MurphyA/hacker-news huggingface dataset:
by hannob | 2025-09-16 11:56:34+00:00
It's actually relatively simple.

Adding dependencies comes with advantages and downsides. You need to strike a balance between them. External libraries can help implement things that you better don't implement yourself, so the answer is certainly not "no dependencies". But there are downsides and risks, and the risks grow with the number of dependencies.

In the world of NPM, people think those simple truths don't apply to them and the downsides and risks of dependencies can be ignored. Then you end up with thousands of transitive dependencies.

They're wrong and learn it the hard way now.
by codemonkey-zeta | 2025-09-16 11:56:38+00:00
I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem.

These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probably be faster and less janky anyway.
by crazygringo | 2025-09-16 11:56:45+00:00
"Share profile photo" would be grammatically incorrect as a complete sentence.

But it's perfectly grammatically correct as a command label.

English has different grammar rules in different contexts. For example, newspaper headlines omit articles all the time. That doesn't make the NYT grammatically incorrect on every page, though. Because they're using correct headline grammar, which is different from sentence grammar.
by poetaster | 2025-09-16 11:58:59+00:00
I also have this setup and SFos on Gigaset GS5. Similar battery performance. I did a roadtrip last week with navigation (starting with about 90% battery) and after 5&1/2 hours navigation was down to 65% or therabouts. Works for me.

And, yes, I often turn off wifi. I never go over my Data limits and 4G/5G is much more efficient for some reason.
by Izkata | 2025-09-16 11:59:49+00:00
> React calling them "just functions" is untrue

I'm pretty sure this is also untrue. AFAIK React has never used that phrase (and at the very least, I can't find it anywhere official right now), it came from other people convincing newcomers that hooks aren't something more complicated like objects (comparing to class-based components). React has always treated them as special functions, hence always prefixing them with the word "use".
by TacticalCoder | 2025-09-16 11:59:56+00:00
> It's amazing how far CRT technology got

And China is still building, today, brand new CRT boards for CRT TVs and monitors. You can buy them on AliExpress.

I don't know if CRT themselves are still being built though.

I'm hanging on to my vintage arcade cab from the 80s with its still-working huge CRT screen. Hope I fail before that thing (and I hope it doesn't fail anytime soon!).
by jbreckmckye | 2025-09-16 12:00:14+00:00
> The way you know it's magic is it shatters the principle of referential identity, which tells you that a variable is itself

When you do a useValue() it is clear you are grasping at something with a larger lifespan than your function.

Conceptually it is not much different than

int counter() { static int x = 1; return x++; }

Which predates C89, if age is an argument
by nc30 | 2025-09-16 12:00:31+00:00
I am starting to do that but I still find that will be annoying to keep up. The dumb device will need to be kept up-to-date because that's important for e.g banking apps so that automatically excludes "old" devices (usually 3+ years old) because most stop getting updates that fast. Even LineageOS isn't an option because it does not pass Google's integrity checks so I am afraid I will need to buy a new dumb phone every couple of years..
by viraptor | 2025-09-16 12:00:52+00:00
You can protect yourself using existing tools, but it's not trivial and requires serious custom work. Effectively you want minimal permissions and loud failures.

This is something I'm trying to polish for my system now, but the idea is: yarn (and bundler and others) needs to talk only to the repositories. That means yarn install is only allowed outbound connections to localhost running a proxy for packages. It can only write in tmp, its caches, and the current project's node_packages. It cannot read home files beyond specified ones (like .yarnrc). The alias to yarn strips the cloud credentials. All tokens used for installation are read-only. Then you have to do the same for the projects themselves.

On Linux, selinux can do this. On Mac, you have to fight a long battle with sandbox-exec, but it's kinda maybe working. (If it gained "allow exec with specified profile", it would be so much better)

But you may have guessed from the description so far - it's all very environment dependent, time sink-y, and often annoying. It will explode on issues though - try to touch ~/.aws/credentials for example and yarn will get killed and reported - which is exactly what we want.

