MurphyA/hacker-news huggingface dataset:
by kerkeslager | 2025-09-07 04:23:14+00:00
> Why not just simulate a real shuffle?

If you are asking why your proposed shuffling method is insecure: I don't know, and that's why I would never use that.

Asking "why not do X?" is entirely not paranoid enough for security. If you want to propose an algorithm, start with trying to prove the security claims of the algorithm. In this case, you'd need to prove that your algorithm creates a permutation that is indistinguishable from random. If you can't prove it, it's highly probable that your algorithm doesn't create a random permutation and someone will figure out how to break it.

I'll point out that we already have proven shuffling algorithms[1] and they're obviously faster than what you've proposed. So the simple answer to your question is "Because it's unproven and slower than proven algorithms."

[1] https://en.wikipedia.org/wiki/Fisher%E2%80%93Yates_shuffle
by ijk | 2025-09-07 04:25:26+00:00
Arcadia's biggest drawback was that it was dependent on Unity, which meant that it had all of the issues that Unity had plus some new ones. Without source code access it's difficult to exceed the features/performance of the base engine.

Maybe they've fixed some stuff (or ported it it Godot) since I last checked it, but the general lack of editor support, the clash between how Unity wanted to operate and how Clojure wanted to work, and usual Unity problems kept me from building anything significant in it.
by hamandcheese | 2025-09-07 04:25:58+00:00
If I gave away free brownies that happened to be poison, but I really didn't mean to, I still probably should be held liable in some way.

If I was giving away free brownies, and someone kindly informed me that they were poison, and I continued to give them away, I belong in prison.

Edit: it seems like there's been no activity in the repo since before the issue was filed, so it's hard to say if the author can be considered to have been informed.
by jaredklewis | 2025-09-07 04:30:42+00:00
I don’t think we tried.

For a market to work, the buyers have to be exercising their discretion. But most health insurance in the US is provided through employers (whose interests are different from those of the employees). There are a thousand other ways that the US healthcare markets are not free or poorly designed, but this is the original sin that (I would argue) causes most of the issues: the insured don’t choose their insurer, so the insurers are not competing for members, they’re competing for employers.

See Singapore for a place that actually tried. They have a public healthcare but also a well functioning private healthcare market.
by drgo | 2025-09-07 04:33:09+00:00
I experienced similar challenges writing a music engraver app. I ended up rewriting it in Go in fifth the time. I think Rust is trying to solve a really difficult problem (certifying total memory safety at compile time) by exposing faulty assumptions about our code. But the problem is that in real programs, the interplay between correctness, safety, ease of maintenance and performance considerations is not a mathematical equation that can be solved at once by fixing the values of certain parameters. Often, what is needed is the ability to quickly experiment and rule out all the dead-end designs and algorithms which is really hard to do when you are changing multiple parts of your program while wrestling with the borrow checker all the way.
by heavyset_go | 2025-09-07 04:33:20+00:00
> Don't worry, Reddit's day of reckoning comes when the advertisers figure out what percent of Reddit's traffic that they're paying to serve ads to are just bots.

No it won't, we'll all have to upload our IDs and videos of our faces just to register or use Reddit or any social media. They will know who is a real monetizable user or not.
by dang | 2025-09-07 04:33:24+00:00
You can't judge this by individual datapoints that you disagree with.

To answer your question, imagine HN's frontpage saturated by stories that you would consider entirely offtopic and sensational. To a first approximation, that's what HN would be for everyone if it weren't for user flags.

Of course the system is imperfect and overcorrects. But the presence of the current post on the frontpage already shows that sometimes—often, in fact—the overcorrection gets adjusted.
by pmarreck | 2025-09-07 04:33:59+00:00
From what I understand, the quality of the randomness of Fisher-Yates depends entirely on the quality of the random source AND that you didn't bias it by using modulo with a non-evenly-dividing divisor. It actually says that right in the article.

My method may not suffer as much from those drawbacks, but you're right, without testing it thoroughly, there's no way to know and it should not be relied upon instead of F-Y.

