MurphyA/hacker-news huggingface dataset:
by K0nserv | 2025-09-08 13:30:56+00:00
I agree with the idea of not making bugs in the first place. Overall I think this piece is great and includes good suggestions. However, personally I think the best weapon to avoid writing bugs is making them impossible in the first place, ala "Making invalid state unpresentable".

Interestingly there's a post from the last day arguing that "Making invalid state unpresentable" is harmful[0], which I don't think I agree with. My experience is that bugs hide in crevices created by having invalid states remain representable and are often caused by the increased cognitive load of not having small reasoning scopes. In terms of reading code to find bugs, having fewer valid states and fewer intersections of valid state makes this easier. With well-define and constrained interfaces you can reason about more code because you need to keep fewer facts in your head.

electric_muse's point in a sibling comment "The whole “just read the code carefully and you’ll find bugs” thing works fine on a 500-line rope implementation. Try that on a million-line distributed system with 15 years of history and a dozen half-baked abstractions layered on top of each other. You won’t build a neat mental model, you’ll get lost in indirection." is a good case study in this too. Having poorly scoped state boundaries means this reasoning is hard, here too making invalid states unpresentable and interfaces constrained helps.

0: https://news.ycombinator.com/item?id=45164444
by spacebanana7 | 2025-09-08 13:30:58+00:00
In the context of my team, us getting rid of npm wouldn't change the whole SPA ecosystem. Or the various requirements we have that effectively mandate SPA like applications.

But in the context of newer ecosystems or ones that are more tightly controlled things might be different. For example if apple massively expanded the swift standard library and made dependency management painful, iOS apps might end up having fewer dependencies.
by raphaeltm | 2025-09-08 13:31:20+00:00
Certainly feels to me like it already has. I like the back and forth on the Big Technology Podcast about whether the model layer or application layer will "win". I think with the release of GPT-5 I'm more and more convinced that the application layer is what will matter more than the actual models. We'll find ways to get around the limitations by building systems that adapt to those limitations by wiring together different models for different use cases. Throwing more data and compute at training feels like it's over IMO.
by sascha_heyer | 2025-09-08 13:31:22+00:00
I'm a huge fan of the Gemini CLI and the power it gives us to automate our workflows. But

I've always found it a bit challenging to discover new and interesting commands. I've spent a lot of time searching through GitHub repos and blog posts, and I always wished there was a central place to find the best commands.

So, I decided to build a solution: https://dotgemini.dev

It's a community-driven website where you can find a curated collection of high-quality Gemini CLI commands.

Here are some of the key features:

Smart Search: Quickly find the command you're looking for.

Powerful Filtering: Filter commands by category to narrow down your options.

Community Votes: Upvote your favorite commands to help them rise to the top.

Top Contributors Hall of Fame: We recognize and celebrate the amazing people who contribute to the collection.

NEW! Easy Drag-and-Drop Contributions: We've made it incredibly easy to share your own commands. Just log in with your GitHub account and drag and drop your .toml files directly onto the site.

I would love for you to check it out, use the commands, and, most importantly, contribute your own commands to the collection. With our new drag-and-drop feature, it only takes a few seconds to share your work with the community.

I've been blown away by the positive response from the community so far. I shared this on LinkedIn a little while ago, and the feedback has been amazing (you can see the post here:

https://www.linkedin.com/feed/update/urn:li:activity:7365709...

It seems like a lot of people are excited about this, which is why I'm so excited to share it with you all here on Reddit.

This is a community project, so your feedback is incredibly valuable.

Please let me know what you think, what features you'd like to see next, and what commands you'd like to add.
by Havoc | 2025-09-08 13:31:56+00:00
RSS has more of a commercial problem. You can’t put ads in it so sites are incentivized to force a site visit. Which in turn forces them to withhold the bulk of the value from the feed itself. Ie just include first sentence or two. Which kills the usefulness of the feed as anything more thank headlines and link. Headlines in turn are all clickbait these days so those don’t have much info density either.
by alphazard | 2025-09-08 13:32:02+00:00
> type systems, invariant checks

Yes, something strange happens in large systems, where it's better to assume they work the way they are supposed to, rather than deal with how they (currently) work in reality.

