MurphyA/hacker-news huggingface dataset:
by bri3d | 2025-10-22 16:54:43+00:00
Sure, I'm all for protection for white hats, although I don't think is at all relevant and don't see this as a particularly prominent practical problem in the modern day.

> If a company has a security hole that leads to disclosure of sensitive information, it should be fined

What's a "security hole"? How do you determine the fines? Where do you draw the line for burden of responsibility? If someone discovers a giant global issue in a common industry standard library, like Heartbleed, or the Log4J vulnerability, and uses it against you first, were you responsible for not discovering that vulnerability and mitigating it ahead of time? Why?

> such fines can be used for rewards.

So we're back to the award allocation problem.

> This creates an actual market for penetration testing that includes more than just the handful of big tech companies willing to participate.

Yes, if you can figure out how to determine the value of a vulnerability, the value of a breach, and the value of a reward.
by tracnar | 2025-10-22 16:54:58+00:00
I wish a Python package manager would support patching dependencies, like e.g. Cargo allows: https://doc.rust-lang.org/cargo/reference/overriding-depende...

It's much cleaner than monkey patching, and it will more likely detect if an update conflicts with your patching.

I've used it by packaging everything through nix, but that can be cumbersome.
by dpoloncsak | 2025-10-22 16:55:00+00:00
Jesus lies in John 7:8-10

Jesus violently acts out in Matthew 21:12-13

Slavery is encouraged in Exodus 21:2-11

The crusades were done in the name of Christianity, with the consent of the Church.

The Catholic Church has been involved in numerous sexual assault of minors over the past 50 years alone.

We need to have an honest discussion for those arguing in favor of this faith about their positions on these very segments of their core beliefs.
by rowanseymour | 2025-10-22 16:55:12+00:00
I can't think of good way to give programmers control over boxing without adding a bunch of complexity that nobody wants.. but it doesn't seem out of the realm of possibility that the linter could detect issues like this. It should be able to spot methods that aren't nil-safe and spot nil values of those types ending up in interfaces with those methods. Then you'd have less explaining to do!
by shetaye | 2025-10-22 16:55:13+00:00
Great read! I'm sure expensive enterprise tooling exists for busy kitchens to manage safety protocols (or not?), so it is very cool to see high quality tooling for this kind of thing out in the open. After watching so many Chubby Emu videos, I'm definitely scared straight.

Off-topic, but the syntax highlighting is a little difficult to read on light mode: https://pasteboard.co/5dXcQjgcHIqu.png
by xethos | 2025-10-22 16:55:27+00:00
I'm not sure I consider this view to be looking back far enough. Android as an OS that people use has been slowly growing more closed and controlled for... well, almost since its inception.

Google has kept an infamously tight leash that OEMs must not stray too far from; the Open Handset Alliance ensures certain Google apps come pre-installed, down to homescreen placement. The OHA mandates OEMs not release "incompatible" versions of Android, or other mobile OS', as well. Should an OEM want to sell Windows Mobile, Amazons FireOS, or Firefox's mobile OS, they will likely lose their license to sell anything with the brand name Android.

Google has also been moving away from the 'O' in AOSP for some time as well. Running many AOSP apps means dealing with what Google treats as abandonware, such as the eMail app, Contacts, and the open launcher (replaced with Google's proprietary launcher).

I'm certain I don't have to tell this crowd about the death of bootloader unlocking and the ROM scene. Telling me this isn't pushed by Google (which I agree with), and following up with "And Google has no way to prevent this" isn't something I see as believable. Google mandates where the YouTube and Chrome apps get placed on the homescreen; you're telling me that, in order to be licensed as Android, Google can't similarly mandate bootloader unlocking?

Nothing changed last week, or even the week before, but the direction isn't terribly difficult to see, IMO.
by cyberpunk | 2025-10-22 16:55:44+00:00
Okay, but breaking that TLS (device->bank) would allow you to intercept the session keys and then decrypt the conversation. Alright, so now you can read I logged in and booked a transaction to my landlord or whatever. What else can you do? OTP/2FA code prevents you from re-using my credentials. Has it been demonstrated at all that someone who intercepts a session key is able to somehow inject into a conversation? It seems highly unlikely to me with TCP over the internet.

