MurphyA/hacker-news huggingface dataset:
by fkyoureadthedoc | 2025-09-16 12:37:07+00:00
There are many examples of good and bad regulations, I don't think you can just point at this one and say "see, regulation bad." They were too narrowly focused on cartridge based systems because that's what high school kids were hooked on.

Technically the disposables need FDA approval I think, many just don't have it. Manufacturers, importers, and retailers just don't care. There's a buck to be made and the spice must flow.
by kees99 | 2025-09-16 12:37:14+00:00
I agree other repos deserve a good look for potential mitigations as well (PyPI too, has a history of publishing malicious packages).

But don't brush off "special status" of NPM here. It is unique in that JS being language of both front-end and back-end, it is much easier for the crooks to sneak in malware that will end up running in visitor's browser and affect them directly. And that makes it a uniquely more attractive target.
by munksbeer | 2025-09-16 12:38:46+00:00
Factories are a pattern that is not unique to Java. They're used prolifically in C++ at least, and I'm sure in other languages.

The factory pattern is tightly coupled with polymorphism. If you're not using polymorphism, then you may not typically need factories. But if you are, then at some point you're going to have some conditional logic about what concrete type of class you're going to create of a particular interface.

Modern Java is lending itself more towards data oriented programming, and coders are trending in that direction. This may or may not last, like every trend. But even then, at the moment this tends to still involve using sealed interfaces and records, so you still have some form of instance creation and polymorphism.

How do you avoid factories? Doesn't you code end up littered with worse code?
by jones89176 | 2025-09-16 12:39:00+00:00
Oh, hello, i recognize your username from the jolla forums :-) I do have two Gigasets here (GX290 and GX4 pro) waiting to be flashed, but I still need to finally set up a windows machine to make a proper backup of the stock android images and generate the scatter files. Like with most of the SoC-Vendors, the MTK tools are quite a PITA. I have to download some weird binaries from some weird websites. How can it be that there are no official tools available for things like this?!

And there is one more Question I have since you're already here ;-) I'm already doing embedded Linux development in my day job, so I would say I have quite some knowledge in that area. However I haven't found a good introduction to this whole "porting" topic. Do you have some advice on how to get started in that direction? What exactly happens when I flash (say) sailfish onto some (specific) Android version? Why do I even need this? How does the whole libhybris thing work and why don't people just use the binary drivers from some Android image? It's all very confusing to me. Especially since people from the android corner seem to use different terminology that the embedded Linux crowd...

anyway, thanks for your work so far. I hope I can join the SFOS users (again) soon!
by t1234s | 2025-09-16 12:39:30+00:00
If you are ever able to make it to the KSC visitor complex in Cape Canaveral they have mock-ups of both the Gemini and earlier Mercury capsules you can get in as a size reference. They are both incredibly tight. It's amazing during Gemini 7 they spent 14 days crammed in the capsule testing systems, doing EVA activity along with normal human activity (eating, sleeping, bodily functions). All while being seconds from death at any time if things go wrong. These early astronauts were men of a different caliber.
by orwin | 2025-09-16 12:39:32+00:00
Not really, the Nazis did manage to push a lot of pro-nazi judges everywhere, who judged that what their friends were doing was legal, but fair judges wouldn't have danced to the same tune.

A Brown shirt killed by a communist/socialist was always illegal, but a communist/socialist killed by a brown shirt was always self defence and always legal.

That's why the rule of law is so important, and that's why it shouldn't have exceptions for anyone, even policemen (arguments could be made for elected people as long as they are elected though).
by cookiengineer | 2025-09-16 12:40:13+00:00
Part of the reason of my switch to using Go as my primary language is that there's this trend of purego implementations which usually aim towards zero dependencies besides the stdlib and golang.org/x.

These kind of projects usually are pretty great because they aim to work with CGO_ENABLED=0 so the libs are very portable and work with different syscall backends.

Additionally I really like to go mod vendor my snapshot of dependencies which is great for short term fixes, but it won't fix the cause in the long run.

However, the go ecosystem is just as vulnerable here because of lack of signing off package updates. As long as there's no verification possible end-to-end when it comes to "who signed this package" then there's no way this will get better.

