MurphyA/hacker-news huggingface dataset:
by doubled112 | 2025-09-16 12:20:18+00:00
https://a.co/d/igikGeL

I'm not sure how many times it would charge our phones. One day I think we did 4 different ones without issue.

When you're standing around at a BMX track, the functionality here actually made a lot of sense. It's not travel friendly in the same sense.

We have named ours "the cube".

Phone dead? Grab the cube. Tires soft? Grab the cube. Left the lights on in the car? You got it, the cube.
by pbmonster | 2025-09-16 12:20:26+00:00
> It's uncommon, but a wind generator can help a lot

It's uncommon for a reason. Wind generator capacity rises with the square of the rotor diameter. That means small-ish generators (let's say "small enough to be roof mountable without additional mechanical supports") are significantly below 1 kW of power. Seriously, the systems people by for their sailing yachts make around 50W from a nice breeze - enough for lights and to trickle charge the battery while docked, not nearly enough for a fridge.

Combine that with quite a number of moving parts, changing loads and exposure to weather, you get very short maintenance intervals and final lifetimes.

If you have any other option for power, its almost always economical to just use that.
by freakynit | 2025-09-16 12:20:31+00:00
You're partly right.

But the issue isn't just about the “thank god I don't have to deal with that myself” perspective. It's more about asking: do you actually need a dependency, or do you simply want it?

A lot of developers, especially newer ones, tend to blur that distinction. The result is an inflated dependency tree that unnecessarily increases the attack surface for malware.

The "ship fast at all costs" mindset that dominates many startups only makes this worse, since it encourages pulling in packages without much thought to long-term risk.
by grvdrm | 2025-09-16 12:20:32+00:00
Agree, completely.

Also aligns in spirit with "company is not your family" idea.

The original post reads like an aggregation of complaints. I have some too! In particular stating that the Apple Watch is too complicated to use resonates. I have/use regularly but I am never pleased w/the interface.

AirPods on the other hand - a gem. They just work. Sure, they sometimes awkwardly disconnect/connect to other devices (when I have more than 1 vying for attention) but they're rock solid for me thus far.
by coldpie | 2025-09-16 12:20:33+00:00
I don't know Go, but Rust absolutely has the same problem, yes. So does Python. NPM is being discussed here, because it is the topic of the article, but the issue is the ease with which you can pull in unvetted dependencies.

Languages without package managers have a lot more friction to pull in dependencies. You usually rely on the operating system and its package-manager-humans to provide your dependencies; or on primitive OSes like Windows or macOS, you package the dependencies with your application, which involves integrating them into your build and distribution systems. Both of those involve a lot of manual, human effort, which reduces the total number of dependencies (attack points), and makes supply-chain issues like this more likely to be noticed.

The language package managers make it trivial to pull in dozens or hundreds of dependencies, straight from some random source code repository. Your dependencies can add their own dependencies, without you ever knowing. When you have dozens or hundreds of unvetted dependencies, it becomes trivial for an attacker to inject code they control into just one of those dependencies, and then it's game over for every project that includes that one dependency anywhere in their chain.

It's not impossible to do that in the OS-provided or self-managed dependency scenario, but it's much more difficult and will have a much narrower impact.
by eschatology | 2025-09-16 12:20:42+00:00
> What's the hardest part about an open phone?

Very good question; what's holding us back really? If we want an open phone there should be more discussions on this. Some thoughts aided with chatgpt:

Easy: get display, sound, cellular, sensors, inputs working

Harder: (efficient) Power management, App ecosystem: distribution, SDK, compatibility, (tight) Privacy controls, (robust) Update delivery system, (vast) Hardware support, Backward compatibility, Accessibility, Localization, Customizability, Camera (apparently)

Beyond tech:

Proprietary hardware drivers: how do you get the hardware manufacturers' commitment to allocate their engineers to write drivers for the open phone system? Reverse engineering requires more effort and is not very sustainable.

Carrier requirements: Supporting and testing emergency services, lawful interceptions, certifications, possibly differing requirements for each carrier and regions.

