MurphyA/hacker-news huggingface dataset:
by jillesvangurp | 2025-09-17 08:09:20+00:00
C++ and C rely, heavily, on skill and discipline instead of automated checks to stay safe. Over time, and in larger groups of people that always fails. People just aren't that disciplined and they get overconfident of their own skills (or level of discipline). Decades of endless memory leaks, buffer overflows, etc. and the related security issues, crash bugs, data corruption, etc. shows that no code base is really immune to this.

The best attitude in programmers (regardless of the language) is the awareness that "my code probably contains embarrassing bugs, I just haven't found them yet". Act accordingly.

There are of course lots of valid reasons to continue to use C/C++ on projects where it is used and there are a lot such projects. Rewrites are disruptive, time consuming, expensive, and risky.

It is true that there are ways in C++ to mitigate some of these issues. Mostly this boils down to using tools, libraries, and avoiding some of the more dark corners of the language and standard library. And if you have a large legacy code base, adopting some of these practices is prudent.

However, a lot of this stuff boils down to discipline and skill. You need to know what to use and do, and why. And then you need to be disciplined enough to stick with that. And hope that everybody around you is equally skilled and disciplined.

However, for new projects, there usually are valid alternatives. Even performance and memory are not the arguments they used to be. Rust seems to be building a decent reputation for combining compile time safety with performance and robustness; often beating C/C++ implementations of things where Rust is used to provide a drop in replacement. Given that, I can see why major companies are reluctant to take on new C/C++ projects. I don't think there are many (or any) upsides to the well documented downsides.
by imor80 | 2025-09-17 08:09:55+00:00
There are two levels on which this argument feels weak:

* The author is confusing memory safety with other kinds of safety. This is evident from the fact that they say you can write unsafe code in GC languages like python and javascript. unsafe != memory unsafe. Rust only gives you memory safety, it won't magically fix all your bugs.

* The slippery slope trick. I've seen this so often, people say because Rust has unsafe keyword it's the same as c/c++. The reason it's not is because in c/c++ you don't have any idea where to look for undefined behaviour. In Rust at least the code points you to look at the unsafe blocks. The difference is of degree which for practial purposes makes a huge difference.
by fratellobigio | 2025-09-17 08:10:51+00:00
Good question! To do that I think you can do the following:

- open Indexing Options (get to there from the Start Menu, or from Control Panel)

- click on Advanced

- go to the File Types tab

- find doc, docx, or whatever in the list

- change from "Index Properties and File Contents" to "Index Properties Only"

Honestly I haven't tried this so I can't vouch for it, but it seems to be the official way to go.
by nottorp | 2025-09-17 08:11:10+00:00
Apparently this happens only if you set the laptop to discrete GPU only mode, which most people won't do.

However, this is not the only problem with Asus bioses. My daughter has one and it randomly locks up if you add an extra SSD, sooner or later depending on the SSD. You'll blame the SSD's firmware, but the most locking one was one that I have in two desktops with no problems...
by xorcist | 2025-09-17 08:12:02+00:00
Well, there's something to be said about the inability to capitalize long term.

Britain has managed to be at the forefront of all those revolutionary technologies, but when the real break out happens somehow the Americans swoop in and buy the winners. That's shaky ground for future ingenuity.

ARM seems to have been very important to Cambridge at large, but it's not Silicon Valley. I can sort of understand why politicians would look back at things and ponder what could have been done differently.
by Ygg2 | 2025-09-17 08:16:12+00:00
> Right. Allowing 500 strangers to push code to our CI infra

That's bullshit, pure and simple. If you pull in a deeply nested dependency like icu_normalizer it has 30 dependencies, OMGHAXOZRS. I'm doing this, so I don't have to spend a day going through the library.

Except of the 30 depedencies crates, there are 10 from ICUX repository, and then you have almost standard dependencies like proc-macro/syn/quote crates from dtolnay, `zerofrom` from Google. `smallvec` from the Servo project, and yoke from... checks notes... from ICUX.

