MurphyA/hacker-news huggingface dataset:
by mvdwoord | 2025-09-17 11:50:12+00:00
Indeed.. besides the herd mentality, and obvious bias in all of these authorities, what irks me most is the complete and utter randomness of the outrage over Gaza.

I'm sure horrible things happen there, also that Israel plays dirty, but the selectiveness of the outrage, and complete silence on similar situations, or for that matter, the United States foreign policy of the past century...

I honestly don't care what happens there. I've seen and read enough to know that the conflicts in the region are so ideological that trying to project any rationality on them is effectively moot.

How come so many Ukrainians were accepted into their neighbor countries when Russia invaded, and apparently none of the neighbors want to have anything to do with the Palestinians?
by viraptor | 2025-09-17 11:50:21+00:00
He thinks from the cosmic perspective political violence and even ridicule doesn't make sense? And we should be thinking of alien worlds instead? He is extremely detached from reality here. He's welcome to live in his world not impacted by people like Kirk. But I'd rather read articles written by people who are impacted by racist policies and xenophobia and I'll think of those "aliens" much closer to our lives.

Avi wrote a perfect description of privilege.

> There is so much more that Charlie could have done if he had lived to his full potential

Yes, he'd make lives of people, very much not like Avi, at least a little bit worse.
by bux93 | 2025-09-17 11:51:34+00:00
It's the same reason police (in every country) are always asking for more powers, and then end up not using them effectively. It's a cycle where crime is not perfectly prevented/punished, politicians blame the police, police blame not having enough powers, and then they get more. But the wrong ones to prevent the next tragedy, well, in hindsight of course. So new powers are needed yet again. (And no-one needs to examine why the existing powers are not used effectively, since the underlying problems there would probably be a lot more expensive and boring to fix, e.g. better pay/hours, better management, education, outreach, blahblahblah.)

Then those powers are abused, curtailed a bit, and the cycle starts again.
by pjmlp | 2025-09-17 11:51:50+00:00
> Maybe other languages that depend on this broken dependency management model, like Cargo, PyPI, RubyGems, and many more, are watching this incident and know that the very same crisis looms in their future. Maybe they will change course, too, before the inevitable.

Unfortunely no, that is why SBOM (Software Bill Of Materials), and only allowing vetted software packages on in-house CI/CD is such a thing on many companies.

Unfortunely not yet spread wide enough, and anyway doesn't do anything for everyone else doing software outside big corporation virtual wall.

Most developers are too trigger happy to add software dependencies without thinking twice about them.
by tanepiper | 2025-09-17 11:51:50+00:00
Author of the article here - holistically this isn't just about NPM dependencies, it's the entire stacks we work with. Cloud vendors provide security, but out of the box they don't provide secure platforms - a lot of this is left up to developers, without security experts - this is dangerous - I have 25 years of experience and I wouldn't want to touch the depths of RBAC.

SaaS products don't enforce good security - I've seen some internally that don't have MFA or EntraID integration because they simply don't have those as features (mostly legacy systems these days, but they still exist).

I'm also an open-source author (I have the most used bit.ly library on npm - and have had demands and requests too), and I'm the only person you can publicly see on our [company github](https://github.com/ikea) - there's reasons for this - but not every company is leeching, rather there is simply no other alternative.
by nickslaughter02 | 2025-09-17 11:52:13+00:00
A few comments about the state of security and privacy in the UK so let me reply with a top level comment instead:

People forget that the UK has ChatControl. It was made into law as part of the Online Safety Act 2023. It has not been enforced so far because it's not "technically feasible to do so" and because companies threatened to leave the UK with their services. You can be 100% certain it will suddenly become feasible if EU does the same.

