MurphyA/hacker-news huggingface dataset:
by socalgal2 | 2025-09-08 19:22:35+00:00
You are correct, the discussion is often unthoughtful and spun.

> the bulk of the population an advertiser would actually care about would be the huge middle of the bell curve on Chrome using Windows

The middle of the bell curve in the USA would be an iPhone and there is very little you can customize. So many people have the same model with the same settings that trying to track by fingerprinting is effectively useless.

Yes, PC/Linux users have more to track. They are the minority though. I'm not saying therefore ignore this issue. But grandma is using her phone. Not a PC.

> Firefox sends some dummy data when making use of privacy.resistFingerprinting, and so you should get a unique fingerprint _every time_ you visit a site

This assumes the fingerprinter can't filter out that random data, and that the feature is actually useful. Some of things it does sound like sites might fail or cause problems. Setting timezone to something else seems like I'm going to make a reservation for 7pm only to find out it was 7pm in another timezone. other things it doesn't might not be good for grandma. CSS will report preferred reduced motion as False. CSS will report preferred contrast as No Preference.
by dbdr | 2025-09-08 19:22:41+00:00
Next comment:

> Those are swap contract addresses, not attacker addresses. E.g. 0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af the Uniswap v4 universal router addr.

> Every indication so far is that the attacker stole $0 from all of this. Which is a best-case outcome.
by naikrovek | 2025-09-08 19:22:41+00:00
> The solution is to not use email.

and use what? instant message? few things lack legitimacy more than an instant message asking you to do something.

Links in email are much more of a problem than email itself. So tempting to click. It's right there, you don't have to dig through bookmarks, you don't have to remember anything, just click. A link is seductive.

the actual solution is to avoid dependencies whenever possible, so that you can review them when they change. You depend on them. You ARE reviewing them, right? Fewer things to depend on is better than more, and NPM is very much an ecosystem where one is encouraged to depend on others as much as possible.
by jdthedisciple | 2025-09-08 19:23:15+00:00
Appreciate the perspective. I can see how it would help someone with ADHD.

For me it's a bit different: It's phases.

Some phases of extreme self-control, others where I tend to give in a bit more (usually induced by external stress).

But that tells me I have it in me to do it without external fences.
by tolerance | 2025-09-08 19:23:22+00:00
> If those things were getting aggregated topically it would please both me and Rachel.

I think I catch what you’re getting at and it reminds me of what seems to be a primary gripe with RSS—compromising an otherwise decent spec as far as I can tell—discoverability and curation.

I can’t grasp the more technical issues surrounding polling just yet so I can only intuitively get how it corresponds with the other issues. In spite of this, and leaning again on my intuition, I didn’t get a good feeling from Rachel’s blog post when I first came across it either.

And yeah I’m not sure how FeedLand works under the hood, I just matched Wikipedia's description of a planet with what I knew FeedLand looks like on the frontend.

I also know there’s been some “folksonomic" efforts for curating lesser-know feeds, but to be honest I’m not fond of what these networks of folks appear to be into. Compare your distaste for Daily Kos and 404 Media (which I share) to the vibe I’m trying to avoid on that front.
by devilbunny | 2025-09-08 19:23:36+00:00
> caller on the phone to take higher priority than a customer standing in front of them

Oh. That triggers one horrific memory.

I was buying some bread at a nice local bakery. I wanted a few items. While three or four of us were in line, someone called in. The in-store employee pulled the last loaf of one variety off the shelf to reserve it for them.

When I complained, the manager told me that that was the correct move and they supported the decision. I suggested that polling the people who were actually in the store - actual, not just potential customers - before giving away the last loaf is probably wiser.
by 12_throw_away | 2025-09-08 19:23:42+00:00
> Why a package with 10+ million weekly downloads can just be "updated" like this is beyond me. Have a waiting period. Make sure you have to be explicit. Use dates.