The only few remaining crates here are `write16`, `utf8_iter` and `utf16_iter` that are written from hsivonen, who is also a ICUX contributor.

So even for 30 dependencies, you actually depend on proc-macro/syn/quote which are foundational crates. Few crates from Google, few crates from Servo, and three crates written by another ICUX contributor.

We started with 30 dependencies and ended up with 3 strangers
by DiogenesKynikos | 2025-09-17 08:16:14+00:00
The Palestinians pursued a 2-state solution (option 1 above) for over two decades. It failed largely because of dead-set opposition from the Israeli right (thanks Netanyahu) and because even the Israeli center-left was unwilling to fully withdraw to Israel's internationally recognized borders and recognize a fully sovereign Palestinian state. There were always demands to keep large chunks of territory (most critically in East Jerusalem) and maintain effective control over any future Palestinian semi-state.

Both options laid out above (the 2-state and 1-state solution) are vastly better for the Palestinians than living under permanent Israeli military occupation with no rights, and subjected to continuous violence from the Israelis. It would not be the Palestinians who would block these types of solutions, were they actually on offer.

The Israelis have a near monopoly on force in this conflict. They are the overwhelmingly dominant party, the only one with tanks, aircraft, destroyers and nuclear weapons. They have the power to dictate solutions, and that's what they've been doing for decades, using brute force. Pretending these are two equal sides that just can't agree is a fantasy.
by rob74 | 2025-09-17 08:17:02+00:00
"It is now safe to turn off your computer" was a kludge for running Windows 95 on PCs with a physical on/off switch (as opposed to newer ATX power supplies, which have a pushbutton to turn them on and can be switched off via software). I guess it's theoretically possible to build a modern PC with a 30+ year PSU, and then you would see this screen again - or, more realistically, you could disconnect the PS_ON line (https://electronics.stackexchange.com/questions/394414/how-d...) from the mainboard, preventing the system from turning off the PSU.
by highwaylights | 2025-09-17 08:17:09+00:00
If you haven’t tried openSUSE Aeon, I’ve been really impressed with it.

BTRFS I find is a more elegant solution than OSTree for this use case, and it’s got a very minimal and polished happy path.

Silverblue covers way more use cases (not least multiple users), but the setup and secure boot encryption setup is very slick and macOS-esque philosophically.
by Yizahi | 2025-09-17 08:17:12+00:00
I don't get the intention of the author. No, I mean, I get that he wants a 80x25 terminal "eventually" but I don't get how exactly. He says it himself that he has multiple different displays, so even if he did manage to get his text only terminal, it will be microscopic on one of the displays, giant on another etc. For me personally, the whole point of terminal rendered by graphic pipeline is that I can get terminal the same size, same font size, and same everything regardless if I use 1080p scaled to 150%, or native 4K or some ancient LCD display on some old laptop (remember 1024x600?). Ok, maybe it is not religiously pure way and maybe it is not as robust and stable way as pure text, but we do get usable terminal in return at least.
by traceroute66 | 2025-09-17 08:18:10+00:00
> And what happens if you lose your Yubikey or it stops working?

That's why you own N+1 Yubikeys ;p

Any place that offers Yubikey auth will enable you to register multiple Yubikeys against your account.

In all my time on the internet I have only ever seen one place that allows Yubikeys but restricts you to one key.
by aurareturn | 2025-09-17 08:18:17+00:00
1. IPO. I'm guessing they can IPO at $1 trillion valuation today. Maybe raise a cool $200b instantly.

2. Continue private investment route getting investments from Saudis, Nvidia, Oracle, Microsoft, and Softbank.

3. Grow revenue 3-4x each year. ~$13b this year. ~$52b next year. Throw all of it into data centers.

So it is possible.
by mzl | 2025-09-17 08:18:18+00:00
If you want to work in Python, I would either use OR-Tools which has a Python library or CPMpy which is a solver agnostic Python library using numpy style for modeling combinatorial optimization problems.

There is a Python package for MiniZinc, but it is aimed at structuring calls to MiniZinc, not as a modeling layer for MiniZinc.