> The Act also requires platforms, including end-to-end encrypted messengers, to scan for child pornography, which experts say is not possible to implement without undermining users' privacy.[6] The government has said it does not intend to enforce this provision of the Act until it becomes "technically feasible" to do so.[7] The Act also obliges technology platforms to introduce systems that will allow users to better filter out the harmful content they do not want to see.[8][9]

https://en.wikipedia.org/wiki/Online_Safety_Act_2023

https://www.bbc.com/news/technology-66028773
by energy123 | 2025-09-17 11:52:33+00:00
I mean, there is a discrepancy, because even if I grant you your wildest guess as the base case, it is still going to be vastly lower than 6 Hiroshimas, despite 10x higher density, which makes no sense. So maybe it is not "carpet bombing", at least not how it was done in WW2 or Vietnam, and maybe such vague, loaded words are being deployed more for rhetorical effect than for descriptive accuracy. It kind of looks like ... a war?
by d4mi3n | 2025-09-17 11:52:36+00:00
Odd article. I agree on points made about political violence being counterproductive, but the author goes on to imply ridicule of others is as problematic in the same sentence.

Killing someone is a very, very different thing from ridicule and it’s important to recognize this.

While I wouldn’t say ridicule is productive, criticism of problematic ideas absolutely is. I don’t think Charlie deserved to be shot.

At the same time, it is absolutely healthy and important to reject certain ideologies that are counter to the foundational ideas of a society if you want to maintain said society. For the US, I believe that’s anything that erodes the rule of law and disenfranchises citizenry from participating in the democratic procsss.

I’m not deeply familiar with Kirk or his assailant’s ideologies, but I sure as hell hope the US as a country can move away from a lot of the political extremism motivating this violence. I suspect I’ll be disappointed—a lot of people are hurting and that’s hard to come back from—but I hope.
by lapcat | 2025-09-17 11:52:50+00:00
> If he was averaging a dollar a week since release (which I was once told is above average for mac tools) it seems unlikely that cloners would continue cloning his app as long as he kept maintaining the original.

With every comment the developer makes, it becomes more and more apparent to me that the developer's story is a lie, and this HN submission was just a publicity stunt, perhaps in a desperate attempt to escape from App Store oblivion. There are no links or concrete proof given of any of the developer's claims. Unfortunately, the audience appears to have taken the story for granted with no skepticism.
by ACCount37 | 2025-09-17 11:53:00+00:00
LLM image frontends suck, and a lot of them suck big time.

The naive approach of "use a pretrained encoder to massage the input pixels into a bag of soft tokens and paste those tokens into the context window" is good enough to get you a third of the way to humanlike vision performance - but struggles to go much further.

Claude's current vision implementation is also notoriously awful. Like, "a goddamn 4B Gemma 3 beats it" level of awful. For a lot of vision-heavy tasks, you'd be better off using literally anything else.
by reify | 2025-09-17 11:54:03+00:00
Clearly these wankers are repressed homo-sexuals.

I'll add this shit to my U-block filter list to block it

New Discourses is privately owned and operated by James Lindsay, a self-proclaimed expert on critical race theory. The website generates revenue through book sales, donations, and subscription-based content.

New Discourses exhibits a right bias, particularly evident in its strong opposition to Critical Social Justice and related movements. The website frequently publishes content that critiques progressive ideologies and defends classical liberal values. For example, articles like “Queer Theory is the Doctrine of a Sex-Based Cult” and “Marxism is a Cult Religion” reflect a clear conservative stance against what it views as the ideological excesses of the left.

The site’s framing and language often emphasize the dangers of progressive ideologies, portraying them as threats to free speech and liberal democracy. This last article also contains no form of sourcing other than the author’s opinions.
by trhway | 2025-09-17 11:54:06+00:00
>Just look at death tolls maybe? October 7, 1200 people. While despicable, nowhere near the effort Israel is putting in, right?

Crime of genocide has nothing to do with numbers.

It sounds though that for you the numbers do matter, and that the 1200 deaths isn't enough for you. What number is enough for you?

>No one is justifying October 7.

You haven't heard any pro-Palestinian protests and their various supporters?

>Aside from the affect that the Israeli government has pretty much said they want to get all the Palestinians out of Gaza and are actively working towards that.

