MurphyA/hacker-news huggingface dataset:
by caminante | 2025-09-08 16:54:26+00:00
> 30 years ago it wasn't dark ages...

I didn't say or imply books didn't exist. You can't credibly say it was as readily available, and I promise you that people are still making these mistakes, today.

> When you do a shuffling algorithm in a sensitive context (money or security), you have prove that it returns all the possible...If you're unable to prove it, you shouldn't move forward with the algorithm.

Ideally, of course! This is a really high standard that I'm afraid isn't enforced in a lot of commercial or even sensitive applications. 86 million permutations is probably good enough and even if someone was clever enough to synch clocks and narrow to 200k permutations, then I'm not convinced there was actually any harm.

Do you have any proof of harm?

And there are plenty of smart people in the 90s and beyond not realizing that relying a system clock to seed values is attackable. These guys, to their credit, patched their system by openly providing their algorithms.

Even if their clients had been harmed, they'd published the algorithm so that their "sophisticated" clients could audit the algorithm.

> I'm definitely open to reconsider my conclusion if more facts become available.

This is circular as you're taking the article's narrative at face value without getting any primary sources confirming gross negligence or "arrogance" as you imply.
by glenstein | 2025-09-08 16:55:25+00:00
Neuroscience denialism is fascinating to me. It flies under the radar because we mostly hear about global warming denial, evolution denial or flat earther denial. But we have mountains of evidence of wakeful mental states being tied to measurable effects.

Facial recognition is specific to a particular brain region, clearly tied to a mental event sufficient for working definition of a form of conscious activity, and only active when someone is conscious and picturing or imaging a face. Remarkably, damage to the area responsible for facial recognition can predict faceblindness. That is more than enough for a working definition of conscious activity, and that's just one example from mountains of them.

Others include everything from wakefulness under anesthesia (which can be tested for and predicted based on EEGs), as well as which brain activity distinguish locked-in syndrome from persistent vegetative states. Not to mention mountains of evidence for how physical circumstances predict mental states, everything from psychedelics to iron deficiency.

You can always retreat to the claim that nothing short of direct access to another's subjectivity "counts" but that's not how science works. We don't directly see dark matter either (or electrons or neutrons or magnetic fields etc), we see its effects and build theories around them.
by bongodongobob | 2025-09-08 16:55:45+00:00
Eh, I could see it. When I look at my rating graph it's really easy to correlate with life events. Bad stuff at work, rating drops. Went on vacation, goes way up etc. Just being in a bad mood will fuck up my game, so I def think it's very possible it did affect your game that much. Not to mention that that level of chess is very volatile. A 2200 player would definitely not see the same effects.
by junon | 2025-09-08 16:56:19+00:00
It's been almost two hours without a single email back from npm. I am sitting here struggling to figure out what to do to fix any of this. The packages that have Sindre as a co-publisher have been published over but even he isn't able to yank the malicious versions AFAIU.

If there's any ideas on what I should be doing, I'm all ears.

EDIT: I've heard back, they said they're aware and are on it, but no further details.
by bluGill | 2025-09-08 16:57:00+00:00
If the rule is not enforced in ci it isn't a rule. I've made that a mantra for a long time now and it helps. For a while I did verify formatting in ci but eventually we decided that formatiing wasn't as important as getting builds done fast. We still run other test and linters in ci and if they break fix the build but formatting isn't really that imbortant so we don't care. Yes our formatting is somewhat a mess but it isn't really that bad even after a decade of agreeing not to care.
by bitpush | 2025-09-08 16:57:40+00:00
Whether a company has a business relationship with a company you dont like, doesnt make the same argument you're making.

It is like saying, I dont like Coca Cola but when I go to McDonald's to eat food, they only serve Coca Cola. Hence, Coca Cola is.. bad? McDonald's is free to chose any business partner they like, and you insisting that McDonald's shouldnt use Coca Cola sounds silly.
by wtbdbrrr | 2025-09-08 16:57:42+00:00
Now ... of course.

