MurphyA/hacker-news huggingface dataset:
by MangoToupe | 2025-09-16 20:11:56+00:00
I'm afraid the latest spate of "recognizing the state of Palestine" is not, in fact, a sign of coming relief for the people there, but rather a spigot to relieve domestic pressure to engage in substantive actions (sanctions, pressuring the US and other suppliers of arms to engage in sanctions, let alone sending peacekeepers or no-fly zones).

Regardless of how much you're personally invested in the topic, this should break the hearts of everyone who dreamed that the international community could hold each other legally accountable. Indeed, the US would rather sanction individuals at the ICJ than acknowledge any sort of legitimacy—even as our own politicians accuse Russia of engaging in "war crimes". I have no doubt that they are, in fact, I think that the evidence is quite damning. But the double standard is striking, as is the difference between the footage visible on social media and what is acknowledged when you turn on the TV or open the paper.
by mrgriscom | 2025-09-16 20:12:52+00:00
SDR is amazing!

Here are some more things you can do with your RTL-SDR after the first 50:

Meteor weather satellite reception (Russian counterpart of the NOAA satellites, but digital, so higher res and in color)

Digital Radio Mondiale -- digital radio but for shortwave

Analog TV -- if you're in an area that still broadcasts this (unlikely), you can receive a black & white picture and closed captioning. If no OTA broadcasts remain, you can use the analog output of a VCR or DVD player

GPS -- rtlsdr is capable of decoding GPS, Galileo, and BeiDou! (Likely not GLONASS since each satellite uses a separate frequency, spreading the signal beyond the sdr's bandwidth)

Hidden secondary audio broadcasts inside FM radio (like the stereo audio hack, but using higher frequencies in the demodulated stream)

Brazilian outlaws and UHF pirates using open repeaters on US military satellites launched in the 70s

TEMPEST / "Van Eck phreaking" where you can remotely read a nearby screen due to leakage from the monitor or video cabling

Instrument landing system -- if you're near an airport you can tune to a runway's ILS frequency and see the signal change as you move from the left side of the runway to the right

Infrared remotes -- stick an IR photodiode in the antenna port and you can demodulate codes from remote controls

Passive radar -- Tune into a very narrowband signal like a VOR or ATSC pilot signal, set your decimation extremely high (i.e., trading bandwidth for dynamic range) and you can see nearby planes in the area from their doppler-shifted reflections of the main signal
by mingus88 | 2025-09-16 20:13:27+00:00
Exactly, because owning a gun and being trained are very different things.

I own guns but I am not capable of performing a Charlie Kirk style assassination. Nor could I actually carry out a school shooting with high rate of fire across many weapons.

Both of these crimes require that the shooter have training and practice in this style of shooting. You need specialized equipment beyond what a casual gun owner will spend. Buying a 9mm and going to the range every couple of months isn’t cutting it.

Gun culture creates the environment where folk are prepping for combat situations. Go watch any guntuber and you’ll see them train for military situations that your hunter, farmer, or even family defense gun owner is not concerned with.

In fact, I learned that there’s a pejorative term “Fudds” for gun owners who aren’t militarized like this. As in, Elmer Fudd; an actual hunter that uses guns for game. Somehow this is not a respectable person for a gun nut.

When gun ownership becomes a hobby and personality trait you see a lot more people optimizing their habits toward maximum lethality
by AnimalMuppet | 2025-09-16 20:13:46+00:00
It's still a massive cherry-pick.

But I suppose it might depend on the point of the study. If the point is "what dangers should people in the US be worried about", then it's absolutely a cherry-pick. If international terrorists kill you, you're still just as dead. But if the point is "where should law enforcement focus its efforts", and if international terrorism is not the responsibility of the same people, then the distinction matters.

Note "not a responsibility" is different from "not primarily the responsibility".
by weinzierl | 2025-09-16 20:14:04+00:00
"exactly the same software supply chain problem"

While the crates ecosystem is certainly not immune to supply chain attacks this over generalization is not justified.

