MurphyA/hacker-news huggingface dataset:
by throwaway127482 | 2025-09-09 14:45:47+00:00
Genuine question: why is `curl https://trusted-site.com | sh` a security risk?

Fundamentally, doesn't the security depend entirely on whether https is working properly? Even the standard package repos are relying on https right?

Like, I don't see how it's different than going to their website, copying their recommended command to install via a standard repo, then pasting that command into your shell. Either way, you are depending entirely on the legitimacy of their domain right?
by perihelions | 2025-09-09 14:45:51+00:00
Yes; it's an absurd law. Anyone looking for unblurred satellite photos of South Korea can trivially find them on any number of international services who are not Google. Google is complying with this law, which is absurd, in order to negotiate export-controlled GIS data from South Korea—it needs those to make Google Maps competitive with South Korean consumers. The net result is Google will now blur a couple buildings; other websites will not; and incompetent bureaucrats will continuing failing upwards, doing useless things.

(It's arguably even actively counterproductive, since internationally there are people who[0] go tracking down blurred objects on satellite maps, and identifying what they are. The Streisand Effect of these regulations is to provide curated, military-certified alists of (1) what a military thinks is valuable enough it *ought* to be a secret, paired together with (2) the complete content of that secret).

[0] https://en.wikipedia.org/wiki/List_of_satellite_map_images_w... ("List of satellite map images with missing or unclear data")
by tonyg | 2025-09-09 14:47:13+00:00
(1998). Java existed, but neither Scala nor Java-with-generics did.

From the conclusion:

"We have presented a programming protocol, Extensible Visitor, that can be used to construct systems with extensible recursive data domains and toolkits. It is a novel combination of the functional and object-oriented programming styles that draws on the strengths of each. The object-oriented style is essential to achieve extensibility along the data dimension, yet tools are organized in a functional fashion, enabling extensibility in the functional dimension. Systems based on the Extensible Visitor can be extended without modification to existing code or recompilation (which is an increasingly important concern)."
by ep103 | 2025-09-09 14:47:35+00:00
Yesterday I used ChatGPT to transform a csv file. Move around a couple of columns, add a few new ones. Very large file.

It got them all right. Except when I really looked through the data, for 3 of the excel cells, it clearly just made up new numbers. I found the first one by accident, the remaining two took longer than it would have taken to modify the file from scratch myself.

Watching my coworkers blindly trust output like this is concerning.
by ApolloFortyNine | 2025-09-09 14:48:22+00:00
If your someone who barely speaks English in a third world country running a phishing campaign, you can have chatgpt write you a professional sounding email in 10 seconds. If you convince it your running a phishing test you can probably even have a back and forth about the entire design and wording of the email and phishing site.

That's what I'm guessing OP meant.
by account42 | 2025-09-09 14:48:28+00:00
Unintrusive ads are still there to manipulate you into acting against your own interests and therefore unethical.

> I'm fine with video creators having sponsored sequences because I can skip them if I want.

I'm not fine with them because skipping the obvious segments doesn't mean the rest of the content isn't compromised due to the financial incentive to not upset those advertisers.
by const_cast | 2025-09-09 14:48:49+00:00
Imagine if 99% of stores only served coca cola.

Is coca cola then a monopoly on soft drinks? I would say obviously yes.

This is the situation the current internet and applications are in. They only service users who utilize Google in some type of way, for the majority of apps.

Its deceptive to say "well it's just that one bank". No, that one bank is an example. That's not the breadth of it, and we both know that.
by privatelypublic | 2025-09-09 14:49:10+00:00
Photoprism shouldn't be in consideration at all. They felt the need to post in their FAQ that not checking authorization/authentication before serving photos* if directly linked is OK because its "industry standard" and (paraphrased) "difficult/impossible to implement"

* might just be thumbnails. But lets be honest- a 1/10 scale thumbnail of 40MP shot is... still a ton of detail.
by torginus | 2025-09-09 14:49:11+00:00
This reads like a blog written by someone who sells expensive consulting for business critical issues, but not to actually solve them, but dispense Eastern Wisdom to the poor developers facing and impossible and unsavory task. This sounds like this was written by a guy who was never directly responsible for producing actually usable and productive results.