And do they mention anything about how much of the work is going to be outsourced and where to? Or are they gonna import workers to do the job and send them back home when their local AI can replace most of the easy and tedious stuff? Or are they gonna use local models to do all that right away?

The site is loading ...
by akkartik | 2025-09-08 16:58:22+00:00
This looks brilliant. I just hope they make it easy to do test restores. In particular, I want to test restore without perturbing my main device. Let me restore using the secret key on a new device.

When I install Signal on a computer it won't show me message history. Will backups allow me to view _all_ my message history on a computer? A big screen is very helpful for browsing lots of messages.
Show HN: Shadcn-native shadcn UI for React Native
by ethan_krich | 2025-09-08 16:58:24+00:00
After trying to find a ui Library which works which works well with Expo and react native web. I decided to create my own.

Cross platform: iOS, Andriod, and the web with Windows and macOS support on the way.

Our components are accessible on Native and the web. To achieve web accesibility we use react-aria

This is what differentiates us even beyond shadcn/ui! Our components include extra variants so you can adjust error, loading, borderRadius, and style without writing any extra tailwind.

Storybook: We have included a storybook to let you play with all the variants.

Tested: We write unit tests for all the components to ensure they are working as expected.

Customizable: You own the code and the implementation. You can customize anything you want.

Get a live demo with storybook here https://main--68af7af75f72e5521a7e0f93.chromatic.com/?path=/...
by hadlock | 2025-09-08 16:58:31+00:00
If VRAM is ~$10/gb I suspect people paying $450 for a 12GB card would be happy to pay $1200 for a 64gb card. Running local LLM only uses about 3-6% of my GPU's capability, but all of it's VRAM. Local LLM has no need for 6 3090s to serve a single or handful of users; they just need the VRAM to run the model locally.
by ryandrake | 2025-09-08 16:58:43+00:00
I think we should stop using "driveway repairs" as a derogative term. There's nothing wrong with a car owner repairing their own car. Years ago, that was a very usual, normal thing to do. I replaced my own wheel bearings in my garage, and have been driving on them for 5 years. It's not that difficult, and doing it yourself doesn't make your car unsafe or defective.

Kind of scary how "repairing your own things yourself" has fallen so far out of fashion. We should be applauding and encouraging people to build these kind of skills, not insulting them.
by exmadscientist | 2025-09-08 16:59:36+00:00
> I have to assume that amd and intel would like similar chips

They historically haven't. They've wanted the higher single-core performance and frequency and they've pulled out all the stops to get it. Everything had been optimized for this. (Also, they underinvested in their uncores, the nastiest part of a modern processor. Part of the reason AMD is beating Intel right now despite being overall very similar is their more recent and more reliable uncore design.)

They are now realizing that this was, perhaps, a mistake.

AMD is only now in a position to afford to invest otherwise (they chose quite well among the options actually available to them, in my opinion), but Intel has no such excuse.
by vikingerik | 2025-09-08 16:59:44+00:00
The assume-good-faith answer to a speed limit dip like that is usually that the road has one or more intersections with some risk factor. Like limited visibility around a bend or hill, or a short merging/acceleration area, or prone to flooding in rain, or intersection with a bike trail. Of course, any particular spot like yours could be a police cash grab, but there are many places where something like that seems arbitrary but there is a real reason. Best to follow the signs, for conditions you might not know about.
by quotemstr | 2025-09-08 17:00:14+00:00
Not your fault. Thanks for posting and being proactive about fixing the problem. It could happen to anyone.