It's common in industry for (often very productive) people to claim the "code is the source of truth", and just make things work as bluntly as possible. Sprinkling in special cases and workarounds as needed. For smaller systems that might even be the right way about it.

For larger systems, there will always be bugs, and the only way for the number of bugs to tend to zero is for everyone to have the same set of strong assumptions about how the system is supposed to behave. Continuously depending on those assumptions, and building more and more on them will eventually reveal the most consequential bugs, and fixing them will be more straightforward. Once they are fixed, everything assuming the correct behavior is also fixed.

In large systems, it is worse to build something that works, but depends on broken behavior than to build something that doesn't work, but depends on correct behavior. In the second case you basically added an invariant check by building a feature. It's a virtuous process.
by GrumpyGoblin | 2025-09-08 13:32:47+00:00
Uber didn't have to convince anyone, taxis were ripoffs. It didn't even have to always do with money. Taxis asked people where they were going and drove off if it wasn't far enough was a significant issues. Taxis not picking up black people. Many taxis in my town were dirty and and the drivers were jerks or creepy or both. With protections built into law and no competition the industry didn't have to even try to cater to the customer.

The taxi industry sealed it's own death warrant a long time ago. Ride sharing services solved a real problem at the right time. If that cost a bit more, it was well worth it. I won't take a taxi now unless I am forced to.
by HelloUsername | 2025-09-08 13:33:00+00:00
> The NES games inside Animal Crossing blew my mind as a kid

Sounds similar to Donkey Kong 64 (1999) that had an arcade machine inside a level that let you play the original Donkey Kong (1981): https://www.youtube.com/watch?v=vwPRHdhhVK8

> Nintendo doesn't simply have its entire catalogue available via virtual console

Not entirely the same, but Nintendo does offer a lot of their classic games through the Nintendo Switch Online membership: https://www.nintendo.com/us/online/nintendo-switch-online/cl...
by bluGill | 2025-09-08 13:33:03+00:00
There is the question. See "Reflections on Trusting trust" (a classic paper). However in the end you cannot do everything you might want to and so you must trust someone else. Operating systems are common, audited by many, and used by enough that you can have high trust they work in general (but there are some not worthy of trust). Package managers tend to contain many packages that are not in common use and if the only one who audit them might be you so you better do it yourself for each release.

If you only use a package manager for libraries that you have high trust in then you don't need to worry - but there are so few projects you can have high trust in that manual management isn't a big deal. Meanwhile there are many many potentially useful packages that can save you a lot of effort if you use them - but you need to manually audit each because if you don't nobody will and that will bite you.
by jprjr_ | 2025-09-08 13:33:16+00:00
I think there's a deeply-ingrained sense of being in love with our cars, loving to do things in our cars, etc. We made long commutes via car a thing, and I think a part of that was the drive-through - you could get things quickly on your way to/from work.

There used to be a time where the drive-through was a pretty great deal but - for all the reasons you outlined above it's losing a lot of appeal. I think you pretty much hit the nail on the head - businesses prefer drive-through because it requires less staff, less resources. You also eliminate issues with people loitering in lobbies.

There are places where drive-through/walk-up only may be the only way a restaurant will open due to perceived safety concerns. So that I kind of get but ideally, the municipality would find a way to address the actual safety of the area, or at least the perception. Sometimes areas just look dangerous but are actually fine.

But yeah I think the appeal of drive-through is dying out for a variety of reasons. We no longer see cars as convenient, we desire walkability, we value healthier food over faster food, we'd rather work less and have extra time at home to do things like cook, things like that.