So we are all in a collective flap that someone can see my bank transactions? These are pretty much public knowledge to governments/central banks/clearing houses anyway -- doesn't seem like all that big a deal to me.

(I work on payment processing systems for a large bank)
by bawolff | 2025-10-22 16:55:45+00:00
> those all use ec by now anyway

As far as i am aware, eliptic curve is also vulnerable to quantum attacks.

The threat is generally both passive eavesdropping to decrypt later and also active MITM attacks. Both of course require the attacker to be in a position to eavesdrop.

> Let’s say you crack the encryption key used in my bank between a java payment processing system and a database server.

Well if you are sitting in the right place on the network then you can.

> how do you mitm this traffic?

Depends on the scenario. If you are government or ISP then its easy. Otherwise it might be difficult. Typical real life scenarios are when the victim is using wifi and the attacker is in the physical vicinity.

Like all things crypto, it always depends on context. What information are you trying to protect and who are you trying to protect.

All that said, people are already experimenting with PQC so it might mostly be moot by the time a quantum computer comes around. On the other hand people are still using md5 so legacy will bite.
by teachrdan | 2025-10-22 16:55:51+00:00
> The Quran contains passages along these lines along with other things like the exploitation of female captives and booty distribution from the spoils of war (including female captives).

Let's please not get started about sexism in major religions. The New Testament is rife with sexism, as even a cursory Google search would have revealed to you. Here's just one example:

Ephesians 5:22–24: "Wives, submit to your own husbands, as to the Lord. For the husband is the head of the wife even as Christ is the head of the church... Now as the church submits to Christ, so also wives should submit in everything to their husbands".

Unless you are willing to scrutinize other religions as you would Islam, then you are being intellectually lazy at best, a bigot at worst.
by naasking | 2025-10-22 16:56:21+00:00
> Well it turns 100k inserts into tens of millions.

I don't think "number of inserts" is the right metric because the total amount of bytes being written is almost the same, it's just written in different areas and still mostly contiguously. I think "number of distinct tables being written" is a better metric. Assuming all 400 columns become 400 records in the data type tables, say evenly divided among the 4 most common data types (int, decimal, text, date), that would be more like (4 or 5) x 100k = 400k-500k. I would still hesitate to naively compare it this way without a benchmark though, because with 4 or 5 tables being written there's also less contention than there is when everyone is writing to 1 table.

Regarding indexes, you can index the field tables but obviously this applies to the whole table. Without more understanding of your domain I can't really say if this breaks down. There's also the possibility that this one table is serving two competing goals, eg. perhaps the user should be able to add data incrementally (so this pattern applies), but then at some point when all of the data is filled it should be migrated to an actual table with all non-null columns that can be indexed and queried/processed as you usually do.

In any case, what I've sketched out isn't really new, it's been used at least since the 90s under "Dynamic Object Model" and "Entity-Attribute-Value" [1,2], so if they were using on hardware in the 90s I can't imagine the pattern would be unusable on modern hardware.

[1] https://www.cs.sjsu.edu/~pearce/oom/patterns/new/Riehle.pdf

[2] https://softwarepatternslexicon.com/patterns-sql/4/5/
by reliabilityguy | 2025-10-22 16:56:58+00:00
What incentive does the French media (or any media for that matter) has to tell the truth?

I do not want to be all about doom and gloom but I do not think that there is any media on this planet that delivers factual information without lying (either directly or by omission) to shape the opinion. And no, having a narrative is not lying as long as all the facts are presented, which allows the reader to make their own judgement whether they are buying into the narrative or not. Unfortunately, today journalists/editors believe that they have to report in a specific way as otherwise the “fight” would be lost.
by timdev2 | 2025-10-22 16:57:02+00:00
Thanks for sharing. After digging in, it appears that something very similar happened here, after all. It looks like an access key with admin role leaked some time ago. At first, they just ran a quiet GetCallerIdentity, then sat on it. Then, on outage day, they leveraged it. In our case, they just did the SES thing, and tried to persist access by setting up IAM Identity Center.
by muwtyhg | 2025-10-22 16:57:10+00:00
> Showing it to more people

The people obsessed with Trump do not watch any Democratic press conferences or media. They will not see it, and everyone watching already disagrees with what is happening. They would just be preaching to the choir.

