MurphyA/hacker-news huggingface dataset:
by Cervisia | 2025-10-31 21:20:13+00:00
> robots.txt. This is not the law

In Germany, it is the law. § 44b UrhG says (translated):

(1) Text and data mining is the automated analysis of one or more digital or digitized works to obtain information, in particular about patterns, trends, and correlations.

(2) Reproductions of lawfully accessible works for text and data mining are permitted. These reproductions must be deleted when they are no longer needed for text and data mining.

(3) Uses pursuant to paragraph 2, sentence 1, are only permitted if the rights holder has not reserved these rights. A reservation of rights for works accessible online is only effective if it is in machine-readable form.
by niemandhier | 2025-10-31 21:20:15+00:00
I live next to a baron, next town lives a count. Both are just moderately wealthy humans.

There is one distinction that sets them apart from "new money": They could not leave without loosing a significant part of their identity and influence.

I grew up among socialists, I have no love for aristocracy, but in times when the schism between rich and poor widens a caste of people that are bound by custom to be loyal to a place, meaning they are reluctant to abandon their local community, might be worth more than we think.
by LorenPechtel | 2025-10-31 21:20:38+00:00
Disagree--it can be entirely sane to eject from a fully functional aircraft.

1) Something is going catastrophically wrong with the plane. It's flying now, but soon that fire will burn through the hydraulics, safer to punch while it's still in controlled flight.

2) There is not enough fuel to put it on a runway. Once again, punch while it's still stable. We've even seen a civilian do that--ferry flight with one of those planes with an integrated parachute. He had a fancy rig with extra fuel in the cabin, it wouldn't feed. Without it he wasn't going to make Hawaii.

3) We have seen a Navy pilot correctly punch from a fully functional aircraft. He was on final when somebody launched an SM-2 at him. Low, slow, defenses off--no chance, he punched. He was pointed right at the carrier at the time, having an autopilot do something else would be a good idea. (There would always be a chance that the missile was destructed in time.)

And with semi-functional planes:

4) We have seen an Israeli pilot bring their bird back with one wing. He had to land very hot but there was a long enough runway, he was able to do it. But what if it's even worse? There can be enough damage that your minimum airspeed is above any runway you can reach or above what your wheels can handle. Or maybe the Navy would prefer the pilot to eject rather than risking a major mishap on the deck.

5) What if the problem is elsewhere? We have seen a pilot punch from an apparently-functional F-35. The problem was actually in his controls. (Yes, he has been found wrong--the first two investigations cleared him (if the plane is not responding properly to pilot inputs below 6,000' AGL, eject), they finally found a panel that would declare him wrong. Doesn't make him wrong.)
by martinvonz | 2025-10-31 21:20:53+00:00
The difference is that jj doesn't force you to resolve the conflict right away. I agree that you usually want to do that anyway, but it has happened to me many times that some conflict turned out to be more complicated than I had time for at the moment and I needed to work on something else for a while. When using Git, I would typically abort the rebase in such cases, which is not so bad if you have rerere enabled (I can't remember if it records any resolutions I had staged or if that's only one you commit).

Anyway, I'm just explaining how jj works and what I prefer. As Steve always says, you should use the tools you prefer :)
1K Users – Let Community Vote on Next App
by NAKSTStudio | 2025-10-31 21:21:15+00:00
We launched this today!

Hit 1K DAU across our apps and realized we need to ask: "What should we build next?"

So we built a voting platform. Launched literally hours ago.

We've got the first handful of ideas in, but the goal is simple: you submit ideas, community votes, we build the winner.

Technical stuff (since this is HN): - Browser fingerprinting to prevent vote manipulation - localStorage caching to reduce server load - Prepared statements + strict validation (no SQL injection) - Rate limiting per action - XSS protection headers

Built in ~24 hours.

Would genuinely love feedback - on UX, tech choices, security approach, anything!

https://nakststudio.com/vote-next-app-beta/
by dghlsakjg | 2025-10-31 21:22:21+00:00
I live in a place where I have to fly to a nearby bigger airport to go anywhere outside my province. In other words, everything is a compromise on routing, layovers and cost. When I lived in a big city, it was just timing and cost that mattered.