Additionally most supply chaib attacks focussed on the CI/CD infrastructure in the past, because they are just as broken with just as many problems. There needs to be a better CI/CD workflow where signing keys don't have to be available on the runners themselves, otherwise this will just shift the attack surface to a different location.

In my opinion the package managers are somewhat to blame here, too. They should encourage and mandate gpg signatures, and especially in git commits when they rely on git tags for distribution.
by zelphirkalt | 2025-09-16 12:40:21+00:00
If that is the point, then I feel it is made out of technical mediocrity, rather than excellence. A good team should be able to adapt the technology that best fits the task, and companies should be able to hire for it. Or stay mediocre otherwise.

The hiring issue is home made. If companies started hiring for engineering skills, rather than familiarity with existing tech stack, it would change quickly. Experienced engineers are able to learn new languages and frameworks on the job. Of course, if hiring is too petty to give engineers a month of getting familiar with the product and expect readiness from the get go, then they will continue to miss out on talent.
by gethly | 2025-09-16 12:40:23+00:00
Don't. By that I mean, do not get involved in the tax burden yourself. Let the sellers, which are businesses, manage their own taxes. This is what I am doing with my own project. Amazon and few others have taken up on themselves to make life of their sellers easier by handling taxes for them, especially for EU, but i see no reason for it whatsoever.

Businesses should be businesses and handle their own taxes and legal obligations by themselves.

Additionally, if you get involved in between the seller and the buyer, YOU are now liable when it comes to taxes, as you become de-facto the seller, you have to handle returns/refunds(including the tax aspect and have to handle already paid taxes in such cases as well), audits and other legal aspects. There is simply no good reason why you should involve yourself in this whatsoever. Just facilitate the business transaction, but not the financial transaction.
by TomaszZielinski | 2025-09-16 12:40:51+00:00
I can’t recall a single time where I would want to put JSX in an „if” statement.. In fact I can’t recall a single time where I would want to use JSX in a different context than the return value of a render phase.

So from my personal experience the things you mentioned are non-issues in practice. Do you have a different experience?
by ghtbircshotbe | 2025-09-16 12:40:53+00:00
This is a common thing to hear, but I'm not sure how true it is. It would be nice to hear from a historian, but Hitler and the Nazis did many things that were not legal in the early days. They did dodgy and possibly illegal things to give Hitler German citizenship so that he could run in German elections. He literally employed a private army which was committing violent acts across Germany. Not long after being appointed chancellor he personally ordered murders and assassinations including the night of long knives.
by JdeBP | 2025-09-16 12:40:58+00:00
The problem is that all other things are no longer equal, and have not been for quite some time.

Retuning digital audio to 440Hz equal temperament is an industry norm now, even for (say) re-issued 1970s stuff. You just won't get modern digital versions that are the same as the analogue versions, and the equal temperament stuff thus won't pass a resonance test unless the test instrument is also equal temperament, which most string instruments of course are not.

The far easier test for amateurs nowadays is not to buy a whole string instrument, but to use pitch monitoring applications, which all too readily show when a sound is bang-on the specific equal temperament frequencies.

Obligatory recent Fil Henley:

* https://youtube.com/watch?v=0x5dfbqE5hE
by mananaysiempre | 2025-09-16 12:41:01+00:00
https://en.wikipedia.org/wiki/Van_Buren_v._United_States (2020):

> [Supreme Court Justice Amy Coney] Barrett ruled that for the CFAA, a person violates the "exceeds authorized access" language when they access files or other information that is off-limits to them on a computer system that they otherwise have authorized access to. The majority opinion distinguished this from Van Buren's case, in that the information that he obtained was within the limits of what he could access with his authorization, but was done for improper reasons, and thus he could not be charged under CFAA for this crime.

