MurphyA/hacker-news huggingface dataset:
by godelski | 2025-10-31 01:15:02+00:00
> I'm saying that when you shipped, in many situations there was no way to patch the bugs.

This was never in disagreement.

>>>>>> We had patches that [...] that came through physical media. ***The latter making it harder to patch.*** > And I do believe that it became like that precisely because it's easy to send patches.

Look, we aren't going to go back to a setting where we don't patch software. That's a WORSE place to be. It leaves people vulnerable for long times. Devices carry more valuable information now and the threat model is much more sophisticated. We do not want to do this.

Besides that, I just don't believe you can blame the ability to patch over the internet as the reason for shoddy work.

Is Linux full of bugs and shipping half built products? I don't think so.

> There is no stopping it. The quality of software is going down because it's economically viable, and I don't see that changing anytime soon (especially with LLMs).

The great thing about the future is that it is in our hands to control.

The bad thing about the future is we need foresight and to work together to avoid pitfalls.

Luckily humans are quite adept at having foresight. I mean here we are talking about likely future problems. But we're also often feeling helpless to address those issues. But this is an observation bias. Look at the Y2K bug, it is a perfect example. The average person brushes it off as if we made too big of a deal about it. But the thing is, it was a big deal. The thing is... we solved it before it created major issues. We also had similar success in big problems like fixing the ozone layer. We've done this countless times. We just have a tendency to focus on problems that are still problems and not look back and use our success as motivation to keep going.

Every big problem can be broken down into many smaller problems that are much more manageable. "They" win by making us believe that the little things don't matter. "They" win because it means we aren't taking the first steps or making progress, killing any momentum. The worst thing that can happen is to make us feel like the problem is too big to be solved. But that's a lie. We've created this mess and frankly I would like to try to fix things before it becomes an even bigger mess. Personally, I'm a big fan of not doing unnecessary and avoidable work.

So the question is are you with me? Are you going to help try to fix this problem? Or are you going to just sit by and let it grow worse? Hoping that it just solves itself or someone else solves it? Frankly, we need as many people in on this as we can. You don't need to do a lot of work. All I ask is that you speak up and question when the teams you work for are trying to push unfinished products. All I ask is that you help encourage others to do quality work, and not let slop just slip by. I'm not asking you to change the world, certainly not over night. I'm asking if you will make just a modest attempt to address the problem in your own sphere of influence.
by metalman | 2025-10-31 01:15:46+00:00
It is a good thing that on the road exists, it tells a vivid truth about america that many millions have experienced but very few put down in words My grandmother left NYC in 1929 with 3 other recently graduated nurses and drove a model A ford to california when there were still patches of prairy that had to be driven over, and in the 90's I drove there useing mostly back roads, bought a school bus in Vancouver for $50, and drove it back to Nova Scotia, though ended up chatting with Keasy at the country fair....got invited to the farm, but was in a hurry going south got a copy of on the road in a cleminites box, with a stack of state maps from the time it was written that I found all perfectly preserved in the rafters of my shop
by pama | 2025-10-31 01:15:48+00:00
Many people still use package managers though and these run such checks and disclose infosec events. And I still know enough other people who also look at the checksums of individual downloads when needed.

Piping curl to bash, especially a copy/paste from a random blog is way too easy to exploit. Most people might not realize if the unicode they copied from a website silently translates to a different location than what they thought they read in the screen.
by lioeters | 2025-10-31 01:16:24+00:00
Apparently NaN (not a number) becomes false when type-cast to boolean.

Boolean(NaN) ===> false

For a hypothetical NaB (not a boolean), the same behavior seems logical.

Boolean(NaB) ===> false

So the condition `if (NaB)` is false and will fall through to the `else` branch. But..

> what you do determines what NaN === NaN actually evaluates to

I think I disagree with this because it's not about casting to boolean, it's a totally different question of self-identity, or comparing two instances (?) of a value (?!).

