MurphyA/hacker-news huggingface dataset:
by 33a | 2025-09-09 00:04:13+00:00
When we find malware on any registry (npm, rubygems, pypi or otherwise), we immediately report it to the upstream registry and try to get it taken down. This helps reduce the blast radius from incidents like this and mitigates the damage done to the entire ecosystem.

You can call it ambulance chasing, but I think this is a good thing for the whole software ecosystem if people aren't accidentally bundling cryptostealers in their web apps.

And regarding not copying massive trees of untrusted dependencies: I am actually all for this! It's better to have fewer dependencies, but this is also not how software works today. Given the imperfect world we have, I think it's better to at least try to do something to detect and block malware than just complain about npm.
by AnthonyMouse | 2025-09-09 00:05:41+00:00
> By prioritizing efficiency, Apple also prioritizes integration. The PC ecosystem prefers less integration (separate RAM, GPU, OS, etc) even at the cost of efficiency.

People always say this but "integration" has almost nothing to do with it.

How do you lower the power consumption of your wireless radio? You have a network stack that queues non-latency sensitive transmissions to minimize radio wake-ups. But that's true for radios in general, not something that requires integration with any particular wireless chip.

How do you lower the power consumption of your CPU? Remediate poorly written code that unnecessarily keeps the CPU in a high power state. Again not something that depends on a specific CPU.

How much power is saved by soldering the memory or CPU instead of using a socket? A negligible amount if any; the socket itself has no significant power draw.

What Apple does well isn't integration, it's choosing (or designing) components that are each independently power efficient, so that then the entire device is. Which you can perfectly well do in a market of fungible components simply by choosing the ones with high efficiency.

In fact, a major problem in the Android and PC laptop market is that the devices are insufficiently fungible. You find a laptop you like where all the components are efficient except that it uses an Intel processor instead of the more efficient ones from AMD, but those components are all soldered to a system board that only takes Intel processors. Another model has the AMD APU but the OEM there chose poorly for the screen.

It's a mess not because the integration is poor but because the integration exists instead of allowing you to easily swap out the part you don't like for a better one.
by gerdesj | 2025-09-09 00:05:42+00:00
"He also claimed the company failed to remedy the hacking and takeover of more than 100,000 accounts each day, ignoring his pleas and proposed fixes and choosing instead to prioritize user growth."

There is no oversight of these monstrosities of any sort. I doubt anyone would have issues with the thesis that Meta would implement anything that might curb their user numbers unless it was mandated.

Why would they? They are beholden to their shareholders first. If it isn't illegal then it isn't illegal, immoral perhaps but that is not illegal, unless it is illegal.

My learned friends are going to have to really get their bowling arms warmed up for this sort of skit. For starters, you need a victim ... err complainant.
by FridayoLeary | 2025-09-09 00:06:47+00:00
----------------------------------------------------------------

Dear battery technology claimant, Thank you for your submission of proposed new revolutionary battery technology.

Your new technology claims to be superior to existing lithium-ion technology is is just around the corner from taking over the world. Unfortunately your technology will likely fail, because:

[ ] it is impractical to manufacture at scale.

[ ] it will be too expensive for users.

[ ] it suffers from too few recharge cycles.

[ ] it is incapable of delivering current at sufficient levels.

[ ] it lacks thermal stability at low or high temperatures.

[ ] it lacks the energy density to make it sufficiently portable.

[ ] it has too short of a lifetime.

[ ] its charge rate is too slow.

[ ] its materials are too toxic.

[ ] it is too likely to catch fire or explode.

[ ] it is too minimal of a step forward for anybody to care.

[ ] this was already done 20 years ago and didn't work then.

[ ] by this time it ships li-ion advances will match it.

[ ] your claims are lies.

----------------------------------------------------------------
by briansun | 2025-09-09 00:07:15+00:00
Thanks — I agree with your three big pain points: quality vs hosted SOTA, token speed, and economics/utilization.

Have you run into cases where on‑device still makes sense?