This still does criminalize logging into your mom’s Netflix account, probably (?), but at least browsing HN on your work computer not covered anymore.
by WA | 2025-09-16 12:42:13+00:00
Thanks, but this is a server-side thing and has nothing to do with client-side DOM manipulation?! Sure, you can put stuff on the server and do HTTP over the wire. It's oftentimes the better solution. But there are apps/tools that are rightfully an SPA (like tldraw or excalidraw for example) and can run local-first and offline in a browser. You build the entire app in JS and you'd need a bit more than vanilla Web components for that if you want to avoid client-side state explosion.
by akagusu | 2025-09-16 12:42:16+00:00
> Common people don't care about the OS, they care about apps.

My statement is based on 25 year as an IT professional where I migrated people and businesses from Windows to Linux, from iOS to Android, from old Unixes to Windows/Linux and the list goes on.

Just give to people the apps they need or want and the rest is easily managed.
by herewulf | 2025-09-16 12:43:12+00:00
I wanted to post this myself because I swear by my Framework 13 and it's my workhorse. However, it doesn't hold a candle to my wife's M3 Pro on a number of metrics mentioned here such as: Battery life, screen quality, and overall performance.

The Framework (Intel 12th Gen) also has the added benefit of heating the house, particularly with graphics "heavy" workloads (lots of windows open in GNOME Mutter, VMs, etc).
by dakiol | 2025-09-16 12:43:17+00:00
I think it goes in cycles. I used to work with Kafka and so I learned something about it. I haven’t touched kafka for 4 or so years, not sure what has changed but I feel like I want to revisit it. Same for k8s, clickhouse, etc.

Happens the same with the fundamentals (networking, OS, etc). I revisit new aspects of these topics every now and then. I still haven’t worked deeper with llms. Last week I tried for the first time coding with an agent. I take it slowly.

For instance, I never cared about learning react or vercel. I guess it paid off.
by acdha | 2025-09-16 12:43:30+00:00
Laws have non-binary options - for example, most countries have laws controlling industrial-scale air pollution which do not prevent you from grilling at home.

In this case, I think it would be interesting to think about the most concerning area: linking a person in a photo to their real-world identity. It seems like there could be restrictions on how face-recognition databases are built and accessed, possibly incorporating intent to harass or intimidate as an aggravating factor, and possibly linking across time and place. If I take a picture of some guys playing basketball or chess as I walk around town, I don’t need to identify them in my art exhibit entry and I certainly don’t need to link one of them to a different time and place without their permission.
by killerstorm | 2025-09-16 12:43:58+00:00
Well, to me it looks like people are unreasonably eager to use "pathologically dynamic" languages like JS & Python, and it's an impossible problem in a highly dynamic environment where you can just randomly traverse and change objects.

Programming languages which are "static" (or, basically, sane) you can identify all imports of a module/library, and, basically, ban anything which isn't "pure" part of stdlib.

If your module needs to work with files, it will receive an object which lets it to work with files.

A lot of programming languages implement object-capability model: https://en.m.wikipedia.org/wiki/Object-capability_model it doesn't seem to be hard at all. It's just programmers have preference for shittier languages, just like they prefer C which doesn't even have language-level array bound checking (for a lack of a "dynamic array" concept on a language level).

I think it's sort of orthogonal to "pure functional" / monadic: if you have unrestricted imports you can import some shit like unsafePerformIO, right? You have another level of control, of course (i.e. you just need to ban unsafePerformIO and look for unlicensed IO) but I don't feel like ocap requires Haskell
by st-keller | 2025-09-16 12:44:14+00:00
I’m not setting boundaries - and I think you will notice when to shift! When noone and no book seems to teach you anything new about a certain topic. When you read the latest book and think, „hmm yes, but i think they omitted a and b and c and in reality this isn’t so nicely separated and way more nuanced“. Then it is definitely time to shift your attention to a different topic. I’m doing this for decades now - and i think lots of others too. You will never learn all about everything. But it’s fun to try :-)
Show HN: AuthPress – Advanced WordPress 2FA Plugin
by debba | 2025-09-16 12:44:27+00:00
I've been working on AuthPress, a comprehensive two-factor authentication plugin for WordPress that started as a simple Telegram-based 2FA solution and has evolved into a flexible multi-provider authentication system.