Moving refugees from one camp to another may be warranted to solve serious security issues (Jordan for example kicked out Palestinians from Jordan back then when the Palestinians attacked Jordan which was hosting them at the time - a lot of similarities to how Palestinians attacked Israel. Nobody argued against expelling Palestinians from Jordan back then). Or do you mean that Gaza is the Motherland of those living there, and they aren't refugees anymore?
by asksomeoneelse | 2025-09-17 11:54:10+00:00
Yeah, I would have been interested in the diff too.

That said, the article does mention replacing basically all the hardware and still encountering the issue. FWIW, my personal experience with Apple software so far is that the usage expected for Average Joe is well tested and polished. But stepping outside of that, it's "Here be dragons" territory very quickly.
by TuxSH | 2025-09-17 11:54:37+00:00
Right, I've checked that char foo = "bar"; is indeed the same as the const char variant (both reference a string literal in rodata), which IMO makes it worse.

About string literals, the C23 standard states:

It is unspecified whether these arrays are distinct provided their elements have the appropriate values. If the program attempts to modify such an array, the behavior is undefined.

therefore `char foo = "bar";` is very bad practice (compared to using const char).

I assumed you wanted a mutable array of char initializable from a string literal, which is provided by std::string and char[] (depending on usecase).

> In modern C++ you probably want to convert to a string_view asap (ideally using the sv literal suffix)

I know as much
by maybewhenthesun | 2025-09-17 11:54:38+00:00
I agree. The opponents (I am one for sure) are often saying 'This is not about catching criminals'. And they are correct in the sense that it goes much further than catching criminals alone.

But there are a lot of people who are no experts in the matter (even among the politicians deciding this matter) and they will discard reasoning which start with 'it's not about catching criminals', because in many cases that is where the idea originates. Law enforcement has the problem that they can't really do (analog) wiretaps anymore in the digital age and they want to remedy that. However, everybody needs to realize that 'restoring the ability to wiretap' has side effects which are way more dangerous than the loss of the wiretap ability.
by jbstack | 2025-09-17 11:54:49+00:00
At no point did I ever point to a video and say that it shows genocide, so your first line is invented. Here's a more accurate version:

Him: "Here is some evidence that some videos have been faked" Me: "The fact that some have been faked doesn't mean there aren't real ones"

So yes, it's the right fallacy.
by FpUser | 2025-09-17 11:54:53+00:00
>"Talk/contacts your ministers and MEPs if you want your voice to be represented."

And be told to sod off.

From Wikipedia: [0]-"Currently, there is one member per member state, but members are bound by their oath of office to represent the general interest of the EU as a whole rather than their home state."

[0] - https://en.wikipedia.org/wiki/European_Commission
by DocTomoe | 2025-09-17 11:54:55+00:00
No, you see, you can trust Father State. He would never ever do anything bad with your data. Trust him. 1933-1945? 1948-1990? Those were ... different times. He's been on a twelve steps program. He's better now.

Data to private companies? That baker that remembers your telelphone number that's DANGEROUS. He could sell the info how many breadrolls you buy per week to the FSB or the MSS. Also, we would lose a chance to add extra fines to small and medium companies, and no-one wants that, do we? ⸮

The older I become, the more 'government' - regardless of the colors it is wearing at the time - looks like Thénardier to me.
Suggestions on practical way to learn algorithms
by unrequited | 2025-09-17 11:55:10+00:00
As a self taught engineer who works in the industry as an SRE/Devops/Infra engineer, haven’t taken a course in Algo/DS. I’m planning to build the foundations by developing intuition to problem solving and understanding the building blocks before I go deep into ML/AI stuff later.

The focus is not really interview problem like leetcode but more to develop foundational understanding/intuition for algorithms and DS. Please do recommend if you have any suggestions on practical way to learn algorithms and data structure, time complexity and in the progress get better at applying the right algorithm or data structure for a problem. Any advice is appreciated.
by crazygringo | 2025-09-17 11:56:36+00:00
The average American sees something like $500 of ads that go through Google per year. There's a profit margin of around 50% since Google has to pay publishers and pay for running search. So that's $250/person in profit per year.

