MurphyA/hacker-news huggingface dataset:
by exDM69 | 2025-09-17 10:20:58+00:00
> How exactly does your debugger know whether the compiled code it stepped into came from C++ or Fortran source?

Executables with debug symbols contain the names of the source files it was built from. Your debugger understands the debug symbols, or you can use tools like `addr2line` to find the source file and line number of an instruction in an executable.

Debugger does not need to understand the source language. It's possible to cross language boundaries in just vanilla GDB for example.
by DoctorOW | 2025-09-17 10:21:30+00:00
> The fact that someone would attack an open source product such as DataTables sickens me. I release by far the majority of my work as free open source software, host a free to use CDN, and support the software.

Seriously, no idea what could motivate this, unless a paid datatables vendor felt you were undercutting their business. We all like to think that attacks are beneath them, but stuff like that has happened before.
Scanoss GitHub Actions Adds Dependency Track Integration
by scanosss | 2025-09-17 10:22:03+00:00
The SCANOSS GitHub Actions integration has been extended to support Dependency Track.

This update lets you:

– Convert scan results into CycloneDX SBOMs – Upload results as artifacts – Apply Dependency Track policies directly in the workflow

The same capabilities are also supported in theSCANOSS Python CLI:

scanoss-py export dt scanoss-py ins dt

Repo → https://github.com/scanoss/gha-code-scan
by sausagefeet | 2025-09-17 10:23:17+00:00
Not necessarily. The guidance is to split your TF code across multiple states which might feel like it make sense but for your microservices to communicate that beed to share some base infrastructure, such as networking, so where does that live? Putting dependencies in their own state means that you lose the ability to understand how changing them impacts all of your infrastructure because you have this information black hole at the boundary of their state.

With Stategraph, you'll get all the benefits and isolation of separate state files, but when you changed resources, you'll get meaningful plans around all of the infrastructure they impact, not just the statically defined boundaries of a state file.
by lawnchair | 2025-09-17 10:23:27+00:00
Author here. You are right that splitting by microservice reduces overlap. The problem is shared resources never go away such as VPCs IAM or databases so contention shows up there.

Splitting state files is the common workaround but that only creates new problems like cross state dependencies and orchestration glue. The real issue is the storage model which is a single JSON blob with a global lock. Treating state as a graph with proper concurrency control avoids contention while keeping a cohesive view of infrastructure.
by KaiserPro | 2025-09-17 10:24:27+00:00
1953 was 5.6m above mean sea levels.

but parts of the Netherlands are -3 below sea level, it kinda evens out.

I think the other point to mention is that there isn't one barrier, there are a fuck load of them. (https://nltimes.nl/2024/09/03/tech-failure-nearly-caused-mas... but they also need to be close to work....)
by andy_ppp | 2025-09-17 10:24:48+00:00
I always think just open sourcing the whole software stack for graphics cards would be an excellent thing for hardware manufacturers, in the end these are free pieces of software and I've certain there would be a big community contributing loads of cool things for free. AMD (say) would also sell a load more hardware as enthusiast features would be added by the community.

Maybe I'm just naive but the downsides of doing this seem absolutely minimal and the upsides quite large.
by homebrewer | 2025-09-17 10:25:13+00:00
> ESC was supposed to work immediately, not after a delay.

It's not mc's fault, the Escape delay is added by the terminal emulator, to correctly handle escape sequences. You can probably configure it, but the most portable way that works everywhere is to simply press it twice quickly. It's only barely slower than the DOS way of doing it, and much faster than pressing and waiting for a second.
by p_l | 2025-09-17 10:25:23+00:00
The counterfactual is that the investment required was beyond what even IBM could consider to spend at the time, to the point that even with "guaranteed buyer" in form of military procurement there was strong opposition towards going into "niche computer business".

Military/government procurement provided the demand for which private entities could provide, money and other resources at level that private market never managed.