1. Data that is contractually/regulatorily prohibited from being sent to any third‑party processor (no exceptions).

2. Very large datasets where throughput can be low (overnights acceptable) but the cost is high for cloud models.

3. Inputs behind a password-wall that hosted assistants/chatgpt/claude can’t reach and can't do agentic things with them.
by danans | 2025-09-09 00:07:19+00:00
> Has the United States ever had an effective tariff policy though? All I’ve ever seen is a lengthy history of bumbling fuckups that make things worse for the consumer for no benefit.

The primary point of narrowly applied tariffs coupled with industrial policy is to help critical domestic industries become domestically and internationally competitive, not to to immediately reduce consumer costs.

An example of this is the Biden Administration's 100% tariff on Chinese EVS, coupled with the industrial policy that was part of the inflation reduction act.

The goal of that tariff and the IRA was to prevent domestic auto manufacturers from being pushed to bankruptcy by the clearly superior and more cost-effective EVs from China, while making the necessary investments in domestic supply chains and manufacturing efficiency to allow domestic industry to catch up to China.

With the new administration, the EV tariffs have stayed in place, but more have been levied against the supply chains for all cars, not just EVs, and the domestic investments have stopped, all but guaranteeing higher prices and lower quality for US consumers for all cars (ICE and EV), while also all but guaranteeing and uncompetitive US auto industry globally.

Thanks to this, the world is going to be buying BYDs, not Chevys.
by goosejuice | 2025-09-09 00:07:52+00:00
It's perfectly fine for most MVPs to go into production. Most SaaS software is solved. Prototypes are outsourcing the hard parts around security. The hard part is making a sale and finding the right fit. Spending 4x the cost on a product that never makes a sale is bad economics. This app isn't remotely harmful, so do you care to make an argument for why it shouldn't exist?

Should decision makers be more informed? Yes, of course, but that's not an argument for gatekeeping. We shouldn't be gatekeeping software or the web. Not through licensure or some arbitrary meaning of "effort". That will do nothing but stifle job growth and I'd very much like to keep developers employed.
Ask HN: Where can I learn about T-Splines?
by dschroer | 2025-09-09 00:08:41+00:00
I have been doing work in the 3D cad space. Primarily using existing kernels but now that the patent for T-Splines is expired I figured I would give it a go to implement.

There is lots of information about BSplines and NURBS and I have implemented them. However T-Splines seems rather illusive, especially given their hype in other posts.

Does anyone have any good resources or references for figuring out how to actually implement them? I'm looking for things like lectures, reference implementations or other sources that make the concept clear.
by RyanOD | 2025-09-09 00:08:50+00:00
I would absolutely LOVE to see those design docs.

I've been playing Zork, Planetfall, Deadline, etc off and on since I was in elementary school. The only Infocom game I've ever successfully solved is Enchanter. My favorite games by far!

These issues of The New Zork Times are fun...

https://infodoc.plover.net/nzt/NZT4.1.pdf

https://infodoc.plover.net/nzt/NZT4.2.pdf

https://infodoc.plover.net/nzt/NZT4.3.pdf

Edit: Added links to NZT
by jltsiren | 2025-09-09 00:10:04+00:00
"In the exact same subfield" is the key point. The academia is small. If a topic has enough direct monetary value to justify substantial spending in it, the industry will usually do better work. Academic research works better in topics that don't have such monetary value, at least not yet.

The academia lacks consistency, but I wouldn't characterize it as toxic. Many individual labs and departments are toxic, but the academia as a whole isn't. The same freedom that lets individual PIs pursue their own directions in their own ways also lets many of them create toxic work environments. But curtailing the toxicity is difficult without sacrificing the freedom the academia depends on.
by netsharc | 2025-09-09 00:10:10+00:00
I have an old launcher, and even an old version of it. Version 2 was great, version 3 came with small cosmetic changes I didn't like, plus fucking ads. So I restored v2 from backups and stopped allowing auto-updates, to stay on v2.

One day the makers disappeared from the Play Store, voila, no more auto-enshittification, I win!
by mmargenot | 2025-09-09 00:10:57+00:00
At least within tech, there seem to have been explosive changes and development of new products. While many of these fail, things like agents and other approaches for handling foundation models are only expanding in use cases. Agents themselves are hardly a year old as part of common discourse on AI, though technologists have been building POCs for longer. I've been very impressed with the wave of tools along the lines of Claude Code and friends.

