MurphyA/hacker-news huggingface dataset:
by donmcronald | 2025-10-08 21:30:40+00:00
Thanks for these links.

I've used Active Backup and never would have guessed it worked like that. Although, the MS365 security and permissions are so complex that I don't have a hope in hell of understanding them. The suggestions to do your own auditing in that post are moot because the target audience for something like a Synology doesn't have the resources or the ability to do that kind of assessment.

For me, I saw the permissions request along with the 'Synology Active Backup for MS365' app registration in my tenant and assumed everything was local to my tenant and NAS. The redirect back to the private LAN IP of the NAS also makes it seem like the communication is between the NAS and MS only.

I can't even tell if the issue has been fixed.

Ignoring the security stuff, my experience with Synology Active Backup for MS365 as a product hasn't been good for OneDrive backups. I have one setup where I reconcile the backup repo against a live (paused to get a consistent point in time) data set that's synced by the OneDrive client.

The Synology Active Backup for MS365 never reconciles correctly. Some files will randomly have things like '(1)' appended. Some files are simply missing. It seems to struggle with certain characters that Windows and OneDrive allow in filenames. For example, dots (.) appear to be problematic.

I monitor it and once it gets to the point where I think we'd suffer an intolerable amount of data loss if needing to restore, I delete it and restart it.

I would strongly encourage anyone relying on it to take the time to reconcile your OneDrive backups against a set of known good data. Pause your OneDrive syncing, restore the backup into a temporary folder, and use something like Beyond Compare [2] to compare the two directories. You can also map a network drive directly to storage location on the NAS which makes it very convenient to reconcile.

VEEAM used to have the same kind of issues with files missing for no reason, but they seem to be better lately if you ignore the way they append the version number to name of every (versioned) file restored (OMG why?). VEEAM has very slow restores and is much more difficult to reconcile due to the modified file names on restore.

Microsoft won't take responsibility for data loss "in the cloud" and the backup solutions all suck pretty bad IMO. Some of the blame for this kind of thing should fall to Microsoft. They've made everything too complex to be reliable.

1. https://oauth.net/2/grant-types/client-credentials/

2. https://www.scootersoftware.com/
by SiempreViernes | 2025-10-08 21:31:13+00:00
I think it's fairly common that individual members of parliament do directly draft and submit their own bills, certainly it is not uncommon that they have the right to propose their own bills.

But by volume most of these bills are shit and so just quietly die in a vote nobody noticed, and so most law that we actually have was indeed drafted by a special commission and put forward by the executive before it was approved by parliament.
by hnlmorg | 2025-10-08 21:31:16+00:00
> By making everything licensed with the absolute bottom wrung restrictions, you're just made it even easier for corpos to have free pickings of any given tool on the internet to incorporate into their own tools and have never-ending Amazon and Elasticsearch situations.

I've already given plenty of examples of BSD-licensed coreutils. If an evil corporation wanted to steal coreutils, they wouldn't need to take the Rust implementation. And as a bonus, if they took FreeBSD/OpenBSD/whatever, they'd get a project that's far more mature too.

It is, after all, exactly what Apple did with Darwin.

> Obviously the community wouldn't even be here to begin with if it wasn't for Linux going with a GPLv2 license.

That's survivor bias and doesn't fall in line with my experiences using Linux and BSD in the 90s.

BSD originally had a bigger community than Linux for quite a while. What accelerated Linux wasn't the license; it was the hacker culture.

BSD systems were tightly controlled ecosystems, whereas Linux was a free-for-all because the kernel was managed by a different developer to the guy who managed GNU. So everything about the GNU/Linux ecosystem was disparate projects slapped together. This encouraged others to slap their own parts to GNU/Linux. This is why fsck needed to exist: the file system was slapped together so Linux needed a way to fix file corruptions. It's why there's different package managers and why the concept of a "distribution" exists in the first place.

It's what made Linux approachable and it meant development on Linux happened at a much faster pace than on BSD.

