MurphyA/hacker-news huggingface dataset:
by Sammi | 2025-10-15 10:04:58+00:00
"Signalling System 7, or SS7, is a decades-old set of protocols that allows phone networks to communicate with one another, routing messages and calls across borders. It was never designed with security in mind, and while operators have moved to more secure evolutions with 4G and 5G, they still need to maintain backwards compatibility with SS7. This is likely to remain the case for years if not decades to come.

Phone networks need to know where users are in order to route text messages and phone calls. Operators exchange signalling messages to request, and respond with, user location information. The existence of these signalling messages is not in itself a vulnerability. The issue is rather that networks process commands, such as location requests, from other networks, without being able to verify who is actually sending them and for what purpose.

These signalling messages are never seen on a user’s phone. They are sent and received by “Global Titles” (GTs), phone numbers that represent nodes in a network but are not assigned to subscribers. Surveillance companies have often leased GTs from phone operators and used them to send unauthorised signalling messages into other networks, benefitting from the fact that the signalling messages appear to be coming from the legitimate operator which owns the GT.

First Wap primarily works via in-country installations of Altamides. In this setup, a government client uses Altamides via an SS7 link belonging to a local phone operator. The local phone operator provides the GTs and Altamides uses these GTs to conduct location tracking domestically and internationally."

So basically the telecoms network itself has no security. Anyone operating network equipment on the telecoms network can see where any phone is at any time.

I didn't know we lived in a world that is this stupid. Great. If you're a dissident you basically cannot have a phone or be around anyone who has a phone.
by intended | 2025-10-15 10:05:07+00:00
If upskilling is your hope - you have no hope.

Without any modifications - MOOCs have single digit completion rates. This is high quality, free, publicly available educational material.

The vast majority of people do not simply have the time, money, or undivided attention - to get a new domain under their belt.

This is “help miners learn code” territory.
by jng | 2025-10-15 10:05:13+00:00
He is no Jim Keller, and the mostly[1] automated transcript makes it read cringe, but it is not at all devoid of content.

Some examples of very interesting, non-obvious content:

* Even if store ports are kept fixed (2 in his example), adding store address generators (up to 4 in his example) actually improves performance, because it frees up load port dependencies. * Within the same core, they use two different styles of load/address address contention mechanisms which he describes as two tables, one with explicit "allows" and the other one with explicit "denies" -- which of course end up converging (I understand it refers to two different encodings which vary in what is stored). * Between cores, they have completely separate teams which reach different designs for things like this. * It was interesting to me to discover how isolated the different core design teams work (which makes sense) * It was interesting to me to picture the load/store address contention subsystem, which must be quite complex and needs to be really fast.

And I stop listing, re different types of workloads, gaming workloads being similar to DB workloads, and even more similar between them than to SPEC benchmarks and so on.

Just go read the interview if you're interested in CPU design!

[1] mostly automated: at least the dialog name labels seem to be hand-edited, as one of them has a typo
by RagingCactus | 2025-10-15 10:05:14+00:00
The SameSite cookie flag is effective against CSRF when you put it on your session cookie, it's one of its main use cases. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/... for more information.

SameSite=Lax (default for legacy sites in Chrome) will protect you against POST-based CSRF.

SameSite=Strict will also protect against GET-based CSRF (which shouldn't really exist as GET is not a safe method that should be allowed to trigger state changes, but in practice some applications do it). It does, however, also make it so users clicking a link to your page might not be logged in once they arrive unless you implement other measures.

In practice, SameSite=Lax is appropriate and just works for most sites. A notable exception are POST-based SAML SSO flows, which might require a SameSite=None cookie just for the login flow.
by hmry | 2025-10-15 10:05:49+00:00
I don't understand what you are getting at. CSRF is not another name for auth. You always need auth, CSRF is a separate problem.

When the browser sends a request to your server, it includes all the cookies for your domain. Even if that request is coming from a <form> or <img> tag on a different website you don't control. A malicious website could create a form element that sends a request to yourdomain.com/api/delete-my-account and the browser would send along the auth cookie for yourdomain.com.

A cookie only proves that the browser is authorized to act on behalf of the user, not that the request came from your website. That's why you need some non-cookie way to prove the request came from your origin. That's what Sec-Fetch-Site is.
by majke | 2025-10-15 10:07:11+00:00
Most of the responses here are knee-jerk.

I liked the article. It's close to my adverntures with containers. I think the invention of docker is indeed mostly packaging: Dockerfile (functional) is pretty neat, docker hub (addressing a container) is awesome, and the ENTRYPOINT in Dockerfile is great, it distinguishes Docker from .deb.

