MurphyA/hacker-news huggingface dataset:
by ben_w | 2025-10-14 14:07:39+00:00
> I'm kind of surprised no one just searched for "deduplication algorithm".

Fair.

To set the scene a bit: the other developer at this point was arrogant, not at all up to date with even the developments of his preferred language, did not listen to or take advice from anyone.

I think a full quarter of my time there was just fire-fighting yet another weird thing he'd done.

> If it was absolutely necessary to get this 1MB dataset to be smaller

It was not, which is why my conversation with the CTO to check on if it was still needed was approximately one or two sentences from each of us. It's possible this might have been important on a previous pivot of the thing, at least one platform shift before I got there, but not when I got to it.
by eduction | 2025-10-14 14:07:55+00:00
Chesterton's Fence - why did everyone start encyrpting their websites?

His critiques of why LE is flawed security wise are spot on and I suspect something like SSH keys as he suggests would be pretty much as good.

But there's a reason we're encrypting everything, and the time when we started encrypting offers a clue as to why. Mass surveillance threat actors are not going to go to the trouble and visibility of MITMing every cert connection, but they will (and in the case of NSA did) happily go to the trouble of hoovering up network traffic en masse and watching how people surf. HTTPS provides some protection there because it at least hides the paths to the specific pages you are reading as you surf online, including things like search engine query terms.

The idea that $3.6m is a lot of money to encrypt a huge chunk of web traffic, or that Google is eagerly guarding the money it makes (?) off web certs, which must be a tiny fraction of its actual income, is a clue that this is maybe not a greedy conspiracy.
by rasz | 2025-10-14 14:08:15+00:00
You are losing against Microsoft marketing. In Europe one of the biggest electronic chains MediaMarkt (think bestbuy in its heyday) is currently running commercials targeting older audience and clearly co-financed by Microsoft. Its all about dangers of doing basic ecommerce on "old unsupported computers" and how you are going to have all of your data and identity stolen if you dont upgrade _right now_ to a new computer with Win11.
by hamzakat | 2025-10-14 14:08:22+00:00
Hi there

I worked on this tool in an afternoon (with GLM 4.6) to solve a problem I'm facing: in some workspaces, AI coding assistants aren't allowed, forcing you to use web-based chatbots or local LLMs . To get meaningful help, you need to provide context about your codebase, but manually copying files is tedious.

While there are great tools like Gitingest and Repomix, they require installing packages which isn't straightforward in air-gapped work environments! I wanted something more portable - just a shell script that works anywhere you have a terminal.

GitHub: https://github.com/hamzakat/ingest.sh
by hansmayer | 2025-10-14 14:08:49+00:00
That depends on the context, obviously. If you had asked me to count them in every "strawberry" in a text file, then I may whip out my Python or some combination of bash, awk and sed. If you asked me in a conversation, I may close my eyes, visualise the string and use my visual cortext tool to count them in-memory. If you gave me a piece of paper with the word on it, I may use my 'eye' or 'finger' tool to count them. There are numerous approaches, based on the problem setting as you see, but one thing in common - you don't need to specifically tell me what tool to use. I will infer it myself, based on the context. Something an LLM almost never does.
by ocdtrekkie | 2025-10-14 14:08:55+00:00
The entire behavior of the PKI regime seems like satire, but here we are. A massive amount of fragility introduced to the Internet to basically protect a few edge cases while not addressing any real practical attacks.

It's been six years, this author is still right, and now the idiots at the CA/B have decided to move the bomb to a 47 day timer for the whole Internet.
by danielbarla | 2025-10-14 14:08:57+00:00
> First point: if you imagine that the brain is doing something like collapsing the quantum wavefunction, wouldn't you say that this is a functionally relevant difference in addition to an ontologically relevant difference?