Without large injection of money supply there's not much extra dollar to chase and safe investments sound like better bets.
by singulasar | 2025-09-17 10:25:30+00:00
Yes to the you guys can detect it in my codebase, but it's generally not required for someone to report a compromised package, we do also discover them ourselves quite fast due to automated scans of npm package updates. This is how aikido was first to discover the previous supply chain hack.

The easiest way for you to use our product to be protected is actually using one of our free open source tools. https://www.npmjs.com/package/@aikidosec/safe-chain

This is a wrapper around npm etc that will prevent you from installing malware
by adastra22 | 2025-09-17 10:26:00+00:00
> When you control the food and water supply for two million people, and turn that off for months until they are starved and malnourished

Show me the evidence. You can find Arabic speaking influencers eating out in Gaza on social media. You can find security camera images of full supermarkets. The facts on the ground don’t match the narrative.

Far from withholding food, most of the food coming into Gaza now is via the Israel government, which is doing an end run around Hamas to get food to the people. Because Hamas, not the IDF, was shooting up aid trucks and taking all the food, both for their own use and to sell at inflated prices.

Hamas via MENA media companies is pushing the narrative of a famine because controlling the food supply is a primary means of extracting money from the population to further the war. Get Americans and Europeans to donate to starving Gazans, to fill the coffers of Hamas.
by Rendello | 2025-09-17 10:26:06+00:00
That's right, I (GP) am not really afraid of them, I just find leeches and bloodsuckers quite unpleasant.

A funny story: a few years ago I went canoeing up a small river with my younger cousin. There's not a lot of current because the river is shallow and there are beaver dams around every corner. Most of the dams are unused and broken up, but the river's so shallow in the late summer that they block quite a bit of water anyway and necessitate portaging.

My cousin, being young, gets bored and stops padding, though he's still willing to help portage. We zig zag up the small river, crashing into either side every few paddlestrokes, because I hadn't realized that being the heavier one, I should be in the back of the canoe.

Eventually we get to a large felled tree blocking the river, and we attempt to portage around it, but the banks are quite steep and thick with brush, and I end up losing the canoe down the river. The current is slow, still, but the canoe is floating away, so I have to strip down and jump in after it. Unfortunately my feet touched the bottom and I was covered in bloodsuckers large and small, some of which hid themselves under my feet and between my toes for the rest of the excursion.

When I got back to the house, I lifted my leg, put my foot in the sink, and said "get the salt!"
by froh42 | 2025-09-17 10:26:11+00:00
My 3D printer has a physical off switch. And it runs Linux - debian - on an embedded ARM board, so I can ssh into the printer etc. (I can even hook up a keyboard and HDMI monitor)

I fear about my filesystem every time I notice the printer is running at night (after a long print job) and I just turn it off without going over to my pc, ssh in and shut down the OS.

Still, it hasn't eaten my filesystem, yet ... ext4 journaling DOES seem to work.
by user34283 | 2025-09-17 10:26:25+00:00
If someone is wondering how effective such an approach is going to be with npm, consider the following:

If you add jest, the popular test runner by Meta, that's adding 300 packages to your dependency graph.

And here we don't yet have a bundler, linter, code formatter, or even web framework.

So good luck with minimizing those dependencies.
by IshKebab | 2025-09-17 10:26:32+00:00
> without using a lot of “unsafe”

You are allowed to use a lot of `unsafe` if you really need to. How much `unsafe` do you use in C++?

> it is uncomfortable with core systems-y things like DMA because it breaks lifetime and ownership models,

Sure, it means it can't prove memory safety. But that just takes you back to parity with C++. It feels bad in Rust because normally you can do way better than that, but this isn't an argument for C++.
by CompoundEyes | 2025-09-17 10:27:05+00:00
All these years later another thing from Zuckerberg to enable playing “hot” or “not” targeting the women around the office with his buddies.

Every owner will “Share your contacts” then do the work of labeling their friends and family in every which way for Meta. Even if those friends and family don’t want to be on social media it’ll be stored.

