harris would have done, but it’s unlikely she would have greenlit the complete demolition of Gaza so she could build a resort.

Similarly, I doubt she would have forced places like UC Berkeley to send her lists of people critical of Israel (like you), then opened critical investigations against them.

Refusing to vote is the best way to ensure policies you object to the most are expanded.
by pyuser583 | 2025-09-17 02:09:53+00:00
Multiple times. I’ve specifically asked about this vaccine again and again.

I’ve had a few GPs in the past 20 years. They’re consistent.

I admit it’s weird. And ideologically I feel like a bit of a laggard.

But I’ve had both the conversation with my doctor, and the conversation with online “smart people who know better than my doctor” many times.
by cyrnel | 2025-09-17 02:10:09+00:00
Code signing, 2FA, and reducing dependencies are all incomplete solutions. What we need is fine-grained sandboxing, down to the function and type level. You will always be vulnerable as long as you're relying on fallible humans (even yourself) to catch or prevent vulnerabilities.

Apparently they've tried to implement this in JavaScript but the language is generally too flexible to resist a malicious package running in the same process.

We need to be using different languages with runtimes that don't allow privileged operations by default.
by II2II | 2025-09-17 02:11:34+00:00
> Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number.

Not to justify their behaviour, but: most businesses are not set up to allow for callbacks or they're set up to actively discourage them. For example: they may be contracting out to call centers or employee performance may depend upon making a sale. My situation is unique since all calls our handled internally and my performance is not based upon making a sale.

That's said, the current situation pretty much dictates that a secure option should be offered to clients.
by bri3d | 2025-09-17 02:11:46+00:00
And since nobody got to it in the other thread, https://www.whatsapp.com/security/advisories/2025/ .

It seems to me that this exploit was used in a chain with a WhatsApp issue that would trigger the malicious DNG data to be loaded as a zero click, presumably just into WhatsApp. It’s unclear to me if there was a sandbox escape or kernel vulnerability used along with this; it might have been used to exfiltrate WhatsApp messages only.

This would explain why there’s only a single patch for a simple memory corruption issue; usually an attacker would need a lot of chained vulnerabilities to bypass mitigations on iOS, but if the vulnerability is in the exact target application to begin with, it sure does make things easier.
by smaudet | 2025-09-17 02:14:05+00:00
I found it funny back when people were abandoning Java for JavaScript thinking that was better somehow...(especially in terms of security)

NPM is good for building your own stack but it's a bad idea (usually) to download the Internet. No dep system is 100% safe (including AI, generating new security vulns yay).

I'd like to think that we'll all stop grabbing code we don't understand and thrusting it into places we don't belong, or at least, do it more slowly, however, I also don't have much faith in the average (especially frontend web) dev. They are often the same idiots doing XYZ in the street.

I predict more hilarious (scary even) kerfuffles, probably even major militaries losing control of things ala Terminator style.
by lisbbb | 2025-09-17 02:14:48+00:00
You haven't done it, then. Just the re-testing of everything in these large companies is terrifying and complex. Particularly the real-time stuff like Kafka. Most companies refuse to update unless absolutely necessary as they see the solution as an investment that has to produce. Security concerns have changed that attitude somewhat, but you would be surprised how much re-work is often necessary. The frustration of sorting it all out is not worth the money, imho--I'd rather just do something else, so I am.
by boxerab | 2025-09-17 02:15:20+00:00
I think you missed the point. Granted the disease is dangerous, but what if the cure is worse ? If we don't know this is true, we ought to assume the risk outweighs the benefits until PROVEN otherwise- that is the precautionary principle. As an analogy take Vioxx, a headache remedy that caused thousands of heart attacks. Merck the manufacturer started an advertising campaign for the drug AFTER the learned it was killing people - they were ultimately fined 4.5 billion.

https://www.nejm.org/doi/full/10.1056/NEJMp048286

The docket shows us that pharmaceutical companies are serial felons who have paid some of the largest fines in history for lying about their products. It is prudent to be skeptical until proven otherwise.
by firefax | 2025-09-17 02:15:49+00:00
Reminds me of the "But I Don't Want To Cure Cancer. I Want To Turn People Into Dinosaurs" meme[1]

They don't want to apt install, they want to use docker :-)

[1] https://knowyourmeme.com/memes/but-i-dont-want-to-cure-cance...
by Cyph0n | 2025-09-17 02:16:38+00:00
This is what people don’t understand, because it isn’t their single issue.