Regulatory compliance: Constantly changing requirements by nations and geographical regions.

--

Reading from the other comments, power management seems very hard to get right.

The non-tech reasons seem to be the most challenging; it introduces the most complexity and it's not exactly something that can be achieved by a passionate person in an evening
by Stratoscope | 2025-09-16 12:20:44+00:00
I am a mere programmer, not any kind of UX writer.

A company I worked for some 20 years ago had writers who mostly thought about the "happy path". When things went wrong, the error messages were left up to the programmers.

I discovered this when I tried to install our product on an old Mac and got this message:

Your hard disk is too small

Wait? My what is too small?

Later, on Windows, I got this popup:

You are not here

WTF?

I searched for this message and found it came from a function called CantHappen(), which was kind of like an assert(false). Something you throw into a code path just to note a place that you really know the code can never reach. Until it inevitably does.

I went on a rampage through our code, finding all these crazy messages and updating them - and when possible, fixing the code so the error messages wouldn't be needed.

My manager and his manager, to their credit, knew how bad our messages were, and they helped me pull together a little team with a writer and translators to fix these up. And we did. Our messages got a lot better, easier to understand and more helpful.

All because our Mac installer told me my hard disk was too small.
by delis-thumbs-7e | 2025-09-16 12:20:45+00:00
I don’t have OCD, but pretty bad ADHD and major chronic depression. Neither of those are curable nor do they ever go away even with medication. When I was pretty close to rm -rf / myself, when I got therapy, meda and finally started weightlifting and boxing. Turns out a big bruiser punching you in the face twice a week causing an actual panic, and then having to learn to deal with it - in order to be able to defend oneself - teaches one to deal with the nervous system freaking out from something rather ordinary in the day-to-day life as well. My depression was always ok after boxing as well as my ADHD.

Sadly, since a possible brain injury hardly helps in mental disorders, so it can’t be recommended as a therapy. But it helped me over some hard times. Of course I was in theraphy at the times as well, so there’s that. But I do believe _hard_ physical exercise is excellent way to induce positive mental outcones as well, together with therapy.
by lucideer | 2025-09-16 12:21:06+00:00
> I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem.

I see this odd take a lot - the automatic narrowing of the scope of an attack to the single ecosystem it occurred in most recently, without any real technical argument for doing so.

What's especially concerning is I see this take in the security industry: mitigations put in place to target e.g. NPM, but are then completely absent for PyPi or Crates. It's bizarre not only because it leaves those ecosystems wide open, but also because the mitigation measures would be very similar (so it would be a minimal amount of additional effort for a large benefit).
by LeifCarrotson | 2025-09-16 12:21:15+00:00
It's both that and a culture of installing a myriad of constantly-updating, tiny libraries to do basic utility functions. (Not even libraries, they're more like individual pages in individual books).

In our line-of-business .NET app, we have a logger, a database, a unit tester, and a driver for some specialty hardware. We upgrade to the latest version of each external dependency about once per year (every major version) to avoid accruing tech debt. They're all pinned and locally hosted, nuget exists but we (like most .Net developers) don't use it to the extent that npm devs do. We read the changelogs - all four of them! - and manually update.

I understand that the NPM ecosystem works differently from a "batteries included" .Net environment for a desktop app, but it's not just about where the users are. Line of business code in .Net and Java apps process a lot of important data. Slipping a malicious package into pypi could expose all kinds of juicy, proprietary data, but again, it's less about the existence of a package manager and more about when and how you use it.
by al_borland | 2025-09-16 12:21:29+00:00
This UI refresh seems better than Jony Ive’s attempt. The first version he was in control of was probably the worst UI they’ve had. Poor contrast, ultra-thin fonts, strange color pallet, and the buttons were gone. Need a back button, here: <. Liquid Glass seems much better than that, and they will continue to refine it, just like they did Ive’s design.
by MereInterest | 2025-09-16 12:21:51+00:00
> Do you want to delete this? This action is IRREVERSIBLE

Every so often, I’ll check this github issue[0] from 2017, which requests that the various prune commands for docker (e.g. “docker image prune”) have a dry-run flag to display what will actually be deleted. These commands have a warning that data may be deleted, which requires user confirmation to continue, but don’t actually tell you what actions will be performed based on that confirmation until after the deletion has been performed.