From the article:

typeof NaN ===> "number"

For symmetry and consistency:

typeof NaB ===> "boolean"

> NaN is the only value in the whole of JavaScript that isn’t equal to itself .. the concept of NaN is meant to represent a breakdown of calculation

Similarly, NaB would represent a breakdown of true/false condition (somehow) as an exceptional case. Whether it equals itself is a matter of convention or language design, not logic - since it's beyond logic just as NaN is beyond numbers. I would say:

NaN === NaN ===> false NaB === NaB ===> false

> you throw an exception (and imo it is better..

I agree throwing an exception is better design for such exceptional cases - but we know JavaScript as a cowboy language would rather plow through such ambiguities with idiosyncratic dynamic typing, and let the user figure out the implicit logic (if any).
by phil21 | 2025-10-31 01:16:32+00:00
When it comes to AML/KYC you get effectively zero government guarantees. It’s almost the opposite.

I agree in the sense of FDIC insurance and being nominally operating under the banking regulatory system - but those typically offer exactly zero protection to a whole category of not-crimes.

A bank can decide you are suspicious and simply freeze your accounts indefinitely - and stonewall you at the customer service level. It’s not like they are required by any law to respond to you or anything like that.

There is likely more recourse if you have enough funds worth perusing legal action to its final conclusion - if you win then you can be more assured the bank will exist six years later when your judgement finally hits. Enjoy paying those legal bills though.

Having witnessed this happen and seen six figure losses due to absolutely zero crime being committed, I basically operate under the mental model that any money within a bank or financial institution is their money and not yours.
by jancsika | 2025-10-31 01:16:37+00:00
I think people are rightly skeptical of intuitions for the obvious reason-- they are shortcuts that don't come with easy verification that the "intuiter" knows (and can effectively communicate) the chain of reasoning that led to the conclusion. So you can't tell from the stated intuition whether the corresponding chain of reasoning is correct (or, for any non-trivial intuition, even if there exists a corresponding chain of reasoning at all).

Edit: Well, people are rightly skeptical of intuitions which aren't merely definitional tautologies. The author put definitional tautologies in their list, which seems odd. I don't care about intuitions for which everyone minus edgelords assumes that a thing is being defined in a sentence. It's all the other, subtle intuitions that require unrolling. E.g, if someone thinks it's wrong to torture puppies for fun because everyone has Ring installed nowadays, I want to know that! So I guess we need the edgelords after all :(
by pkayy7458 | 2025-10-31 01:16:48+00:00
Hey everyone, I’ve noticed more startups using AI tools but not really thinking about governance or compliance early on. I’m building something called RiskLit — it helps startups spot hidden AI risks before investors do.

I’m curious, from a VC or founder point of view, how important is AI governance and compliance readiness when evaluating startups today? Do you see it as something that matters now, or only once regulations like the EU AI Act fully kick in?

Would really love to hear your thoughts
by CamperBob2 | 2025-10-31 01:17:32+00:00
In principle I agree with the concept of charging for support and refunding if the issue is not at the customer's end. I'd certainly be fine with that myself, even if it cost $50 or so to get a responsible human on the line when there's trouble with a service like banking, payments, or business-critical SaaS providers.

I think Microsoft tried that at one point, but they didn't stick with it for some reason. Maybe it leads to a lot of knock-down, drag-out arguments about whose fault something is.
by ezfe | 2025-10-31 01:17:53+00:00
I understand what you're saying, and yeah, that does suck.

> Losing access to all your old work in its original format

Most photo editing apps retain your originals, even when they're in a database. For example, Apple Photos has a folder full of originals with no modifications. Does Lightroom not have this?

I understand that there is a lot of metadata that you also want, I'm just curious about this detail?
Show HN: TruthGuard – AI System That Detects Invalid Survey Responses
by vivekjaiswal | 2025-10-31 01:18:20+00:00
Hi HN , I’m Vivek Jaiswal, Founder & Technology Strategist at QBits Marketing Research.

We built TruthGuard, an AI-powered validation platform designed to detect synthetic, low-quality, or fraudulent survey responses in large-scale research datasets — a $10B+ issue in global data collection.