There are several features that make crates.io more robust than npm. One of them is that vulnerable versions can be yanked without human intervention. Desperate comments from maintainers like this one[1] from just a few days ago would not happen with crates.io.

There are also features not provided by crates.io that make the situation better. For example you could very easily clone the repo and run

cargo vet

to check how many of the packages had human audits. I'd done it if I was on a computer, but a quick glance at the Cargo.lock file makes me confident that you'd get a significant number.

[1] https://news.ycombinator.com/item?id=45170687
by 9dev | 2025-09-16 20:14:15+00:00
Until you have to fire one of your disgruntled employees, who has a copy of all your secrets that you now need to rotate.

A repository that an attacker only needs to get access to once, after which they can perform offline attacks against at their leisure.

A repository that contains the history of changed values, possibly making the latter easier, if you used the same encryption secret for rotated values.

This is an awful idea. Use a proper secret management tool you need to authenticate to using OIDC or Passkeys, and load secrets at runtime within the process. Everything else is dangerous.
by g42gregory | 2025-09-16 20:14:30+00:00
I have no basis to conclude anything in this matter. I saw multiple news reports/interviews to that effect. True/not - you get to decide based on news you hear.

Do you have a basis to conclude that "every intelligence and law enforcement agency that has looked into it and published a report has found the opposite"? You exhaustively went through all Western intelligence and law enforcement agencies and read their reports? So you are quoting other news articles/interviews. Apparently their views differed. Ok.
by cbm-vic-20 | 2025-09-16 20:14:31+00:00
Licensing for OpenJDK is trivial (GPLv2+Classpath). Just like gcc/g++ and its runtime library exception.

Licensing for Oracle JDK is more complicated. This is the one where you can use it for free, but after the next LTS you either have to move to the LTS or pay for updates. There's no reason to use Oracle JDK unless you want to pay for support from Oracle, or if your applications specifically require Oracle JDK. Oracle JDK is built from the same source as OpenJDK.

https://blogs.oracle.com/java/post/free-java-license
by LegionMammal978 | 2025-09-16 20:14:51+00:00
In the vast majority of cases, people using ODE solvers are working with physical systems, where there likely aren't more than a dozen digits of accuracy in any of the parameters. So you set some fixed level of accuracy for the output, and seek a method that can reliably attain that accuracy at the lowest cost. (Either that, or the system is too chaotic, in which case you're told not to bother since the output would be meaningless anyway.)

Something I've had trouble finding any information about is, what if we have a mathematical system, where the initial configuration is known to infinite precision, and we want to solve the ODE to an arbitrary precision (say, 100 digits, or 1000 digits)? All the usual stepwise methods would seemingly require a very high order to avoid a galactic step count, but initializing all the coefficients, etc., would be a struggle in itself.

Is this the best that can be done, or are there less-usual methods that would win out at extremely high accuracy levels?
by LorenPechtel | 2025-09-16 20:15:31+00:00
Don't look at school shootings, they don't matter. What matters is how many, not by what means. Note that the most deadly such attack was with a truck, not a gun.

The data proves nothing about whether it works because it's a cultural problem far more than it is a means problem. They choose to go out in a blaze of infamy rather than be a nobody. They generally are planned long in advance, there's plenty of lethal things they can get their hands on.
by Flimm | 2025-09-16 20:15:38+00:00
I've received a phishing email from an @paypal.com email address. (The From: header showed an @paypal.com email address.) Fortunately, the text of the email itself was fishy enough to make me realise it wasn't legitimate. I have no idea how it passed spam filters. I reported the email to both PayPal and my email provider, and I never heard back.
by dang | 2025-09-16 20:16:06+00:00
HN hasn't changed in that way: https://news.ycombinator.com/item?id=17014869. But even if you had been right about that, it wouldn't make it ok to break the rules. That ought to be obvious, no?