In the future Meta will just plan to attend a senate hearing, apologize for the misuse of that data and pay a fine.
by MagnumOpus | 2025-09-17 10:27:05+00:00
> people are less naive about it and also realized they don't really care all that much about their second cousin's vacations or their old classmates' life updates

Young people do care - but the "checking on friends" and "showing off my glamourous life/vacation" has moved to Instagram and Snapchat. Partly because Facebook is full of "old people" and thus less cool. As the Insta generation starts to have their own kids, those kids indubitably will look for another platform...
by eviks | 2025-09-17 10:27:17+00:00
> Something being known doesn’t mean a solution exist.

But we aren't talking theory. In this case solutions exist, just not in this app?

Also, the triviality point is puzzling, are we only allowed to criticize professionals for trivial fails? (though using a different font is one of the trivial mitigations)

> that also minimises your liability.

How is that a factor, what is their liability now without any mechanism and will it increase if they add some?
by blackkettle | 2025-09-17 10:27:35+00:00
Cool, I wonder if this means they will finally start letting foreign visitors also use the app. I'm an American living abroad now for many years, and I was initially super excited to try Waymo in LA and SF this summer when I visited with my family. Unfortunately they only make the iPhone app available via the US app store, and while I actually have a US credit card that I could have in theory used to make the switch, Apple makes it an absurd pain to change your region as they require you to both a) cancel any existing subscription AND b) wait until they all expire. Most tourists have it worse as they have no option to even switch in theory.
by rafaelmn | 2025-09-17 10:28:13+00:00
What is your threat/concern that you will not leave the house on order not to be photographed in public ?

I get it could be mildly to very annoying depending on what's available on you online - but not leaving the house ? The only things that come to mind are you have a hit on you and you did an identity change to ditch it or some thinfoil hat level theory.

The way I see this is this is all being done for over a decade now we are just making it more widespread. In some ways I find it a good thing - where previously the government could track you through security infra, now the government servants are also surveiled in all public appearances.

If we're inevitably going in this direction, might as well have the same rules for everyone.
by ianopolous | 2025-09-17 10:28:39+00:00
I love this. It is close to what we've built with Peergos [0].

1. People have to accept you as a follower, and the default is bi-directional.

2. There are no visible follower/friend counts.

3. Chronological feed which has an end (no infinite scroll)

4. No arbitrary character limit

5. No analytics (enforced by E2EE)

We don't have a max friends/number of posts per day though.

[0] https://peergos.org/posts/decentralized-social-media
by mschuster91 | 2025-09-17 10:28:41+00:00
> When the fears are unfounded the reason isn't "Nvidia/Intel could find out things about the hardware"

Good luck trying to explain that to Legal. The problem at the core with everything FOSS is the patent and patent licensing minefield. Hardware patents are already risky enough to get torched by some "submarine patent" troll, the US adds software patents to that mix. And even if you think you got all the licenses you need, it might be the case that the licensing terms ban you from developing FOSS drivers/software implementing the patent, or that you got a situation like the HDMI2/HDCP situation where the DRM <insert derogatory term here> insist on keeping their shit secret, or you got regulatory requirements on RF emissions.

And unless you got backing from someone very high up the chain, Corporate Legal will default to denying your request for FOSS work if there is even a slight chance it might pose a legal risk for the company.
by scabel | 2025-09-17 10:28:56+00:00
I use alacritty. I tried ghostty but not supported on my old home mac, felt slower, and some of the config was not robust. Same with Wezterm, felt slow. Alacritty has worked with no problem everywhere I installed it. Only annoyance was once when the config changed from yaml to toml. Other than that, happy user of alacritty.
by exDM69 | 2025-09-17 10:29:16+00:00
> I wish hardware vendors would just stop trying to write software.

How would/should this work? Release hardware that doesn't have drivers on day one and then wait until someone volunteers to do it?