What makes AuthPress different: • Multiple Auth Providers: Telegram, Email, TOTP (Google Authenticator, Authy, etc.), Recovery codes, plus extensible support for SMS, Passkeys, and custom implementations • Developer-Friendly Architecture: Clean API for creating custom 2FA providers - you can integrate with any authentication service (Twilio SMS, Push notifications, Hardware tokens, etc.) • Professional Admin Interface: Comprehensive logging, user management, and monitoring tools built with WordPress best practices • Security-First: Rate limiting, encrypted storage, activity monitoring, and protection against brute force attacks The Journey: Started as a Telegram-only plugin (because who doesn't want 2FA codes via Telegram bot?), but realized the WordPress ecosystem needed something more flexible. Instead of just adding more providers, I built an extensible system where developers can create their own 2FA methods as separate plugins. Technical Highlights: - WordPress 5.0+ compatibility - Database-backed (moved away from WordPress options for performance) - Proper internationalization - Uses WordPress standards (hooks, filters, WP_List_Table) - Clean separation between core and providers The plugin is GPL-licensed and available on WordPress.org. Perfect for anyone securing WordPress sites or developers wanting to build custom 2FA solutions. Demo/Screenshots: Available in the WordPress plugin directory GitHub: https://github.com/dueclic/authpress Would love feedback from the community, especially on the extensibility aspects and any custom providers you'd like to see!
by api | 2025-09-16 12:44:38+00:00
Things I like: reintroducing a little bit of 3D/skeumorphism. I'm sick of flat. Also the Music and Podcasts app changes aren't bad. Haven't tried the iPhone/desktop tighter integration but it looks interesting. Not UI, but it seems like my wifi is faster, but I could also be nuts. Maybe a driver update?

Things that are "meh": the "apps" thing that replaces the previous launch pad, the translucency, the "dark" icon theme.

Things I don't like: stop wasting my f'ing screen real estate. Stop it with the unnecessary whitespace and the f'ing thicc menu bar. This is a desktop/laptop and it's for real work. It's also ugly. Speaking of ugly, I count several different window corner radii. Why do Windows need gigantically rounded corners?
by weinzierl | 2025-09-16 12:44:46+00:00
Which mitigations specifically are in npm but not in crates.io?

As far as I know crates.io has everything that npm has, plus

- strictly immutable versions[1]

- fully automated and no human in the loop perpetual yanking

- no deletions ever

- a public and append only index

Go modules go even further and add automatic checksum verification per default and a cryptographic transparency log.

Contrast this with docker hub for example, where not even npm's basic properties hold.

So, it is more like

docker hub ⊂ npm ⊂ crates.io ⊂ Go modules

[1] Nowadays npm has this arguably too
by homeonthemtn | 2025-09-16 12:44:54+00:00
Fairly sure we only use "My" at all due to iMacs being misinterpreted by computer illiterate people assuming the I as a possessive term, meaning "I Mac" and not the correct truncation of "Internet Machine."

This blew up as an assumption at the time - the kids want identity! Customization! - and soon we got "My" tagged to everything, the most famous being myspace.com

So now we're stuck with these dumb assumptions of possession when we could just have "My Account" be "Account" and be done with it.

/rant
by Zak | 2025-09-16 12:45:06+00:00
I wonder what an alternate history where Google didn't implement remote attestation and actively made it difficult for apps to snoop on user modifications would look like.