Then all of those hackers got jobs. Became managers. And recommended Linux because it's what they learned "UNIX" on.

Linux was basically the original "move fast and break things". If it had been licensed MIT then nothing would have changed.

> I suspect, should there come a time in the future where we realize that this may have been a critical error, it'll be far too late to correct it.

The GPL vs BSD argument is probably older than you've been alive. It's probably older than a considerable number of HNers have been alive. And it's been proven time and time again that it's an ideological debate that has no practical truth. Hence why people stopped arguing it.
by osener | 2025-10-08 21:31:51+00:00
Former. Otherwise I would need to have multiple database instances running, each with its own data and migrations to keep in sync. Plus I would need to re-do local env vars to hook all of this up for each worktree etc. And I often want to know how these branches play together, with GitButler I can bring these branches in and out with a single “apply to workspace” click.
by cosmicgadget | 2025-10-08 21:31:57+00:00
What idiot would ever use a ladder in a dangerous way?

It's me, I'm the idiot.

Standing on the top step? Yes. Putting a hammer on the top step and forgetting about it? Uh huh. Putting the ladder on plywood on a mattress so I could change a lightbulb without moving the bed and buying a taller ladder? You better believe it. Using a paint sprayer with a 25' latter and no spotter? Absolutely not. Wait, yes.

There are dozens of us: https://old.reddit.com/r/MenonUnstableLadders/
by reverendsteveii | 2025-10-08 21:32:03+00:00
our industry has existed on the cutting edge doing what's hard since its inception. it's just that there was a time when sending a piece of text across a wire was hard. Now that's easy, so we do more with the tools that make that easy. When what's hard today becomes easy we'll do that quickly with the tools that make it easy and then do more hard stuff. We can say we've achieved AGI when the tools are doing better on their own than a tool plus an engineer would do, and I think that's a long way off.
by usefulcat | 2025-10-08 21:34:16+00:00
I guess I'm just not seeing how it makes sense to describe missing out on an unexpected windfall as a failure to "avoid complete financial ruin".

Like, if I have $N of equity in my house and it burns down and it's not insured, then I've just lost $N regardless of what is or is not in my bank account. IMO there's really no comparison between that scenario and missing out on winning $N because I didn't buy a winning lottery ticket.
by ozim | 2025-10-08 21:34:39+00:00
Reading comments here, Reddit or other places my guess is lots of people don’t know the difference between just a website and an app. Even ones that seem experienced.

Lots of newcomers are struggling and not understanding what are the options and which approach is best for their case.

Business people don’t help as they rightfully don’t care. But they want „do everything” - „pay once” approach so people bolt on static pages ona apps or other way around.
I drove my (new to me) 1999 911 996 5k Miles in 3 Months: Engineer's Review
by h100ker | 2025-10-08 21:35:31+00:00
I've driven air-cooled 911s, water-cooled GT cars, and everything in between at different levels of intensity over the past 8 years.

This is the purest water-cooled Porsche I've ever driven. It almost has an air-cooled personality, but with the modern amenities you'd expect from 996-992 models.

Things I like: cable wire throttle feels like a go-kart. Mechanical latches, stripped-down weight, no traction aids, halogen headlights, ease of service (post-IMS/RMS repairs), and resistance to various driving conditions. The 3.4 flat-6 is very rev-happy and significantly more reliable than the 3.6, with little to no bore scoring issues.

Things I don't like: no cup holders; mine didn't come with an LSD (which is rare), and those weird insulation foams coming out of the AC vents (a common issue on 996/997s, apparently).

Can't say enough positive things about this generation of 911. I used to dislike the '98 Boxster headlights (the orange fried eggs), and I was part of that camp myself. But nobody has the right to criticize the 99 headlights. After all, these lights helped light the way for the GT 1 to win Le Mans in 1998. So if that's still a reason for anyone to hate the entire car, they should build a bridge and get over it.

My one reservation: interior quality could have been better, but the fact that parts are cheap and readily available is a huge plus. The interior design was once criticized, but it has aged well, and everything falls into place when you drive it daily.