But internally? The whole environment would have to be redone from scratch. Right now package installation will run any code it wants. It will compile extensions with gyp which is another way of custom code running. The whole system relies on arbitrary code execution and hopes it's secure. (It will never be) Capabilities are a fun idea, but would have to be seriously improved and scoped to work here.
by tootie | 2025-09-16 12:01:18+00:00
You're trying to rewrite decades of economic theory in a single comment. You can just Google "deflation great depression" and "elasticity of demand". Think about the opposite side of the coin. You have car that is ok but want a better one. The better one costs $35k. In a few months, it will be $30k and a few more $25k. When will you buy it? Deflation is kryptonite to consumer spending.
by touristtam | 2025-09-16 12:01:27+00:00
I've heard another take that is interesting and a clear departure from that never ending moaning: Like the ultra slim new iPhone that could be a step to validate the technical challenges to a foldable device, this change in UI is to prepare the user base for a complete change in the form factor, be it a glass slab or a greater focus on wearable (ala glasses).
by jeroenhd | 2025-09-16 12:01:46+00:00
You can still do all the checks you need, they're right there in the connection properties. This website is OV-certified (not EV) to PayPal, Inc. in San Jose by DigiCert Inc.

You do need to know what US state PayPal is registered in for them to work, of course, as proven by https://arstechnica.com/information-technology/2017/12/nope-... during the time EV certificates were still considered special.

I don't see why EV wouldn't be viable. ACME can work with any certificate. A certificate authority can just sign new certificates every week at the request of an authenticated ACME client. The biggest issue with this workflow is the CA's billing flow optimised for the "pay once, hand over a file once" workflow.
by diggan | 2025-09-16 12:01:46+00:00
Off-topic, but I love how different programmers think about things, and how nothing really is "correct" or "incorrect". Started thinking about it because for me it's the opposite, JS is an OK and at least usable language, as long as you avoid TS and all that comes with it.

Still, even I who'd call myself a JavaScript developer also try to avoid desktop applications made with just JS :)
by viggity | 2025-09-16 12:02:01+00:00
My dad is a tax attorney/cpa, but is also a magician. My birthday parties were dope. It certainly wasn't a full time job, but he made enough money from corporate parties doing walk around magic to fund his habit, and magic is expensive (most videos teaching the trick are ~$100 or more). He has a magic library that if I had to guess is worth 6 figures.

I've tried getting into the craft many times, and if I had to boil down the essence of nearly every trick (especially for slight of hand, not necessarily stage magic)... Imagine the stupidest, dumbest, simplest explanation of the trick that you write off as "well certainly they're not doing _that_", and that is what is happening. The real art is that doing that simple thing is hard AF, they have to practice it a thousand times to make it look convincing. I never really got into it because it required too much dedication. And if anything, that makes it more special than something more cerebral.
by js8 | 2025-09-16 12:02:03+00:00
Let me give an optmistic counterpoint. We should go back to Gramsci, who observed that the regime holds itself to power mostly by ideological hegemony. If everyone is being wiretapped, it's difficult to construct and maintain ideology that would justify that.

We can imagine something like 1984, where it was only the party (middle) class monitored for thinking. But proletariat (low) class was free to think whatever - because they knew system was bad; they weren't required to pretend.

I guess my point is, the totalitarian system doesn't need widespread surveillance. But it needs believable ideology, which enough people from low and middle class believes to keep the communication barrier between these groups sufficiently closed.

Is the neoliberalism such ideology? Is it something that can offer enough positives to sustain/counterpoint negatives of widespread surveillance? I doubt it.

We can look at recent examples where UK and US tried to control the narrative and failed - Palestine Action, ICE arrests, troop deployments in cities, Tiktok ban.. Despite surveillance, people are not buying the ideology.
by GuB-42 | 2025-09-16 12:04:00+00:00
I don't consider "My..." in Windows XP to be a blooper. In folders, it meant these are personal folders, as opposed to system folders, shared data, etc...