Yep. Also interesting how many automated security scanners picked this up right away ... but NPM itself can't be bothered, their attitude is "YOLO we'll publish anything"
by libraryofbabel | 2025-09-08 19:23:53+00:00
And yet "Hyrum's Law" famously says people will come to rely on features of your system anyway, even if they are undocumented. So I'm not convinced this is really customer-centric, it's more AWS being able to say: hey sorry this change broke things for you, but you were relying on an internal detail. I do think there is a better option here where there are important details that are published but with a "this is subject to change at any time" warning slapped on them. Otherwise, like OP says, customers just have to figure it all out on their own.
Show HN: New Site for My GitHub TUI
by dlvhdr | 2025-09-08 19:23:58+00:00
Hey! So I worked on a new website for my TUI called `dash` on https://gh-dash.dev

The docs content was contributed by a community member @michaeltlombardi https://github.com/michaeltlombardi which I'm super grateful for.

Also, for any community member I created a discord server (https://discord.com/invite/SXNXp9NctV) where we can share configs and nerd out about terminal.

The site itself is built with Starlight by Astro. I've set up a VPS with Dokploy (https://dokploy.com/) which made things so easy! Each PR publishes a new version of the site.

I love ASCII art so I sprinkled just a tiny bit (still need to practice :D).

Let me know what you think!
by pseudosavant | 2025-09-08 19:24:06+00:00
I love Wireguard, but if you want to do this, I think there are only two ways that make sense for most users.

The best option is just to use tailscale, either on your router or on a device on the network that is always on, and set it as an exit node. It uses Wireguard under-the-hood, and it way easier to setup.

If you really must use Wireguard directly, get a router like a GL.iNet with OpenWRT that has a Wireguard server built-in. It'll handle creating certs for users, etc.
by FireBeyond | 2025-09-08 19:24:16+00:00
That's not a concern. At that level, you need to be "type-certified". It's not that they are training on Airbus aircraft, it's that "to operate Airbus (or Boeing or Embraer), you must train on Airbus (Boeing, or Embraer)".

In addition to type certification for a pilot, each airline will then layer their SOPs on top of that, the "this is how -we- fly this aircraft on these types of routes".
by BrandoElFollito | 2025-09-08 19:24:23+00:00
This is a good point, in particular regarding the updates that you do not know happened.

This is also true for a lot of modern greenfield applications where for the legitimate ones this is a blessing and a nightmare for the malicious ones. We just had a strike of cases related to a ODF reader that got updated with malware (https://www.google.com/amp/s/www.bleepingcomputer.com/news/s...)
by FirmwareBurner | 2025-09-08 19:24:23+00:00
Maybe it's the language barrier since I'm not a native English speaker but where I'm from the phrase "brand new" means something different, it means something that just came onto the market very recently, not something that came on the market 10+ years ago but was never opened from the packaging. That's no longer means "brand new", it means "old but never used/opened". Very different things.

So when you tell me "brand new 32 bit Celeron" it is understood as "just came onto the market".

Am I right or wrong with this understanding?

>My point is this stuff is still in play in a lot of places.

I spent ~15 years in embedded and can't concur on the "still in play in a lot of places" part, but I'm not denying some users can't still exists out there, however I'm sure we can probably count them on very few fingers since Intel's 32 bit Embedded chips never had much traction to begin with.
by chpatrick | 2025-09-08 19:24:49+00:00
Actually LLMs crunch through half a terabyte of weights before they "speak". How are you so confident that nothing happens in that immense amount of processing that has anything to do with thinking? Modern LLMs are also trained to have an inner dialogue before they output an answer to the user.

When you type the next word you also put a word that fits some requirement. That doesn't mean you're not thinking.
by cyphax | 2025-09-08 19:25:00+00:00
I've had wireguard in a container for a few years, and it's never failed me. I will say it took me a long time to get the firewall part of the configuration right but the configuration is otherwise simple. When I'm on the road I can access all the things I self host, which I don't have to expose anything of to the outside world.

I also really like using qr codes to transfer a configuration to a phone (mostly used by me once when I replaced my phone): https://www.cyberciti.biz/faq/how-to-generate-wireguard-qr-c...
by vkou | 2025-09-08 19:25:24+00:00
An act of war follows the rules of war. You are allowed to shoot in an area where civilians are, if you are aiming for a military asset.

You can't just massacre a village because some villagers saw you.

The animals who did this were not following the rules of war. The animals who covered it up, and did not prosecute them deserve to hang with them, too.
by rpdillon | 2025-09-08 19:25:28+00:00
The earlier Anthropic case found that training was fair use. Anthropic got slammed for how they obtained the digital copies, not how they used them.