Pointing the finger at other users is not a good way to respond when you have been breaking the rules. Everyone always feels like the other person started it and did worse (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...). The only way out of the downward spiral is for users to take responsibility for their own posts and follow the rules regardless of what others are doing.

I'm happy to answer questions about HN in general, but not when the questions feel like a cross-examination and/or a distraction from an important moderation point. If you're curious about aspects of how we operate HN, I'll be happy to answer your questions once you've corrected the things I'm asking you to correct and have built up a track record of using HN as intended.

(But I hear you re "you've continued to post in this style after I asked you to stop" - if you actually hadn't seen my reply yet, then yes, that is a good point. I apologize for assuming wrongly.)
by aeturnum | 2025-09-16 20:17:01+00:00
There was a good overview on here a while ago about the challenges[1]. You need to plan longer in the future and your sensors need to reach further. It's also a much bigger challenge to collect sensor data as fewer diversions happen per mile (but those that do have higher stakes).

[1] https://news.ycombinator.com/item?id=38973404
by SRKDan | 2025-09-16 20:17:04+00:00
Most early startups focus on product, growth, and fundraising, but often their site, socials, and decks all look like different companies. Some argue it doesn’t matter until PMF, others say it kills trust with customers and investors.

I’ve been working on this problem (with an AI tool called Brandiseer that creates/keeps assets consistent), and I’m curious:

Have you seen inconsistent branding actually hurt adoption or fundraising?

Is it worth investing in early, or only after PMF?

Would love to hear founder/investor perspectives.
by all2 | 2025-09-16 20:17:35+00:00
There are algorithms in computational photography that effectively "stack" multiple images of the same thing in order to achieve a kind of 'super-resolution'. It's been a bit since I've done any of that, so I do not recall, but my hazy memory says its pretty straight forward linear algebra (and has the concomitant drawbacks that algorithms of this type have).
by squigz | 2025-09-16 20:18:00+00:00
I'm not denying that there's a difference - obviously technology has enabled the scale of things to grow quite a bit, both good and bad - but it's beside my point, which is that, given that it's not a new phenomenon, blaming it on technology seems doomed to failure. Without solving for the underlying issues, people will continue to mistrust authority, whether they're being told to by news or their neighbor.
by JumpCrisscross | 2025-09-16 20:18:05+00:00
> Why is there an age limit on an all encompassing vax

Vaccines are subject to stringent safety standards since they’re administered to healthy people. The age limit may suggest that at the time of the recommendation, in the relevant jurisdiction, the manufacturer had not studied its safety and efficacy in >40 year olds.

(I also don’t think it’s an age limit as much as the upper end of a recommendation.)
by Saaster | 2025-09-16 20:18:47+00:00
Your framing seems somehow backwards. Based on the other article[0] Nate and David bought out the business from Blue Systems. Jonathan (previously employed by Blue) proposes a co-op model, the new owners say “no thanks, we’re good”. Jonathan is surprised at this, storms out, detonating all the bridges on the way.

[0] https://pointieststick.com/2025/03/10/personal-and-professio...
by kelnos | 2025-09-16 20:20:01+00:00
Sort of, but I don't really buy this argument. Someone could go and write the "missing JS stdlib" library that has no dependencies of its own. They could adopt release policies that reduce the risk of successful supply chain attacks. Other people could depend on it and not suffer deep dependency trees.

JS library authors in general could decide to write their own (or carefully copy-paste from libraries) utility functions for things rather than depend on a huge mess of packages. This isn't always a great path; obviously reinventing the wheel can come with its own problems.

So yes, I'd agree that the ecosystem encourages JS/TS developers to make use of the existing set of libraries and packages with deep dependency trees, but no one is holding a gun to anyone's head. There are other ways to do it.
by steadyelk | 2025-09-16 20:20:09+00:00
Firstly, thanks for reading the ToS and for raising your concern. Not that it means much, but our goal is not to screw over our users. This is the first time someone has raised an issue with the ToS.