You have to put it into context, it was the fist multi-user system for most people. Before that, they considered the whole filesystem to be theirs, no pesky permissions or anything like that. So "My" is a good indication for where to put their stuff (instead of, say, C:\).

I think it makes more sense than "Your" as "Your" is more like "stuff the computer gives you / read only" rather than "stuff you give the computer / editable" and a folder like "My Photos" is more of the latter. Matching the idea of the article where "your" is the question, a question is not something you change, and "my" is the answer, which is the thing you act on.

And by the way, the more I look at it, the more I respect the UI designers at pre-Windows 8 Microsoft. So many stupid things that turned out not to be stupid at all. It doesn't mean perfect, but when we see the mess that we have now, it pretty much was by comparison.

Another one is why have folders with spaces in them: "Program Files", "My Documents", etc... The rumor is that it was to force programmers to take handle spaces in filenames properly, because if they don't, it won't work at all. And seeing how terrible the situation is with Unix shells, if true, it is definitely justified. Most of the shell scripts (and not just shell scripts) I see outside of popular public projects fail to handle spaces properly, sometimes catastrophically.
by sevenseacat | 2025-09-16 12:04:34+00:00
I remember getting yelled at by an American on Reddit once, when I asked what they meant by EST. Because of course America is the only country that shouldn't have to use country-prefixed versions of anything.

And of course, saying 'EST' doesn't actually tell me what fucking time something is happening. Telling me what UTC offset EST is, does.
by diggan | 2025-09-16 12:05:06+00:00
I don't use AWS and looking in ~/.config/gh I see two config files, no plain-text secrets.

With that said, it's not impossible some tool leaks their secrets into ~/.local, ~/.cache or ~/.config I suppose.

I thought they were referencing the common approach of adding environment variables with plaintext secrets to your shell config or as an individual file in $HOME, which been a big no-no for as long as I can remember.

I guess I'd reword it to "I'm not manually putting any cleartext secrets on disk" or something instead, if we wanted it to be 100% accurate.
by latexr | 2025-09-16 12:05:07+00:00
Who exactly is “Tesla” here? Presumably (and the article seems to support this) we’re talking about the board of directors. Which Musk is a part of. So he’s promising himself extra personal money from the company he controls.

He was just declared the second riches person in the world, falling from first place. Such as transparent blow to the ego.
by shelled | 2025-09-16 12:05:08+00:00
I just installed it (had to; if I am using the Mac, I'd rather be on the latest OS for security and compatibility reasons), and it is just disgusting. It is more disgusting than the iOS 26 monstrosity.

I mean, how do you even provide constructive feedback to such a pathetic design choice? Not that this company ever deals in feedback (unless it's a strong feedback directly to its wallet).

I do believe they are just exhibiting sheer incompetence and intellectual bankruptcy as a corporation. Is it beginning of an end? I don't know. Do giga corps even die anymore?
by grues-dinner | 2025-09-16 12:05:24+00:00
I used to use i3. Even now I've mostly moved to Cinnamon via KDE (which I abandoned as Plasma made my laptop fans spin too much, maybe user error? I never solved it) I haven't "settled" on anywhere and never really felt either was good enough to commit to. Obviously you don't have to commit, but you end up kind of unmoored. Especially as a lot of GNOME apps seem somewhat lacking so I often end up using, say, Okular or XReader rather than Evince, or CuteCom rather than whatever the GNOME serial terminal is. And I also gave up on vim as an editor so I don't really even have a "home" editor other than VS Code which is just kind of default. Plus a bunch of Windows only industrial and East Asian software the only works via a VM which is pretty clunky.

I used to use Macs at work and while I never really loved the experience (and certainly not that of fiddling with kernel drivers) and write keenly felt the metaphorical guards watching from the towers, it really did feel like a thought-through experience for a normal computer user.
by pietz | 2025-09-16 12:05:46+00:00
Do we really know that gpt-5-codex is a finetune of gpt-5(-thinking)? The article doesn't clearly say that, right?