And because it could happen to anyone that we should be doing a better job using AI models for defense. If ordinary people reading a link target URL can see it as suspicious, a model probably can too. We should be plumbing all our emails through privacy-preserving models to detect things like this. The old family of vulnerability scanners isn't working.
by th0ma5 | 2025-09-08 17:00:15+00:00
It's wild to see would-be influencers continue to build upon a pile of sand, each trying to out pace the lingo on one hand and clinging to anecdotes and conjecture on the other. I wish like other technologies there were first principals that everyone could agree on but you still see it here with people offering what worked for them as some kind of objective fact. Someone should study how these influencer tactics are short circuited by this stuff?
What would you learn to become a "full stack web developer"?
by firefax | 2025-09-08 17:00:24+00:00
My web design skills are left in the 90s -- I can make a nice little web page for a research group or set up a small wordpress, but I haven't done much Design With a Capital D in many years.

So as a personal project I will be redoing my personal site.

If you were looking to redo your personal website, what tech would you use?

I guess there's two asks:

1.) What do you use to design small static sites if not coding by hand?

2.) What tech stack do you think currently captures the needs of the market in terms of "full stack developer".

I've found designing a web page gets... distracting. It's kind of like building a house from the ground up (or so I heard, for some reason adults loved to come up to me at parties as a child and complain about things like the number of doorbells in their life. People coming up... what type of switchplate cover? What type of switch? What color is it? What about the body?... and that's if there's no user input.

So while I respect that a lot of folks are big on AI here, I'm really more interested in books, courses, or just names of tech stacks that I can self learn from. I used to have a bit of a phobia of math, which translated into a phobia of programming, but to paint a picture I was able to get fluent with Python using Al Sweigart's books[0] after a couple false starts trying to start using the K&H C book... people were adamant online (AKA Slashdot) at the time that interpreted languages were inefficient and "real programmers" will be forever handicapped if we don't learn it and learn it first...

Anyways, if anyone has strong opinions on how to build a website, in terms of tech or design, I'd love suggestions on how to bridge the "gulf of execution" on this project.

[0] This one doubles as both an intro to Python and cryptography and has helped friends on the more pure math/physics side learn jump to programming [1] https://en.wikipedia.org/wiki/Gulf_of_execution
by matthewdgreen | 2025-09-08 17:00:53+00:00
If you’re a search engine competitor of Google’s, and Google owns the largest browser and mobile OS and pays the remaining browsers to make them the default, your business is vastly less likely to succeed. This holds even if customers could go out of their way to use your service. That’s what I understood this verdict to have determined. Unfortunately the remedy is bad and pointless, but that’s a separate matter.
by phkahler | 2025-09-08 17:01:14+00:00
>> which silently intercepts crypto and web3 activity in the browser, manipulates wallet interactions, and rewrites payment destinations so that funds and approvals are redirected to attacker-controlled accounts without any obvious signs to the user.

If you're doing financial transactions using a big pile of NPM dependencies, you should IMHO be financially liable for this kind of thing when your users get scammed.
by coredog64 | 2025-09-08 17:01:41+00:00
This comment appears to misunderstand the control plane/data plane distinction of AWS. AWS does have limited access to your control plane, primarily for things like enabling your TAMs to analyze your costs or getting assistance from enterprise support teams. They absolutely do not have access to your dataplane unless you specifically grant it. The primary use case for the latter is allowing writes into your storage for things like ALB access logs to S3. If you were deep in a debug session with enterprise support they might request one-off access to something large in S3, but I would be surprised if that were to happen.
by jijijijij | 2025-09-08 17:02:03+00:00
> Within mainland China, Apple was facing fraud of having their devices purchased, stripped for genuine parts, and then rebuilt with knockoffs and sold as new to unsuspecting victims within China or returned.

This doesn't make any sense. If Apple wasn't making genuine parts extremely valuable by locking down the hardware, making this proposed scam economically attractive, there would be no such scam. Circular logic.
by theologic | 2025-09-08 17:02:08+00:00
Consumer Labs offers as a subscription service testing of various vitamins Including fish oil. They perform a great service, and I think it's economical in terms of determining if what you're buying is really what you want.

Heavy metal contamination is classically not a problem because the fish oil is distilled. My guess is your researcher friend has fallen victim to the marketing of the pharmacological industry-- Although I do want to indicate they do have value, probably not the 500 percent markup that they put on what in essence is a generic product.