EDIT: My intuition was correct more or less. Doing it the way I described serves to "smear" any bias across the deck. Fascinating chatgpt convo on it: https://chatgpt.com/share/68bd103f-9188-8004-8cbc-86693a0d87...

Turns out that an even easier way is just to assign 128 bits of randomness to each card and sort them by that. Degrades gracefully from biased sources, apparently.
Show HN: I am vibe coding a collaborative vibe coding tool
by brainless | 2025-09-07 04:34:31+00:00
Hello everyone,

I am Sumit and I am building nocodo.com - https://github.com/brainless/nocodo. It is is a fairly ambitious project and I feel I would get some needed support from folks on HN. Here is what nocodo is becoming:

- Use your own Linux machine or a cloud server (dev machine) to manage full lifecycle of building apps using Git, GitHub, cloud providers, CI, etc. - You will get integrated view of code changes (Git), issues/tasks (GitHub initially), CI (GitHub Actions initially) - Access test deployments direct to your computer if you generate binary or to server - DNS, DB managed for you - Team collaboration will become possible at the task/project level - `manager` daemon hosts API to connect from web/mobile interfaces to projects on the dev machine - `manager` runs any number of Claude Code, Gemini CLI, Qwen Code, Continue dev, etc. - your own API keys/Pro plans - `manager-web` app that connects to `manager`, allows sending prompts to any project, see status, etc. - `manager` will have API integrations to GitHub, GitLab, CI platforms, Cloudflare, and cloud providers - `manager` will check CI, manage DNS for test and live deployment - `manager` builds on my own set of contextual prompts to allow working on your projects (vibe coding): http://nododo.com/playbook - `manager-mobile` app(s) will come soon that allows same functionality as manager-web - `launcher` app will come soon that manages developer server on Scaleway, Digital Ocean, etc. using your API keys, SSH keys, etc.

The UI is becoming similar to what you expect from Bolt, RepltIt, Lovable, etc. Initially nocodo will support new projects only, Rust + Actix Web backend and Typescript + Solid JS + Tailwind web apps. SQLite for DB with LiteStream + S3 backups. CI pipelines will be added for you - all generated by coding agents. The aim is to enable non engineering teams to build full-stack apps.

If you go to https://github.com/brainless/nocodo/releases you can see I use this myself. I connect to my developer machine over SSH (this will be through manager soon), I talk to Claude Code, Claude edits code code, use GitHub based workflow, test binaries locally and continue building.

nocodo will be self-hosted and have no vendor lock-in, supporting multiple coding agents, cloud providers, etc. It will have authentication through nocodo.com if you enable that and it will be a small subscription (like USD 60 annual for 5 people team).

I am a solo founder and I have been chasing this for the last 2 years. nocodo.com is with me since 2013. I felt like sharing this since it is taking shape and also because I am running out of funds. I consult on the side to keep lights on, so if you like my work and have any work please message me on any network I am on.

Thank you so much, Sumit
by mketab | 2025-09-07 04:35:20+00:00
Great feedback, a couple of clarifications: It is not an email harvester. The reason for collecting emails is to be able to send kind messages. If someone wants to unsubscribe, they can easily do so by clicking the unsubscribe button in the email they receive. Geographical position is optional. You’re right that it can be misused in the wrong hands. The intent for requesting geographical information is: A. Showing the country counts, which indicates how many people across the world have sent these messages. B. Displaying it in the email so the receiver can see the place from which the sender has sent it. But again, this is optional, as I mentioned earlier. The AI-generated message is a secondary option. The “how it works” section explains that you can craft a message in any language yourself. The AI then checks the content to ensure it is not harmful, and it can optionally translate it if you write it in a non-English language. And I completely agree with you that education is paramount. Thanks for bringing these matters up so I can clarify.
by andrewflnr | 2025-09-07 04:36:59+00:00
Yeah, it's really hard to tease them apart in a GUI sort of environment, since the input is so tightly tied to the graphical view. Model and View have always seemed pretty obvious to me but I've never gotten a compelling answer as to what a controller is.