I should point out I'm speaking very broadly, as an American who isn't facing poverty. My view is likely limited and skewed, there are very likely to be scenarios I'm not considering.
by thefreeman | 2025-09-08 13:33:23+00:00
It also barely meets the definition of "a vulnerability report". He basically just nmap scanned the server and googled the apache version. The "critical" vulnerability he linked requires controlling a backend server being reverse proxied through apache... so completely irrelevant. I didn't read every CVE for the apache version but I am doubtful there is anything that actually allows taking over the server there.
by ModernMech | 2025-09-08 13:33:24+00:00
Your personal experience with your car doesn't change that Tesla is waving the white flag due to the fact the sensor system Musk insisted on has caused deaths and is too unreliable to deliver full autonomy. The sun has confounded Tesla autonomy since its inception, and its shortcomings caused multiple decapitations: https://www.latimes.com/business/la-fi-tesla-florida-acciden...

> You're just bringing up a never-ending stream of but-what-abouts

By "what abouts" you of course mean "shortcomings of camera-only systems that make them unsuitable for full autonomy."

> It's not a good use of my time.

No it's not, it's a losing battle, and Musk has admitted it. Camera-only systems will not enable full self driving. Y'all got scammed.
by toss1 | 2025-09-08 13:33:51+00:00
THIS.

Conflating a software vulnerability with a criticism of the overall concept is a good way to become non-credible and get both ignored

The article repeatedly claims the entire concept is mere "activism theater" yet with zero evidence or even discussion to back up the claims. In fact, this sort of app may be very effective in both helping people evade authoritarian raids and helping generate flash-mob-type protests that impede the authoritarians. Every bit of friction added to authoritarian rule improves the likelihood of successfully defeating it.

And, buried in the vague overall accusations of not liking the app, the author is stating he's using the wrong version of Apache. I missed anything about the actual good version if it was in there. And, he openly admits he has no idea if the server in question even houses any significant data.

The whole article comes off as the author being an asshat, and even more sore that he's being ignored. TBF, I'd probably ignore him too.

But yeah, it probably is a good idea to run the update sooner rather than later.
by rkrisztian | 2025-09-08 13:33:57+00:00
What are you talking about? AMD has been really good at the power efficiency department until the 3D CPUs that use extra power for cache memory that simply cannot be turned off. Plus, Intel started applying the 3nm fabrication process, while AMD is still at 4nm. But previously, Intel was at 10nm for a long time, see i9-13900K for example, while Ryzen went to 5nm much sooner, see Ryzen 9 7900x.
by scott_w | 2025-09-08 13:34:36+00:00
From the article:

> Complaining is not a character flaw; it is a response shaped by context, past experiences, and unmet needs such as recognition, belonging, or agency. When leaders interpret complaint only as negativity, they risk silencing the very signals that reveal what people care about. By seeing complaints as expressions of care in disguise, leaders can move beyond irritation and instead use inquiry to uncover underlying concerns, redirect energy, and invite ownership. In this way, what begins as frustration can become the raw material for contribution and engagement.
by gwbas1c | 2025-09-08 13:34:42+00:00
> In the software development / security world, someone reporting a vulnerability to you is one of the greatest things one human can do for another.

Depends on context. When it's a knowledgeable user reporting the issue, you're right.

What I mostly encounter are for profit "security researchers" who try to profit on fear and/or misunderstanding.
Ask HN: Why aren't local LLMs used as widely as we expected?
by briansun | 2025-09-08 13:34:45+00:00
On paper, local LLMs seem like a perfect fit for privacy‑sensitive work: no data leaves the machine, no margin cost, and can access local data. Think law firms, financial agents, or companies where IT bans browser extensions and disallows cloud AI tools on work machines. Given that, I’d expect local models to be everywhere by now—yet they still feel niche.

I’m trying to understand what’s in the way. My hypotheses (and I’d love corrections):

1) People optimize for output quality over privacy. 2) Hardware is far behind. 3) The tool people truly want (e.g., “a trustworthy, local‑only browser extension”) have yet to emerge. 4) No one has informed your lawyer about this—for now. 5) Or: adoption is already happening, just not visible.

It’s possible many teams are quietly using Ollama in daily work, and we just don’t hear about it.
by nromiun | 2025-09-08 13:34:49+00:00
Have you tried to write a kernel for basic matrix multiplication? Because I have and I can assure you it is very hard to get 50% of maximum FLOPs, let alone 90%. It is nothing like CPUs where you write a * b in C and get 99% of the performance by the compiler.