Maybe this will end up relegated to a single field, but from where I'm standing (from within ML / AI), the way in which greenfield projects develop now is fundamentally different as a result of these foundation models. Even if development on these models froze today, MLEs would still likely be prompted to start with feeding something to a LLM, just because it's lightning fast to stand up.
by soulofmischief | 2025-09-09 00:11:09+00:00
> We currently have a working prototype that, after training with user-specific example data, demonstrates over 90% accuracy on an application-specific vocabulary. The system is currently user-dependent and requires individual training. We are currently on working on iterations that would not require any personalization.

https://www.media.mit.edu/projects/alterego/frequently-asked...
by andy99 | 2025-09-09 00:11:10+00:00
Makes sense, and I know driving in france I've felt the same. I also know driving in Canada our speed limits often cater to some lowest common denominator, where anyone driving the limit is going dangerously slow (I'm thinking of certain country roads) and inevitably has a long line of angry people following them.

I've heard before about setting speed limits using percentile studies of people driving on the road, which in the absence of some specific safety concern (which then needs engineering like narrowing the road or adding turns) makes the most sense.

I also wish there was more of a culture of pulling over if you don't want to drive at the flow speed. If I want a leisurely drive and see someone rapidly coming up behind me, I'll happily pull over and let them pass. There seem to be these sociopaths or self-righteous jerks who will happily drive 5km/h under the speed limit with 20 cars behind them. This is way more dangerous than speeding and should be treated as such. If you just want to drive slowly, why would you want the stress or a bunch of angry drivers behind you.
by lovich | 2025-09-09 00:11:30+00:00
> First I saw you use "global health crisis" to describe AI psychosis which seems like something one would only conceive of out of genuine hatred of AI

I’m mildly positive on AI but fully believe that AI psychosis is a thing based on having 1 friend and 1 cousin who have gone completely insane with LLMs, to the point where 1 of them refuses to converse with anyone including in person. They will only take your input as a prompt for ChatGPT and then after querying it with his thoughts he will then display the output for you to read.

Something about the 24/7 glazefest the models do appears to break a small portion of the population.
by freetime2 | 2025-09-09 00:11:33+00:00
> I'd rather be running a Debian, with systemd, and boring regular utilities, than the bespoke environment openwrt has crafted together.

I agree. I tried running OpenWrt as a wired router on an x86 mini PC, and found that it had some really powerful features and was certainly rock solid as a router. But there were some major annoyances, too. For example, their documentation includes a script for expanding the root filesystem [1] that left my system unable to boot. And while I didn't use it long enough to make it through an upgrade, their documentation on upgrades makes the process sound very brittle (it sounded like configs for installed packages don't carry over by default) and confusing.

I thought about trying to set up an Ubuntu (or other popular distro) box as a router, which I think would be much easier to maintain over time. But my concern is that I might overlook some important config that is set by default in OpenWrt, and leave my machine vulnerable to attack. Having a web UI that I can log into and view/make config changes is also kind of nice. Are there any good out-of-the-box solutions or guides for doing this? (I know that OPNSense/PFSense are really popular among homelab users, but unfortunately the Marvell NICs in my mini PC are not supported in FreeBSD).

[1] https://openwrt.org/docs/guide-user/installation/openwrt_x86...
by sterlind | 2025-09-09 00:12:00+00:00
I'd personally like to have a FOSS, privacy-aware CSAM (or even generic gore/porn) detector I could plug into Matrix/Lemmy/Mastodon servers. something self-hostable, so I could run those services without worrying about pedos and trolls ruining my platform.

I'm not sure if something like it exists. I'm not sure if it could exist. PhotoDNA (the old CSAM detector) ended up being somewhat reversible, so that you could actually turn signatures back into obscene material. because of this, the signature databases were shared under strict NDA, only to large players.

probably the most realistic solution is a generic porn classifier convnet. if it blocks adult porn, it should block CSAM too (hopefully?)

they are not reliant on image hashes, and reversibility concerns apply less because the dataset used to train it was presumably legal (if distasteful.)
by dabockster | 2025-09-09 00:14:06+00:00
Here's something I generated in my coding AI for Powershell:

`Get-ChildItem -Recurse | Select-String -Pattern '_0x112fa8' | ForEach-Object { $_.Line.Substring(0, [Math]::Min(80, $_.Line.Length)) }`

Breakdown of the Command:

- Get-ChildItem -Recurse: This command retrieves all files in the current directory and its subdirectories.