[0] https://github.com/moby/moby/issues/30623
by neilv | 2025-09-16 12:22:03+00:00
Straight face read on client-value.pdf here.

It seems to be describing a series of high-end sales calls, in the form of a management consulting engagement, with the question of, "How can I send IBM more business, and can you help me make slide decks to pitch this idea internally?"

That's not necessarily bad. You could do a lot worse on vendors or consultants.

(And what's the saying? "Nobody ever got fired for hitching their wagon to an IBM sales team.")
by lycopodiopsida | 2025-09-16 12:22:11+00:00
> Until you go get malware

While technically true, I have yet to see Go projects importing thousands of dependencies. They may certainly exist, but are absolutely not the rule. JS projects, however...

We have to realize, that while supply chain attacks can happen everywhere, the best mitigations are development culture and solid standard library - looking at you, cargo.

I am a JS developer by trade and I think that this ecosystem is doomed. I absolutely avoid even installing node on my private machine.
by everdrive | 2025-09-16 12:23:15+00:00
Javascript is badly over-used and over-depended on. So many websites just display text and images, but have extremely heavy javascript libraries because that's what people know and that is part of the default, and because it enables all the tracking that powers the modern web. There's no benefit to the user, and we'd be better off without these sites existing if there were really no other choice but to use javascript.
by alnwlsn | 2025-09-16 12:23:17+00:00
Your mom was probably thinking along the right lines haha.

But don't worry, TV tubes are practically worthless. I've been to swap meets for an antique radio club in my area. Sometimes, there will be a few boxes of tubes from TV sets there (400-500 tubes) and people literally can't give them away. Tubes from audio equipment are the only ones people are after.
by ksec | 2025-09-16 12:24:02+00:00
That is what I have been saying for close to 10 years now. We are quite close to Patents free H.264 High Profile.

You will always have to provide H.264 as baseline due to compatibility. And that has a cost of storage. Bandwidth cost have been declining fast, and with AI Capex it doesn't seems to be slowing down either. Meanwhile Storage cost hasn't drop, if anything recent trend suggest it may have plateau and went up for HDD.

H.264 1080P 2Mbps is good enough for a lot of things. Just like how MPEG-2 is still getting encoder improvement ~30 years later so is H.264 encoder.

There are other codec like LCEVC which you can apply on top of H.264 can provide up to 60% bitrate reduction for 4K content. This saves on storage cost and provide enough benefits.

It is only in streaming services like Netflix where the catalog of video are low enough they could afford to re-encode it every 5- 8 months and storage cost is minimal.

Again a new codec introduction is easily a 10 years task. Higher Speed PON is already being tested, while others are working on NGS-PON2 roll out. 5G Home Broadband with Massive MIMO. The true free and open Video Codec may not be AV1 or AV2, but H.264.
by throw310822 | 2025-09-16 12:24:16+00:00
The skin colour of the victims is not such a relevant part of the issue here- the issue is that Israel has spent decades infiltrating every position of power in western countries as well as building an ideological framework for its impunity: one that identifies Jews as the eternal victims, antisemitism as the root of all criticism and violence towards Israel, while disseminating the idea of Arabs as inferior savages. This is the result. Had they decided to direct their propaganda against Ukrainians instead of Arabs, we would be almost as paralysed as we are now.
by homebrewer | 2025-09-16 12:24:32+00:00
From what I've seen, it's either spam, telemetry, or downloading prebuilt binaries. The first two are anti-user and should not exist, the last one isn't really necessary — swc, esbuild, and typescript-go simply split native versions into separate packages, and install just what your system needs.