Here is an example of how hard it is: https://siboehm.com/articles/22/CUDA-MMM

And this is just basic matrix mult. If you add activation functions it will slow down even more. There is nothing easy about GPU programming, if you care about performance. CUDA gives you all that optimization on a plate.
by rob74 | 2025-09-08 13:34:50+00:00
Sure... and, to prove your point, Go has a package manager too (although it's a relatively new addition). But Go still follows a "batteries included" approach, where "standard" stuff (yes, even database handling) is handled by the standard library. Which still leaves lots of other things for which you need third party packages, but those will be typically far fewer than in other languages.
by SideburnsOfDoom | 2025-09-08 13:35:20+00:00
> He's arguing for developers to be more conscious of the dependencies they use

"be careful all the time" doesn't scale. Half of all developers have below-average diligence, and that's a low bar. No-one is always vigilant, don't think that you're immune to human error.

No, you need tooling, automation to assist. It needs to be supported at the package manager side. Managing a site where many files are uploaded, and then downloaded many times is not a trivial undertaking. It comes with oversight responsibilities. If it's video you have to check for CSAM. If it's executable code, then you have to check for malware.

Package managers are not evil, but they are a tempting target and need to be secured. This can't just be an individual consumer responsibility.

I can't speak for other ecosystems, but some NuGet measures are here:

https://devblogs.microsoft.com/dotnet/building-a-safer-futur...

https://learn.microsoft.com/en-us/nuget/concepts/security-be...

I believe that there have been (a few) successful compromises of packages in NuGet, and that these have been mitigated. I don't know how intense the arms race is now.
by mangoman | 2025-09-08 13:35:25+00:00
I’ve never built something like ICEBlock that puts me personally in the crosshairs of not just normal hacking attempts, but also the political will of the federal government. I can’t imagine the cess pool that is Joshua’s DMs. I think OP makes all the right assessments when examining how seriously ICEBlock is taking the risks here. The Android push notifications assertion is proof enough to make me raise a pretty big question, let alone the other issues raised.

Were I building something that I would want to assert the level of privacy claims that ICEBlock asserts, I would absolutely be taking any/all reports about security extremely seriously.
by account42 | 2025-09-08 13:35:47+00:00
The point of the limits is the challenge though, not just nostalgia. I don't agree that a 64KiB demo is any less impressive on a modern machine than it was back then. On the contrary, moving to something like the latest Pi means there isn't much point in having the limit at all - and those competitions already exist, e.g. a PC "demo" (as opposed to "intro") isn't usually limited to a specific size.
by ynouri | 2025-09-08 13:35:48+00:00
Pave | https://www.pavefi.com | Data Scientist | Backend Engineer | Remote (US or Canada) | Full-time

I’m the Director of Engineering at Pave, a rapidly growing startup revolutionizing financial access for underserved consumers and small businesses through AI-powered Cashflow Analytics and Scores. 50+ risk teams use Pave to reduce defaults, provide the optimal loan amount/credit limit, and maximize collections success.

- We’re hiring Software Engineers in Backend, Full Stack, Data and ML to scale our data processing platform to 100M+ users: https://wellfound.com/l/2BmPpa

- We’re hiring Data Scientists to ship models that will redefine the US credit system, making it fair and inclusive: https://wellfound.com/l/2AqFf9

Shoot us an email at howdy@pave.dev and let us know you found us on HN!

Pave is backed by Better Tomorrow, Bessemer, 8VC, and other top funds and angels from Coinbase, Chime, SoFi, CashApp, and Plaid.
by SOLAR_FIELDS | 2025-09-08 13:35:48+00:00
Title is pretty inflammatory, I agree, but the article itself is also a pretty savage takedown. It just so happens that it was a pretty reasonable savage takedown backed up by evidence and it’s mostly just excerpts of the ICEBlock app author putting his own foot in his mouth and exposing his rather large lack of knowledge and competence in what he is doing.