I can't praise the 996.1 C2 enough. I'm definitely keeping this car since it's a clean example with 145k miles. It's a blast and a complete bargain for a rear-engine 911 under $20k.

If you're in the market, a 1999 base Carrera C 2 with complete service records, IMS/RMS done, and LSD (if available) is an incredible deal at any mileage. It's almost certain to become a classic and is definitely worth buying right now. The dual-row IMS has a failure rate of less than 2%, so even if it has been serviced every 99, it's not a big concern.

Among all the hate for the 996, the 1999 C2 is the best option outside of the Hans Mezger flat-6 engines found in Turbo and GTS models.
by piskov | 2025-10-08 21:35:39+00:00
Battery and mobile performance is what killed flash and silverlight as an aftermath in the first place.

See “Thoughts on Flash” by Steve Jobs

https://web.archive.org/web/20170615060422/https://www.apple...

—

As for Blazor, we ain’t fools to rewrite the RIA app the fourth time.

I just wish these “innovation” MF stopped reinventing the wheel.

The code from 2008 was perfectly fine and should have worked in 2025 if all these guys stopped making web frameworks like hot cakes. Some of us with an actual job have products that last more than a couple years (15+ in my case)
by gausswho | 2025-10-08 21:36:08+00:00
This is much more detailed and worth reading. I didn't realize the specific location of the origin of the fire was known.

The origin fire was extinguished seven days previously but allegedly continued underground. Their assessment that there was one fire that resurged vs two separate fires reads circumstantial rather than proven.

Running with the official explanation, can dormant fires like this be detected via underground temperature anomalies? If high winds are expected, the fire department could then be preemptively assigned to known risk locations.

The broader picture here does look very incriminating (via law enforcement sharing from telcos, Google, OpenAI, and Meta) towards the individual. But it also demonstrates that there was a weeklong opportunity for preventing it from becoming the disaster that it did.
by nine_k | 2025-10-08 21:37:23+00:00
You don't need a missile. Any fighter jet is equipped with a cannon; a bunch of 30mm fragmentation-action ammo would dispatch the drone. You don't need a jet; any decent piston-engine trainer plane can fly 4x as fast as the drone, just mount a machine gun on it. Hell, take a civilian helicopter, shoot through the open door. You have ten hours to dispatch it, given that you have detected it.

But, since this is not being done routinely along the way, I conclude that detection fails. All reports about drones shot down mention that the drones were shot down nearby, likely by local air-defense teams near the target. These could as well detect the drone visually, or by the sound.
by TZubiri | 2025-10-08 21:38:23+00:00
>For most wifi networks, there is no encryption between users. And it's quite likely that the neglected router got hacked over the internet and is part of a botnet.

WPA2? Sure it can be broken, but you still would have to break HTTPS on top of that.

I don't deny that a third layer adds security in that scenario, as 3 layers is more than 2 layers. But you necessarily weaken some other stretch in a zero-sum fashion, as mentioned. I'll concede that the server can be in your own country if you so choose to. But these datacenters are not necessarily controlled by the VPN provider, and they may be highly heterogeneous, in addition there will be many routers in the VPN DC to destination stretch that can still be hacked. Although again I'll grant that endpoint routers are probably weaker targets than ISP routers.
by JoshTriplett | 2025-10-08 21:38:29+00:00
> My initial post wasn't about mass surveillance.

When you said "If you can install stuff on the device, how could you protect against it?", that sounded like it was talking about how a device that can have new software installed onto it can have a backdoor for later use installed onto it, and that led into a discussion about how to protect against that.

Were you instead saying "on a device you have control over, how can you protect yourself against that?". Or something else?

> If you look at history, not sure why technical measures would offer much protection against violence based approaches against privacy, though.

