MurphyA/hacker-news huggingface dataset:
by mouse_ | 2025-10-13 23:54:02+00:00
Would you buy a hammer that can't ever hurt your thumb? What implications would that have? Would that be a good hammer?

Bad opinion time that I hope will maybe at least be thought provoking: I would hope a malicious app I willingly installed will be able to behave maliciously. Our security bureaucracy is going to grow exponentially and people are still going to be stealing people's shit, because people need to be able to access their shit and people are dumb.
by spartanatreyu | 2025-10-13 23:54:28+00:00
> Flash players had zoom built in

The zoom was limited to the frame that the flash player sat in, so you'd end up with different parts of the website at different zoom levels.

Also flash wasn't responsive and couldn't flow like real website content can.

> Flash was the last thing that got people excited for the Web generally

That's only because all the capabilities were new, now they're built into the web itself. See:

- https://ciechanow.ski/airfoil/

- https://slowroads.io/

- https://photopea.com

- https://superspl.at/view?id=1eacd61c

- https://itch.io/games/platform-web

- https://alche.studio/

- https://ruinergame.com/ (scroll down)

- etc...
by monksy | 2025-10-13 23:54:33+00:00
The funny thing here: They have active spyware and malware on their app store. They go by vague offical sounding names like "Gallery" and "Messages" "Text Messages"

I've reported it and that goes to an google form where the app stays up. I've even gone farenough where I've escalated through internal Google contacts. Nothing is done. It's not sideloading that's the issue.

It's google. This is a hostile behavior to all users of the devices and developers of their platform.

_--

My thoughts on where this might go:

We're getting into an era where there are organizations that are violently hostile to your device and they demand that. These people believe that the device you paid for and the service you paid for is theirs.

I.e. mobile ids from governments, which may introduce client side scanning. More so, theres a hostile push for "age verification" which would lean on the Play integrity chain. Want to find out who does this? Look into Magisck on reddit and the apps people have difficultly using. This is not a case of "someone wants to hack something".. it's all about control.

If you're watching the Root/third party space.. right now there are issues running apps. Some apps scan for "SuperSU" app and will refuse to run. (As in they're not sandboxed)
by BoredPositron | 2025-10-13 23:55:50+00:00
I don't need to know anything about the space to see that you are anything but a well adjusted person. That's all I said and that's all I need to know about you and your project. The last three days were humorous and datastar topics went to the top more than once so I had a look and found you. An adult CEO of one of the projects that talks like a 12 year old on IRC. I hope you take care of your blood pressure. Bye-bye.
by simonw | 2025-10-13 23:56:21+00:00
The place where speed really matters is in virtual environment management.

uv uses some very neat tricks involving hard links such that if you start a new uv-managed virtual environment and install packages into it that you've used previously, the packages are symlinked in. This means the new environment becomes usable almost instantly and you don't end up wasting filesystem space on a bunch of duplicate files.

This means it's no longer expensive to have dozens, hundreds or even thousands of environments on a machine. This is fantastic for people like myself who work on a lot of different projects at once.

Then you can use "uv run" to run Python code in a brand new temporary environment that get created on-demand within ms of you launching it.

I wrote a Bash script the other day that lets me do this in any Python project directory that includes a setup.py or pyproject.toml file:

uv-test -p 3.11

That will run pytest with Python 3.11 (or 3.12/3.13/3.14/whatever version you like) against the current project, in a fresh isolated environment, without any risk of conflicting with anything else. And it's fast - the overhead of that environment setup is negligible.

Which means I can test any code I like against different Python versions without any extra steps.

https://til.simonwillison.net/python/uv-tests
by malshe | 2025-10-13 23:56:58+00:00
I play Quartiles in Apple News app daily (https://support.apple.com/guide/iphone/solve-quartiles-puzzl...). Occasionally when I get stuck, I use ChatGPT to find a word that uses four word fragments or tiles. It never worked before GPT 5. And with GPT 5 it works only with reasoning enabled. Even then, there is no guarantee it will find the correct word and may end up hallucinating badly.
by chrisco255 | 2025-10-13 23:57:52+00:00
> In principle I'm against outsourcing or technology transfers to China, but please do it on you own schedule.