Use pnpm and whitelist just what you need. It disables all scripts by default.
by bitexploder | 2025-09-16 12:24:35+00:00
C++ is an advanced programming language with a couple decades of features. Assembly is very simple in terms of syntax, requiring an hour to understand the basics. Assembly is simple if you know the processor you are writing against. It can take some time to learn instructions and figure out how to implement familiar programming constructs like loop and logic conditions. The simplicity of assembly comes with a cost: it takes many more lines of assembly to do simple things compared even to C. The lack of abstraction and language features make assembly very simple, but not easy for large programs.
by matt_s | 2025-09-16 12:24:56+00:00
I stop when I find a solution to the problem. Most of the time the learning happens along the way, not necessarily in the solution itself but all the things you try and iterate on your journey to the solution.

Everything changes in tech by the minute ... but also nothing changes. For web applications it has been HTML, CSS and JS for nearly 30 years. XMLHttpRequest/AJAX came out 25+ years ago. There have been many improvements along the way, like applying design patterns instead of cgi-bin directories with scripts that had a +x modifier on them in the file system. But the base technologies have not changed all that much. We still submit HTML form's with input fields to a back-end server that handles that data. We're still rendering HTML and using CSS to style it. Gone are custom UI toolkits like Flash or Java Applets. Maybe WASM is something to look into but it feels like its not mainstream to me.

If you don't want to get left behind, learn the basic building blocks at a deep level, they don't change much.
by account42 | 2025-09-16 12:24:58+00:00
> I have no idea what they were thinking with that. Their product relied on it having attained the status of being a common unit. They have many recipes calling for 1 box of their product, it's the perfect way to have your customers promote your product or even to lock them into your brand, with the same consistent unit size coming with every variant of your cake mix.

Yes but how do you use that to make the line go up enough to justify a pay rise for yourself.
by Meneth | 2025-09-16 12:25:34+00:00
This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person.

The general solution is to do what Debian does.

Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use.

Keep a testing/unstable distro where new packages and new versions can be added, but even then added only by the distro maintainer, NOT by the package developers. This is where the audits happen.

NPM, Python, Rust, Go, Ruby all suffer from this problem, because they have centralized and open package repositories.
by staminade | 2025-09-16 12:25:55+00:00
Don't they?

I just went to crates.io and picked a random newly updated crate, which happened to be pixelfix, which fixes transparent pixels in pngs.

It has six dependencies and hundreds of transient dependencies, may of which appear to be small and highly specific a la left-pad.

https://crates.io/crates/pixelfix/0.1.1/dependencies

Maybe this package isn't representative, but it feels pretty identical to the JS ecosystem.
by OskarS | 2025-09-16 12:26:08+00:00
I must say, this is a little bit like complaining that Google supplied a PNG when you wanted a JPG. Like, the original file is the TTF/OTF, that's the raw material and what you would use in an OS or an application. And it works fine in CSS as well. Just convert it to a WOFF2 if you really want to, it's not hard.
by everdrive | 2025-09-16 12:26:10+00:00
We're in a state of decline in a number of areas. I agree with you with regard to macOS, but Windows has degraded far worse than even the most cynical among us would have guessed just 5-10 years ago. Linux is great in my opinion, but there's no reason to think it's immune. What happens if corporate interests get even more invested in Linux? Just look at Android. Or, when Linus Torvalds passes, will there be good stewardship? Will the government require ID verification that simply won't run in Linux? The modern computing situation is quite fragile, and many options are receding on a yearly basis.
by diggan | 2025-09-16 12:26:12+00:00
> JS's issue is that it allows you to run an objectively wrong code without throwing explicit error to the user, it just fails silently or does something magical. Seems innocent, until you realize what we use JS for, other than silly websites or ERP dashboards.

What some people see as a fault, others see as a feature :) For me, that's there to prevent entire websites from breaking because some small widget in the bottom right corner breaks, for example. Rather than stopping the entire runtime, it just surfaces that error in the developer tools, but lets the rest to continue working.

Then of course entire web apps crash because one tiny error somewhere (remember seeing a blank page with just some short error text in black in the middle? Those), but that doesn't mean that's the best way of doing things.