> June 24 (Reuters) - A federal judge in San Francisco ruled late on Monday that Anthropic's use of books without permission to train its artificial intelligence system was legal under U.S. copyright law. Siding with tech companies on a pivotal question for the AI industry, U.S. District Judge William Alsup said Anthropic made "fair use", opens new tab of books by writers Andrea Bartz, Charles Graeber and Kirk Wallace Johnson to train its Claude large language model.

https://www.reuters.com/legal/litigation/anthropic-wins-key-...
by Nathan2055 | 2025-09-08 19:25:36+00:00
That's really surprising to me.

iOS has had pretty decent audio format support for a few years now: even though you can't directly import FLAC files to iTunes/Music, they are supported in the OS itself since 2017 and play fine both in Files and in Safari. The other big mainstream formats (WAV, AIFF, MP3, AAC, and ALAC) have been supported for years, and even Opus finally got picked up in 2021.

About the only non-niche audio format that isn't supported natively on Apple platforms at this point is Vorbis, which was fully superseded by Opus well over a decade ago. Even then, I believe it's possible to get Vorbis support in iOS apps using various media libraries, although I'm sure Apple frowns upon it.

I'd really love to know what's causing that incompatibility.
by xphos | 2025-09-08 19:25:54+00:00
I agree there are much better examples. I think Historically more significant loses have happened. There is trove of techniques Gauss solved 100 years in advance that were not communicated and lost. Example here being FFTs which were not rediscovered until post ww2.

I think the question is also really hard to answer in a non-answerable way because if you don't know you've forgotten who do something you simply just don't know. If you sub-divide humanity in to factions certain factions have lost the economic ability of doing some things for example have been lost to America. While humanity can still do it certain places would be totally lost without the existing tribal knowledge. It would take us a long time to reinvigorate a tool and die industry in America its not a lost thing but if you can't do it commercial currently can you do it at all?

Hopefully that's nota weird direction to take the discussion in
by FluGameAce007 | 2025-09-08 19:26:37+00:00
Disables request signing if the config “Bag” fails to load (e.g. DNS block, timeout).

Unsigned requests are sent directly to Apple APIs. No fallback, no integrity checks. Replay and downgrade attacks are possible.

Includes syslog evidence + PoC sketch: https://github.com/JGoyd/ams-failopen

Not theoretical — this was observed live in the wild.
Ask HN: Technology Teacher Needs Validation from Smarter People
by hnpolicestate | 2025-09-08 19:26:39+00:00
Long story short. I teach K-8 technology. Middle school students figured out how to send memes and communicate with each other via Google slides and docs. The school thinks this is terrible and I must immediately reprimand them for it.

The problem. I am actually impressed that my students found a way to communicate with one another digitally within the police state environment that is managed Google Chromebooks and GoGuardian. Yes, if any of the memes were inappropriate I get that, it's bad. But I mean the technical solution to communicating with one another uses tools outside the box (definitely at their age) from within an authoritarian local system.

What should I do? I feel like telling them that their initial inclinations are valid because information wants to be free. Whether that be digitally, printing press, gossip etc.

Long story short again, I think what they figured out is a good thing. It means they are thinking criticality about how to solve technical conditions which they consider problems. Thoughts? Any brilliant, wealthy people want to vouch for my perspective?
by bigyabai | 2025-09-08 19:26:49+00:00
Software-wise, it makes sense: Nvidia has the IP lead, industry buy-in and supports the OSes everyone wants to use.

Hardware-wise though, I actually agree - Apple has dropped the ball so hard here that it's dumbfounding. They're the only TSMC customer that could realistically ship a comparable volume of chips as Nvidia, even without really impacting their smartphone business. They have hardware designers who can design GPUs from scratch, write proprietary graphics APIs and fine-tune for power efficiency. The only organizational roadblock that I can see is the executive vision, which has been pretty wishy-washy on AI for a while now. Apple wants to build a CoreML silo in a world where better products exist everywhere, it's a dead-end approach that should have died back in 2018.