In principle, the tit for tat policy with China should have been initiated 15 years ago. China has restricted its own markets in similar ways since at least that far back, and it was clear then, when they banned Google in 2010, that they were not playing by the same playbook as we were.

The U.S. doesn't control oil in the Middle East, that would be Saudi Arabia, UAE, Qatar, Kuwait, Iran, etc, all sovereign nations with their own governments. It also produces more domestically than its own demand and is a net exporter of oil.

Also, not sure why the Ukraine war is the United States responsibility over the EU's responsibility given that its your next-door neighbor and its your eastern flank that would suffer if Ukraine were to fall to Russian control. EU, of course, partly responsible for enriching Russia to the point where it can afford such a war with its own purchases of gas while shuttering nuclear power plants for indescribable reasons.
by zahlman | 2025-10-13 23:58:12+00:00
> the deadsnakes ppa

Please don't use this. You need to be careful about how you place any secondary installation of Python on Ubuntu. Meanwhile, it's easy to build from source on Ubuntu and you can easily control its destination this way (by setting a prefix when you ./configure, and using make altinstall) and keep it out of Apt's way.

> and venvs, plus the ongoing awkwardness about whether pip should be writing stuff into usr/local or ~/.local or something else.

There is not really anything like this. You just use venvs now, which should have already been the rule since 3.3. If you need to put the package in the system environment, use an Apt package for that. If there isn't an Apt package for what you want, it shouldn't live in the system environment and also shouldn't live in your "user" site-packages — because that can still cause problems for system tools written in Python, including Apt.

You only need to think about venvs as the destination, and venvs are easy to understand (and are also fundamental to how uv works). Start with https://chriswarrick.com/blog/2018/09/04/python-virtual-envi... .

> It’s really only in the last ten years or so that there’s been the clarity of what is a build backend vs frontend

Well no; it's in that time that the idea of separating a backend and frontend emerged. Before that, it was assumed that Setuptools could just do everything. But it really couldn't, and it also led to people distributing source packages for pure-Python projects, resulting in installation doing a ton of ultimately useless work. And now that Setuptools is supposed to be focused on providing a build backend, it's mostly dead code in that workflow, but they still can't get rid of it for backwards compatibility reasons.

(Incidentally, uv's provided backend only supports pure Python — they're currently recommending heavyweight tools like maturin and scikit-build-core if you need to compile something. Although in principle you can use Setuptools if you want.)
by itintheory | 2025-10-14 00:01:22+00:00
> Nintendo does not get to march into my home and smash my games because they want me to buy the new one instead of playing my old ones.

This is a really interesting example to choose because the new Nintendo Switch 2 cartridges have literally no data storage except to hold a license key. The content has to be downloaded from their servers, which they absolutely will take offline eventually.
by emmelaich | 2025-10-14 00:01:29+00:00
I really wonder how much rare earth element deposits are not found for want of looking. Not much reason to source them yourselves if the country (China) uses them for products that you're going to buy.

According to this map, China has vastly more. But is there something special about China/Myanmar geologically? I guess being downstream of the Himalayas is something.

https://worldpopulationreview.com/country-rankings/rare-eart...
by zahlman | 2025-10-14 00:01:30+00:00
> Funny thing is that decision was for modularity, but uv didn't even reuse pip.

To be fair, that's justified by pip's overall lack of good design. Which in turn is justified by its long, organic development (I'm not trying to slight the maintainers here).

But I'm making modular pieces that I hope will showcase the original idea properly. Starting with an installer, PAPER, and build backend, bbbb. These work together with `build` and `twine` (already provided by PyPA) to do the important core tasks of packaging and distribution. I'm not trying to make a "project manager", but I do plan to support PEP 751 lockfiles.
by Mindless2112 | 2025-10-14 00:01:38+00:00
> “The outbound and cross-bound DDoS attacks can be just as disruptive as the inbound stuff,” Dobbin said. “We’re now in a situation where ISPs are routinely seeing terabit-per-second plus outbound attacks from their networks that can cause operational problems.”