If I beg you to reconsider on a very serious issue that is in your power to change stance on, and you not only ignore me but laugh in my face, then why exactly do you still get my vote? Why exactly should I reward you for completely ignoring my protests?

Make sure to swap Gaza for your single issue - maybe LGBT rights, or abortion, or gun rights - and then seriously think about how you would deal with it.

The Democratic party has basically decided to lean on “but they’re worse” as a political platform while backsliding on multiple issues. They do this because Democrat voters lap that shit up, chant “vote blue no matter who” like members of a cult, and then cry out in astonishment when the Democrats in Congress and in the gov keep sliding towards the right.

Also, an addendum: before blaming abstainers and third-party voters, it might be good to ponder on why Democrats preferred risking losing the presidency over making any concessions whatsoever on Palestine. At best, it was a grave miscalculation borne out of hubris. At worst, it was an act of self-sabotage to ensure unconditional support for Israel. Pick your poison :)
by fakedang | 2025-09-17 02:17:09+00:00
Tbf, that's Athenian democracy at work - politicians would promise the most audacious things just to get elected. One could argue that's even how democracy started in the first place - just so that one guy could rule Athens independently and not as a Spartan puppet.

Of course, we haven't adopted the other facet of Athenian democracy which is ostracization by voting.
by crossroadsguy | 2025-09-17 02:18:06+00:00
Thank you. I will try it.

Just one more question: is my mac hardware (and encrypted data) still protected the way it is protected before installing Asahi on it? Like device/theft protection etc.

My limited exploration/search on this topic kinda says in some way Asahi Linux lives inside the bounds of macOS (even all the data is available/readable in macOS which is fine by me). Is that so?
by SilverElfin | 2025-09-17 02:19:13+00:00
Well the real solution is to have a single state and assimilation of some kind, so that people can coexist. It’s possible. Israel itself demonstrates this since nearly 30% of the population isn’t Jewish. But I think a peaceful two state coexistence is unlikely with people who chant “from the River to sea”, which implies the complete erasure of the state of Israel.
Show HN: I built a tool to translate Chinese, Japanese, & Korean Novels
by yamii | 2025-09-17 02:19:13+00:00
Hi HN!! I'm a Chinese Translator, also a developer and I made this to solve my own problems. I got tired of waiting for official translations, so I built a tool that lets you read the original text and get a clean, consistent translation on the fly.

I am not a translator by trade and that's probably why I have a different opinion than most translators for using clankers to translate, I have always felt that we should not be limited by language when it comes to wanting to read, this tool is mostly for people who do not want to wait for official translations and have a copy/purchase of the ebook in its original language.

How it works

1) Upload your own EPUB/TXT you have access to

2) Batch translate chapters with glossary support so names/terms stay consistent

3) Wait for the completion email and then download the completed translation for your personal use.

Works well for fiction, but also handles non-fiction books, I am working with a team and other translators to constantly improve the output.
by winkelmann | 2025-09-17 02:19:23+00:00
Warning: My German legalese isn't very good and this is not legal advice. I unfortunately know very little about how the German court system works and where to look up stuff.

The law[1] is worded like this:

> (1) Mit einer Funkanlage (§ 3 Absatz 1 Nummer 1 des Funkanlagengesetzes) dürfen nur solche Nachrichten abgehört oder in vergleichbarer Weise zur Kenntnis genommen werden, die für den Betreiber der Funkanlage, für Funkamateure im Sinne des § 2 Nummer 1 des Amateurfunkgesetzes, für die Allgemeinheit oder für einen unbestimmten Personenkreis bestimmt sind.

The law basically says that you may only listen to (or take note of in comparable way[2]) messages that are:

1. For you, the operator

2. For amateur radio operators according to the Amateurfunkgesetz

3. For the general public

4. For an indeterminate group of persons (I think that's an accurate translation?)

For me, a big question regarding aviation and marine traffic monitoring is what "unbestimmten Personenkreis"/"indeterminate group of persons" actually means. Since "die Allgemeinheit"/"the general public" is listed separately, I'd assume it's a distinct group from that, and to me the previous commenter's "meant for any member of the public who happens to be flying a plane nearby" sounds like it could fit that description. I'd argue, for example, that police radio is for a "determinate" group of persons, police officers and dispatchers working for the government, whereas aviation and maritime traffic is an "indeterminate" group of people, people working for all sorts of airlines, shipping companies, recreational pilots/boaters, who happen to be around the same area.