I can imagine a lot of things, but the argument did not go this far, it left it as "obvious" well before this stage. Also, when I see trivial simulations of our biological machinery yielding results which are _very similar_, e.g. character or shape recognition, I am left wondering if the people talking about quantum wavefunctions are not the ones that are making extraordinary claims, which would require extraordinary evidence. I can certainly find it plausible that these _could_ be one particular way that we could be superior to the electronics / valves of the argument, but I'm not yet convinced it is a differentiator that actually exists.
by toomuchtodo | 2025-10-14 14:10:56+00:00
Trump is threatening more tariffs. But it looks like China is winning the trade war - https://qz.com/china-winning-trump-trade-war-tariffs - October 13th, 2025

> China’s exports surged 8.3% in September, their fastest pace in months, even as shipments to the U.S. fell 27%. So, far from being crippled by tariffs, Beijing appears to be quietly rerouting its economy around them. Europe, Southeast Asia, and the countries across the global south have largely picked up the slack. Exports to the E.U. rose more than 14%, to ASEAN nations nearly 16%, and to Africa an impressive 56% (although Africa still represents a small fraction of China's total exports).

> That math is more or less simple: While direct shipments to the U.S. now make up barely 10% of China’s total exports, trade with the rest of the world is booming. Even just two or three years ago, the U.S. claimed at least a quarter of Chinese exports.

> Why does this matter so much? Washington’s power in a trade war largely comes from its ability to hurt China’s export machine by cutting off access to the vast base of U.S. consumers. But that power only works if the U.S. remains an un-ignorable, indispensable buyer.

> When China can offset a 27% drop in U.S. sales with double-digit growth elsewhere, it shows the U.S. market is no longer as critical to Chinese growth as it once was. That diversification weakens the impact of tariffs, as well as other trade-war weapons like sanctions or boycotts, because China now has alternative buyers and more routes to market. Tariffs may still sting, but they can’t force concessions the way they might have just a few years ago.
by notatoad | 2025-10-14 14:11:13+00:00
the current level of AI hype amongst a lot of people, but especially investors and bosses, is that you can already give an AI a simple prompt and get it to spit out a fully functional, user-ready application for you. and we're so incredibly far off that.

the things that AI is able to do are incredible, but hype levels are just totally detached from reality.
by jrockway | 2025-10-14 14:11:15+00:00
I think that if we didn't do TLS, every ISP would be injecting ads into websites these days. Making it difficult for middle-of-the-road interlopers is a good thing. ISPs don't want the customer service burden of proxy configurations and custom certs (god knows your IT department hates the support aspect of this tampering), so TLS keeps us free of excessive advertising. (Of course, they like do tampering with DNS which is why we have to do DNS-over-HTTPS. If you make it easy to tamper with your traffic, your ISP has a good business case to tamper with your traffic. Sad but true.)

I'm not as convinced as the author is that nation states can easily tamper with certificates these days. I am not sure how much CT checking we do before each page load, but either nation states are compelling the issue of certs that aren't in the CT database, or they are and you can just get a list of who the nation states are spying on. Seems like less of a problem than it was a decade ago.

The author seems to miss the one guarantee that certificates provide; "the same people that controlled this site on $ISSUANCE_DATE control the site right now". That can be a useful guarantee.
by MagnumOpus | 2025-10-14 14:11:19+00:00
At least since the mid-1990s Echelon revelations in the EU parliament anybody who cares knows that Bad Aibling (and similar stations all across Europe like Bude/Morwenstow in the UK) had been operated by the NSA in collaboration with US Army intelligence (if the official name of “18th United States Army Security Agency Field Station” didn’t clue you in.

Officially it has been transferred to the BND; experience suggests all data from there still goes straight back to Fort Meade… (And in exchange the BND gets some morsels back on people _they_ are not allowed to spy on publicly.)
by neutronicus | 2025-10-14 14:11:20+00:00
This matches my experience as well.

I'm a Spacemacs user, and Claude knows the difference between Spacemacs and stock emacs. It basically wrote tools for itself to hook into the emacs LSP package and look up C++ code (in our codebase, which is, uh, challenging for FOSS language servers) from gptel. I was completely fucking unable to do this via publicly-available MCP servers in the VSCode agent mode. In general I have been able to resolve a bunch of niggling config issues that I had just been ignoring in favor of doing Actual Work.