Contextually it's weird too, I've seen tons of people defend Cook's relationship with Trump as "his duty to shareholders" and the like. But whenever you mention crypto mining or AI datacenter markets, people act like Apple is above selling products that people want. Future MBAs will be taught about this hubris once the shape of the total damages come into view.
by devonsolomon | 2025-09-08 19:26:49+00:00
Thanks! Great idea to use configurator. Turning my iPhone into a dumb phone has been one of the best things I ever did. My relationship with my phone was weird (using it for distraction from anxiety, zoning out on it etc) and all this has gotten way better, I’m finding I can focus again. (I’ve set something similar up using an ad blocker app, but it was a bit of a hack.)

I’d highly suggest installing Dumb Phone (dp) from App Store to simplify your home into a monochromatic list, to top off this excellent guide.
by fidotron | 2025-09-08 19:27:11+00:00
I definitely believe people underestimate the potential of OpenWRT as an app platform. Before getting sidelined with work I did some proof of concept WebRTC SFU on it https://github.com/atomirex/umbrella which worked surprisingly well.

Was also surprised, then not surprised, to learn it's used as the front end on many of the new generation of 3D printers.
by drnick1 | 2025-09-08 19:27:30+00:00
Another option (depending on your requirements) is to use normal "workstation" Linux distro like Debian on an regular x86 PC equipped with two NICs. I added an SFP28 dual NIC to an old gaming PC and now use it as a router/home server and can saturate the link (25Gbps). I get north of 4Gbps through Wireguard too. Routing and the firewall are built into the kernel so you don't really need a specific distro. I just added a DNS server (Unbound in recursive mode) and a DHCP server. For WiFi I use hostapd, but an external AP would be a better solution for most people.
by em500 | 2025-09-08 19:27:40+00:00
> I need Jira, Slack, and GitHub during work hours for example.

So do I, but I certainly don't need them on my phone. For the longest time the only work app I had on my phone was some 2FA thing. Then asked them to either buy me a phone or a yubikey. I got a yubikey (and my phone complete free from anything work related).
by maqp | 2025-09-08 19:27:50+00:00
Shoutout to Signal team for another fantastic achievement!

As a fun evening read I'd like to remind everyone of Pavel Durov's gaslighting on how their approach of everything-leaks-to-server was the right way to implement "cloud backups" for Telegram.

https://web.archive.org/web/20200226124508/https://tgraph.io...

Nice to finally see someone competent show how it's actually done :)
by ndiddy | 2025-09-08 19:27:51+00:00
One thing to note is that Nintendo doesn't really have any intrinsic advantage over the unofficial emulation community just because they produced the NES. Whatever documents they have archived internally (something along the lines of this: https://archive.org/details/famicomdocs ) would just document how the system is supposed to work and how well-behaved software should work, not any of the quirks and edge cases being tested for in the video. I think it makes sense that Nintendo didn't bother making an accurate NES emulator until they moved to the "emulator and a bunch of games" model with the NES Classic and Switch Online. The "emulator bundled with each game" model used by the Virtual Console allowed them to avoid doing all that difficult hardware analysis work. If a poorly behaved game exposed some inaccuracy in the Virtual Console emulator, they were able to add a hack to that game's build of the emulator to make the game run correctly instead of having to figure out what strange hardware behavior the game was depending on.
by jabl | 2025-09-08 19:27:57+00:00
Yeah, vsphere has a mile-long list of enterprise checkbox features that the sales managers can overwhelm the CIO's with on the golf course.

Kubernetes might have success, but AFAICS Kubernetes also sort of involves a new way of architecting applications (cloud native applications, 12-factor apps, microservices, etc.; whatever the buzzword du jour is). The idea with vmware was always to virtualize all those zillions of more or less idling physical servers, and get some snazzy management GUI to handle them all etc. etc.
by barrell | 2025-09-08 19:28:26+00:00
The onboarding flow is already updated with better examples. It’s been my main task this past week — it still needs quite a bit of QA, but it’s been better than the previous flow, so I decided to ship it early. Any bugs will get ironed out in the next day or two. There’s now pretty clear examples of everything

My main task this week (besides QAing the new setup flow) is updating examples on the home page and in the blog. It’s all a one person show, so things move a little slowly, but I’m working as fast as I can :)

The paid trial gets you credits at cost — Phrasing is bootstrapped by me, and there’s no way I can afford a $4 loss leader for everyone who signs up. I would have to 100x the subscription prices (or more) in order to afford that.