If anyone has any links to cases where this law was tried in relation to aviation or maritime communications, please share them, I have been struggling to figure out where to look for this stuff, on top of that, the law was also renamed or moved around, which makes it extra confusing.

[1] https://dejure.org/gesetze/TDDDG/5.html

[2] Might be related to this weird ruling, where a judge in a case about some ADS-B receiver decided that it was ok because rendering the position of aircraft wasn't "listening to" (as in, literally hearing) the traffic: https://openjur.de/u/130555.html - This decision is probably moot now, due the addition of "take note of in comparable way". The judge briefly mentions that actually listening to the traffic could be violating the law, but I am not sure if this point was ever properly litigated.
by znort_ | 2025-09-17 02:20:49+00:00
there are indeed monster packages but you should ask yourself if you need them at all, because if you really do there is no way around performing nr1. you get the code, you own it. you propagate malware by negligence, you're finished as a sw engineer. simple as that.

personally i keep dependencies at a minimum and are very picky with them, partly because of nr1, but as a general principle. of course if people happily suck in entire trees without supervision just to print ansi colors on the terminal or, as in this case, use fancy aliases for colors then bad things are bound to happen. (tbf tinycolor has one single devDependency, shim-deno-test, which only requires typescript. that should be manageable)

i'll grant you that the js ecosystem is special, partly because the business has traditionally reinforced the notion of it being accessory, superficial and not "serious" development. well, that's just naivety, it is as critical a component as any other. ideally you should even have a security department vetting the dependencies for you.
by LegionMammal978 | 2025-09-17 02:21:06+00:00
Of course you'd have to use arbitrary-precision arithmetic, that's the easy part. The hard part is knowing what to do with it, if you're someone like me who isn't an expert in ODEs. Do you know of any accessible resources on spectral methods?

(Of course arbitrary precision is far, far worse than double precision in terms of performance, which is why so much work goes into techniques that avoid increasing precision. But sometimes you have few enough instances to solve that you can simply eat the cost.)
by Cyph0n | 2025-09-17 02:21:36+00:00
Yes, we did know Trump is a disaster. Perhaps Democrats should have met their voterbase somewhere in the middle to reduce the risk of losing to Trump? Of course, they didn’t, so to me the Harris campaign is to blame more than the third-party voters.

Frankly, my reading was that Democrats preferred risking losing the presidency to making any concessions whatsoever on the Palestine issue.
by ffsm8 | 2025-09-17 02:21:36+00:00
So the elevator pitch for this is "if wait-for [1] isn't sufficient and you want a go lang binary to evaluate the behavior or response of the request"?

https://github.com/vishnubob/wait-for-it

I however suspect that I wouldn't use it, if I was still working in devops. The niche where a simple wait for the port is insufficient is _extremely_ rare in practice... Because almost everything that needs such either already has the concept of a readiness check to make it available (k8s, LBs, etc) or will retry automatically given the port being open (DB connections etc)
by zzo38computer | 2025-09-17 02:22:01+00:00
In my experience, most sandboxing systems seem to be deficient in many ways. (It would be possible to improve it (I don't know what changes might be required in the kernel, although some things might be possible with ptrace, it would make it difficult and possibly inefficient and/or unportable), although making an entirely new computer design would improve the security more than that.)
by AdieuToLogic | 2025-09-17 02:22:43+00:00
Saltwater crocs do exist in southern Florida, no doubt. And there's some chance a gator could swim from one island to another (or the mainland).

The easiest way to discern each is based on their snout. If the reptile you saw has a blunt nose about the same width as its jaw, then it's a gator. If, instead, the jaw looked more like a trapezoid, then it's a croc.

Both are opportunistic hunters capable of taking down mammals up to adult bovines or horses. The latter two examples are rare as the size of the croc/gator has to be rather large.
by FireBeyond | 2025-09-17 02:24:03+00:00
I wonder if that had anything at all to do with the Israeli right backing Hamas at the time, because they were being shamed internationally (haha) by the previously militant PLA/PLO being more and more willing to negotiate.