They can at a minimal level (e.g. steganography, duress passwords), but yes, ultimately there is little you can do against someone threatening you personally with harm.
by YmiYugy | 2025-10-08 21:38:39+00:00
Runes got introduced with svelte 5 and they address some problems that really bite when your components become complex and just weren’t solvable in the old paradigm. I think svelte is still very ergonomic to use. Having to write $state() when declaring reactive variables is not a big deal and neither is writing $effect instead of $:. I think the real reason the hype has waned a little is a combination of time, LLMs really liking React and generally absorbing any spare attention.
by archagon | 2025-10-08 21:39:10+00:00
Are there any other NASes out there that a) support ZFS/BTRFS, b) support different-sized drives in a single pool, and c) allow arbitrary in-place drive upgrades?

Last I checked, I believe I didn't find anything that satisfied all three. So DSM sits in a sweet spot, I think. Plus, plastic or not, Synology hardware just looks great.
by rolandog | 2025-10-08 21:39:26+00:00
Completely agree... though I wouldn't underestimate them: Their main strength, I'd argue, comes from their very successful use of the Firehose Of Falsehood (effectively managing to make the US self-own itself by turbocharging neoliberalism, among other things). They "James-Bond-Villain'd" the US (announced how they'd "take over the world") 28 years ago [0], and... well... look how that's going.

[0]: https://en.wikipedia.org/wiki/Foundations_of_Geopolitics
by acka | 2025-10-08 21:39:27+00:00
Would you care to explain what you mean by "the bandwidth just isn't there"? VR is more than just mobile devices; all currently available VR headsets can also do PC VR, whether via a wired DisplayPort link or a wired or wireless network connection.

As I see it, the only absolute upper limit for VR is the resolution and frame rate of the VR headset displays, as well as the quality of the optical stack. Rendering of the graphics can be done by anything from a single high-end GPU in a PC up to a beefy server in the cloud—although in that case, of course, network latency and video compression will impact the experience.
by JoshTriplett | 2025-10-08 21:39:36+00:00
> I agree that there shouldn’t be a backdoor by default. But, for example, planting a modified app update with backdoor on the device of a suspected high-risk felon, based on a court warrant, is something that can be more reasonably debated.

Sure. And on the flipside, given the many ways such a capability is a security risk and an abusable backdoor itself, it's something to develop additional technical safeguards against, such as Binary Transparency to verify that everyone's getting the same binaries.
by bccdee | 2025-10-08 21:40:03+00:00
It also depends what the "most important papers" actually are. What is it that makes something a breakthrough?

Suppose I'm analyzing a species of bacteria with some well-known techniques and I discover it produces an enzyme with promising medical properties. I cite some other research on that species, I cite a couple papers about my analytical tools. This is paper A.

Other scientists start trying to replicate my findings and discover that my compound really lives up to its promise. A huge meta-analysis is published with a hundred citations—paper B—and my compound becomes a new life-saving medicine.

Which paper is the "important" one? A or B? In the long run, paper A may get more citations, but bear in mind that paper A is, in and of itself, not terribly unique. People discover compounds with the potential to be useful all the time. It's in paper B, in the validation of that potential, that science determines whether something truly valuable has been discovered.

Was paper A a uniquely inspired work of genius, or is science a distributed process of trial and error where we sometimes get lucky? I'm not sure we can decide this based on how many citations paper A winds up with.
by davnicwil | 2025-10-08 21:40:04+00:00
Yeah. There's a sort of uncanny valley to this that's hard to explain but you know when you see it.

It's like, conversations naturally taper yes, sensitive topics are danced around yes, particularly with people you're not that close with, but there's a grey area people play with generously in genuine interactions, precisely because they actually care.

Conversely in some interactions where you're sort of made acutely aware you've gone 'off script' the moment it happens and you realise, oh, this was always just templated/transactional.

I just think it's generally bad advice to enter into such interactions knowingly, even if you have good intentions, because of this. It's quite likely to happen and it's just an overall negative experience.
by jchmbrln | 2025-10-08 21:40:18+00:00
This is insightful. I remember thinking after the first generation of SPA frameworks like Backbone and Ember and—somewhat later—AngularJS that maybe the second generation (React, Vue, etc.) would get it all sorted out and we'd arrive at stability and consensus. But that hasn't happened. The next generation was better in some ways, worse in a few, and still not quite right in many others.