> Intel had great success for many years by doing that well

Not sure what you're referring to but Intel's open source GPU drivers are mostly written by Intel employees.
by jasonjayr | 2025-09-17 10:29:21+00:00
This video shows a Passive RF/Fiber connector that seems to work pretty reliably for broadcast tv.

https://www.youtube.com/watch?v=wIN7DVGBbKM

I imagine, provided the IR's frequency can be sampled by the SDR, it would look like fairly wide band bursts that could be decoded? Especially if you just treat the SDR as a ADC Oscilloscope
by singulasar | 2025-09-17 10:29:26+00:00
on the other hand, the previous supply chain attack was found by automated tech. Also, if MS would be so kind as to just run similar scans at the time a package is updated instead of after the package is updated (which is the only way the automated tech can run if npm doesn't integrate it), then malware like this would be way less common.

MS doesn't care
by robertlagrant | 2025-09-17 10:29:50+00:00
> if it encourages dev teams to stop the silly habit of returning successful health checks from their microservices even before the back-end dependencies (DBs, other web services, etc) are ready, then it might have some value

Deciding what starts when shouldn't live inside the things themselves. They should be able to start independently and react accordingly if their dependencies aren't met.

Two reasons:

Dependencies can vanish anyway, once everything's started, so it's silly to special-case starting a microservice.

Microservices can need to behave differently depending on the deployment situation, so you don't want to bake into them a single way of doing things.
by tecleandor | 2025-09-17 10:30:42+00:00
This. Protects against strains you don't have, reduces the spreading. We (male that have sex with females, and haven't been vaccinated) are a huge infection vector.

My doctors have generally refused vaccinating me for years (Male/43yo), but finally a new (female) doctor told me it's a good idea. I'm not in a risk group, so I have to pay for the vaccine: Gardasil 9, 3 doses, 3 months away of each other, ~€200 each, although studies say that 2 doses might be enough.

In reality, you can pay to a private doctor so they write you a prescription, but I feel more validated if my doctor says it's OK :)
by michaelsshaw | 2025-09-17 10:30:45+00:00
Amnesty International, The International Red Cross, Doctors Without Borders, numerous other human rights organizations and world governments all say the same thing: genocide. To deny this is to say that you believe all of those groups are wrong and it is actually Netanyahu, Trump, Biden and Harris, along with their cronies in congress are correct. It is a position that cannot be defended logically.
by lproven | 2025-09-17 10:30:58+00:00
This is absolutely fascinating. As usual for Dr Cam, it’s long, very deep, very discursive, and probes superficially disconnected areas. It could almost be calculated to distract me for ages.

Great stuff. I wish someone ported the tForth code and made a standalone text editor (or word processor or even integrated app) that incorporated as much as possible of this editing technology as could be adapted to standard PC/Mac hardware, keyboards, UI controls and so on.
by itopaloglu83 | 2025-09-17 10:31:32+00:00
It’s still a complicated attack and I can understand the registrar being confused, though they should’ve called you for sure.

> They used an email address intentionally crafted to look like it could be mine and submitted a fake driver's license and utility bill with information that could only have been from leaked WHOIS data. The registrar accepted this as proof of identity and started the transfer process. That included sending an email to me to confirm the transfer, an email which I never saw due to the flood of emails (which it is now easy to say was the start of the attack).

Edit: Cloudflare blocking the attackers code with a 1000 error is interesting. Could you share some information about it?
by brewmarche | 2025-09-17 10:32:04+00:00
I have the same phone but to be fair some websites stopped working (GitHub is among them) and some of my banking apps stopped getting updates as well.

No huge deal breakers _personally_ as I don’t need banking on my phone anyway (I have an iPad at home, and also checked that the banks offer authentication devices like TAN generators if I really need to get out of the iOS/Android ecosystem).

Apple Pay still works fine.

I hope that small phone has a long life ahead of it still :)
by imtringued | 2025-09-17 10:32:43+00:00
Billionaire POV: You are one of the most influential humans on the planet. You think to yourself that you are a pretty chill guy and that you haven't wronged anybody directly other than the employees and executives you've shouted at or even fired, but you had very good reasons for doing so.

You've tried your best and as proof of being a good person, you've been rewarded with tremendous wealth, but for some reason society is getting worse and this is getting in the way of obtaining more proof of how good of a person you are.