Some natural fish oils are not distilled and do have this problem-- These are normally marketed as natural or cod liver oil or something that should hit your radar pretty quick. Your friend's concern about rancidity is clearly a problem And pretty well understood by people for years if you have any familiarity with chemistry. Omega threes get their name from the fact that you have a weird bend on the end of a long carbon molecule. This is susceptible to oxidation. This is true for any Omega 3 molecule regardless of its length Or it's sourcing.

This includes omega-3 "drugs" like Vascepa (pure EPA) and Lovaza (EPA and DHA combination).

Fortunately in testing, they have not found widespread issues with rancidity, although they definitely have found pockets. My normal suggestion to everybody is by a high volume manufacturer that you know is tearing through the product quite rapidly. My top suggestion is Costco. Then make sure you keep your fish oil in the refrigerator, and churn through it on a regular basis.
by Animats | 2025-09-08 17:02:09+00:00
Here are two suppressed inventions.

The first was Airadar. (Not "AI", "Air".)[1] I wrote about this on HN in 2016. This was a small phased-array radar for light aircraft, developed in 1973. It was suppressed by a patent secrecy order, because it was better than what the USAF had at the time. The inventor was a really good RF designer. Phased array radars existed back then, but they were huge ground-based installations. Mini phased array radars are available now, but it took decades for them to be available for light aircraft.[2]

The second was the electronic fluorescent lamp ballast. This was a replacement for those bulky magnetic ballasts found inside fluorescent light fixtures. The inventor licensed it to MagneTek, the biggest maker for magnetic ballasts, which didn't make it and didn't pay any royalties. So the inventor went to Townsend, Townsend, and Crew, the IP law firm in Palo Alto, and, after much litigation, came out with a hundred million or so. The law firm put this in their reception room brag book. Today, electronic fluorescent lamp ballasts are a commodity.

The problem with FOGBANK, the aerogel used in fusion weapons, turned out to be that the original process only worked because of some impurity in the raw materials. Attempts to replicate the process used a source for a raw material which was now better purified, and the process failed. It required tens of millions of dollars and a special appropriation to figure out the underlying problem. There was a period of over a decade during which the US could not make new H-bombs.

[1] https://books.google.com/books?id=NWzlTqj0gQ4C&pg=PA64#v=one...

[2] https://www.garmin.com/en-US/p/576890/

[3] https://news.ycombinator.com/item?id=11862911
by redskyluan | 2025-09-08 17:02:19+00:00
Author of this article.

Yes, I’m the founder and maintainer of the Milvus project, and also a big fan of many AWS projects, including S3, Lambda, and Aurora. Personally, I don’t consider S3Vector to be among the best products in the S3 ecosystem, though I was impressed by its excellent latency control. It’s not particularly fast, nor is it feature-rich, but it seems to embody S3’s design philosophy: being “good enough” for certain scenarios.

In contrast, the products I’ve built usually push for extreme scalability and high performance. Beyond Milvus, I’ve also been deeply involved in the development of HBase and Oracle products. I hope more people will dive into the underlying implementation of S3Vector—this kind of discussion could greatly benefit both the search and storage communities and accelerate their growth.
by elvisloops | 2025-09-08 17:02:33+00:00
I can't believe Signal is doing this.

Signal is known for its cutting-edge cryptographic protocol, but this feature has the effect of throwing that out the window and replacing it with a single static key. If a device with this enabled goes through the whole advanced protocol to receive a message (double ratcheting etc), then turns around and uploads it back to Signal’s servers with a static key, isn't that a roundabout way of replacing all of signal's protocol and its forward secrecy with a static key that has no forward secrecy?

They’re calling it "opt-in," but it doesn't look like that's actually true? You can’t know whether someone you’re talking to -- who may not understand the implications -- has enabled it. In group chats, it looks like a single person turning it on eliminates signal protocol for everyone in the chat.