This is done so management can lay back and say they already did their due diligence, now you know how to do it, now off to the mines! And be ready by the end of next week!

First:

If your codebase doesn't come with tests you are fucked. There's no possible way you can refactor anything without angry customers calling next day you broke their use case. I worked on legacy code that did come with tests (or even better, well written docs!) And even then it was basically everyday that we broke some elaborate use case checked by the tests.

Management will never approve of a refactor, and with good reason.

> unit tests are fast and reliable

They are also often worthless, because they don't capture real world behavior. Not always but having to mock out half your codebase (including libraries you couldn't possibly know how they work, like a legacy version of Qt your app depends on). You end up with five hundred lines of mock for ten lines of test and it doesn't even give you confidence in anything. These workshy consulting ghouls often force devs to write unit tests, who full well know they're going to be absolutely worthless.

Because you have no idea how it's supposed to work.

> Don’t make your code depend on libraries’ implementation

Good advice , though isn't the definition of legacy code that its already written and after refactor it should keep working like it already did? If somebody before you pulled in a COM object from Microsoft Excel 2003, and your ERP system pivotal to your companies success relies on the exact behavior of that component, where does that leave you?
by omnimus | 2025-09-09 14:49:24+00:00
I think there is contradiction in that what makes europe attractive is the thing that doesn't allow building Silicon Valley. You cant't have Google, Facebook, Microsoft, Amazon... without intense surveillance and financial speculation. That are things that europeans view as bad (atleast they say that).

Best what europe could hope for is finding different tech path than SV. That path most likely won't be as profitable but that might be OK. In a way companies like Hetzner might already be on that path of not trying to replace AWS.

What is much more likely is that europe will just become even more reliant on US tech. But it will be because of politic not for technical inability.
by gruez | 2025-09-09 14:49:46+00:00
>This is a stawman designed to misdirect the discussion. How about we keep discussing regulation in the context of ad abuse?

I can't see how my comment is a "strawman" in any meaningful sense.

>A valid criticism would be an implied false dichotomy in my original comment

That's exactly my point. Adopting a "you're either with us or against us" attitude is totally toxic, and shouldn't be accepted just because it's for a cause you happen to agree with.

>My idea is for us to discuss this. Is regulation not the right way? What's the alternative? Not, "oh if that doesn't work for all possible universe of applicable solutions, it doesn't deserve merit"

If you wanted an intelligent discussion on what regulation should consist of, what's the point of starting off which such an absolutist remark? What does it add compared to something like "what's the right form of regulation to address this?"
by godshatter | 2025-09-09 14:49:47+00:00
> Without, the last line is inconsistent with the other lines.

The last line without a comma imparts the information that this line is expected to be the last line in the list which is something you don't get from it with that trailing comma. It's a small thing, but I don't like putting in that last comma because I'm effectively misrepresenting things for "syntactic sugar".
by bediger4000 | 2025-09-09 14:49:49+00:00
I've been told since at least 1980 that small, local government was best. I was given the impression that state level government was probably the optimum level to decide things, cities and counties could go off the rails in various ways.

I haven't see a coherent rationale for reversing course on this doctrine, which was extremely strongly held, and cited a lot.
by IAmBroom | 2025-09-09 14:50:02+00:00
> > we did this to ourselves > I would argue that a small minority of the human race did this to the rest

Yes, just the people that use fossil fuels to drive, heat their homes, power their electrical lines, and so forth. /s

You can't dodge responsibility by pushing the blame upwards on everything. Are you posting these comments from a computer powered by solar panels?
by cyphar | 2025-09-09 14:50:19+00:00
On the other hand, process managers care about the exit signal of child processes and the most straightforward way is to keep around a zombie that just contains that information and ensures the only identifier available to userspace at the time continues to reference the same pid (of course, zombies on Linux contain some more information but some of that is sometimes necessary and pidfds remove some of the need for this).