TruthGuard runs a multi-stage validation pipeline combining:

LLM-based semantic verification (OpenAI, Anthropic, Azure models)

Vector similarity scoring using Qdrant/Chroma

Anomaly & pattern detection for response duplication

Adaptive thresholding tuned with live dataset feedback

It processes 100K+ responses per day with 99%+ accuracy, cutting operational costs by over 60% for our enterprise clients.

I’d love to get feedback from this community — especially around:

Improving real-time validation at scale

Better approaches for prompt consistency between multiple LLMs

Efficient ways to benchmark accuracy on mixed human + AI datasets

Code architecture and system design overview (non-confidential parts) are here: github.com/vivekjaiswal-ai/truthguard

Thanks for reading — open to ideas, critiques, and collaborations!

— Vivek
by xpe | 2025-10-31 01:18:26+00:00
Hard to say if the above comment is serious or sarcastic.

To my eye, seeing "Agentic Postgres" at the top of the page, in yellow, is not persuasive; it comes across as bandwagony. (About me: I try to be open but critical about new tech developments; I try out various agentic tooling often.).

But I'm not dismissing the product. I'm just saying this part is what I found persuasive:

> Agents spin up environments, test code, and evolve systems continuously. They need storage that can do the same: forking, scaling, and provisioning instantly, without manual work or waste.

That explains it clearly in my opinion.

* Seems to me, there are taglines that only work after someone in "on-board". I think "Agentic Postgres" is that kind of tagline. I don't have a better suggestion in mind at the moment, though, sorry.
by jread | 2025-10-31 01:18:37+00:00
Yes, we've been testing volume attachments every 5m since start of the year, and have experienced 100-150 attachment failures per volume type in that time frame during multiple events (most recently last week):

https://cloudlooking.glass/dashboard/#aws.ebs.us-east-1--cp-...

Another interesting bit, is last March AWS changed something in the control plane which both triggered a multi-day LSE, and ultimately increased attachment times from 2-3s to 10-20s (also visible in the graphs).
by kyer-sh | 2025-10-31 01:19:12+00:00
You answered your own question. Buying a perpetual license ensures the company can’t rug pull you. Not having the option for a perpetual license gives no guarantees of the sort. One of Serif’s top selling points was the perpetual license, and people were rightfully nervous about the Canva acquisition. They even made it a huge point in their announcement to reassure people who were nervous about the perpetual license model going away.

A perpetual license does not entitle me to anything beyond the scope of the license, of course. It’s great that I can use V2 for as long as it serves my needs. But now, when someone new is looking for graphic design software, or if I find am missing some good features in V1 or V2 that get added to the new software, of course I will be upset that I no longer have the option to upgrade to or recommend the non-rug-pullable option.

I feel like it’s not unreasonable to have a negative opinion towards the decisions companies make that further the enshittification of the professional software world.
by tastyfreeze | 2025-10-31 01:19:57+00:00
I am writing scheduling software for an uncommon use case.

The best method I have found is to use the interface and fix the parts that annoy me. After decades of games and internet I think we all know what good interfaces feel like. Smooth and seamless to get a particular job done. If it doesn't feel good to use it is going to cause problems with users.

Thats said. I see the software they use on the sales side. People will learn complexity if they have to.
by zzyzxd | 2025-10-31 01:20:04+00:00
Abstraction needs to happen on a different layer. Because your power users are already dealing with complicated stuff and you don't want to make their lives even harder.

I know about 10 people in real life that uses Handbrake. And 10 of them use it to rip Blu-ray discs and store media files on their NAS. It will piss them off if you hide all the codec settings and replace the main screen with a giant "convert to Facebook compatible video" button.

Instead, do it like how iina[1] packages mpv[2].

1. https://github.com/iina/iina

2. https://github.com/mpv-player/mpv
by sigmar | 2025-10-31 01:20:55+00:00
>A bit more back and forth… then the call was disconnected.

who disconnected it? were you yelling at support? this seems relevant and you just put "yadda yadda... the call was disconnected" (not to defend Wise, just curious what happened there)

>This isn’t just poor service — it’s unacceptable.

meaningless LLM-addendums don't improve your blogpost
by Andrex | 2025-10-31 01:22:32+00:00
Ideally you'd want to add selectable options for users in a way that's sustainable long-term and not just panic-adding things all over the place because of user demands. That's how you get the Handbrake situation that OP article is complaining about.