> No one is saying “ugh, why are people pointing out that Trump is destroying the White House?”

Trump has constantly played the victim, claiming no matter what he does, the media will portray it in a negative light. And all of his cabinet echoes this. And his base seems to accept it as fact. The amount of times he's called them "nasty" and asked why they "can't focus on the good stuff" is at least 100+ this term.
by peter_d_sherman | 2025-10-22 16:57:18+00:00
>No, that's not what I'm saying. I'm talking about env vars: bound via `execve`, stored near the spawned process's stack). Not shell variables, or any other language-specific/internal variables (whether a shell, like Bash, or otherwise). That's the entire reason why my code example used `export`.

OK, fair enough!

>"If we ignore those, and just stick to normal FS operations in an ordinary Linux process, then

those filesystem objects are globals

, since the

filesystem is a global namespace

: a name (or path, in this case) will always refer to the same filesystem object (modulo the caveats above)."

Now, here you make an excellent point (and one that escaped my perception at the start of this dialogue, when I focused mostly on considering shell variables as globals), which is simply this:

Any OS system object (which includes but is not limited to files, environment variables, shared memory, synchronization objects, lists of things (and other objects) produced by API calls, sockets, OS data structures in memory, etc.) which is global in scope, that is, accessible to processes/programs -- is potentially a global variable...because programs/processes can potentially treat them as global variables...

(Now, let me nuance that statement, and import some of your arguments!)

...at least a good percentage of the time...

...that is (and here's the import of some of your arguments!), at least, not when edge-cases and other special circumstances and caveats apply (of which you've given many that could potentially apply!)

So is any global OS object -- the same as a global variable?

The short answer might be "a good percentage of the time, yes".

The longer answer might be "a good percentage of the time, yes -- but it can depend on many other factors..."

And the longest, most nuanced answer, might start something like this: "a good percentage of the time, yes, but it can depend on many other factors -- and what follows is a list of all of those potential factors..."

Anyway, you make a whole lot of very excellent, interesting, and certainly thought-provoking points!

I appreciate your engagement in this discussion! (You genuinely broadened my perception in this area!)
by latexr | 2025-10-22 16:58:12+00:00
How exactly did you arrive at that conclusion? What in your examples is proof of that “more than 45%” statement? I’m not seeing it.

But even if we concede that to be true, it doesn’t change the fact that LLMs are misrepresenting the text they’ve been given half the time. Which means the information is degraded further. Which is worse.

I guess I don’t exactly understand the point you’re trying to make.
by user____name | 2025-10-22 16:58:19+00:00
This is implicitly about Whitted Raytracing, which was synonymous with cost effective "raytracing" for a time.

The simplified history is usually presented as Whitted Raytracing -> Distributed Raytracing -> Path Tracing.

The gist is that in Whitted for each surface hit a single shadow ray per light, a reflection ray and a refraction ray are traced. Shadows and reflections are perfectly hard. Distributed raytracing takes all those single rays and shoots N randomized rays instead, which gives soft reflections and shadows. Neither of these orthodox algorithms imply indirect lighting, which is what Path Tracing added into the mix.

This is not considering other light transport algorithms such as radiosity or photon mapping, which were popular ways of doing more cost effective global illumination in the nineties and noughties.
by thomastjeffery | 2025-10-22 16:58:21+00:00
They are unclear about it, but from the looks of it, that's optional.

> The main concept of the Wesh Protocol is called the "group", a virtual place where multiple devices can share messages and metadata using OrbitDB, which itself relies on the InterPlanetary File System (IPFS)

I don't really care enough to dig deeper, so I'm not going to bother answering my own questions.
by 6SixTy | 2025-10-22 16:58:57+00:00
The move to 48v is very much about efficiency within the harness backbone. For the same wattage, less amperage is needed in a higher voltage system, meaning the wires can be smaller and they produce less waste heat.