The average American spends something like $12,500 in car+taxi/rideshare per year. Suppose with Waymo that goes down to $7,000 and it's 20% profit. That's $1,400/person in profit per year.

Obviously it gets much more complicated -- the profit margin depends on whether there are serious competitors to Waymo and how much Waymo's head start matters. Waymo will bring costs down further with shared vans and buses on demand. Profitability will rise with video ads in vehicles that you pay not to see. And so forth.

But autonomous rideshare is going to be larger than search any way you look at it. Profits won't be as high as search, but the barriers to entry are so high that profits will be high for a long time.
by tcoff91 | 2025-09-17 11:57:51+00:00
There’s no way within web standards to match iOS native api UX. Even on Android where you have chrome as the mobile browser you can’t match it.

Even if you could ship chrome renderer on iOS you won’t be able to make a mobile web app feel as good as an iOS app. The little details, animations, and microinteractions that come with native apps are better, plus there are other less visiual capabilities like background uploads and prefetching. The moment you need something like an in app camera, a native app is going to be so much better.
by michaelsshaw | 2025-09-17 11:58:04+00:00
The rate of civilian casualties in this action are significantly higher than in any other urban action. It has been this bad for so long that in 2023, the median age in Gaza was 18. The Israeli government has, over decades, performed so called lawn-mowing operations in Gaza.

Here's a question, what kind of defensive violence needs to be scheduled in advance and performed with clockwork regularity? The non-defensive, genocidal kind.

There is no amount of groups, no amount of evidence, no statistic that will get the supporters of Israel now to flip, that much is clear. They are only interested in denying. Facts to them are merely an inconvenience.

When you run cover for this action, in the future you will have to live with the fact that you defended and denied this genocide.
by Arnt | 2025-09-17 11:58:44+00:00
It hasn't been resubmitted yet, has it? The proponents keep it alive without putting it to an actual vote, AIUI. They try to wait until they think they have a majority, and keep their proposal ready for a vote on short order before their majority dissipates.

Which is many things, I' might call it cynical, but it doesn't seem undemocratic.
by boringg | 2025-09-17 11:58:49+00:00
I think you guys shouldn't be comparing “geniuses” because i don't think thats the forcing function here (ie IQ and ability).

The forcing function is having so much responsibility and stress from running so many companies. You have no extra bandwidth for anything. All your time is spent.

So maybe look at comparable people with insane schedules/workloads/very high pressure situations.
by Eddy_Viscosity2 | 2025-09-17 11:58:54+00:00
> And who runs the EU?

How difficult is it to run? How much money do you need? What are the barriers to success? Is it set up so that only the already rich and powerful can run and win (and therefore they are just pushing their own interests), and if not do you need considerable financial support (and therefore are beholden to the already rich and powerful who funded your campaign)?
by bravetraveler | 2025-09-17 12:02:05+00:00
I'm pretty sure SSH wouldn't mind the config being a symlink to a file in your safely-held-elsewhere repository. Maybe I'm wrong. (m)DNS is what I'd really go for if I'm really just looking for easy access to names.

I wouldn't worry, but I also have the habit of adding things to the index explicitly. If I did worry: gitignore.
by yuumei | 2025-09-17 12:02:18+00:00
Worth noting that with RIPA (2000, activated in 2007) UK has enforced key disclosure. It is illegal to fail to disclose a password for any data for any reason (including random data).

I would say the UK has worse privacy than any other country on earth. I'm really hoping for plausible deniability to become more common to help protect against the government.

https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...
by acdha | 2025-09-17 12:02:23+00:00
They’re not the same problems. The Secure Enclave protects things like your biometrics, hardware-backed keys (e.g. on a Mac, WebAuthn and iCloud Keychain), and the integrity of the operating system but not every bit of code running as your account. That means that an NPM install can’t compromise your OS to the point that you can’t recover control, but it means the attacker can get everything you haven’t protected using sandbox features.