Frequently it isn't that google flights on a phone doesn't find the same flight, its that it is much easier to figure out the tradeoffs with more screen real estate. E.g. I can see that a flight is cheaper, but it involves mixing airlines, and a terminal change that I probably can't trust on a tight schedule in winter.
by miki123211 | 2025-10-31 21:23:38+00:00
So, if I understand this article correctly, if a single terminal private key ever leaks, all the protections preventing any random passer-by from reading your biometric data go out the window[1].

You could partially mitigate such a weakness by including "not valid before" and "not valid after" timestamps in the certificates, which would have to be short-lived. Passports would then verify that the timestamp supplied by the terminal is in the correct range, as well as that it is greater than any previous timestamp this passport has ever recorded.
by derefr | 2025-10-31 21:23:54+00:00
My friend, my writing isn't AI slop. It's Adderall slop. AI slop is far more structured.

(Also, because I assume this is your issue: em-dash is option-shift-hyphen on US-English Mac keyboard. I've been using them in my writing for 25 years now, and I won't stop just because LLMs got ahold of them.)
by tinfoilhatter | 2025-10-31 21:24:05+00:00
You're right - I probably am being too charitable in my description of him. To his credit, he's gotten better over the years, but I still check in on the forums and find examples of this behavior. Andreas could be the most talented compiler developer in the world, but as long as community members are being treated poorly for asking questions, the language will continue to languish in relative obscurity.
by JKCalhoun | 2025-10-31 21:24:14+00:00
iCloud (and the Mac) App Store, AppleCare are Mac products as well. But to your point, sure, Mac sales are a fraction of the phone's—the latter's loss would be devastating for Apple and for services.

It's too bad the world has moved on as it has. I liked Apple a lot when they were just a computer company.
by mycoliza | 2025-10-31 21:24:23+00:00
What could `tokio::select!` do differently here to prevent bugs like this?

In the case of `select!`, it is a direct consequence of the ability to poll a `&mut` reference to a future in a `select!` arm, where the future is not dropped should another future win the "race" of the select. This is not really a choice Tokio made when designing `select!`, but is instead due to the existence of implementations of `Future` for `&mut T: Future + Unpin`[1] and `Pin<T: Future>`[2] in the standard library.

Tokio's `select!` macro cannot easily stop the user from doing this, and, furthermore, the fact that you can do this is useful --- there are many legitimate reasons you might want to continue polling a future if another branch of the select completes first. It's desirable to be able to express the idea that we want to continually poll drive one asynchronous operation to completion while periodically checking if some other thing has happened and taking action based on that, and then continue driving forward the ongoing operation. That was precisely what the code in which we found the bug was doing, and it is a pretty reasonable thing to want to do; a version of the `select!` macro which disallows that would limit its usefulness. The issue arises specifically from the fact that the `&mut future` has been polled to a state in which it has acquired, but not released, a shared lock or lock-like resource, and then another arm of the `select!` completes first and the body of that branch runs async code that also awaits that shared resource.

If you can think of an API change which Tokio could make that would solve this problem, I'd love to hear it. But, having spent some time trying to think of one myself, I'm not sure how it would be done without limiting the ability to express code that one might reasonably want to be able to write, and without making fundamental changes to the design of Rust async as a whole.

[1] https://doc.rust-lang.org/stable/std/future/trait.Future.htm... [2]: https://doc.rust-lang.org/stable/std/future/trait.Future.htm...
by oconnor663 | 2025-10-31 21:24:30+00:00
> I wonder if there is a similar idea possible with tokio? E.g. if you are awaiting a Mutex held by a future that "can't run", then poll that future instead.