The funny thing is that there is a way to opt out of zombie reaping as pid1 or a subreaper -- set sigaction of SIGCHLD to SIG_IGN (and so it really isn't that hard on the kernel side). Unfortunately this opts you out of all child death events, which means process managers can't use it.

If you want to argue that interaction of zombies with re-parenting is borked, that is a very different discussion (though re-parenting itself is necessary for daemonisation). If there was a way to only opt-out of zombie reaping for reparented processes things would be much nicer.

IMHO the bigger issue with Docker and pid1 is that pid1 signal semantics (for instance, most signals are effectively SIG_IGN by default) are different than other processes and lots of programs didn't deal with that properly back then. Nowadays it might be a bit better, it Docker has also had a built-in minimal init for many years (just use --init) so the problem is basically solved these days.
by SoftTalker | 2025-09-09 14:50:26+00:00
"you can actually disable the App Store! This is a marvelous win."

I thought this one was weird, personally. The App Store is among those I use least on my phone. I only open it when there is a specific new app I want to install (which is rare; I have maybe a dozen apps installed that didn't come with my phone). I easly go months without opening the App Store.

Are there people just browsing the App Store daily?
by wmaxlees | 2025-09-09 14:50:43+00:00
Hi HN, author here.

This post is the final chapter of a wild goose chase I've been on for the last few months. In a previous post, I found a "helpful bug" that was giving my PPO agent a superstar score. I spent weeks reverse-engineering that bug into a principled technique (τ-regularization).

Just as I was about to test that new technique's generality, a reader in the RL community on Reddit found a second, deeper bug in my critic loss calculation.

This post is the story of that discovery. It turns out the first "helpful bug" was only effective because it was compensating for the second, more fundamental bug. Fixing the second bug and then re-testing my "principled" technique showed that it was completely ineffective on its own. It's a classic case of two wrongs accidentally making a right.

The post is a full write-up of the final investigation, a reflection on the messy reality of RL research, and the final, correct, SOTA-performing agent. Thanks to the community for being a huge part of the debugging process!
by gruez | 2025-09-09 14:51:11+00:00
>You are comparing the regulation of business practices to the breach of human rights.

So "you're either with us or on the side of the bad guys" is a valid form of argument, but only when the bad guys are evil corporations? More to the point, much of the "regulations" proposed does end up infringing on human rights. For instance regulations forcing social media companies to remove "disinformation" or "content causing hatred/discomfort" necessarily limits others' freedom of speech.
by Nifty3929 | 2025-09-09 14:51:22+00:00
I think there aren't enough folks (including me) with sophisticated enough speaker setups to take advantage of it, limiting the market.

There's only so much you can do with just a left and right speaker and MAYBE a sub.

That said, it does seem like there's new interest in spatial audio, so we'll see. Maybe with some spatial audio headphones, and especially if they add head-tracking so that a sound to your left moves relative to your head (and stationary relative to your body) as you turn your head to face it.
by evilDagmar | 2025-09-09 14:51:25+00:00
Truth. A stripped down configuration of that running nothing but personally-written code on the backend would pretty much render those issues moot (as in "completely mitigated").

Considering how lacking in detail the reports were, I'd probably have just dismissed this man's claims as "AI slop". That he was relying on nmap to tell him the version of something that is easily discovered using openssl s_client (because those HTTP response headers are perfectly human-readable) is kind of telling in and of itself.
by smoovb | 2025-09-09 14:51:32+00:00
Etherscan has tagged these addresses already. As of this check, none of the other block explorers have. Etherscan - yes - https://etherscan.io/address/0x4Cb4c0E7057829c378Eb7A9b174B0...

Mempool.space - no Blockchair - no Tronscan - no Blockcypher.com - no Blockread.io - no
by bccdee | 2025-09-09 14:51:57+00:00
Bullet hell shooters are deterministic. Mob behaviour in Silksong is random. It is entirely possible for a boss in Silksong to spawn several mobs that all do inconvenient attacks at once, boxing you in.