That’s the path out of this mess: not just trying to catch it on NPM but moving sensitive data into OS-enforced sandboxes (e.g. Mac containers) so every process you start can’t just read a file and get keys, and using sandboxing features in package managers themselves to restrict when new installs can run code and what they can do (e.g. changing the granularity from “can read any file accessible to the user” to “can read a configuration file at this location and data files selected by the user”), and tracking capability changes (“the leftpad update says it needs ~/.aws in this update?”).

We need to do that long-term but it’s a ton of work since it breaks the general model of how programs work we’ve used for most the last century.
by amelius | 2025-09-17 12:02:44+00:00
> Even under generous assumptions - 0.01% offender prevalence, 90% detection accuracy, and just 1% false positives - you’d correctly flag ~40,500 offenders while generating ~4.5 million false alarms. For every offender, over 110 innocents are treated as suspects.

Playing devil's advocate here, but you can skew those numbers however you want. I.e., given any classifier and corresponding confusion matrix, you can make the number of false positives arbitrarily low, at the cost of more false negatives.
by brookst | 2025-09-17 12:03:12+00:00
Semantic games with “their work”. An artist who sells a painting can still call it their work, even if someone else owns it. And I suppose the collector who bought it could also call it their work, though that phrasing isn’t usually used.

It comes about because “work” is overloaded to mean both the activity of creating and the product/result of that activity.
Secure_packager: A simple tool for distributing data/models securely
by apiemotion | 2025-09-17 12:03:28+00:00
I've just released secure_packager, a Go utility designed to solve a common problem: how to securely ship sensitive files to customers without complex key management or heavy DRM.

The project uses a hybrid encryption approach. Files are encrypted with a symmetric Fernet key, which is then wrapped using the recipient's RSA public key. This ensures confidentiality by design, as the symmetric key is never in plaintext and can only be unwrapped by the intended recipient's private key.

An optional feature allows vendors to include a signed license token, which can be verified at decrypt time to enforce basic access rules (e.g., expiry). It's a simple, portable solution available via CLI or multi-arch Docker images.

Looking forward to your feedback and thoughts.

Link: https://github.com/stevef1uk/secure_packager.git
by dig1 | 2025-09-17 12:03:37+00:00
> You have to learn about what the insane move semantics are (and the syntax for move ctors/operators) to do fairly basic things with the language

That is simply not true. You can write a lot of C++ code without even touching move stuff. Hell, we've been fine without move semantics for the last 30 years :P

> Overloaded operators like operator*() and operator<<() are widely used in the standard library so you're forced to understand what craziness they're doing under the hood

Partially true. operator*() is used through the standard library a lot, because it nicely wraps pointer semantics. Still, you don't have to know about implementation details, as they depend on how the standard library implements the underlying containers.

AFAIK operator<<() is mainly (ab)used by streams. And you can freely skip that part; many C++ developers find them unnecessarily slow and complex.

> Basic standard library datatypes like std::vector use templates, so you're debugging template instantiation issues whether you write your own templated code or not.

As long as you keep things simple, errors are going to be simple. The problem with "modern C++" is that people overuse these new features without fully comprehending their pros and cons, simply because they look cool.
by hyperman1 | 2025-09-17 12:03:40+00:00
Reminds me of a cursed HP keyboard I had at work once. You plug it into USB, then your irq rate goes way, way up. All keyboard events telling you the key pressed last millisecond is still pressed. You literally gained 5 to 10% speed when compiling without it. Apart from that, and the way its sleep-state-destroying irqs ate battery, it was a nice keyboard, so some data entry person got it in the end.
by traceroute66 | 2025-09-17 12:03:49+00:00
This is perhaps a lesson that people should use the extra domain security functions, e.g. Domain Lock which is available on most (all ?) TLDs.

If your registrar does not expose the functionality, move to one that does.

N.B. Ideally you want Domain Lock == REGISTRY-LOCK, there is also REGISTRAR-LOCK which is similar in concept but not quite as secure because REGISTRAR-LOCK is implemented at Registrar not Registry level.