- Select-String -Pattern '_0x112fa8': This searches for the specified pattern in the files.

- ForEach-Object { ... }: This processes each match found.

- Substring(0, [Math]::Min(80, $_.Line.Length)): This limits the output to a maximum of 80 characters per line.

---

Hopefully this should work for Windows devs out there. If not, reply and I'll try to modify it.
by greyw | 2025-09-09 00:14:40+00:00
All my accesspoints and routers run OpenWRT. Love it.

At some point I even ported OpenWRT to my unsupported tplink device. IIRC I hacked together a devicetree and made some small modifications to the tplink loader code.

Funnily enough when I made a PR on github it was basically ignored after I implemented the feedback. I proceed to instead send the patch to the mailinglist and it was merged the same day without comment. That must be some kind of skill filter...
by rezmason | 2025-09-09 00:14:55+00:00
I'm not especially familiar with this, but I believe making the SVG element larger can increase its filter effects' resolution, and then using CSS transforms to scale the element's parent will return it to its original size, but with a higher resolution result. From there, additional changes to the filter effect (to incorporate a subtle blur for instance) may help it over the finish line.

Regardless, this is a great writeup for changes I wish to never see in ordinary UI.
by jsight | 2025-09-09 00:15:07+00:00
I understood that reference. :)

One funny thing though... the issues have had more to do with volumetric energy capacity than weight. See also tests like this: https://www.youtube.com/watch?v=UmKf8smvGsA

That's why vehicles like Semi trucks can get by with batteries that are only ~4x bigger than a Silverado EV, weigh 8.5x more, and still manage to also produce higher ranges.
by briansun | 2025-09-09 00:15:13+00:00
Thanks for the view from a very privacy‑sensitive environment — agreed that hosted SOTA still leads on broad capability.

Could you share a quick split: which tasks truly require hosted SOTA than open‑weight? I think gpt-oss is quite good for a lot of things.

SMBs can’t get enterprise contracts with OpenAI/Anthropic, so local/open‑weight may be their only viable path — or wait for a hybrid plan.
by rtpg | 2025-09-09 00:15:30+00:00
I have a hard time arguing that 2FA isn't a massive win in almost every circumstance. Having a "confirm that you have uploaded a new package" thing as the default seems good! Someone like npm mandating that a human being presses a button with a recaptcha for any package downloaded by more than X times per week just feels almost mandatory at this point.

The attacks are still possible, but they're not going to be nearly as easy here.
by latexr | 2025-09-09 00:15:55+00:00
> Chat control is going to happen sooner or later.

Even if that is true—which you don’t know, because you cannot predict the future—later is definitely better than sooner. Later is worth fighting for.

Your defeatist attitude is exactly what these bad actors want, you’re playing right into their hands. Thankfully not everyone thinks like you, or Chat Control would have passed first time and no positive change would have been enacted ever about anything.
by tharkun__ | 2025-09-09 00:16:14+00:00
Well apparently we're "big" then. About 15 years old code base. About 100 services or libraries. The service I tried to first use it on because of the "only use it on small code bases" was only about 300 files though (doesn't include tests even). But I guess Aider got overwhelmed (or rather overwhelmed the LLM with the repo map) by the entire code base's repo map (that's what it said it was updating before it proclaimed that there were too many tokens.

Monorepo.

And that was me already knowing what I wanted and just telling it to do it. I never added any files but the one service but it knows the entire repo.

Claude code on the other I tell "I need to do X thing across the code base" and it just goes and does it (sometimes badly of course) but it has no issue just "doing its agent thing" on it.