We understand how personal user fitness data is, which is why we’ve tried our best to leave data in the control of the users. A first step was to make sure that users actually see the ToS, and we require all users to scroll through them and accept before they link any data with us. But honestly, we know the ToS is daunting for many users, which is why we give clear switches for users to revoke our access to using their data (both for model training and for using their anonymized stats in aggregated statistics); we respect the user’s decision to revoke our access in these ways, even though our ToS doesn’t require us to. Your fitness data gets immediately deleted when you delete your account; we also allow specific sources (e.g., Garmin) to get deleted without deleting your entire account.

But we agree with you–the ToS are too aggressive. For context, we had them drafted by a well-respected firm in the Bay Area. As a startup, we didn’t have the budget to carefully, line-by-line, draft terms that perfectly fit our site. Instead, we gave the firm some ToS from large companies like Strava and Garmin, and asked them if they can draft something similar. We wanted to ensure that we were legally allowed to glean insights from the fitness data of our users, and when we read the terms, it looked like it provided that, which is why we approved it. We aren’t lawyers, so we didn’t understand the ramifications of the legalese, and we’ll make sure to emphasize that we respect the user’s decision to remove our access when we re-draft them. We’ll shop around again for other firms that specialize in this area.
by acdha | 2025-09-16 20:20:26+00:00
The need was clear even 30 years ago when UTF-16 was standardized in 1996. UCS-2 was known at the time to be inadequate but there was a period from the mid-80s to early 90s where western developers tried to rpetend that they could only support a tiny fraction of Asian languages like Chinese (>50k characters, even if Han unification was uncontroversial), scholarly and technical usage, etc. The language used in 1988 was “Unicode aims in the first instance at the characters published in modern text (e.g. in the union of all newspapers and magazines printed in the world in 1988)” with the idea that other characters could be punted into a private registry.

Once enough people accepted that this approach was impractical, UCS-2 was replaced with UTF-16 and surrogate codes. At that point it was clear that UTF-8 was better in almost every scenario because neither had an advantage for random access and UTF-8 was usually substantially smaller.

1. https://unicode.org/history/unicode88.pdf
by IshKebab | 2025-09-16 20:20:30+00:00
Nope. It's because:

1. You don't want to tie your software to the OS. Most people want their software to be cross-platform. Much better to have a language-specific package manager because I'm using the same language on every OS. And when I say "OS" here, I really mean OS or Linux distro, because Linux doesn't have one package manager.

2. OS package managers (where they even exist), have too high a bar of entry. Not only do you have to make a load of different packages for different OSes and distros, but you have to convince all of them to accept them. Waaay too much work for all but the largest projects.

You're probably going to say "Good! It would solve this problem!", but I don't think the solution to package security is to just make it so annoying nobody bothers. We can do better than that.
by LorenPechtel | 2025-09-16 20:20:42+00:00
It's a "problem" because we are becoming a theocracy.

There's no reasonable demonstration of harm and a very strong correlation between availability of pornography and a big reduction in sex crimes. The purported harms are due to blocking reasonable sex education, leaving teens with the equivalent of Hollywood being the only model of sex they see. The original study that was created to show the harms concluded they couldn't find any to anyone, even minors.
by Flimm | 2025-09-16 20:21:14+00:00
I agree. I wonder if there is a good compromise between convenience and security, though. For example, before allowing Google Authenticator to sync for the first time on a new device, maybe notify the user on all devices and enforce a 72-hour delay, or wait until the user approves the new device using an old device (in a way that is hard for a scammer to pass off as legitimate).
by johnh-hn | 2025-09-16 20:21:17+00:00
> In case of XWayland apps, you'll have to choose between allowing X11 apps to scale themselves (like the old days) or having the compositor scale them (the scaling will be right, even across displays, but it will appear blurry at scales higher than 1x.) I still recommend the Wayland session overall; it gives a much more solid scaling experience, especially with multiple monitors.