I suspect that this is smaller than gpt-5 or at least a quantized version. Similar to what I suspect Opus 4.1 is. That would also explain why it's faster.
by singulasar | 2025-09-16 12:06:26+00:00
I'm so sick of people saying this. If you use js for any non-tiny project, you'll have a bunch of packages. Due to how modules work in js, you'll have many, many sub dependencies.

Nobody has time to review every package they'll use, especially when not all sub dependencies have fully pinned versions.

If you have time to review every package, every time it updates, you might as well just write it yourself.

Yes, this is a problem, no reviewing every dependency is not the damn solution
by numpad0 | 2025-09-16 12:06:34+00:00
wtf. I'm talking about DISTANCES. not ANGLE. Are you an LLM? I don't think there's a way out from here for you, no matter how you spin it. Why double down?

You can't focus on objects at 20 and 25 centimeters away at the same time. How hard is it for you to understand this?
by epolanski | 2025-09-16 12:07:16+00:00
"I knew you weren't a great engineer the moment you started pulling dependencies for a simple app"

You realize my point right? People are taught to not reinvent the wheel at work (mostly for good reasons) so that's what they do, me and you included.

You ain't gonna be bothered to write html and manual manipulation, the people that will give you libraries to do so won't be bothered reimplementing parsers and file watchers, file watcher writers won't be bothered reimplementing file system utils, file system utils developers won't be bothered reimplementing structured cloning or event loops, etc, etc.

I myself just the other day had the task of converting HTML to markdown, because I don't remember whether it was Jira or Github APIs that returns comments as HTML and despite it being mostly few hours of work that would get us 90% there everybody was in favor of pulling a dependency to do so (with its own dependencies) and thus further exposing our application to those risks.
by mfru | 2025-09-16 12:07:17+00:00
Conclusion:

" 251. The Commission’s analysis in this report relates solely to the determination of genocide under the Genocide Convention as it relates to the responsibility of the State of Israel both for the failure to prevent genocide, for committing genocide against the Palestinians in Gaza since October 2023 and for the failure to punish genocide. The Commission also notes that, while its analysis is limited to the Palestinians specifically in Gaza during the period since 7 October 2023, it nevertheless raises the serious concern that the specific intent to destroy the Palestinians as a whole has extended to the rest of the occupied Palestinian territory, that is, the West Bank, including East Jerusalem, based on Israeli authorities’ and Israeli security forces’ actions therein, and to the period before 7 October 2023. The events in Gaza since 7 October 2023 have not occurred in isolation, as the Commission has noted. They were preceded by decades of unlawful occupation and repression under an ideology requiring the removal of the Palestinian population from their lands and its replacement.

252. The Commission concludes on reasonable grounds that the Israeli authorities and Israeli security forces have committed and are continuing to commit the following actus reus of genocide against the Palestinians in the Gaza Strip, namely (i) killing members of the group; (ii) causing serious bodily or mental harm to members of the group; (iii) deliberately inflicting on the group conditions of life calculated to bring about its physical destruction in whole or in part; and (iv) imposing measures intended to prevent births within the group.

253. On incitement to genocide, the Commission concludes that Israeli President Isaac Herzog, Prime Minister Benjamin Netanyahu and then Defence Minister Yoav Gallant, have incited the commission of genocide and that Israeli authorities have failed to take action against them to punish this incitement. The Commission has not fully assessed statements by other Israeli political and military leaders, including Minister for National Security Itamar Ben-Gvir and Minister for Finance Bezalel Smotrich, and considers that they too should be assessed to determine whether they constitute incitement to commit genocide.

254. On the mens rea of genocide, the Commission concludes that statements made by Israeli authorities are direct evidence of genocidal intent. In addition, the Commission concludes that the pattern of conduct is circumstantial evidence of genocidal intent and that genocidal intent was the only reasonable inference that could be drawn from the totality of the evidence. Thus, the Commission concludes that the Israeli authorities and Israeli security forces have had and continue to have the genocidal intent to destroy, in whole or in part, the Palestinians in the Gaza Strip.