Aider wouldn't even be able to do both code and tests in one go? Like the whole idea of "only add the files you need" makes no sense to me for agentic use.
by nextos | 2025-09-09 00:16:23+00:00
I don't agree curtailing toxicity would sacrifice freedom. The toxicity I was referring to translates into power abuse, bullying, data fabrication, and all the different kinds of misconduct that emerge in systems where there is no control, no filtering, and no skin in the game. Actually, I think freedom and creativity would flourish if academic misconduct was pursued more actively. I have worked at a few top departments, and academic misconduct led to extremely low efficiency and resource waste. Everyone was either fighting or demotivated. Huge multi-million projects didn't get anywhere. Some minimal guardrails are needed.
by kfrzcode | 2025-09-09 00:16:34+00:00
McMurdo was powered by a modular reactor in the 60s. It's not "hypothetical" - though I do agree it's not economically scalable, but neither is training an LLM and before OpenAI did it DARPA did it, and you'd better believe the DOD did it too. I'm saying that the technology exists, it's been proven, and it can work - the hangup is political and cultural, and it burdens me with sadness to see conversation focus on things like "omg what if microsoft put clippy on an ICBM" it's appealing to ridicule and we've enough of that tendency these days. Instead we should celebrate this! Explore and discuss it from merit and principle.

https://world-nuclear.org/information-library/non-power-nucl...

https://www.energy.gov/ne/articles/us-sets-targets-triple-nu...
by gonzopancho | 2025-09-09 00:17:39+00:00
> I'd love to see OpenWRT take a (deserved) bite out of the "SMB firewall vendors" like Netgate

I'll just leave this here: https://www.netgate.com/blog/pfsense-software-embraces-chang...

OPNsense are unlikely to be able to make this transition, as they can't even reliably work on the FreeBSD kernel.
by sudahtigabulan | 2025-09-09 00:19:33+00:00
> In his whistleblower complaint, Baig is requesting reinstatement, back pay and compensatory damages, along with potential regulatory enforcement action against the company.

If the company is so bad (it is), why does he want back?!

'Just pay me the salaries I "missed", and keep them coming.' The regulatory action is just "potential".

I have no sympathy for Meta, but this guy...
by AnthonyMouse | 2025-09-09 00:20:24+00:00
A lot of these laws are now attempting to apply extra-territorially, e.g. to servers and companies in the US just because people in the UK are connected to the same internet, with punishments meted out if any part of that company does any business in the UK even if it's unrelated.

It might be interesting to go the other way: Get it put into the constitution of a major country that these kind of backdoors are banned world-wide and you can't do business in that country if any part of your enterprise implements them anywhere else.

To begin with this would make it harder to pass laws like this in other places -- domestic companies with international operations would put up stronger opposition because it would compromise their ability to do business elsewhere, and legislators might actually be concerned about that. And then on top of that it would force the companies to choose which subset of the world they want to operate in, allowing people in oppressive countries to pick up uncompromised devices from the places where compromised devices are banned.
by andsoitis | 2025-09-09 00:20:28+00:00
Company value is dependent on expected future profit/revenue/etc. not market share per se.

If the market grows in size and you’re able to grow revenue and profit, reduced market share in and of itself doesn’t matter.

While the U.S. market share has declined, Tesla's overall annual revenue has continued to grow from $11.75 billion in 2017 to over $97 billion in 2024, though it saw a slight decline in revenue for the 12 months ending June 30, 2025.

https://www.macrotrends.net/stocks/charts/TSLA/tesla/revenue
by th0ma5 | 2025-09-09 00:20:53+00:00
Yeah to me it more poisonous that people reflexively believe any pushback must be wrong because people feel empowered regardless of any measurement that may point out that people only get (maybe) out of LLM models what they put into them, and even then we can't be sure. That this situation exists and people have been primed with a complete triangulation of all the arguments just simply isn't healthy and we should demand independent measurements instead of the fumbling in the dark of the current model measurements... Or admit that measuring them isn't helpful and like a parent maybe alluded to, can only be described as anecdote and there is no discernable difference between many models.
by tremon | 2025-09-09 00:20:59+00:00
Ah, that constitution must explain why we never see people being abducted in broad daylight by goon squads in the US, right? Because anything that clearly violates the constitution would obviously never happen there. Because you're the best country. The greatest.

For reference, the EU does have an equivalent norm: https://fra.europa.eu/en/eu-charter/article/7-respect-privat...