My best guess from this article, given then "associated by observer" link from View to Controller, is that the View is supposed to pass events to the Controller, which will interpret them into changes to the Model. But what's the format of these events that's both meaningfully separate from the View, e.g. could be emitted from different views to maybe different controllers, but doesn't just force the View to do most of the work we want the Controller to do?
by kachapopopow | 2025-09-07 04:37:10+00:00
kinda don't get me wrong c++ is useful, however, rust is a platform language and should be used as such, like c++, but much further than that.

modern games are almost never made in a native language, but rather on a language on top of it, be it squirle, lua, blueprints, c#, wasm, javascript, state trees, binary trees, decision trees...
by dang | 2025-09-07 04:38:10+00:00
Oh, it happens all the time. Usually we post a comment saying so (here are 2,000 of those: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...), but sometimes we don't have time or are on mobile, etc.

I've added such a comment to https://news.ycombinator.com/item?id=45155452 now, which is where it would usually go.
by DetroitThrow | 2025-09-07 04:39:03+00:00
>By mentioning "current configuration" the report is implying that the brakes were not applied fully, and the reason for this is still being investigated

Thank you for clarifying since the brakes never being able to stop a high up car is an alarming design. It does make me imagine the reason for this failure will be some horrificly implemented operational process.
by apsurd | 2025-09-07 04:42:20+00:00
You're not being charitable with the take. seems like you just switched "objective truth" with your flavor: "error rate"

what is an error? how does the llm "know"?

wikipedia example is good. i'd say its "truth" is based on human curated consensus. everyone gets that. what i don't get what's the llm analog? as you state, it's just about making the error rate go down, ok so what is an error? does it require human in the loop?
by theturtle | 2025-09-07 04:43:02+00:00
Well, yeah. But some of us were there before the beginning. Wordpress? Huh? You wrote your own code or you just wrote raw HTML.

1997 also was mostly in the books before the word "blog" ever appeared. The number of us writing on the "internet" numbered in the low thousands, not the millions.

My entire readership was online, not in-person, friends. If they knew I "wrote on the internet," my in-person associates didn't give a shit and probably didn't know how to use a browser yet.

Most of us pioneers are scattered to the winds, and a substantial number are dead now.
by MangoToupe | 2025-09-07 04:44:20+00:00
As always, clicking past the newspaper headline and through to the research shows that it is the newsroom that introduces this confusion. Here’s the abstract, showing that the microbiome is indeed assumed and the paper is offering an initial exploration as to what precisely this microbiome consists of:

> Despite significant advances in microbiome research across various environments, the microbiome of Earth’s largest biomass reservoir—the wood of living trees—remains largely unexplored. Here, we illuminate the microbiome inhabiting and adapted to wood and further specialized to individual host tree species, revealing that wood is a harbour of biodiversity and potential key players in tree health and forest ecosystem functions. We demonstrate that a single tree hosts approximately one trillion bacteria in its woody tissues, with microbial communities distinctly partitioned between heartwood and sapwood, each maintaining unique microbiomes with minimal similarity to other plant tissues or ecosystem components. The heartwood microbiome emerges as a particularly unique ecological niche, distinguished by specialized archaea and anaerobic bacteria driving consequential biogeochemical processes. Our findings support the concept of plants as ‘holobionts’—integrated ecological units of host and associated microorganisms—with implications for tree health, disease and functionality. By characterizing the composition, structure and functions of tree internal microbiomes, our work opens up pathways for understanding tree physiology and forest ecology and establishes a new frontier in environmental microbiology.
by kerkeslager | 2025-09-07 04:45:24+00:00
1. Every remotely competent language has a secure (P)RNG and is using it to Fisher-Yates shuffle. Go is not special in this regard.

2. Nobody in this thread is criticizing Fisher-Yates, because in all likelihood all of us are using Fisher-Yates. We're discussing the failure of the algorithm used in the article.

3. Please take the time to read and understand the posts you respond to before you respond to them.
by nomilk | 2025-09-07 04:45:24+00:00
Nice. Idea: it would be cool if HN kept the original submission just as signpost or tombstone, that would be incredibly transparent (otherwise tracing URL modifications depends entirely on the submitter mentioning it and being honest about it). Although I admit this is a very minor feature. I know stack overflow does a vaguely similar thing with duplicate posts, where they'll usually be downvoted and closed quickly, but they often remain as 'signposts' linking to the preferred post on that topic.