I'm wondering if this was the problem I was running into before – it sounds eerily familiar. I never got far enough to explore individual apps outside of preinstalled ones because I couldn't get comfortable enough. I appreciate your response as I wasn't aware of the different session types.
by b_e_n_t_o_n | 2025-09-16 20:21:47+00:00
The third example is missing the data binding that you get automatically with React. It should look more like this:

function increment() { count += 1; dispatchEvent(new CustomEvent( "count-incremented", { detail: { count } } )); }

I think I prefer not having to manage events all over the place.
by rectang | 2025-09-16 20:22:02+00:00
It's true that smuggling multiple identities into the whitelist is one attack vector, and one reason why I said "cut down" rather than "eliminate". But that's not easy to do for most organizations.

For what it's worth, back when I was active at the ASF we used to vote on releases — you needed at least 3 positive votes from a whitelist of approved voters to publish a release outside the org and there was a cultural expectation of review. (Dunno if things have changed.) It would have been very difficult to duplicate this NPM attack against the upstream ASF release distribution system.
by tetha | 2025-09-16 20:22:10+00:00
But if we think about a release publishing chain like a BSD process separation, why do they have to be?

Sure, there will be a step/stage that will require access to NPM publish credentials to publish to NPM. But why does this stage need to execute any code except a very small footprint of vetted code? It should just pickup a packaged, signed binary and move it to NPM.

The compilation/packaging step on the other hand doesn't need publishing rights to NPM. Ideally, it should only get a filesystem with the sources, dependencies and a few shared libraries and /sys or /proc dependencies it may need to function. Why does some dependency downloading need access to your entire filesystem? Maybe it needs some allowed secrets, but eh.

It's certainly a lot of change into existing pipelines and ideas, and it's certainly possible to poke holes into there if you want things to be easy. But it'd raise the bar quite a bit.
by chao- | 2025-09-16 20:23:00+00:00
This is my takeaway as well. Having brushed up against a few things like this, I assume there is more back-and-forth about reorganizing Tech Paladin than what is published. However, I am certainly not suggesting an escalatory exposé of communications, as it likely does nothing to change the two bottom line facts: Riddell was not included in the new company, possibly over their disagreement regarding company structure, but this isn't something we could know for certain. Following that, Riddell decided to end contributions to KDE.

EDIT: Updated to reflect details from https://pointieststick.com/2025/09/16/a-few-corrections-abou... reflecting that "...at no point was [Nate Graham] or Techpaladin ever Jonathan’s employer."
by ants_everywhere | 2025-09-16 20:23:33+00:00
The malware is modifying files and adding github workflows. If your builds are reproducible and run from committed code then the only way to add the post install script is if the maintainer reviews and accepts the commit that adds it. Similarly with the github workflow branch.

And if your CI is building and releasing in a sandboxed hermetic environment, then the sandboxes that build and release don't need credentials like AWS_ACCESS_KEY because they can't depend on data from the network. You need credentials for deploying and signing, but they don't need to be present during build time.
by simjnd | 2025-09-16 20:24:48+00:00
> For my taste, this standard macOS 26 Liquid Glass treatment muddies the boundary between UI and content way too much

Exactly this. Apple's marketing of Liquid Glass was about separating navigation from content so that content is more prominent, but in practice it's the exact opposite: animation, flashes, shadows, saturation. The navigation draws so much more attention than the content, especially so in macOS with that floating sidebar thing.

The Notes app, the Music app, and more. Why is the sidebar drawing so much attention? The increased roundness and padding also actively REDUCES the amount of content that is visible. People have compared iOS 26 with whatever iOS version was on the iPhone 5, and despite the iPhone 5 screen being only 4 inches (60% of the size of a regular iPhone today), it shows MORE content than today's iPhone with Liquid Glass.

It really feels like Apple has lost its head. How do people test this, compare this, and say "this is good, this improves the user experience"?