There are a few different topologies for a 48v harness, but somewhere in the line there's a 12V DC/DC converter in there somewhere.
by text0404 | 2025-10-22 16:59:26+00:00
Uh no it isn't - you literally said

> We need to have an honest discussion for those arguing in favor of this faith about their positions on these very discriminatory segments of their core texts

and then ignored that most politicians in the US are not Muslim. So again I'm asking you - do you actually believe what you wrote (for all religions), or are you singling out Mamdani and his religion because you're a bigot? I'm having your "honest discussion."

Edit: your original response was just the first sentence, and the edit added that you're scared of Muslims. Not sure that's the flex you think it is.

If you want an "honest discussion" then be honest about your reasons for being scared of Islam and not the other religions which dominate US politics. Pointing out your hypocrisy in singling out Muslims isn't "whataboutism" - it's the honest debate you're looking for.
by vlovich123 | 2025-10-22 16:59:41+00:00
It’s definitely not ccache as they cover that under compiler wrapper. This works for Android because a good chunk of the tree is probably dead code for a single build (device drivers and whatnot). It’s unclear how they benchmark - they probably include checkout time of the codebase which artificially inflates the cost of the build (you only checkout once). It’s a virtual filesystem like what Facebook has open sourced although they claim to also do build caching without needing a dedicated build system that is aware of this and that part feels very novel
by auxiliarymoose | 2025-10-22 17:00:15+00:00
My understanding is that this one is "verifiable" which means you get a reproducible result (i.e. consistent result comes out of a computation that would take much longer to do classically).

Non-verifiable computations include things like pulling from a hard-to-compute probability distribution (i.e. random number generator) where it is faster, but the result is inherently not the same each time.
by Esophagus4 | 2025-10-22 17:00:20+00:00
Can I make a distinction of separating politics (especially US politics) from current affairs?

Shining a light on current affairs, sure. It’s nice to engage with those on this site. I get just as tired of seeing the same posts about LLMs and the Ai BuBbLe as you do. And there are some political stories that are probably worth the real estate here.

But where I’ll draw a distinction is that there will always be a political story grabbing attention on social media. And someone will always be outraged enough about it to deem it important enough for your outrage as well.

For example, I’m sure there are people who would say this is important news: “politician responds to other people who respond to Trump’s ballroom construction”[1].

If we don’t have some line on politics specifically (because that has proven to be engagement-bait high-sugar content for the internet), we will end up with a lot of low quality content here and less interesting / focused discussion with the people that make this site interesting.

Someone will always think every political story is important enough for discussion, but I think it’s healthy to keep HN free of most of it. Most of the low hanging, high-sugar fruit, at least.

[1] https://thehill.com/homenews/senate/5566872-donald-trump-whi...
by ceejayoz | 2025-10-22 17:00:44+00:00
> A position that was considered conservative in the 1980's is likely not conservative a generation and a half later.

If you want a really jarring example of this, watch Bush (Sr.) and Reagan debate immigration during the 1980 primaries. https://www.youtube.com/watch?v=YsmgPp_nlok

They sound like Democrats today. (And that's in the primaries, where people tend to be more party-line!)
by nmeofthestate | 2025-10-22 17:00:49+00:00
> those who spend a lot of time in prison seem to come out worse and reoffend. How is that helpful?

You're implying that imprisonment makes people offend more - perhaps the simpler explanation is that most criminals will commit crimes when they get the chance, especially prolific criminals. Prison takes them off the streets and stops them victimising more people - this is helpful.
by ewoodrich | 2025-10-22 17:01:19+00:00
> Sam Altman of Loopt is one of the most successful alumni, so we asked him what question we could put on the Y Combinator application that would help us discover more people like him. He said to ask about a time when they'd hacked something to their advantage—hacked in the sense of beating the system, not breaking into computers. It has become one of the questions we pay most attention to when judging applications.
by mkipper | 2025-10-22 17:01:21+00:00
This is veering into pedantry, but from what I can understand of that setting (I'm not a sysadmin guy but have used MACsec on embedded stuff), that's just as much of an 802.1X feature as a MACsec feature.