ISPs are starting to feel the pain, so perhaps in the near future they will do something about it.
by fn-mote | 2025-10-14 00:01:51+00:00
I really cannot tell if this is sarcasm (seems not?) or trolling (sounds like it).

How are we reminding China that the US is a big dog? By imposing tariffs? By demonstrating our ability to do work domestically that they believe us unwilling or incapable of doing?

What does this even mean, to be a big dog in the modern world? It seems more like a large ship listing to one side … if it collapses there will be a lot of small ships damaged in the wake.
by r_thambapillai | 2025-10-14 00:02:04+00:00
while its clear that your testing team should have their own 5 Ys as well, I think its reasonable for the manager of your team asking you the question: how do we prevent this in the future? The unfortunate reality of large companies is that sometimes the quality and behaviour of other teams is (to some extent/on some time horizon) out of your control, and so the question for any given team lead is often "what can I do differently". It does seem that in this case there probably was some mechanism that your team could have had its own internal testing process that needn't replicate the full responsibilities of the testing team but could at least have caught this issue.
by shirro | 2025-10-14 00:02:51+00:00
I doubt the employees will make a difference. It is likely more about the lobbying power of Microsoft and them finding a person at the right level who is receptive to their appeals and has the power to revert the policy.

There are a lot of tech people who appreciate open source software and understand the benefits of digital sovereignty but its rare for them to have the final say in most orgs.

Just about every org in my country uses Microsoft's email including universities, government, schools, businesses. I am sure it has some features that make it a good choice but its is unusual for any product to have practically 100% market share and no competition regardless of technical or usability advantages. Microsoft has huge resources and knows how to win customers.
by culi | 2025-10-14 00:03:11+00:00
We actually have a ton of evidence refuting this. The two things anthropologists spend their whole time rejecting in popular sciences is the barter myth and the idea that hunter-gatherer lives are "nasty brutish and short".

The nasty brutish and short idea might have been true about many medieval European peasants but the rest of the world wasn't cramped up with livestock and poverty conditions with poor sanitation. Other people simply didn't face as much disease. There was actually some really interesting work in bioarcheology in 2018 that showed that even extremely long lifespans was not actually that rare.[0] And those who made it to adulthood could generally expect a long life (obviously tons of variation here). In the city of Cholula, Mexico, between 900 and 1531, most people who made it to adulthood lived past the age of 50.[1]

[0] https://sc.edu/uofsc/posts/2022/08/conversation-old-age-is-n...

[1] https://onlinelibrary.wiley.com/doi/10.1002/ajpa.22329

Not to mention the famous "Man the Hunter" symposium where Marshall Sahlins introduced the Original Affluent Society Thesis which has since been largely upheld and reinforced.
by Alir3z4 | 2025-10-14 00:03:32+00:00
I seriously still don't know why I should use "uv". I just create my .venv and pip install.

Rarely I'd need a different version of python, in case I do, either I let the IDE to take care of it or just do pyenv.

I know there's the argument of being fast with uv, but most of the time, the actual downloading is the slowest part.

I'm not sure how big a project should be, before I feel pip is slow for me.

Currently, I have a project with around 50 direct dependencies and everything is installed in less than a min with a fresh venv and without pip cache.

Also, if I ever, ever needed lock files stuff, I use pipx. Never needed the hash of the packages the way it's done in package-lock.json.

Maybe, I'm just not the target audience of uv.
by hinkley | 2025-10-14 00:04:04+00:00
I model RCAs after my understanding of NTSB and incident response after my understanding of NASA command centers.

They're both flawed but often replace something that works 3x worse than my caricature of both.

The findings should always result in a material change that is worth at least the effort of having done it. Not just a checkbox that proves we did something. The investment in the mitigation should honor the consequences of the failure, and the uniqueness of the failure. Or rather, the lack of uniqueness. As a failure repeats in kind (eg, a bunch of 737 Maxes crashing), trust that the system is put in jeopardy. By the time a problem has happened three times, the response should begin to resemble penance.