Gnome 3 was a big update and adding options, which does happen, is not free. There were changes from Gnome 2 and 3 and adding some options "back" from Gnome 2 is really asking for that feature to be rewritten from scratch (not all the time, but a lot of the time).

That the Gnome team has different priorities from other DEs, one of them being "keep the design consistent and sustainable," is completely valid and preferred by many users like myself.
by apsurd | 2025-10-31 01:23:28+00:00
it annoys me that people fully automate things like type checkers and linting into post commit or worse entirely outsourced to CI.

Because it means the hygiene is thrown over the fence in a post commit manner.

AI makes this worse because they also run them "over the fence".

However you run it, i want a human to hold accountability for the mainline committed code.
by danhorner | 2025-10-31 01:23:35+00:00
xe.com is competitive with wise rates and answers the phone. My KYC/AML journey was brief and they came through within their stated timeframe.

However all of the online companies sell the happy path and your experience will be diminished the farther you deviate from it. The right answer may be for a business to maintain a second-source in this as in all critical supplier relationships.
by tdb7893 | 2025-10-31 01:23:46+00:00
One of my friends is a mechanical engineer doing the most standard "nuts and bolts" form of engineering and by these standards he isn't even an engineer. I don't think there are any reasonable English speakers who wouldn't say he's an engineer (if he wasn't you would need to rename the whole field of mechanical engineering). You can have an idiosyncratic definition for personal reasons but it's probably best to realize that it's not the general definition of the word.
by bastawhiz | 2025-10-31 01:24:13+00:00
Right, that's the program. Let's say I really on 1.0.1. I want to upgrade to 1.0.2. Everything that also relies on 1.0.1 also needs to be upgraded.

It effectively means I can only have versions of dependencies that rely on the exact version that I'm updating to. Have a dependency still on 1.0.1 with no upgrade available? You're stuck.

Even worse, let's say you depends on A which depends on B, and B has an update to 1.0.2, if A doesn't support the new version of B, you're equally stuck.
by daemin | 2025-10-31 01:24:32+00:00
There is a big difference between buying a perpetual licence with extra yearly support packages versus leasing the software with on a subscription model. While the two options may appear to be the same thing, the first one doesn't remove your ability to run the software once you stop paying for support.

The best way that I have to describe it is in the first option you're buying a version of the software and then paying for updates and bug fixes in a flexible manner, while in the second option you're leasing use of the software for as long as you continue to pay.
by cyphar | 2025-10-31 01:24:42+00:00
rpm and dpkg both provide mechanisms to run scripts on user machines (usually used to configure users and groups on the user machine), so this aspect is not an NPM-specific. Rust has the same thing with build.rs (which is necessary to find shared C libraries for crates that link with them) so there is a legitimate need for this that would be hard to eliminate.

Personally, I think the issue is that it is too easy to create packages that people can then pull too easily. rpm and dpkg are annoying to write for most people and require some kind of (at least cursory) review before they can be installed on user's systems from the default repos. Both of these act as barriers against the kinds of lazy attacks we've seen in the past few months. Of course, no language package registry has the bandwidth to do that work, so Wild West it is!
by _carbyau_ | 2025-10-31 01:29:25+00:00
My initial post had the context of "life as it is now". To further these thoughts though:

> > Need to move 3 or 4 people? Driving the car may be cheaper. >That's the issue―the average car occupancy is <1.5. Our goal should be to raise it, by offering alternatives to cars in cases where they're not appropriate.

When I said this, I meant in terms of $ to the individual making the choice. Apart from city parking costs, and congestion charges, with modern phones being used a lot for transport these days could we do dynamic group discounts? IE my transport app shows a QR code, my friends who are coming with me scan it with their transport app and by travelling together(beeping on and off at the same locations within the same timeslot) we get a discount?