Sure the switch will only accept encrypted L2 traffic...but that encrypted link is set up via MKA, which is a part of the 802.1X standard. If you don't have 802.1X authenticating the endpoint, you don't have MKA setting up the encrypted link between that endpoint and the switch and you don't have MACsec.

So if you're trying to prevent a bad guy from getting on your LAN, you need 802.1X, whereas MACsec is an optional extra (a very useful extra if you're worried about MITM attacks). But 802.1X is still doing the heavy lifting w.r.t access control.
by rubendev | 2025-10-22 17:01:27+00:00
Can you give some examples of such commonly used libraries for languages like Java / C# / C++?

In my experience there are not many libraries like Google Tink around, and they are not in widespread use at all. Most applications doing encryption manually for specific purposes still have the words AES, CBC, GCM, IV etc hardcoded in their source code.

If you review such code, it’s still useful to have resources that show industry best practices, but I agree that the gold standard is to not have these details in your own code at all.
by ekidd | 2025-10-22 17:01:40+00:00
"Truth" is often a very expensive commodity to obtain. There are plenty of awful sources and mistaken claims on the shelf of any town library. Lots of peer reviewed papers are crap, including a few in Nature. Newspapers are constantly wrong and misleading. Digging through even "reliable" sources can require significant expertise. (This is, in fact, a significant part of PhD training, according to the PhDs and professors I know: Learning to use the literature well.)

One way to successfully use LLMs is to do the initial research legwork. Run the 40 Google searches and follow links. Evaluate sources according to some criteria. Summarize. And then give the human a list of links to follow.

You quickly learn to see patterns. Sonnet will happily give a genuinely useful rule of thumb, phrasing it like it's widely accepted. But the source will turn out to be "one guy on a forum."

There are other tricks that work well. Have the LLM write an initial overview with sources. Tell it strictly limit itself to information in the sources, etc. Then hand the report off to a fresh LLM and tell it to carefully check each citation in the report, removing unsourced information. Then have the human review the output, following links.

None of this will get you guaranteed truth. But if you know what you're doing, it can often give you a better starting point than Wikipedia or anything on the first two pages of Google Search results. Accurate information is genuinely hard to get, and it always has been.
by dangus | 2025-10-22 17:01:56+00:00
Thanks for clarifying. I think this means I was correct in reading this as a flat tax of payroll.

Do you think you can address how this can be made to be fair to the working class?

It sounds like this means that trust fund kids and landlords never pay any tax, and are highly incentivized to hire as few people as possible. (I guess you can say that payroll taxes have the same effect but corporate, property, and capital gains taxes do not).

For example, with no property, corporate, or capital gains taxes in place, this appears to heavily incentivize hoarding of rental properties by those with the means to do so.

As an upper middle class person myself, if this tax system came into place I would immediately liquidate my life savings and buy as many rental properties as I could afford and then quit my job. I’m pretty sure that I would make a better income than I do now doing productive work as my tax rate would drop from like 40% to 0%.
by Joel_Mckay | 2025-10-22 17:02:19+00:00
Depends on the use-case, IPsec is often not supported by many LANs. Also, network crossing is 1 badly configured client away from full infrastructure worming.

At some point, the idealism of white-listed pears and VPN will fail due to maintenance service costs. Two things may be true at the same time friend. =3

https://www.poetry.com/poem/101535/the-blind-men-and-the-ele...
by DocTomoe | 2025-10-22 17:02:21+00:00
But if we target only fifty browsers instead of five million websites, we cut ourselves off that sweet sweet punitive monies. it's much more lucrative for lawyers to have a 5-million-strong pool to sue rather than a 50-strong crew, which has significant money to pay lawyers of their own.

Remember how many members of parliaments have a legal background. That's not a coincidence. It is safe to assume laws are deliberately written badly to create more work for their caste.