But indeed, beyond Dockerfile things are bleak. Docker compose never rose to my expectations. To get serious things you need load blancer, storage, addressing, and these are beyond traditional containers scope.
by tankenmate | 2025-10-15 10:07:38+00:00
The Sec-Fetch-Site header can't be read / written by Javascipt (or WASM, etc), cookies (or some other tokens) on the other hand can be. In most circumstances allowing Javascript to access these tokens allows for "user friendly" interfaces where a user can log in using XMLHttpRequest / API rather than using a form on a page. OOB tokens one a one off auth basis or continuous (i.e. OAuth, TOTP with every request) are more secure, but obviously requires more engineering (and comes with its own "usability" / "failure mode" trade offs).
by dwattttt | 2025-10-15 10:07:43+00:00
While a package with 10 million all-time downloads is nothing to sneeze at, it's had one memory corruption bug reported in its ~7 year life.

It's being compared to a C library that's held to extremely high standards, yet this year had two integer overflow CVEs and two other memory corruption CVEs.

SQLite is a lot more code, but it's also been around a lot longer.
by oblio | 2025-10-15 10:08:27+00:00
LOL.

Compare and contrast this:

> Say what you want about the Stalleman type he was very inspiring and had real leadership. So a lot of hackers followed him in his crazy vision and that gave us a lot.

With this:

> It is very feminine and obviously doesn't work that well.

It's a super sexist comment. A comment born in the 60s, or I guess in our geek land, still in 2025.
by adrian_b | 2025-10-15 10:08:34+00:00
Value prediction and address prediction are very different things.

Address prediction for loads and stores, by detecting various kinds of strides and access patterns, is done by most CPUs designed during the last 25 years and it is used for prefetching the corresponding data. This is as important for loads and stores as branch prediction for branches.

On the other hand, value prediction for loads is done by very few CPUs and for very restricted use cases, because in general it is too costly in comparison with meager benefits. Unlike for branch direction prediction and branch target prediction, where the set from which the predicted value must be chosen is small, the set from which to choose the value that will be returned by a load is huge, except for very specific applications, e.g. which repeatedly load values from a small table.

The application from the parent article is such a very special case, because the value returned by the load can be computed without loading it, except for exceptional cases, which are detected when the loaded value is different from the pre-computed value.
by roenxi | 2025-10-15 10:09:24+00:00
At this level it really is a case of purpose-of-the-system-is-what-it-does. The EU is clearly not interested in building up a tech sector. Factions in the EU, yes. EU as a block, no. They've shown less than no interest; the EU would be a great place to build software companies if the governments weren't hostile to the idea of large tech companies which is where the market wants to go. Nice place to live. Software companies tend to migrate to the US.

I suspect that in the halls of power they would rather interpret "digital sovereignty" as a state where they, the sovereigns, have power in the digital world to mess with EU citizens online lives. It seems very optimistic to think that the EU is suddenly going to get interested in supporting software companies. Even philosophically, why bother changing suddenly just to do something they can ask the Americans to do? Economies require specialisation, everyone can't do everything.

It isn't even a bad thing that the EU doesn't have a thriving software ecosystem but for the fact it appears to be driven by governmental hostility to freedom. Good companies can come from the US. Bad companies can come from the EU. They already have a good FOSS ecosystem. The only problem is the EU seems to be more likely to bring in something like chat control and beat down anyone who achieves enormous success.
by biohazard2 | 2025-10-15 10:09:27+00:00
> there's also just no reason to rewrite SQLite in another language. […] But why would we want to throw away the perfectly good C implementation, and why would we expect the C experts who have been carefully maintaining SQLite for a quarter century to be the ones to learn a new language and start over?

The SQLite developers are actually open to the idea of rewriting SQLite in Rust, so they must see an advantage to it:

> All that said, it is possible that SQLite might one day be recoded in Rust. Recoding SQLite in Go is unlikely since Go hates assert(). But Rust is a possibility. Some preconditions that must occur before SQLite is recoded in Rust include: […] If you are a "rustacean" and feel that Rust already meets the preconditions listed above, and that SQLite should be recoded in Rust, then you are welcomed and encouraged to contact the SQLite developers privately and argue your case.
by metalman | 2025-10-15 10:09:40+00:00
economic conditions were confirmed by clothing styles and music trends in the past, or at least the magazines of my childhood would go to some effort to chart these things, now I think it is fair to say that tribal affiliation, geography and geopolitics are going to be more significant to indivuals than what is happening in stock markets. the simple fact of billions of humans having overcome poverty in the last 20 years means that the whole system is much larger and more energetic, making predictions localy valid at best. and face it, this isn't so much about the money bet, as much as the power and control that is bieng wished into ai
by hnaccount_rng | 2025-10-15 10:10:18+00:00
But that's not the same thing right? That means having two teams competing for developing the next product. That's not two organisations handling the same responsibilities. You may still end up in problems with infighting. But if there is a clear end date for that competition and then no lasting effects for the "losers" this kind of "competition" will have very different effects than setting up two organisations that fight over some responsibility
by geokon | 2025-10-15 10:10:38+00:00
im pretty sure performance counters count accurately. theyre a bit finnicky to use but they dont alter cpu execution.