I suspect the Fire Phone is where things changed. If Amazon had iterated on it and done a good job, it might have been a competitive threat to Google's revenue model for Android; that's less likely if it won't run games and banking apps.
by ndiddy | 2025-09-16 12:45:06+00:00
Yeah I don’t know how they made it so bad. On Windows & Linux, using an SMB share basically gives you the same experience as using a USB hard drive connected directly to the machine. On Mac, you have to wait 30 seconds every time you open a directory. Then when you’re finally at the directory you want and start copying files, the speed slows down to a crawl as the copy progresses. I find it especially confusing because Apple offers 10 Gbit networking for their desktops at an additional fee. What’s the point of having that option when their shitty SMB implementation makes doing anything on your LAN far slower than 1 Gbit anyway?
by ivan_gammel | 2025-09-16 12:45:22+00:00
Great story and exemplar attitude from you and your manager! Too often such issues are eternally deprioritized, but you have got it into the pipeline and the team committed resources for fix. Ideally this should not happen, but that would require end-to-end collaboration of the entire team where UX people are involved on later stages of development process, adapting design and copy based on feedback from engineers. Many modern product designers just work based on „shoot and forget“ principle.
by zachrip | 2025-09-16 12:45:41+00:00
Do you think companies using node don't analyze supply chains? That's nonsense. Have you cargo installed a rust app recently? This isn't just a js issue. This needs to be solved across the industry and npm frankly has done a horrible job at it. We let people with billions of downloads a month with recently changed password/2fa publish packages? Why don't we pool assets as a collective to scan newly published packages before they're allowed to be installed? These types of things really should exist across all package registries (and my really hot take is that we probably don't need a registry for every language, either!).
by ksec | 2025-09-16 12:45:51+00:00
VVC is better than AV1 even before massive amount of tuning. The actual VVC spec including conformance finished in 2022. While for AV1 was 2018.

And H.267 ECM is miles ahead of AV2. There are not even in the same category as AOM has stated AV2 intends for 1080P and efficiency. While ECM at its current form is 50x to 100x slower than VVC encode, and 8 - 10x slower to decode. I am not even sure if it will ever be useable.
by inahga | 2025-09-16 12:45:57+00:00
For those (i.e. me) who were concerned that the cert wasn't actually revoked, it is.

https://crt.sh/?id=20924740030

$ curl -s http://r13.c.lencr.org/105.crl | openssl crl -noout -text | grep -A1 899DE8 Serial Number: 055B8B1F23D5BCF09DD8E9CAF8798F899DE8 Revocation Date: Sep 10 16:00:16 2025 GMT
by AlexandrB | 2025-09-16 12:46:39+00:00
Definitely the worst era of Mac laptop hardware that I lived through. I still have a work-provided 2019 MBP and the keyboard is shot (even though I never use it because it's docked to a monitor + keyboard 99.9% of the time), while the Touch Bar flickers with random white rectangles regularly while the machine is asleep. I personally kept using a 2015 MBP until last year for just this reason.
by orwin | 2025-09-16 12:46:46+00:00
Yes, my mom. I really disliked to be touched when I was a kid, and was fearful of hugs and kisses (and I'm french, the second one would have been almost socially crippling). Now I find it acceptable (and even comfortable depending on the person), and that's a lot of progress. My mom did do a sort of self-experiment exposure therapy, never going too far, but never stopping.

My point is: ask your family.
by t1234s | 2025-09-16 12:47:00+00:00
I think Apple is going the wrong way by not allowing you to easily remove all of the bloatware iOS apps from newer versions of macOS. They could easily use their App Store to redistribute these apps if pro users want to install them later on. With each new macOS version my Applications folder gets more and more junk from apple that I don't ever need to use.

Would this make me go back to windows? Hell No

Needing to use Adobe CS keeps me from switching to Linux. Makes me wonder if MS or Apple is paying Adobe to keep them from releasing a Linux version of CS.
by jjani | 2025-09-16 12:47:01+00:00
> In which countries are ghost kitchens thriving?

Much of Asia.

> How do they avoid the failure modes described in this article?

My suggestion was that this is exactly what a meaningful article on this topic would mention, as clearly the failure modes aren't universal. I'm not the one writing articles about it.

> Is it possible they are simply behind the curve?

Au contraire, ghost kitchens were already more of a thing here before COVID.
by coldpie | 2025-09-16 12:47:10+00:00
> The new UI is so incredibly ugly I honestly cannot understand how they thought it was acceptable to even released as a beta let alone an RC and now release.

I feel like if you replaced all of the paper in a company's printers with transparency sheets you'd be fired because that's obviously a stupid idea that would never work. But then I guess that's why I'm not a software UI designer.
by kace91 | 2025-09-16 12:47:11+00:00
I think these kinds of attack would be strongly reduced if js had a strong standard library.

If it was provided, it would significantly trim dependency trees of all the small utility libraries.

Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being included/forked.