So how do we get the problem not to hit production again, or how do we at least keep it happening due to the exact same error?

And for some failure modes, we need to project the consequences going forward. Let's say you find your app is occasionally crashing over a weekend because of memory leaks, plus the lack of Continuous Deployment forcibly restarting the services. We can predict this problem will happen reliably on Memorial Day, and Labor Day. So we need to do something relatively serious now.

But it'll also get much worse on Thanksgiving weekend, and just stupid around Christmas, when we have code freezes. So we do something to get us through Memorial Day but we also need a second story near the top of the backlog that needs to be done by Labor Day, Thanksgiving at the latest. But we don't necessarily have to do that story next sprint.
by ricksunny | 2025-10-14 00:04:17+00:00
Thank you for not repeating the usual mistaken, and misleading, name for the prize "Nobel Prize in Economics" in the title.

EDIT: Recognizing @huitzitziltzin 's comment, this factoid was originally imparted to me IRL 8 years ago by an economist, one Jackie Mallett of the Threadneedle banking simulation project (and who probably wouldn't mind my invoking her by name on this topic).
by OJFord | 2025-10-14 00:04:49+00:00
A while ago I implemented some little feature I wanted for an open source app, and tested it on my phone. Only Android development I've ever done, a few hours' work: I wasn't going to get certified as an official Android developer for it. With this, I wouldn't be able to do it? Or rather I could, but could only test with the Android Studio emulator or similar?

Similarly if I just wanted to make something for myself, not distribute it at all, I know have to register with this program just to install my thing on my own phone? I don't think even Apple goes that far?
by zahlman | 2025-10-14 00:04:55+00:00
> unless you like using an env in your container that is

A virtual environment, minimally, is a folder hierarchy and a pyvenv.cfg file with a few lines of plain text. (Generally they also contain a few dozen kilobytes of activation scripts that aren't really necessary here.) If you're willing to incur the overhead of using a container image in the first place, plus the ~35 megabyte compiled uv executable, what does a venv matter?
by sammyd56 | 2025-10-14 00:04:59+00:00
I've uploaded the model here: https://huggingface.co/sdobson/nanochat

I didn't get as good results as Karpathy (unlucky seed?)

It's fun to play with though...

User: How many legs does a dog have? Assistant: That's a great question that has been debated by dog enthusiasts for centuries. There's no one "right" answer (...)
by al_borland | 2025-10-14 00:05:16+00:00
Apple Home is already the name of their app for smart home stuff.

The Netflix comparison doesn’t quite work with Apple TV. I have an Apple TV (the device) and I don’t just use Apple TV (the app) to access Apple TV (the service). Apple TV (the app) is also where I need to go to buy/rent movies from the iTunes Store, watch Apple keynotes, and it can also be a place to aggregate content in a single UI from a bunch of different streaming services (notably not Netflix, they opted out). Apple TV (the service) is just one feature of Apple TV (the app), at least when it’s running on Apple TV (the device).

These distinctions do matter, due to Apple trying to consolidate everything into that single app. They sunset multiple other apps with its release. I actually find the app pretty hard to use as a result.
by vunderba | 2025-10-14 00:05:17+00:00
100%. I find the "LLMs are completely useless" and the "LLMs will usher in a new era of messianic programming" camps to be rather reductive.

I've already built some pretty large projects [1] with the assistance of agentic tooling like Claude Code. When it comes to the more squirrely algorithms and logic, they can fall down pretty hard. But as somebody who is just dreadful at UI/UX, having it hammer out all the web dev scaffolding saves me a huge amount of time and stress.

It's just a matter of tempering one's expectations.

[1] https://animated-puzzles.specr.net
by burnt-resistor | 2025-10-14 00:05:30+00:00
Superficial article waxing vague nonsense like "clean", which is meaningless.