As you said, I can evaluate the elisp Claude wrote right there in the gptel buffer, try it out, and iterate before actually pasting it into .spacemacs. It it doesn't work, Claude knows a ton of debugging tricks I can try. trace-function, advice to dump a backtrace, etc. It knows how to do everything in org-mode. Super helpful. Way better than the AI Assistant that my employer bundles with our product (which is outperformed by the Google AI Overview).
by rootlocus | 2025-10-14 14:11:33+00:00
Here's how Claude Code does this:

> Find all java files with more than 100 lines.

● I'll search for all Java files with more than 100 lines in the codebase.

● Bash(find . -name "*.java" -type f -exec wc -l {} + | awk '$1 > 100' | sort -nr)

...

● I found 5 Java files with more than 100 lines:

1. File1.java - 315 lines 2. File2.java - 156 lines 3. File3.java - 154 lines 4. File4.java - 130 lines 5. File5.java - 117 lines The largest file is File1.java with 315 lines.

Or, if you want to count lines:

> How many lines don't start with `import` in File1.java?

● Bash(grep -cv "^import " ./File1.java) ⎿ 287

● There are 287 lines that don't start with import in File1.java.
by 1718627440 | 2025-10-14 14:11:41+00:00
> But if someone is able to perform a man-in-the-middle attack against your website, then he can intercept the certificate verification, too. In other words, Let's Encrypt certificates don't stop the one thing they're supposed to stop.

But the certificate is signed with the key of Let's Encrypt and your own, both of which the private key never leave the server.
by woodruffw | 2025-10-14 14:12:17+00:00
> Not this time. The technical problems are easy to solve. For decades, users of SSH have had a system (save the certificate permanently the first time you connect, and warn if it ever changes) that is optimal in a sense: it works at least as well as any other solution. It's trivial to implement, is completely free, involves no third parties, and lasts forever. To the surprise of absolutely no one, web browsers don't support it.

This is completely backwards: TOFU schemes aren't acceptable for the public web because the average user (1) isn't equipped to compare certificate fingerprints for their bank, and (2) shouldn't be exposed to any MITM risk because they forget to. The entire point of a public key infrastructure like the Web PKI is to ensure that technical and non-technical people alike get transport security.

(The author appears to unwittingly concede this point with the SSH comparison -- asking my grandparents to learn SSH's host pinning behavior to manage their bank accounts would be elder abuse. It works great for nerds, and terribly for everyone else.)
by ajross | 2025-10-14 14:12:25+00:00
I'm confused. They're saying that the original patch was incomplete and that they believe they've re-broken it, but that they aren't publishing the updated attack because the report is embargoed (presumably to update the fix).

What is the security policy you'd like to see here? If the researchers were to publish the updated attack before mitigation then that WOULD be a zero day!
by nogridbag | 2025-10-14 14:12:25+00:00
I see. I think part of the reason why I don't see this (or don't remember it?) is I treat my work computer differently than my home computer. For my work computer, I honestly only restart my Mac maybe once every few months and never install updates. By the time I'm 1-2 OS releases out (usually when the battery starts to fail), my company gives me the latest macbook.

For the people in the office who use Windows they start dropping off randomly during the day as their computer decides to start installing updates during critical times.
by treve | 2025-10-14 14:12:32+00:00
A bit of an alternative take on this, but I talk to a lot of folks at small start-ups (in Toronto, if that matters), but it seems like most people actually get this right and understand not to bring in complexity until later. Things like microservices seems like they are mostly understood as a tool that's not really meant to solve a real scalibility problem and is massive liability early on.

The exceptions are usually just inexperienced people at the helm. My feeling is, hire someone with adequate experience and this is likely not an issue.

I do think architecture astronauts tend to talk a lot more about their houses of cards, which makes it seem like these set ups are more popular than they are.
by dijit | 2025-10-14 14:12:38+00:00
The ironic observation about the page using an LE cert is fantastic; Browser mandates make the encryption discussion moot. If you don't use it, your argument literally won't load for a modern audience.

It speaks to the problem of digital decay. We can still pull up a plain HTTP site from 1995, but a TLS site from five years ago is now often broken or flagged as "insecure" due to aggressive deprecation cycles. The internet is becoming less resilient.