Netanyahu and his ilk didn't like the awkward questions of why the terrorists were negotiating but they weren't. So they started propping up Hamas.

> And when given the right to vote, they placed Hamas into power and began an Iran backed rocket crusade against Israel.

"They" started firing rockets, or Hamas? Hamas who is 30,000 of Gaza's 2.5M? Just when was that last election, again?
by braincat31415 | 2025-09-17 02:24:04+00:00
The article you are referencing is based on CDC data which is not matched by a more complete data maintained by UKHSA. I think Norman Fenton commented on that at some point. I'd be careful when taking its conclusions at a face value. I actually went through that paper and looked at the UKHSA data back in 2023. And the government was spreading a lot of BS, too. I'll let the "CDC can do no wrong" crowd pile up.
by Dylan16807 | 2025-09-17 02:24:15+00:00
Pixels 8 and later get 7 years. Not as good as Apple but reasonable.

Pixels 6-7 got 5 years. I'd say that's on the low end of okay.

For "lol" you have to go back to 2021 or earlier. Or look at some of Motorola's offerings.
by worik | 2025-09-17 02:24:36+00:00
> How can we promise to "do better" when shit like "no author or distributor accepts responsibility to anyone

One way or another that will end.

Free Software will have the same responsibilities. If you write software, negligently, and it causes damage, you will be liable

I should not be able to make a Crypto wallet that is easy to hack and distribute it without consequence

This will be a very good thing

We know how to make secure 4eliable software (some of us) but nobody will pay for it
by jonquest | 2025-09-17 02:24:54+00:00
The massive amount of transitive dependencies is exactly the problem with regard to auditing them. There are successful businesses built solely around auditing project dependencies and alerting teams of security issues, and they make money at all because of the labor required to maintain this machine.

It’s not even a judgement call at this point. It’s more aligned with buckling your seatbelt, pointing your car off the road, closing your eyes, flooring it and hoping for a happy ending.
by sp0rk | 2025-09-17 02:25:03+00:00
> A lot of the news gives the impression that your world is over when 14th hits, not recognising that historically legacy software and hardware is a thing.

There was a lot of buzz in the cybersecurity world near Window XP's EOL about attackers potentially holding on to exploits until after support ended, so as to avoid having them patched. Sure enough, CVE-2014-1776 was found being actively exploited two weeks after support officially ended.

Using a closed source operating system after it will no longer receive security patches is just plain dangerous. I don't really think people should be advocating for it at all outside of the purposes of historical preservation.
by MBCook | 2025-09-17 02:25:15+00:00
> Just using Rust will not magically make your application safe; it will just make it a lot harder to have memory leaks or safety issues.

Even if we take this claim at face value, isn’t that great?

Memory safety is a HUGE source of bugs and security issues. So the author is hand-waving away a really really good reason to use Rust (or other memory safe by default language).

Overall I agree this seems a lot like “I like C++and I’m good at it so it’s fine” with justifications created from there.
by nikitaga | 2025-09-17 02:25:42+00:00
> Comparing React to Web components is comparing apples to oranges.

I mean, yes, but you're the one making this comparison, saying that WCs lack reactivity etc.

Web Components are an extension of the DOM – a low level browser API. They are similarly low level. That's expected. I don't need or expect them to be something more.

I am happy that I can use any reactivity system I want to implement a Web Component. That's a feature, not a bug. Having implemented a reactivity system myself, I know that there isn't a perfect one, the design is full of tradeoffs, and I'd rather not have a blessed implementation in the browser, because it will inevitably turn out to be flawed, yet we won't be able to retire it because "we can't break the web". A blessed implementation like that would benefit from network effects just like React does, and would have all the same problems as React, plus the inability to rapidly innovate due to the browser's unique backwards compatibility concerns. I'd rather ship an extra 3KB and avoid all those problems.
by rkagerer | 2025-09-17 02:28:26+00:00
even today local search is hopelessly broken

I use FileLocator Pro on Windows, and a fairly organized hierarchical structure for all my files (that lives outside of the My Documents crap).

It doesn't need indexing - it makes use of very performant MFT querying to speed things up (and can of course search contents as well). Not quite instant unfortunately, but on modern hardware it's not too bad. I tried Everything and other index-based technologies but was never quite satisfied. I do really miss LookOut for email, that's one of the best search experiences I ever knew.