Personally, I think it is better to start with constraint programming style modeling as it is more flexible, and then move to SMT style models like Z3 if or when it is needed. One of the reasons I think CP is a better initial choice is the focus on higher-level concepts and global constraints.
by torginus | 2025-09-17 08:19:30+00:00
I might've misspoken, I didn't mean to imply the UK didn't contribute significantly to these fields, it's that they didn't manage to establish themselves as major players.

I assure you I've heard these sentiments from real Brits.

While I'm not going to question the contributions of UK people and companies to these fields, but with the exception of RR, none of these companies are actually still in the hands of Britons, DeepMind is Google, ARM has been brought out by SoftBank (and Imagination that used to do the GPUs for the iPhone has been kind of sidelined).

The UK is not percieved as a mover and shaker in the rocketry industry like the USA is with SpaceX and the like, and not even to the extent other players like Russia/China are.

Sota AI is made today by US and Chinese firms, while the UK might have an extensively built out green infrastructure, it's made out of foreign-made equipment, no UK company makes EVs like the way Tesla or VW does etc.
by mike_hearn | 2025-09-17 08:20:14+00:00
In that era JavaScript was also loaded with security issues. That's why browsers had to invest so much in kernel sandboxing. Securing JavaScript VMs written by hand in C++ is a dead end, although ironically given this post, it's easier when they're written in Java [1]

But the reason Java is more secure than JavaScript in the context of supply chain attacks is fourfold:

1. Maven packages don't have install scripts. "Installing" a package from a Maven repository just means downloading it to a local cache, and that's it.

2. Java code is loaded lazily on demand, class at a time. Even adding classes to a JAR doesn't guarantee they'll run.

3. Java uses fewer, larger, more curated libraries in which upgrades are a more manual affair involving reading the release notes and the like. This does have its downsides: apps can ship with old libraries that have unfixed bugs. Corporate users tend to have scanners looking for such problems. But it also has an upside, in that pushing bad code doesn't immediately affect anything and there's plenty of time for the author to notice.

4. Corporate Java users often run internal mirrors of Maven rather than having every developer fetch from upstream.

The gap isn't huge: Java frameworks sometimes come with build system plugins that could inject malware as they compile the code, and of course if you can modify a JAR you can always inject code into a class that's very likely to be used on any reasonable codepath.

But for all the ragging people like to do on Java security, it was ahead of its time. A reasonable fix for these kind of supply chain attacks looks a lot like the SecurityManager! The SecurityManager didn't get enough adoption to justify its maintenance costs and was removed, partly because of those factors above that mean supply chain attacks haven't had a significant impact on the JVM ecosystem yet, and partly due to its complexity.

It's not clear yet what securing the supply chain in the Java world will look like. In-process sandboxing might come back or it might be better to adopt a Chrome-style microservice architecture; GraalVM has got a coarser-grained form of sandboxing that supports both in-process and out-of-process isolation already. I wrote about the tradeoffs involved in different approaches here:

https://blog.plan99.net/why-not-capability-languages-a8e6cbd...

[1] https://medium.com/graalvm/writing-truly-memory-safe-jit-com...
by account42 | 2025-09-17 08:20:23+00:00
Still sounds like petty crime that doesn't need the FBI to roll in.

The point is that in the physical world there is some notion of proportionality in the response to trespassing depending on the actual damage done and sophistication and premeditation of the act. We don't generally lock up people because they accidentally walked into an area they shouldn't have. But once computers are involved we have laws that automatically make even even minor infractions into a big scary issue that allows the government to essentially destroy someone's live.
by NitpickLawyer | 2025-09-17 08:20:24+00:00
At this point any announcement about "outright banning AI contributions" is a futile exercise in combining "old men yelling at clouds" with a bunch of "virtue signalling" and a lot of "flamewar troll feeding". Nothing constructive will ever come out of any such attempt. And zero enforcement possibilities in the real world. Hence, futile.