And this has real, painful operational consequences. For sysadmins, this is making iDRAC/iLO annoying again.

(for those who don't know what iDRAC/iLO are, it's the out-of-band management controller that let you access a server's console (KVM) even when the OS is toast. The shift from requiring crappy, insecure Java Web Start (JWS) to using HTML5 was a massive win for security and usability - old school sysadmins might remember keeping some crappy insecure browser around (maybe on a bastion host) to interact with these things because they wouldn't load on modern browsers after 6mo)

Now, the SSL/TLS push is undoing that. Since the firmware on these embedded controllers can't keep pace with Chrome's release schedule, the controllers' older, functional certificates are rejected. The practical outcome is that we are forced to maintain an old, insecure browser installation just to access critical server hardware again.

We traded one form of operational insecurity (Java's runtime) for another (maintaining a stale browser) all because a universal security policy fails to account for specialised, slow-to-update infrastructure... I can already hear the thundering herd approaching me: "BUT YOU NEED FIRMWARE UPDATES" or "YOU NEED TO DEPRECATE YOUR FIRMWARES IF NOT SUPPORTED".. completely tone-deaf to the environments, objectives and realities where these things operate.
by JLC443 | 2025-10-14 14:12:46+00:00
Just thought I'd add to this thread that I also had a lot of fun playing this game, and I don't normally enjoy puzzles on the computer!

A couple of very minor pieces of feedback, if you're open to it: The camera momentum when dragging felt a little unnatural. The videos seemed to have a slightly jumpy framerate and were a bit low-resolution when zoomed in.

Honestly though, those are minor nitpicks. It's a really fun and polished experience. Thanks for sharing!
by absoluteunit1 | 2025-10-14 14:12:49+00:00
This is something that I constantly struggle with and my co founder and I discuss a lot.

I’m always very tempted to just build everything.

Example: We need a URL shortener - let me just put a basic one together over the weekend.

I’m always tempted to build vs buy.

My cofounder says sometimes that being an engineer founder can be bad for this reason - just because you can build something, doesn’t mean you should.
by Joker_vD | 2025-10-14 14:13:20+00:00
EV certs seem to have basically the same verification policies that CAs had for ordinary certificates back in the early 2000s (i.e., really not that much at all), so I am intrigued as to what the DV has to offer except "it's basically self-signed but with extra steps and the rest of the world will trust it".

> If someone is between a service and LE

There is always someone there: my ISP, my government that monitors my ISP, the LE's ISP, and the US government that monitors the LE's ISP.
by Vinnl | 2025-10-14 14:13:37+00:00
Somewhat off-topic, but since it might be useful to you and others:

> if I want to view that URL, I need to mail it to myself and open it on a desktop.

I'm signed in to both my Firefox on Android and on desktop, and I can hit the share button while viewing a website and then tap my desktop Firefox under "Send to device". Saves a bunch of steps there.

I'm assuming other browsers can do the same.
by janwl | 2025-10-14 14:14:18+00:00
>Case in point: Microsoft is stopping free support for Windows 10 on hundreds of millions of computers this very week. Many of these old yet perfectly usable devices will not be able to upgrade because of spurious hardware requirements. Microsoft’s solution? “Throw away your computer and pollute the planet because we want to make even more money.”

Windows 10 was released in 2015. Does KDE still support whatever version of KDE was released in 2015?
by smoe | 2025-10-14 14:14:51+00:00
In my opinion, if those influential programmers actually architected around some concrete metrics like 1,000 TPS and 10K daily users, they would end up with much simpler systems.

The problem I see is much more about extremely vague notions of scalability, trends, best practices, clean code, and so on. For example we need Kafka, because Kafka is for the big boys like us. Not because the alternatives couldn’t handle the actual numbers.

CV-driven development is a much bigger issue than people picking overly ambitious target numbers.
by pavel_lishin | 2025-10-14 14:15:21+00:00
We had this happen to us at work, once.

We were working on some feature for a client's website, and suddenly things started breaking. We eventually tracked it down to some shoddy HTML + Javascript being on our page that we certainly didn't put there, and further investigation revealed that our ISP - whom we were paying for a business connection - was just slapping a fucking banner ad on most of the pages that were being served.