Necessary and sufficient tests are essential, otherwise code is of limited value. At a minimum, unit test complicated bits and integration test the big, common uses. Add tests for fixed bugs to never repeat them. Without tests, refactoring becomes really risky and damn hard. For extra confidence: benchmark, fuzz, and property test, and sometimes consider formal methods like theorem-proving to validate behavior falls within bounds where applicable. It's easy to go overboard on process or act as a cowboy coder who doesn't do things properly.
by paulryanrogers | 2025-10-14 00:05:32+00:00
Sounds like you had to maintain tests with the wrong kind of coverage. IMO there is an art to crafting tests that are economical.

They should cover core features that pay for the business, ideally as coarsely as practical. Some coupling with the implementation is inevitable, so I prefer it be at the highest level that can be maintained.

Have you never seen tests catch bugs that otherwise would have gone into production?
by rootusrootus | 2025-10-14 00:05:34+00:00
I completely agree. I'm definitely not an expert web developer. I know enough to build functional tools, but it's not exactly art that I'm making. But the core of our tooling is my primary focus, I wrote it, I've spent a lot of time perfecting it. Claude can easily impress me with things like the CSS magic it weaves, because I am unsophisticated.
by AdieuToLogic | 2025-10-14 00:05:50+00:00
Of the reproduced attributes listed (reformatted and numbered):

1 - reason, use strategy, solve puzzles, and make judgments under uncertainty 2 - represent knowledge, including common sense knowledge 3 - plan 4 - learn 5 - communicate in natural language 6 - if necessary, integrate these skills in completion of any given goal

Only 2 (partially) and 5 are applicable to LLM's, as they are statistical text (token) generator algorithms. Very useful ones, no doubt, but not ones which satisfy all of the above.
by echelon | 2025-10-14 00:05:55+00:00
That's why Starlark exists.

You need something between JSON/YAML and Python/JavaScript.

A config language makes the possibility space small.

It also makes it deterministic for CI and repeatable builds.

It also makes it parallelizable and cacheable.

Don't use your language for config. People will abuse it. Use a config language like Starlark or RCL.
by Groxx | 2025-10-14 00:06:21+00:00
Yes, you generally see this kind of thing start from the pain-feelers and move up the chain to the pain-causers.

So why hasn't that happened? These are clearly damaging to many, and ISPs are apparently doing next to nothing to prevent it, and it has been extremely clear for a while now that it's going to just become a bigger and bigger problem.
by culi | 2025-10-14 00:07:34+00:00
you have a point actually. Non-agricultural people had much more varied diets and we have almost zero archeological examples of famines leading to mass deaths of non-agricultural peoples but we have plenty of examples of that happening to agricultural people. Agriculture was, especially initially, a huge step back in food security.

Obviously things have changed a lot since then but some of the risks remain. Cuba is a fascinating case study for what happens when a modern agricultural supply chain can collapse (due to US sanctions). Many many died. But since then there's been a massive focus on locally grown food and even wild tending. I know many people who are into permaculture and alternatives to industrial agriculture who have traveled there to study
by hinkley | 2025-10-14 00:07:45+00:00
I've applied for a couple jobs like this and was somewhat relieved they didn't call me back.

When you move thinking about reliability or safety outside of the teams that generate the problems, you replace self reflection with scolding, and you have to either cajole people to make changes for you or jump into code you're not spending enough time with to truly understand. And then if you make a mistake this is evidence that you shouldn't be touching it at all. See we told you this would end badly.
by zahlman | 2025-10-14 00:08:13+00:00
> It has a lot of the same problems as just globally pip installing packages

No, it doesn't. It specifically avoids the problem of environment pollution by letting you just make another environment. And it avoids the problem of interfering with the system by not getting added to sys.path by default, and not being in a place that system packages care about. PEP 668 was specifically created in cooperation between the Python team and Linux distro maintainers so that people would use the venvs instead of "globally pip installing packages".

> requires a bit of path mangling to work right, or special python configs, etc. In the past, it's also had a bad habit of leaking dependencies, though that was in some weird setups.

Genuinely no idea what you're talking about and I've been specifically studying this stuff for years.

> It's one of the reasons I would recommend against python for much of anything that needs to be "deployed" vs throw away scripts. UV seems to handle all of this much better.

If you're using uv, you're using Python.