255. The Commission concludes that the State of Israel bears responsibility for the failure to prevent genocide, the commission of genocide and the failure to punish genocide against the Palestinians in the Gaza Strip."
by devoutsalsa | 2025-09-16 12:07:22+00:00
I was learning about cold email marketing earlier this year, and it's all about learning to be a spammer:

- Registering lots of domains (launchmyapp.com, trymyapp.com, myapp.info, gomyapp.biz, etc.)

- setting up a limited number of mailboxes per domain

- warming email accounts up for 2 weeks by signing up for a service that sends to and receive messages from your accounts

- setting up a meta inbox to track messages sent and received across all of your accounts

Now pretty much every domain that isn't myapp.com looks like a spammer's domain to me.
by diggan | 2025-09-16 12:07:26+00:00
A bunch, ranging from JS to Clojure and everything in-between, depends on the project.

The approach also depends on the project. There is a bunch of different approaches and I don't think there is one approach that would work for every project, and sometimes I requires some wrangling but takes 5-10 minutes tops.

Some basic information about how you could make it work with 1Password: https://developer.1password.com/docs/cli/secrets-environment...
by mat0 | 2025-09-16 12:08:06+00:00
anyone reading this comment: don’t do this. this is not the way to work on a team.

i’ve seen so many random prs of engineers that thought this was the time to go on a rabbit whole and fix some random error they found. worse, i’ve seen regressions introduced on random “fix” PRs that had no description, no ticket, nothing. this is not team work. if you see an issue and you know how to fix it, by all means, fix it. but create a bug ticket with explicit current and expected behavior that people can read and test. if you don’t have time to create a ticket, then you don’t have time to fix random bugs
by bangaroo | 2025-09-16 12:08:45+00:00
totally familiar with that - more often than not (in that it's always been the case) that is a function of how the company chose to build things, however, and not the base framework the product was built on.

in fact, the greatest source of that kind of trouble, in my experience, is constantly changing approaches and paradigms and patterns throughout the codebase to do something "more modern" without fully committing, leading to a super stratified codebase with dozens of patterns and weird hooks and bindings to make them all get along...
by jddj | 2025-09-16 12:08:50+00:00
Is the difference between the number of dev dependencies for eg. VueJs (a JavaScript library for marshalling Json Ajax responses into UI) and Htmx (a JavaScript library for marshalling html Ajax responses into UI) meaningful?

There is a difference, but it's not an order of magnitude and neither is a true island.

Granted, deciding not to use JS on the server is reasonable in the context of this article, but for the client htmx is as much a js lib with (dev) dependencies as any other.

https://github.com/bigskysoftware/htmx/blob/master/package.j...

https://github.com/vuejs/core/blob/main/package.json
by rickdeckard | 2025-09-16 12:08:51+00:00
> The government is also keen to have these devices controlled more tightly.

Not to oppose what you wrote, but let me try to give you a different view on the same picture to support a different conclusion:

In the eye of most governments these devices play such a minor role that they practically don't even exist.

What governments see is messaging services, finance services, digital marketplaces, and so on. It was and is their job to do that. They used to regulate telecom providers, financial institutions, marketplaces in the past, and they are now catching up realizing that the carrier is no longer the messaging provider, banks are not in control of all finance flows, marketplaces exist beyond the classical physical markets, etc.

If you look at detailed regulation and laws, Governments still have little interest in the explicit devices, they still look at those new variants of classical services and try to adapt to them.

But what the PROVIDERS of those services do, is creating pressure on the devices to help them reach lowest-effort compliance for their SERVICE-requirements (--> "let's make the end-user device bulletproof trusted, so we can offload our responsibilities to his device").

This is in most cases why the devices evolve the way they do. Because they are a merge of product and services (often from the same vendor), and the product is evolving to satisfy the needs for those services.

That's why fighting for "ownership of your device" is mostly futile, because the assumed opponent in this fight doesn't even feel addressed.

You need to bring the fight to their topics, to the topics relevant for governments:

On how a citizen ID should be verified, how financial services should be realized, how a competitive market should be ensured also on digital markets, etc.