People start to despise you, even though you know that you did nothing to earn their contempt. Why can't they see how good of a person you are? You're practically Jesus Christ himself, bestowing miracles upon earth!
by mvx64 | 2025-09-17 10:32:53+00:00
It's a very procedural style. I have not used: iterators, lifetimes, Arcs/Boxes/RefCells and whatnot, any kind of generics, data structures other than vecs/arrays, async, and many more. Also avoided functional style, builder patterns...

I only used traits to more easily implement the scenes; a Scene needs to implement a new(), a start() and an update(), so that I can put them in an array and call them like scenes[current_scene_idx].update() from the main loop.

Also, I used some short and simple closures to avoid repeating the same code in many places (like a scope-local write() closure for the menus that wraps drawtext() with some default parameters).

The vast majority of the time is spent in the triangle filling code, where probably some autovectorization is going on when mixing colors. I tried some SIMD there on x86 and didn't see visible improvements.

Apart from obvious and low-hanging fruit (keeping structs simple, keeping the cache happy, don't pass data around needlessly) I didn't do anything interesting. And TBH profiling it shows a lot of cache misses, but I didn't bother further.
by dgb23 | 2025-09-17 10:33:12+00:00
I live in Switzerland and commute mainly via public transport. We're very privileged here.

Because of decades to centuries of investment, holistic planning and expertise, we have one of the best networks in terms of quality, punctuality and density.

It's a plant the trees for future generations kind of deal, especially in Switzerland, because large, "flashy" projects are rare compared to to the more continuous and steady improvements, due to how funding and planning are set up.
by strnisa | 2025-09-17 10:33:18+00:00
You're correct that this adds a barrier to entry, but for many users, that hurdle is still lower than asking them to start a subscription or buy a prepaid bundle.

We plan to provide the classic "Google Sign-In" style pop-up window instead of a redirect. Research indicates that it can increase conversion by approximately 5-10%.

Additionally, we are considering a white-label onboarding flow. If the merchant provides proof of customer identity, we can also skip the sign-in step. Both of these should help improve conversion rates.

A fully embedded solution is possible, but it would require the merchant to collect the customer's card details on Small Transfers' behalf (using Small Transfers' Stripe publishable key), which complicates things from both implementation and legal perspectives.
by homebrewer | 2025-09-17 10:34:20+00:00
I'm partial to pcmanfm-qt, which also supports splits, and has the best "search in current directory" I've seen anywhere. You open a directory, start typing, and it filters out matching files fzf-style.

It doesn't simply select them like some other file managers do, it searches within the name and not just the prefix (again, like some other file managers), you don't have to press anything beforehand. When you get used to it, it's hard to go without it.

https://github.com/lxqt/pcmanfm-qt

For those preferring lightweight environments, it has far fewer dependencies than dolphin.
by user34283 | 2025-09-17 10:34:21+00:00
It's a waste of time to strictly vet dependencies on my side when adding the standard test runner by Meta - jest - alone adds 300 packages to my dependency graph.

So yes, the sprawling deps tree and culture is the problem. We would need to start reducing dependencies of the basic tools first. Otherwise it seems rather pointless to bother app developers with reducing dependencies.
by tompark | 2025-09-17 10:34:50+00:00
I agree, some of the worst employees I've seen were hired that way.

I haven't hired anyone recently but btwn 10-20 years ago I did hire a lot. Of course we reached out via our network of connections but that gets tapped out fast, so you have to rely on job postings. It was always hundreds of applicants per opening. Back then it wasn't 1000's but it might as well have been because I didn't have enough time to sift through them all. That's ok, you can just approach it like "the dowry problem" (also known as the secretary problem [1]).

But the job market and hiring is way worse now, and it's pretty horrible for job seekers atm.

[1] https://en.wikipedia.org/wiki/Secretary_problem
by haijo2 | 2025-09-17 10:35:47+00:00
Yeah the government - the large and powerful institution designed to take care of its people - has to step in.

Lots of scamming behaviour takes place on those platform by means of acquiring wealth on the platform in the form of social currency (likes, followers and so on). And Meta is there to help them exploit - and perhaps hopes to dumb people down further - so they get hooked to the platform more.