Some of the optional bosses in Silksong (e.g. Savage Beastfly, mentioned in the article) do have that issue: high damage + high health + spawning mobs with uncoordinated random movement. It makes for a prolonged sequence which is ultimately unlearnable but must still be performed perfectly.
by ChrisMarshallNY | 2025-09-09 14:52:17+00:00
That's wild. New Mexico is fairly notorious for having terrible medical and social safety net stuff.

I have a friend that had a daughter that lived there, and had serious mental health issues, and I'd hear nightmare stories about how bad the state was for that.

I have family with similar issues, in New York, and they get an amazing amount of state support.
by mh- | 2025-09-09 14:52:58+00:00
This can't be understated. I started using it heavily earlier this summer and it felt like magic. Someone signing up now based on how I described my personal experiences with it then would think I was out of my mind. For technical tasks it has been a net negative for me for the last several weeks.

(Speaking of both Claude Code and the desktop app, both Sonnet and Opus >=4, on the Max plan.)
by Groxx | 2025-09-09 14:53:05+00:00
Childcare is a great way to kick this off - it's politically hard to fight against anything "for the children" and it's not a stretch at all to extend coverage gradually, as people see the benefit and want it elsewhere / just one more year / etc.

Just gotta hope it stays funded enough to avoid descending into a bureaucratic death spiral with months of delays for everything.
by qcnguy | 2025-09-09 14:53:10+00:00
> Pretty much no one other than extreme rightists would describe the Conservatives as a centre-left party

If an election were called tomorrow your next government would be Reform with a massive majority of 339 seats. It is the most popular party in the country by far. It would collect 33% of the vote vs Labour's 18% and the Conservatives would get only 17%, translating to their near-total destruction (only 35 seats).

Reform's popularity is driven by the belief that the Conservatives have become so captured by left wing "wets" that they cannot be fixed. Otherwise it makes no sense to split the right, and right wing voters there resisted doing so for a long time. The most commonly cited reason for switching to Reform is a belief that the Tories won't actually enact any right wing policies no matter what they say, and so that's a third of the country saying through their votes they think the Conservatives are a center-left party.

The fact that you believe "pretty much no one other than extreme rightists" has this view and that Labour is seen as a "centrist" party indicates that indeed, your gut feel is correct, and the people you know aren't a representative slice of the population. How many people do you hang out with regularly who read the Telegraph or Daily Mail? Maybe it's none?

If centrism means anything it means trying to adopt mid-way positions that appeal to the majority, but Labour's support for far-left ideology is so intense they're reacting to continuously dropping approval numbers by doubling down. That's not what centrists do, they chase votes, doubling down is what ideological extremists do. They'd rather drive their own party into the ground than compromise on modern left wing goals like unlimited mass immigration.
by rich_sasha | 2025-09-09 14:53:25+00:00
Is "despised" jumping to conclusions here a little? There's a selection of stats showing, at face value, a number of his actions are unpopular.

But (a) there's always spread on survey values, so this could be cherry picked / optimistic reading, (b) people's sympathies en masse are not super logical, but rather emotional. He was never elected for rational reasons. People just like him and like his "vibe", and I can imagine they will continue to like him even while he saws at the branch they are sitting on.

Obviously only up to a point, and I'm confident that point will come, but it's not obvious to me (IANAAmerican) that it's there yet.
by palata | 2025-09-09 14:53:41+00:00
> Why should I not be allowed to

Same as I said above: you are asking for a new feature. Their default is those 20 lines that "protect" the files. If they want to offer you a way to still enable it, someone has to do it. Someone has to work on the UX of it, maybe there is a need to explain to the users why it is less secure when this feature is enabled, and then there is work to do with the criticisms that will come next time someone shoots themselves in the foot because of this feature (because "Signal shouldn't have allowed that in the first place").

I know, you will say "it's not much". But everybody asks for their "small feature", and projects generally can't do everything that everybody asks them to do (and usually for free).