Of course I hear plenty of people complaining that apps on top of hypertext is a fundamental mistake and so we can't expect it to ever really work, but the way you put it really made it click for me. The problem isn't that we haven't solved the puzzle, it's that the pieces don't actually fit together. Thank you.
by tsimionescu | 2025-10-08 21:40:46+00:00
O(N) is not a function, though, so the notation is doing a good job of saying this. When we say "the complexity class of an algorithm is O(log N)", we mean "the function WorseCaseComplexity(N) for that algorithm is in the class O(log N)", The function "WorseCaseComplexity(N)" measures how much time the algorithm will take for any input of size N in the worse case scenario. We can also say "the average case complexity of quicksort is O(N log N)", which means "the function AverageCaseComplexity(N) for quicksort in the class O(N log N)", where AverageCaseComplexity(N) is a function that measure how much time quicksort will need to finish for an "average" input of size N.

Saying that a function f(n) is in the class O(g(n)) means that there exists an M and a C such that f(n) < C * g(n) for any n < M. That is, it means that, past some point, f(n) is always lower than C * g(n), for some constant C. For example, we can say the function f(n) = 2n+ 1 is in the class O(n), because 2n + 1 < 7n for any n > 1. Technically, we can also say that our f(n) is in the complexity class O(2^n), because 2n + 1 < 2^n for any n >= 3, but people don't normally do this. Technically, what we typically care about is not O(f(n)), it's more of a "least upper bound", which is closer to big_theta(n).
by ProfessorLayton | 2025-10-08 21:41:01+00:00
I fall squarely in the second camp, but what ended up happening was that I went from going occasionally, to not going at all.

McDonald's app-free pricing is now butting against actual sit-down restaurants, or a good local shop. I'm not price sensitive per se, but I don't want a raw deal, so I'll pick the better option. McD's used to be cheap and fast, now it's neither really.

Their sales are falling, and they're doing $5 deals now, so I'm definitely not the only one picking other options.
by thesz | 2025-10-08 21:41:08+00:00
> while I don't see an easy way to avoid big locks with COLA

Do not modify arrays in-place, create new arrays instead. This way you can have multiple readers as the data pretty much read-only, no write locks and, again, cache-oblivious merging (fast).

Extension of COLA called Fractal Indexes (on-disk storage) are commercialized by Tokutek: https://en.wikipedia.org/wiki/Fractal_tree_index
by bloomingeek | 2025-10-08 21:42:10+00:00
<Manipulating the gear shift lever will deliver vague suggestions to this rod...>

Great read. Several years ago I owned and drove a '67 Olds Cutlass for sixteen years. (Two door, auto-trans, AC, standard brakes.) I purchased the car in 1990 and everything was in working order. When the carburetor finally warped beyond repair, I cobbled together some other Olds carb body parts and, since the automatic choke parts were bad, I rigged up a manual choke line through the firewall. This made the car undriveable for the other drivers in my family! The sequence of gas pedal pumps and knowing when to disengage the choke was too much to surpass. :)
by reillychase | 2025-10-08 21:42:11+00:00
No idea, obviously you can see I'm a n00b and not a profitable poker player but on the strategy side, and this is very oversimplified, but you should be folding a lot of the time other than when you get AA-22, AK, AQ, AJ, AT, KQ, KJ, QJ, JTs, T9s, 87s you call or 3 bet pre-flop because you have good odds. When you're up against tight players you can make a small bluff on the flop and scare them away most of the time, if they raise you fold though. Position is very important in the game, when you're on the button you have odds in your favor because everyone else has to check or bet before you so you play more loose and aggressive in that position and more tight and passive in early position. There is no one single strategy to memorize and apply, that's why it's great. 5 minutes to learn the game, a lifetime to master.