Use your energy wisely, don't interact, don't feed the trolls (on either side) and just keep on keeping on.
by asim | 2025-09-17 08:20:38+00:00
I'm shocked that this post went into negative points territory. It highlights the sentiment of the community here, that we don't even value the governance that was setup to maintain the checks and balances. An organisation tasked with gathering the evidence, checking the facts and then declaring a conclusion that can then be used arguably to convict war crimes is being criticised, incredible. What has happened to us? Listen, we can be disillusioned with the state of the world, but we have to realise that no solution is black or white, no outcome is immediately rectified, no criminal is caught and prosecuted at the time of the crime. And while we can be critical of the governing bodies created to deal with it, they are there for a reason, because the alternative is a wild wild west we don't want to go back to. What we're witnessing in terms of the starvation, bombardment and heinous acts are something humanity has worked tirelessly to avoid. We need to be optimistic that if not today but soon, this report will actually be used as the evidence to convict the criminals who need to be jailed and punished for their horrific acts against humanity. And to add, that goes for anyone who violates the boundaries set forth and anyone who kills innocent people, for any reason. In Islam, it has been dictated that during war you will not kill innocent people. Even the prisoners of war must be treated fairly. We must remember that individuals, groups, they are not representative of an entire philosophy or people e.g whether one body commits a terrible act in the name of a religion does not mean the people who live in peace and harmony advocate for it. But those who oppress and murder others for decades upon decades, they must be held to account.

Maybe this post also gets buried, but if I didn't speak my truth I couldn't live with myself.
by Fluorescence | 2025-09-17 08:21:15+00:00
Most of geopolitics is geography and Israel has greatly benefitted as a unique bridgehead in hostile territory for a changing roster of great-powers and states against another foe e.g.

- Early Soviet support to undermine British Imperialism

- Balfour Declaration from Britain vs. Ottomans

- Nuclear tech from France vs. Nasser and anti-colonialism

- Military/Nuclear from Apartheid South Africa vs. shared pariah status

- Hegemonic power from the US vs. every unaligned country including Cold War, OPEC, Arab Nationalism, Islamism

The more recent metastasising of support into a political-religous-racial belief-system is even more troubling than the apocalyptic machinations of great powers because pure ideology departs from reason itself and is untethered to any care for the consequences.
by Karrot_Kream | 2025-09-17 08:21:22+00:00
As mostly a cyclist (I drive roughly 10% of my transport, the rest is biking and transit), my experience with self-driving cars is that I feel much safer riding in front of them. They're less likely to pass dangerously close to me to drive past me, they're less likely to tailgate me, they're also less likely to just drive me into the door zone, sidewalk, or a parked car. I'm a very confident cyclist but I suspect newer, more skittish cyclists would agree.

If you can restrict certain roads to autonomous cars (or heavily limit the number of non-autonomous cars) then you don't need to build as much bicycle infrastructure (a buffered lane is probably all you need, as opposed to bollards or true grade separation) and I can guarantee you more folks will feel comfortable riding bikes. This is aside from how frequently human-driven cars end up colliding with, damaging, or blocking non-grade-separated forms of transit.

> It's just boring because self-driving is much easier when you build the road to support it instead of removing all constraints and adding GPUs, lidar sensors, cameras and an army of fall-back operators in overseas call centers.

I do bike advocacy so this kind of rhetorical gotcha can make me feel good and hit the upvote button but in reality city councils and other elected officials are mostly people skeptical of the benefits of bicycling, worried that buses/trains would place too high a tax burden on their constituents, or deep down convinced in their lizard brain that Americans are too carpilled to ever do anything else. If you can change this by running for your local council, do it!

Don't get me wrong, we need more bike infrastructure and we needed it yesterday. But anything helps. I'd love to see certain corridors of SF be restricted to transit, autonomous vehicle, and cyclist usage only. Market is already only for transit and cyclists so there's precedent.
by JdeBP | 2025-09-17 08:21:46+00:00
More importantly, VGA text modes cannot be exactly simulated with standard VGA/VESA graphics modes. The people who wrote fake Blue Screen of Death joke programs for Windows NT discovered this years ago.