I find it totally valid if they choose that they won't offer features to lower their security, and instead they will work on features having sufficiently good security. Which in this case is the secure backup.
by pwdisswordfishz | 2025-09-09 14:53:43+00:00
How does it prevent security vulnerabilities when instead of being undefined entirely, the behaviour is defined to be wrong? This is the "chug along at all costs" mentality that PHP has been slowly and painfully growing out of.

`-ftrivial-auto-var-init=pattern` doesn't need "erroneous behaviour" in the standard at all. In fact, it may outright conflict with it, if for example the standard defines that the compiler must initialize variables to zero instead of your chosen pattern in case of "erroneous behaviour".

"Erroneous behaviour" is a superfluous concept that exists only to allow the committee to pat themselves on the back and say "See? We no longer have undefined behaviour!".
by KoolKat23 | 2025-09-09 14:53:47+00:00
Unlike the others this is a natural monopoly.

Your first message contradicts your second, which one is it are they paying government risk level interest rates or business risk level interest rates.

Edit: I just went and looked up their rating with one of the big agencies. CCC rated (junk basically) with a negative outlook, they did get an upgrade on a refinance last year, but from CC (so now lesser junk).

UK's last rating was AA (if you're interested).
by OskarS | 2025-09-09 14:53:52+00:00
I mean, fair enough I guess, but there's a lot of games on that list. I don't think you would go around saying "LittleBigPlanet is widely regarded as one of the best of all time" just because it appears in that article. A lot of publications has done click-baity "top 100 games of all time".
by jpadkins | 2025-09-09 14:55:06+00:00
Can you give examples of laws that put editorial standards on publishers? I am not familiar with any (I mostly know US stuff). A quick search only returned: - Disclosure of Advertorial Content: U.S. law requires that if paid content is presented as editorial matter in a periodical, it must be clearly marked as an "advertisement". - Prohibiting Harmful Content: Laws prohibit publishing content that is obscene, libelous, or scandalous. - Copyright and Intellectual Property: Laws govern the exclusive rights of authors to their literary and artistic works, including the right to print, publish, and distribute them. - Privacy Laws: Publishers must comply with laws protecting personal data and privacy. - Online Platforms and Section 230: While not directly about publisher standards, Section 230 of the Communications Decency Act generally protects interactive computer services from liability for user-generated content, distinguishing them from publishers in this context.

I can't sue a publisher for running an ad that was libel. I sue the advertiser who created the libel.
by sverhagen | 2025-09-09 14:55:24+00:00
Some business are looking ahead long term. Others aren't. It wouldn't be novel for a company like ASML to just stay focused no the goose with the golden egg, look at Intel (Pentium etc.) And then there's business that have some sort of long-term strategy, but just won't go all in, and end up with subpar acquisitions; I worked for Verizon: BlueJeans anyone? Or AOL? And those were just part of a pattern.
Ask HN: Would you use a cold email tool that's configurable via code?
by narayanahari | 2025-09-09 14:55:27+00:00
I'm exploring an idea for developers and technical founders: a cold email tool where you define your cold email campaigns using YAML or a Terraform-style config.

No clunky UI. Just version your campaigns in Git, run them from the CLI, and get metrics via terminal or API.

Something like this:

campaign: outreach sender: me@domain.com audience: leads.csv sequence: - delay: 0 subject: "Hey {{first_name}}" body: "..." - delay: 3d subject: "Just checking in" body: "..."

It would also handle things like inbox rotation, warmup, sending limits, and unsubscribe logic.

Would love to know: * Would you use this? * What features would be essential for you? * Any similar tools you already like? * Any gotchas you see?

Thanks!
by account42 | 2025-09-09 14:55:56+00:00
We didn't have a paywalled internet before ads became commonplace. Most content on the internet is still user-generated and almost all of those users do not get paid anything from the ads put on their works. Hosting is quite cheap unless you want to run a centralized service that serves literally everyone.

If anything is a social contract then it's that if you want to provide a paid service you are up front about requiring payment. Ad-supported websites don't much care about that social contract because they think it's more profitable to pretend to be free when they are not.