> Also remember that it is basically a Lisp wearing Java skin on top

I guess that's why I like it better than TS, that tries to move it away from that. I mainly do Clojure development day-to-day, and static types hardly ever gives me more "safety" than other approaches do. But again, what I do isn't more "correct" than what anyone else does, it's largely based on "It's better for me to program this way".
by tormeh | 2025-09-16 12:26:21+00:00
A good habit, but encryption won't save you in all cases because anything you run has write access to .bashrc.

Frankly, our desktop OSes are not fit for purpose anymore. It's nuts that everything I run can instantly own my entire user account.

It's the old https://xkcd.com/1200/ . That's from 2013 and what little (Flatpak, etc.) has changed has only changed for end users - not developers.
by josteink | 2025-09-16 12:26:31+00:00
I don't get it either. I open the Finder app, and the sidebar is randomly turquoise, over a white background.

It looks ugly, and I have no reason why that sidebar (unlike all other sidebars) is that specific colour. It just makes no sense.

Edit: Oh My God. I just tested installing my own app on Tahoe, and the DMG looks absolutely broken with what used to be solid edges confined inside a window, now being stretched to the window-edges, blurred by the glass-effect making the header on top unreadable.

THANKS APPLE. Jeez.
by stared | 2025-09-16 12:26:31+00:00
OCD can be harsh, and immune to a lot of approaches. It might feel like "LLM on a low temperature".

Even in "Realms of the Human Unconscious: Observations from LSD Research Paperback" by Stanislav Grof, OCD gives remarkable resistance not only to therapy, but even to psychedelics. This book discusses a case of a person with OCD who took 500ug of LSD (well, a rather high dose) yet neither the patient nor their psychiatrist noted any effect. Yet, after getting at ease, much smaller dose worked (and there was a remarkable progress).

What might work though, is reducing overall stress revel. OCD symptoms are often a response to anxiety and uncertainty.
by js8 | 2025-09-16 12:26:33+00:00
What I meant was similar to the article. If I have bit vectors of length 1000 bits (that will be the embedding). Let's say that every concept I want to model corresponds to a set choice of 10 bits being all set to 1, and the remaining bits 0. (These vectors are quasiorthogonal.) Then I can easily store a sentence (bitvector) about 50 concepts, while there is relatively small chance of overlap, i.e. all of the concepts are decodable from that bitstring.

But it's quite similar to what the top comment is saying about spherical codes. I think my comment is also about using coding theory to represent concepts.

Other than that, I don't have any issue with dot product over bitvectors - it's just not very useful for the above.
by jeroenhd | 2025-09-16 12:26:36+00:00
It highly depends on where you live.

I can get gigabit for about €32,50 a month. 2gbps for about €40. Unfortunately, the cheap ISP that offers these rates doesn't have IPv6 so I'll stay with my current one. €70/mo would get me 4gbps symmetrical with another ISP. All of those include a WiFi 7 capable router, of course.

Prices have increased, but high prices are a local problem. The €35 price for cheap gigabit would equate to about €20 in 2000, so I think prices have stagnated alright, but speeds have evolved a lot since then.
by efitz | 2025-09-16 12:26:40+00:00
It's actually harder to design things that are simple than complex

This. In fact it’s often harder to even figure out what simple is until you actually try a bunch of things, and current corporate software methodologies don’t allow for iteration and experimentation to figure it out; you get one shot before the software’s even exists yet.

At the risk of veering off topic, I think the super power that vibe coding gives you is the capability to experiment quickly, so you can figure out how to simplify something.
by mrgoldenbrown | 2025-09-16 12:27:12+00:00
I think it's easy enough to acclimate to the activity. If you are doing something "normal" like driving 75mph on the highway and make a small mistake, like wrenching the steering wheel to the left , you could easily die or kill someone else. But we hand out licenses like they are candy. Woodworkers using a table saw all day are one small mistake away from permanent maiming , and most don't even bother to spend the extra few hundred dollars to mitigate that risk by upgrading to a SawStop. Most people, I think, are good at telling themselves they are better/smarter/more skilled than the people who get hurt.