The article author is explicitly looking for 720 by 400, not 640 by 400, and is trying to obtain that using Linux mechanisms that select graphics modes and do not configure the hardware to be in an actual text mode. i.e. fbcon rather than vgacon.
by the_origami_fox | 2025-09-17 08:22:45+00:00
There are many issues raised with the report, including it omits the invasion by the government of Gaza, Hamas, on 7 October 2023 entirely, and it omits that the Israeli army is fighting the army of Gaza, the Qasam brigades, who had 40,000 salaried fighters (pre-war), have fired thousands of missiles, developed hundreds of kilometres of tunnels specifically for urban warfare, and subverted public and private infrastructure for urban warfare. For such a serious allegation, it is important to consider and address all aspects and not simply omit them.

I would like to add, I don't think this topic is appropriate for Hacker News.
by roryirvine | 2025-09-17 08:23:23+00:00
The problem with that is that the backtick key is awkwardly-placed on most (all?) non-US layouts.

In the UK, for instance, it's immediately above the option key so to hit it requires clawing together your thumb and little finger. It's surprisingly awkward to switch between that and Cmd+Tab.

GNOME does this much better - window switching is done using Super+<whatever the key above Tab is>. In the US, that remains ` but elsewhere it's so much better than on MacOS.
by mzl | 2025-09-17 08:23:30+00:00
I would say that for the specific use-case of a modeling layer for something like constraint programming, SMT, or MIP, full operator overloading is superior. I've written such layers in many languages and used them in even more languages, and it really does help a _lot_ to have the standard mathematical expressions. All the other alternatives become way to cumbersome to write effective models with in my experience.

Is it worth having operator overloading in a language or not? That is a different question. People do bad things with every feature, including operator overloading. I'm slightly in favor of it, but I'm not a fan of using it for anything other than either immediate arithmetic or creating expressions trees representing arithmetic.
by unixhero | 2025-09-17 08:24:18+00:00
That I agree with. In Total Commander I typically do F5 copy and then put it in the background F2. Then start another.

This isn't possible in MC. And also a concrete parallelization is not available. This sounds like a feasible feature request to the upstream MC project! I'm sure Gnu Parallel or just pure C code would be able to handle parallelization of copy jobs.

EDIT: Wait! It does have background transfer now. Which means my technique of how I do it in Total Commander will work in MC now as well. It is almost like having Parallelization.
by internet_points | 2025-09-17 08:25:25+00:00
The above script wraps npm. PWD gets evaluated before npm is called (so PWD is expanded in the "outside" environment).

Of course, if your malicious actor has access to your environment already, they can redefine PWD, but that's assuming you're already compromised. This bwrap script is to avoid that malicious actor running malicious install scripts in the first place.

However, I don't think it protects you against stuff like `npm install compromised-executable && node_modules/.bin/execute-compromised-executable` – then you'd have to bwrap that second call as well. Or just bwrap bash to get a limited shell.
by ExoticPearTree | 2025-09-17 08:27:28+00:00
> The general solution is to do what Debian does.

The problem with this approach is that frameworks tend to "expire" pretty quickly and you can't run anything for too long on Debian until the framework is obsolete. What I mean by obsolete is Debian 13 ships with Golang 1.24, A year from now it's gonna be Golang 1.26 - that is not being made available in trixie. So you have to find an alternative source for the latest golang deb. Same with PHP, Python etc. If you run them for 3 years with no updated just some security fixes here and there, you're gonna wake up in a world of hurt when the next stable release comes out and you have to do en-masse updates that will most likely require huge refactoring because syntax, library changes and so on.

And Javascript is a problem all by itself where versions come up every few months and packages are updated weekly or monthly. You can't run any "modern" app with old packages unless you accept all the bugs or you put in the work and fix them.

I am super interested in a solution for this that provides some security for packages pushed to NPM (the most problematic repository). And for distributions to have a healthy updated ecosystem of packages so you don't get stuck who knows for how long on an old version of some package.

And back to Debian, trixie ships with nginx 1.26.3-3+deb13u1. Why can't they continuously ship the latest stable version if they don't want to use the mainline one?