There is a way to use the new setup process to “try” the application without spending money, but that’s not an avenue I want to intentionally funnel users through, so you won’t see any copy around it. Feel free to get in touch via the app though if you need more details.

I have plans for a free trial eventually, but its blocked by a few key product developments, so it will be a year at least before that’s an option!
by godelski | 2025-09-08 19:28:41+00:00
Not to mention that this is a pretty good way to fund Signal. That's always been a challenge with Open Source projects as not enough people want to donate. On that note, a lot of companies will do donation matching and just saying, that's one way you could go about it if you feel inclined. For an app I use every day, I don't mind throwing them some beer money (and having work pitch in too). I get more utility out of it than my Spotify subscription
by lubujackson | 2025-09-08 19:28:44+00:00
I agree, the article is very dismissive about losing technology. There's lots of ways we lose technology, from big cultural changes over time (Dark Ages) as well as more niche technologies or processes, like a "secret formula" that was protected until it was lost. The difference with technology is that often we can rediscover lost technologies by the web of understanding we have around it and other advancements in our recovery techniques.

For example, Roman concrete, that strengthens in sea water: https://news.mit.edu/2023/roman-concrete-durability-lime-cas...
by smoovb | 2025-09-08 19:29:23+00:00
Here's what Claude has to say about electrek.co:

Tesla Headlines Sentiment Analysis - Electrek.co Bottom Line: Strongly Negative Sentiment Based on analysis of Tesla headlines and articles from Electrek over the past few months, the sentiment is overwhelmingly negative (approximately 85% negative, 10% neutral, 5% positive). The coverage reveals a company in decline across multiple fronts.
by pseudosavant | 2025-09-08 19:29:42+00:00
Ease of managing multiple OpenWRT devices is still its weakest link. OpenWRT is device centric, but I don't want to managed devices, I want to manage a network.

Modern mesh WiFi systems I've seen do that so well. I know in theory that I could create a VLAN + SSID on my OpenWRT router and APs just for iot devices to only access the internet. But setting that up on a TP-Link mesh was a couple of taps in their app. Doing it on my OpenWRT devices would be quite a bit more hassle.
by NehmadO | 2025-09-08 19:29:46+00:00
Location: San Jose, CA

Remote: Yes

Willing to relocate: No

Technologies: Python, Kotlin, JS, Kali Linux (web exploitation tools), Atlassian suite, Elastic, SQL (MySQL), Docker

Resume/CV: Available upon request

Email: oggiebesk@gmail.com

Website: https://www.olganehmad.com/

An industry veteran with roots in tech support, incident management and QA, I am looking to find my next position in the cybersecurity field. My varied background means I am well-versed in all stages of the development and release process, comfortable in both management and hands-on positions, and have broad familiarity with cybersecurity . In the last year I have been honing my web exploitation skills, in addition to maintaining a technical blog, developing custom tooling and broadening my knowledge base. I am a versatile techie who learns fast, adapts quickly and tends to become an asset to any team I join. I am open to all sorts of cybersecurity positions - Red teaming, pentesting, incident response, technical program management, internal tooling development, and more. Looking forward to hear from you!
by anthk | 2025-09-08 19:29:48+00:00
OpenBSD I386 user there, atom n270. Anyone who says it's useless... Slashem, cdda:bn, mednafen, Bitlbee, catgirl, maxima+gnuplot, ecl with common lisp, offpunk, mutt, aria2c, mbsync, nchat, MPV+yt-dip+streamlink, tut, dillo, mupdf, telescope plus gemini://gemini.dev and gopher://magical.fish ... work uber fast. And luakit does okish with a single tab.
by ranger_danger | 2025-09-08 19:29:50+00:00
The comment by gruez is accurate IMO.

Creepjs actually tries to detect what your browser is lying about and takes that into consideration (or not) based on its heuristics.

I'm still not aware of any FOSS browser (with JS actually enabled and functioning) that can produce a random fingerprint ID on every refresh of the creepjs test site.

But please prove me wrong.