Btw, thanks for all the work you do.
by quamserena | 2025-09-07 04:45:31+00:00
Rust’s borrow checker has been mathematically verified to be always sound.[0] These are edge case implementation bugs that user code is unlikely to touch. I have never had a soundness hole/segfault from safe Rust, and I am not aware of any code in the wild which stumbled into one of these soundness holes either. The main bug is [1], which is very contrived lifetime shenanigans that wouldn't appear in real code. Some bugs [2] are miscompilations coming from the LLVM side. If implemented perfectly, all safe Rust code would be sound, but of course all programs have bugs. The important part is that 99.9% of safe Rust code is sound.

[0] https://hal.science/hal-01633165v2/document

[1] https://github.com/rust-lang/rust/issues/25860

[2] https://github.com/rust-lang/rust/issues/107975
by skydhash | 2025-09-07 04:49:25+00:00
The thing is, for a lot of tasks, a formal method (either algorithmic or simulation) can be very efficient to create and run with more reliable results. And for a lot of cases, creating a simpler and smaller model with other ML techniques can be as good or better than LLMs.

There's still no justification for the whole investment craze in LLMs.
by vandalism | 2025-09-07 04:49:50+00:00
There has been a new GitHub release in April of this year, however, it seems to have been made by a member of the community along with the commit it includes, instead of the original creator.

Edit: There seems to be activity on the author's account which points to the conclusion that they are aware of the issue and are making (still at least somewhat questionable) changes for a new (unreleased?) version of the launcher to address the problem.

https://github.com/Zacam/SBRW.Launcher.Net/commit/f09d911fca...

As far as I am aware the launcher repo I linked in the original post is still the main launcher players use for the game, meaning people are still getting the certificate permanently installed.
Ask HN: I'm building an AI database client for macOS in Swift. Is it a bad idea?
by m2fauzaan | 2025-09-07 04:52:07+00:00
Building native apps is slow and hard, but I’m genuinely enjoying the process of developing with Swift despite the challenges. I’ve noticed other projects launching quickly with Electron and gaining traction—even when working on similar ideas. It makes me wonder: is it a mistake to stick with native development when most users don’t seem to care about the underlying tech?
by iask | 2025-09-07 04:52:14+00:00
Wtf! I’m certain this entire stack was reviewed by low level outsourced contractors.

To the person below whining that BK should’ve had more time…absolutely not! Users have a right to know. No effort was made to protect the data. None.

Action needs to be taken. The company contracted to build this stack should be replaced asap! Including the CISO.
by dkga | 2025-09-07 04:52:54+00:00
Recently I went into the whole rabbit hole of sunscreens as I moved to Brazil from Switzerland, and now need to use it everyday (ok I know, theoretically also back home would be nice!). So I bought a mineral sunscreen. It feels "healthier" but also doesn't have that good lotion-like characteristic that you can just apply and forget. I really hope sunscreen companies are able to crack this one up.
by chubot | 2025-09-07 04:53:39+00:00
What happens if you just abort the mission? Probably nothing, and certainly doing nothing is less likely to provoke war and further escalation than murdering civilians, hoping no one notices, and then having a front page NY Times article published about it later

If North Korean spies murdered fisherman off the coast of California on a failed mission, you bet there would be blowback

If they were simply noticed, the US govt might be able to and be incentivized to downplay it. Similar to downplaying whatever drones were flying over NJ
by pjmlp | 2025-09-07 04:53:42+00:00
Python isn't for people that care about performance, and Rust has still lots of work to do to provide any GUI, game engine or GPU framework as ergonomic as C++.

Backwards compatibility is what keeps C and C++ relevant, for better or worse.

All major languages value backwards compatibility to certain extent.

Python was lucky that after Python 2 to Python 3 mess, being the AI scripting language, has turned things around.
by serf | 2025-09-07 04:53:55+00:00
yeah, it's great writing -- it's a total coincidence that the Iron Man origin was conveniently re-written to implicate the middle east with arms trade, energy smuggling, and human trafficking for the movie. It's also great writing that it gets to show off the F-35 , a project that was hugely failed at the time economically, to the public as something with on-par agility to a super hero.

it's also a total coincidence that the original origin had Stark demonstrating his weapons in Vietnam, and being captured by communist war-lord Wong Chu.