Based on this post, the only way to actually opt out of this is to force disappearing messages to be enabled for a time under 24 hours for every chat, which is pretty frustrating.

Signal already lags other messengers in reliability, speed, and features. The reason people use it is for its uncompromising security. Shipping something that weakens that foundation undermines the reason people use Signal.
by austin-cheney | 2025-09-08 17:03:34+00:00
Boycotting countries that actively participate in apartheid sounds perfectly reasonable to me. When that apartheid graduates to ethnic cleansing and then genocide it becomes more than reasonable, more than necessary. Israel will not stop murdering people until they are crushed either economically, militarily, or both. Their political leaders have made this clear even to the loud objections of their own military leadership.
by georgeecollins | 2025-09-08 17:03:44+00:00
I think I could add some great entries to this website! When I started at Activision I went through a bunch of old Infocom (Zork/ Planetfall) docs including design docs for games they never made. It taught me a lot.

And then I have my own. I might even still have a cartridge for Halo for the Nintendo DS. It was really pretty nice, but Bungie was like: No way!
by yoyohello13 | 2025-09-08 17:04:41+00:00
Same! I have no patience for these kind of arguments about formatting. I don't care that you don't like what the formatter does, it isn't about you. I've written code in several different languages over the years and the main take away is that I can get used to reading anything. It's so important to pick a standard and follow it. As long as that standard is somewhat sane I couldn't care less what the actual standard is.

Another argument that is a pet peeve of mine is significant white-space vs curly braces. It literally doesn't matter. We often get new Python developers coming from a C# background and the amount of bitching about curly braces is so annoying. Just learn the language bro, it's not that hard.
by stale2002 | 2025-09-08 17:04:43+00:00
> you're using trump coin as an exemplar?

Its an exemplar of "The government definitely isn't going to go after the crypto space, as even something as ridiculous as this is allowed". |

This is because you previously said "what you can't do is suggest throwing them out altogether".

But if freaking trump coin exists, then it looks like, yes, we actually can throw out all the rules.

> crypto won??

It won the regulation war, yes. Its not going away. If the president launched his own meme coin, then everyone else is safe.
by Someone | 2025-09-08 17:04:46+00:00
I guess that hardware doesn’t make things faster (¿yet?). If so I guess they would have mentioned it in https://machinelearning.apple.com/research/core-ml-on-device.... That is updated for Sequoia and says

“This technical post details how to optimize and deploy an LLM to Apple silicon, achieving the performance required for real time use cases. In this example we use Llama-3.1-8B-Instruct, a popular mid-size LLM, and we show how using Apple’s Core ML framework and the optimizations described here, this model can be run locally on a Mac with M1 Max with about ~33 tokens/s decoding speed. While this post focuses on a particular Llama model, the principles outlined here apply generally to other transformer-based LLMs of different sizes.”
by mhh__ | 2025-09-08 17:04:47+00:00
Some styles can actively make some people less productive though e.g. I really try to avoid allman braces because I can work a lot better with denser (for a certain definition of dense code)

This, however, usually doesn't effect me if the official format for a project is one way or the other because [drumroll] I just format my tree differently and then format to the official style when I push.
by PaulHoule | 2025-09-08 17:04:57+00:00
I’ve seen a lot of Dave Winer saying his blub is good enough and abstractly that ActivityPub is too complex. There’s pixelfed too. Practically if I want to have an ActivityPub feed for my blog I might host in on Mastodon and if the character limit is too little you can have a server like

https://writefreely.org/

If anything characterizes the RSS community it is a lack of imagination and rejection of the last 25 years of work in relevance, ML and UX. RSS readers are still failing with the same failing interfaces that failed 25 years ago.

That said, the people who are still using it feel satisfied and other than Rachel that aren’t a lot of people who will try to stop you if you do try something ambitious. You just gotta poll poll poll and poll poll poll some more or pay somebody to poll poll poll for you.