I do agree with other people’s sentiment here: author is not wrong, but did not really do the most effective thing if their goal was actually to get the ICEBlock author to secure the app. If someone is going to act like a petulant child when confronted with evidence they need to fix something, they need to be treated like a child. And starting off the conversation as combative is going to make the child respond in kind.
by pmontra | 2025-09-08 13:36:01+00:00
Yes, because of human limits of time and of skills.

I remember installing software in the early 90s: download the source code, read the README, find and download the dependencies, read their READMEs, repeat a few times. Sometimes one dependency could not compile because of any incompatibility or bug. Some could be fixed, some couldn't. Often everything ended up with a successful compilation and install and in one day of work I could have what I'm getting in a few minutes now.

Actually those were small programs by today standards. My take is that we would achieve less if we have to use less dependencies.

By the way, the last time I compiled something from source was yesterday. It was openvpn3 on Debian 13, which is still unsupported. TLDR, it works but the apt-get are a little different from the ones in BUILD.md
by zhouzhao | 2025-09-08 13:36:03+00:00
If you had read the actual article, you'd know that the headline is fitting. He got warned, that it is an unflattering article, he got the hint with the insecure web server, he had the chance to explain himself and set things right.

It appear this app was vibe coded, has no security, now serves a lot of people, and the author is somehow thinking how to make money out of it, hence the reluctance to make the code open source
by torginus | 2025-09-08 13:36:10+00:00
This reads much more like a critique of traditional open-source development than package managers themselves.

The author asserts that most open-source projects don't hit the quality standards so that their libraries can be just included, and they'll do what they say.

I assert that this is because there's no serious product effort behind most libraries (as in no dedicated QA/test/release cycle), no large commercial products use it (or if they do, either they do it in a very limited fashion, or just fork it).

Hobbyists do QA as long as it interests them/fits their usecase, but only the big vendors do bulletproof releases (which in the desktop realm seems to be only MS/Apple)

This might have to do with the domain the author chose - desktop development has unfortunately had the life sucked out of it with every dev either being a fullstack/cloud/ML/mobile dev, its mindshare and the resources going toward it have plummeted.

(I also have a sneaking suspicion the author might've encountered those bugs on desktop Linux, which, despite all the cheerleading (and policing negative opinions), is as much as a buggy mess as ever.

In my experience, it's quite likely to run into a bug that nobody has written about on the internet ever.
by znpy | 2025-09-08 13:36:15+00:00
Not a manager, I'm an IC.

I strongly disagree. Noticing the fires is often trivial. Complaining... It depends. Complaining constructively is fine. Complaining for the sake of complaining gets annoying very fast.

Also... People that spend a lot of time complaining are usually that aren't capable of making things happen anyway. They can only see the limitations.

I avoid those people I noticed they just bring down my mental focus.
by kragen | 2025-09-08 13:36:16+00:00
I agree, but what we're trying to look at here is how space-efficient the ISA is at encoding computational operations. If one of the example programs encodes a totally different set of computational operations, it stops being an informative comparison.

But, you may reasonably object, this is handwaving! If a subroutine call is a "computational operation", why isn't duplicating a stack item or storing a variable? The stack code is cheating by not storing all its temporaries into variables! And I think the answer is that there's a bit of a slippery slope there, where more extensive program transformations give us less interesting answers. I would argue that transformations like not allocating registers to temporaries (or, say, subroutine arguments) are more broadly applicable than the transformation you're exhibiting, where the compiler has changed a non-tail call to dumbfib, followed by an addition, into an addition followed by a tail-recursive call implemented as a jump. That depends on being able to reassociate the entire chain of additions through the entire call chain, which is something I wouldn't have expected a compiler to be able to do.

I agree that it's more interesting to see benchmarks that aren't so easily gamed by optimizers, which is why in https://dernocua.github.io/notes/c-stack-bytecode.html I selected a bunch of small C and Pascal subroutines quasi-randomly and hand-compiled them into different candidate stack bytecode representations. I'm not sure that Ackermann or Tak would be as interesting.