Something like this could make sense for Tokio tasks. (I don't know how complicated their task scheduler is; maybe it already does stuff like this?) But it's not possible for futures within a task, as in this post. This goes all the way back to the "futures are inert" design of async Rust: You don't necessarily need to communicate with the runtime at all to create a future or to poll it or to stop polling it. You only need to talk to the runtime at the task level, either to spawn new tasks, or to wake up your own task. Futures are pretty much just plain old structs, and Tokio doesn't know how many futures my async function creates internally, any more than it knows about my integers or strings or hash maps.
by mikeiz404 | 2025-10-31 21:24:48+00:00
Two thoughts here when it comes to poisoning unwanted LLM training data traffic

1) A coordinated effort among different sites will have a much greater chance of poisoning the data of a model so long as they can avoid any post scraping deduplication or filtering.

2) I wonder if copyright law can be used to amplify the cost of poisoning here. Perhaps if the poisoned content is something which has already been shown to be aggressively litigated against then the copyright owner will go after them when the model can be shown to contain that banned data. This may open up site owners to the legal risk of distributing this content though… not sure. A cooperative effort with a copyright holder may sidestep this risk but they would have to have the means and want to litigate.
by ragingregard | 2025-10-31 21:25:05+00:00
The above article is not convincing at all.

Nothing on infra costs, hardware throughput + capacity (accounting for hidden tokens) & depreciation, just a blind faith that pricing by providers "covers all costs and more". Naive estimate of 1000 tokens per search using some simplistic queries, exactly the kind of usage you don't need or want an LLM for. LLMs excel in complex queries with complex and long output. Doesn't account at all for chain-of-thought (hidden tokens) that count as output tokens by the providers but are not present in the output (surprise).

Completely skips the fact the vast majority of paid LLM users use fixed subscription pricing precisely because the API pay-per-use version would be multiples more expensive and therefore not economical.

Moving on.
Show HN: AI that builds travel itineraries from booking confirmations
by mtrip-guide | 2025-10-31 21:25:18+00:00
We’ve developed an AI-powered feature for our travel software that automatically builds structured itineraries from raw booking confirmations.

Travel agencies and tour operators often receive dozens of emails from multiple suppliers — each with different formats. Our AI model parses these confirmations, detects flights, hotels, activities, and creates a clean digital itinerary with day-by-day structure, ready to share with travelers via mobile, web, or PDF.

It’s built on AWS Lambda, OpenAI Responses API, and multi-step function calling with custom JSON schemas. We had to overcome challenges like handling inconsistent data formats, time zones, and merging multi-source bookings without duplication.
by davesque | 2025-10-31 21:25:20+00:00
If I order a package from a company selling a good, am I inviting all that company's competitors to show up at my doorstep to try and outbid the delivery person from the original company when they arrive, and maybe they all show up at the same time and cause my porch to collapse? No, because my front porch is a limited resource for which I paid for an intended purpose. Is it illegal for those other people to show up? Maybe not by the letter of the law.
by jack_pp | 2025-10-31 21:25:36+00:00
here's my analogy, it's like you own a museum and you require entrance by "secret" password (your user agent filtering or what not). the problem is the password is the same for everyone so would you be surprised when someone figures it out or gets it from a friend and they visit your museum? Either require a fee (processing power, captcha etc) or make a private password (auth)

It is inherently a cat and mouse game that you CHOOSE to play. Either implement throttling for clients that consume too much resources for your server / require auth / captcha / javascript / whatever whenever the client is using too much resources. if the client still chooses to go through the hoops you implemented then I don't see any issue. If u still have an issue then implement more hoops until you're satisfied.
by ryandrake | 2025-10-31 21:26:29+00:00
People need to have a better mental model of what it means to host a public web site, and what they are actually doing when they run the web server and point it at a directory of files. They're not just serving those files to customers. They're not just serving them to members. They're not just serving them to human beings. They're not even necessarily serving files to web browsers. They're serving files to every IP address (no matter what machine is attached to it) that is capable of opening a socket and sending GET. There's no such distinct thing as a scraper--and if your mental model tries to distinguish between a scraper and a human user, you're going to be disappointed.