It's so strange that all this great writing seems somehow connected to the current affairs of the United States at the time.

The fakey Lockheed Martin logo and typescript for Stark Industries is also a nice fuck-you, but the fans think it's endearing.

Any kind of semblance of "Oh the superhero now mistrusts authority" is there simply to make the actual propgadandized bullshit more palatable and believable, and you'll be damn sure that after the traitors are ousted in the movie it'll be good old Uncle Sam and the US whatever-corp waiting for the real super heroes when it's all through.

The DoD sure puts out some great fiction writing.
by whstl | 2025-09-07 04:54:48+00:00
This is an oversimplification, and part of the problem I mention.

The "big leap" in Smalltalk was the idea that everything is an object and computation is message-passing, not just classes and instances. That’s not from Simula. Simula was more like an extension of Algol with OO bolted on. Smalltalk was a whole new conceptual model, which is not as simple to explain as Simula/C++/Java-style OOP.
by ednite | 2025-09-07 04:56:02+00:00
I’m old enough to remember when blogs were basically personal journals. Totally agree things have changed. But those diary-style posts are still out there, they mostly circulate in small circles instead of being easy to stumble across.

The upside is self-expression didn’t die, it just evolved into new forms such as vlogs, newsletters, short clips, etc...

My own blog probably fits the “new” style, but for me it’s more about practicing storytelling and sharing something that resonates.

Thanks for sharing.
by travisgriggs | 2025-09-07 04:56:22+00:00
As a former and long smalltalker who learned MVC from the ParcPlace crowd…

I used to say things like this. M and V were always pretty unambiguous, but “controller” was kind of like “Christianity”, everyone talks like it’s a unifying thing, but then ends up having their very own thoughts about what exactly it is, and they’re wildly divergent.

One of the early ParcPlace engineers lamented that while MVC was cool, you always needed this thing at the top, where it all “came together” and the rules/distinctions got squishy. He called it the GluePuppy object. Every Ux kit I’ve played with over the years regardless of the currently in vogue lets-use-the-call-tree-to-mirror-the-view-tree, yesteryears MVVM, MVC, MVP, etc, always ends up with GluePuppy entities in them.

While on the subject, it would be remiss to not hat tip James Depseys MVC song at WWDC

https://youtu.be/kYJmTUPrVuI?feature=shared

“Mad props to the Smalltalk Crew” at 4:18, even though he’d just sung about a controller layer in cocoa that was what the dependency/events layers did in various smalltalks.
by calineczka | 2025-09-07 04:56:48+00:00
Toptal Core is hiring full-time remote (Europe timezones) Senior Ruby Engineer.

Our current stack is Ruby, Rails, PostgreSQL, ElasticSearch, GraphQL, Kafka, K8s. Mostly working on majestic monolith, occasionally on one of the smaller services. We are building a lot of integrations with external providers, recently integrated Google Drive, elastic and LLMs for AI search.

Apply at: https://www.toptal.com/careers/senior-back-end-engineer-plat...
by m4houk | 2025-09-07 04:57:00+00:00
I love this. As a former XP user, here are some pedantic inaccuracies you've got:

- The taskbar tabs are slightly off from how they looked in the real XP (must be the borders? It's the same issue with the windows as well).

- The close/maximize/minimize buttons never had hover transitions

- By default, desktop icons didn't have any hover effects in the real XP

- I'm surprised you didn't recreate the XP mouse cursor!

- IE6:

- The address bar didn't show progress - The buttons in the toolbar at the top never had any transition effect on hover
by amluto | 2025-09-07 04:57:07+00:00
You can:

(a) Use Fischer-Yates, which is fast and, if correctly implemented, unbiased, or

(b) Come up with an ad-hoc scheme like this, do some fancy math to bound its total variation distance (or, worse, some weaker concept of distance), convince yourself that the distance to the uniform distribution is acceptable, and end up with a slower algorithm when you’re done.