> Not many, most. Cars are a niche, they're only economical when transporting a few people with cargo over medium distances. Everything else is more efficiently covered by another mode of transport.

I agree in the context of city planning and public transport being a lot better than it is now. Otherwise, the last mile problem is a hard one to get past. As soon as you walk or ride a bike to the station/bus-stop you've introduced constraints on cargo, physical fitness and weather. All mostly easier with a car. Also, a car provides freedom/flexibility for midday decisions like "I'll do the groceries on the way from work" or "my wife had an issue at work, so I'll go pick up the kids this afternoon" or similar - harder to do if you've committed to pubic transport in the morning.

> And "obviously", huh? Look outside. It's all roads.

Where I am, public transport is buses. Bicycles are meant to ride on the road. So the roads are still used even if the car isn't.

> You'd be surprised. The Netherlands is the best example of this―the Dutch own almost as many cars per person as Americans do, yet they cycle orders of magnitude more.

This is one thing I find frustrating. But not everyone has a "default active" lifestyle. Many are quite sedentary. Also, a significant chunk of car costs - purchase/depreciation, yearly insurance and registration - are not mileage based. But it is frustrating that other options are not even considered. Again though, urban planning and current public transport shape the society we live in for generations. Maybe we'd all be more active if it was better done.

> It's a matter of designing our built environment to make the most efficient mode of transportation for the situation the most convenient option.

So much this. But there is a lot to overcome. Individualism, NIMBYs and cars themselves as a status symbol of freedom and "go anywhere, go anytime" flexibility. I don't see how to do it - but I'd support smart attempts to try.
by vlovich123 | 2025-10-31 01:30:19+00:00
It sounds like you’re disagreeing yet no case is made that throughout and latency isn’t worse.

For example, the best frameworks on TechEmpower are all Rust, C and C++ with the best Java coming in at 25% slower on that microbenchmark. My point stands - it is generally true that well written rust/c/c++ outperforms well written Java and .Net and not just with lower memory usage. The “engineering effort per performance” maybe skews to Java but that’s different than absolute performance. With rust to me it’s also less clear if that is actually even true.

[1] https://www.techempower.com/benchmarks/#section=data-r23
by godelski | 2025-10-31 01:30:29+00:00
I know in the US, Oregon Senator Ron Wyden is highly involved in Net Neutrality and tech. I once had a long conversation with his aid who specialized in tech issues and was quite happy with what they were trying to do. I'd recommend reaching out to his team. I'd expect that they would be happy to work with you all and help you navigate the space.
by jjmarr | 2025-10-31 01:31:14+00:00
You can't buy your way out of this, because C++ builds are only parallelizable across multiple translation units[1] (i.e. separate .cpp files). Unless you're willing to build a better single-core CPU, there's not much you can do.

The challenge with modern C++ projects is that every individual TU can take forever to build because it involves parsing massive header files. Oftentimes you can make this faster with "unity builds" that combine multiple C++ files into a single TU since the individual .cpp file's build time is negligible compared to your chonky headers.

The reason the header files are so massive is because using a templated entity (function or class) requires seeing the ENTIRE DEFINITION at the point of use, because otherwise the compiler doesn't know if the substitution will be successful. You can't forward declare a templated entity like you would with normal code.[2]

If you want to avoid including these definitions, you create an abstract interface and inherit from that in your templated implementations, then pass the abstract interface around.

[1] or linking with mold

[2] There used to be a feature that allowed forward declaring templated entities called "export". A single compiler tried to implement it and it was such a failure it was removed from the language. https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2003/n14...
by fennec-posix | 2025-10-31 01:31:51+00:00
TPMs can be useful for device security, and there are ways in Linux to use it (under your control) to its full extent for protected boot and disk encryption.

Look at tools like Clevis for LUKS, and I believe systemd has support for integration with TPM. Ubuntu is experimenting with TPM-backed Full Disk Encryption on Desktop using the work they put into snapd and Ubuntu Core.

It's an insane (and mostly annoying) rabbit hole if you intend to follow it, you quickly learn how much of a wild west UEFI is between vendors.