As the web server operator, you can try to figure out if there's a human behind the IP, and you might be right or wrong. You can try to figure out if it's a web browser, or if it's someone typing in curl from a command line, or if it's a massively parallel automated system, and you might be right or wrong. You can try to guess what country the IP is in, and you might be right or wrong. But if you really want to actually limit access to the content, you shouldn't be publishing that content publicly.
by dghlsakjg | 2025-10-31 21:27:21+00:00
> These are all relatively simple TO YOU. You are not everyone though. Some people lack the mobility, strength or even time to do these things. Some people just don't want to get dirty working on their car. Some people don't have the space to do these kinds of maintenance.

That is irrelevant to the argument he is making that things have not gotten harder in the last 40 years in regards to car maintenance that you can do at home.

His point is that the perception that car maintenance has gotten harder for the average joe does not match reality. Almost all of the things that need periodic on modern cars are more or less the same as they were in 1985.
by jimmydddd | 2025-10-31 21:28:04+00:00
I think what folks are getting at is that it might not have been an outright scam. Just a third-party company that charged for its help desk. Many folks are willing pay for services like email that they could have otherwise gotten for free. The "scam" may have been more on the part of Google which elevates paid links to the top of the search results.
by n1xis10t | 2025-10-31 21:28:12+00:00
Is this what you are remembering? https://www.searchenginewatch.com/2012/09/06/bing-it-on-bing...

I found that by searching with DuckDuckGo (which is Bing) for "prefer bing" "taste test".

If that is what you are remembering, then I would point out that the article makes it sound like Microsoft conducted the test, and if that is the case I could see the test results being less trustworthy. Also the sample size was only 1000 people, which is really small.

Bing it On was what they called the campaign, that’s pretty funny.

Hey, you might be able to do a test like this today, as an impartial third party. The Cross Origin Policy might make it harder though, see this: https://web.archive.org/web/20230321113801/https://gigablast...

I could see this statistic combined with Bing’s market share being a reason why companies would decide not to try making a search engine, so you have a point there. Considering how terrible both search engines are though, I think it’s a dumb decision. We need a better search engine.
by bmacho | 2025-10-31 21:29:26+00:00
You don't have to use recursion, that is, you don't need language support for it. Having first class (named) functions is enough.

For example you can modify sum such that it doesn't depend on itself, but it depends on a function, which it will receive as argument (and it will be itself).

Something like:

def sum_(f, l): if not l: return 0 return l[0] + f(f, l[1:]) def runreq(f, *args): return f(f, *args) print(runreq(sum_, [1,2,3]))
by gruez | 2025-10-31 21:29:32+00:00
Sounds like the UEFI shim loader that's signed by Microsoft but can load an arbitrary EFI executable (with some signing checks). The difference is that the UEFI shim loader is endorsed/condoned by Microsoft. What about Google? This seems easily patchable, ostensibly for "security purposes" (eg. disabling loading dynamic code).
by ang_cire | 2025-10-31 21:29:33+00:00
Yep. Robots.txt is a framework intended for performance, not a legal or ethical imperative.

If you want to control how someone accesses something, the onus is on you to put access controls in place.

The people who put things on a public, un-restricted server and then complain that the public accessed it in an un-restricted way might be excusable if it's some geocities-esque Mom and Pop site that has no reason to know better, but 'cryptography dog' ain't that.
by swid | 2025-10-31 21:29:41+00:00
I'm going to ignore the actual names used here - you can use any name you want. I think this pattern is vulnerable to introducing bugs that allow security bugs. I'm imagining process being some kind of sanitization or validation. Then, you have this thing called result, and some of the time it might be "safe" or processed, and sometimes not. Sometimes people will process it more or less than once with real consequences.

So yeah, definitely it is much better to name the first one in a way that makes it more clear it hasn't been processed yet.
by IshKebab | 2025-10-31 21:29:44+00:00
I mean if you ranked all the hobbies in terms of cost, casually spending $3k on a laptop would be near the top of the list. But there are a small number of hobbies that are vastly more expensive.