This was around ... 2008? I wonder if they were injecting it into AJAX responses, too.

My boss called them up and chewed them several new assholes, and the banner was gone by afternoon.
by woeirua | 2025-10-14 14:16:00+00:00
There's a huge disconnect between what the benchmarks are showing and what the day-to-day experience of those of us using LLMs are experiencing. According to SWE-bench, I should be able to outsource a lot of tasks to LLMs by now. But practically speaking, I can't get them to reliably do even the most basic of tasks. Benchmaxxing is a real phenomenon. Internal private assessments are the most accurate source of information that we have, and those seem to be quite mixed for the most recent models.
by linsomniac | 2025-10-14 14:16:10+00:00
>I doubt his wealth has really gained much of anything in the last few years either.

He has probably gained around 5x in the last 2-3 years. He is heavily into bitcoin. I've gained 3x in the last 2 years and 4x in the last 3 years largely in the stock market.

Not saying you're wrong. In Colorado USA the middle class income range is $62-186K, which is a pretty huge range.
by NoahZuniga | 2025-10-14 14:16:44+00:00
> You can make the warning go away by paying a third-party—who then pays Google—to sign your website's SSL certificate

This is just not true!!!! CAs don't pay google to be in their root store.

> But if someone is able to perform a man-in-the-middle attack against your website, then he can intercept the certificate verification, too

The reasoning goes that most MITM (potential) attacks are between you and your ISP. Let's encrypt can connect to the backbone basically directly, so most MITM attacks won't reach them. Also, starting on September 15, 2025 (Let's encrypt has been doing this for a while already though) all domain validation requests have to be made from multiple perspectives, making MITM attacks harder.
by sirfz | 2025-10-14 14:16:53+00:00
I've decided to to try out Pyrefly, Ty and Zuban for their language server features (type checking disabled where possible) last week and found that Zuban is the fastest (but unfortunately doesn't currently have the option to disable type checking). Ty comes next and Pyrefly was surprisingly slow to load (have to wait a few seconds before I can goto definition for example).

They all lack certain features vs basedpyright (what I was using) such as auto imports (Ty has experimental support), showing signature/doc when selecting autocomplete options (I think Ty does have this one) and some other features that I can't remember.

One feature that always existed in Jedi (and now also Zuban) is "goto declaration" in Python. It allowed me to goto the "import" instead of the original definition of a function/class which I'm surprised either isn't supported at all (pyright?) or would just do the same thing as "goto definition" (Ty), seems like an obvious oversight imho.

Edit: Also, I wish all these new tools give more importance to such IDE features as much as they do for type checking.
by johnisgood | 2025-10-14 14:17:00+00:00
My problem is that you talk about insecurity because you saw "in C", yet you have not actually reviewed the code. You simply concluded (allegedly) that it is unsafe because it is written "in C". Review the code first. Written "in C" does not automatically make it unsafe. Do you agree?

That is my only problem.

Yes, I agree that every developer should know how to write C (useful skill, reference implementations should be written in C due to its simplicity), but I do not think that using C for writing a web framework is a bad thing. To each their own. It might have issues, but as I have said, it can be analyzed and reviewed through the methods I have previously said so[1]. I have no clue if this code has any issues, I have not reviewed it myself, so it is for not me to claim either way.

Are we in a disagreement or not?

[1] See https://news.ycombinator.com/item?id=45527495.
by gmuslera | 2025-10-14 14:17:01+00:00
https does 2 things: encrypt the communication (self-signed certificates are good enough for this), and verify that the site you are connecting to is what it seem to be, because a certification authority trusted by your browser signed the certificate that that site presents, and it should had validated somehow that the site belongs to its rightful owner.

The second part is the important one in this context, because there are ways to trick your dns resolution or ip routing. The dns resolution part is mitigated with DoH (that it also uses https with certificate), but that doesn't covers everything.

It might not be so fundamental for some just browsing sites, but for the ones you send data (not just credit card info) you may run into some risks.