The distribution is highly skewed. Like wealth. The 99th percentile are near the top in rank (by definition) but nowhere near the top in absolute terms.
by knuckleheads | 2025-10-31 21:30:04+00:00
Yeah I can’t say the emoji linkage do it for me. Perhaps, though, what about color highlights? Sven’s Sudoku Pad lets you apply colors to cells and this is used to great effect during solves on cracking the cryptic. Flipping that from solving to authoring, if you wouldn’t mind adding the option to allow highlighting of clues from some simple preset color list, that might be able to give people some options.
by asimops | 2025-10-31 21:30:36+00:00
While it is technically feasible, it is not a good idea to try and find a technical solution to a people/organisation problem.

Do not accept the premise of assholes.

I hope we can get the EU to fund a truly open Android Fork. Maybe under some organisation similar to NL Labs.

--- edit ---

Furthermore, the need for a trustworthy binary to be auditable to a certain hash or something would make banning this a simple task if Google would want to go that route.
by hinkley | 2025-10-31 21:30:44+00:00
Keys require O(logn) space per key or nlogn for the entire data set, simply to avoid key collisions. But human friendly key spaces grow much, much faster and I don’t think many people have looked too hard at that.

There were recent changes to the NodeJS Prometheus client that eliminates tag names from the keys used for storing the tag cardinality for metrics. The memory savings wasn’t reported but the cpu savings for recording data points was over 1/3. And about twice that when applied to the aggregation logic.

Lookups are rarely O(1), even in hash tables.

I wonder if there’s a general solution for keeping names concise without triggering transposition or reading comprehension errors. And what the space complexity is of such an algorithm.
by GeekyBear | 2025-10-31 21:30:56+00:00
The government certainly objected when Apple designed an implementation of encrypted cloud backups for iDevices.

That didn't stop Apple from eventually rolling out encrypted cloud backups anyway.

Apple also refused to insert a backdoor into iDevices when James Comey ordered them to do so. They took the FBI to court and forced them to back down.

Google is perfectly capable of fighting too, but their business model puts them at a huge disadvantage.

If you make your money spying on users to make ad sales more profitable, then you have no choice but to hand it over to any Federal, State or local agency that can convince a judge to issue a warrant.
by Trasmatta | 2025-10-31 21:31:26+00:00
> If tithing had such a big effect, you would expect non-tithing folks to not have a corresponding decline.

You can't just compare it to declining birthrates for the population at large though: you have to compare to cultures with the same emphasis on large families that exists within Mormonism.

> Other things have

One of those things being cost of living.

I'm sure it's not the only factor, but it has to be one of them.
by oceanplexian | 2025-10-31 21:32:15+00:00
You might "think" you had a repressed memory but it could all be completely made up. You might even get other people to believe it, because human memory is incredibly faulty. Shared delusions are literally a "known bug" of human biology. Wikipedia has a whole page on them (https://en.wikipedia.org/wiki/Folie_%C3%A0_deux). The Seattle Windshield Pitting Epidemic (https://en.wikipedia.org/wiki/Seattle_windshield_pitting_epi...) is yet another example

The thing that changed though is since the 2010s everyone has a high definition camera in their pocket. Everything you do is recorded online. Kids that grew up in the last few years will have their entire childhood recorded in some way or another. Every movement tracked by GPS. Therefore, while I don't agree completely, I wouldn't be surprised if some assumptions about psychology are upended and a great deal of so called repressed memories turn out to be bogus when we can easily disprove them.
by 1718627440 | 2025-10-31 21:32:23+00:00
> Those with a conservative mindset

I have.

> will think of humans as fundamentally flawed, misguided creatures

I do.

> that need to be contained and steered so they don’t veer of the path

No. When people are misguided that will even more apply to those in power and with weapons. The fact that I view everyone as likely misguided means nobody should have any say over the other.

The modern trend to frame conservatism and authoritarianism as "the same thing" is very bad and leads to the normalization of authoritarianism.