last i had to deal with it.. which was eons ago.. Higher end CPUs like Xeons had more counters and more useful ones

im sure there are plenty of situations where theyre insufficient, but its absurd to paint the situation as completely always hopeless
by creer | 2025-10-15 10:10:48+00:00
> Jobs was always thinking Apple could do better with the money in R&D

> Jobs wasn’t one to listen to anybody, so it did not matter.

It did matter. Jobs was wrong. Apple indeed couldn't do better. It's not even that Apple couldn't produce R&D results worth all this money. Apple couldn't even manage to spend at that pace. Steve Jobs' projects could and did use a lot of money but nowhere near that pace. And the pace of earnings got better still after Jobs.

Jobs was right on another aspect which was that this pile of money provided Apple solid, safe ground. Apple was safe from any risk of a few years of bad earnings. That was very costly safety.

It took a different CEO to finally work to reverse the damage. That project has taken many years and (arguably) isn't finished yet. And that's in parallel to massive increases in R&D.

It doesn't do a lot of basic science - I expect. But it does or funds a lot of engineering and applied science. that's the point of the article, that in the up-to-recently US system, corporations even with lots of earnings didn't have to.
by mschuster91 | 2025-10-15 10:10:52+00:00
> -2020-2022 mandatory COVID vaccine ID, to be able travel and enter establishments

That one makes sense for any government valuing the lives of its citizens. COVID was one hell of a nasty bug for healthy people, and for those not in good health it often meant death.

COVID cost the lives of at least 7 million people worldwide, of which 1.2 million were in the USA. "The cost of <<freedom>>" one might say if one were absolutely cynical, simply because of the massive difference in deaths per capita to just about every other large developed country [1].

And that doesn't include the cost of lost productivity due to people being out sick, struck by Long COVID/MECFS or having to be caretaker for affected people.

[1] https://en.wikipedia.org/wiki/COVID-19_pandemic_death_rates_...
by falcor84 | 2025-10-15 10:11:06+00:00
I'll just mention that the community at civitai.com has been on it for a few years, and while their output is impressive, it absolutely doesn't seem to be a 1 Trillion USD market on its own.

I think that there's a much bigger market in being able to have sexually-explicit conversations with a persistent AI persona, and it seems that OpenAI want a chunk of that.
by ysnp | 2025-10-15 10:12:18+00:00
Because the technicalities of accomplishing something like that are quite complicated from what I understand. If an app has the necessary permissions and network access, almost anything you try to stop it from transmitting data about the platform and data about its usage is futile.

You're firing a starting pistol for a race to the bottom where app developers just end up sending all that information to their own first-party servers instead to be shared with whoever they wanted to anyway.

GrapheneOS absolutely tries to deal with the root of the issue, by giving the user control over sensors and network permissions that return fake/simulated data to keep the app running while denying access to data in the first place. Or contact scopes and storage scopes which restrict access to contact information or storage locations in the first place. As you can imagine, more are planned like location scopes, app communication scopes etc.
by 0xEF | 2025-10-15 10:12:34+00:00
I don't disagree with you at all, but my biggest hangup with GUI-based software is twofold:

1. It tends to be bloated, with developers slapping framework upon framework, creating a mess of background wiring that is prone to a dictionary's worth of issues that will either frustrate the user or confound the person maintaining it.

2. UX Designers approach their jobs incorrectly; they assume they are smarter than the user. Interestingly, this might actually be true on paper in most cases, but the practical reality is that the user needs to do things the user's way, not the way the the developer wants them to.

If we could find ways to smooth those two glaring issues, I posit that we'd see a lot of problems with productivity and workflow melt away. Caveat; I'm not a software developer, so I'm sure anyone who is thinks I'm speaking out of school right now. Fact is, I've worked in a few different industries over 40 years, and one of the biggest thorns always seems to boil down to the software not being quite right for the team/application, so workarounds have to be invented, adding layers of complexity on what is already a decidedly fragile system.
by dagss | 2025-10-15 10:14:12+00:00
My experience is it adds a multiplier 10x to the work that needs to be done, which is then a good fit for the 9x extra developers upper management decided to hire.

Sure, it keeps everyone busy with work they feel is meaningful -- but it really is work that was not really needed in the first place with a monolith.

Much simpler to try to stay fewer developers as long as possible.

Also in my experience it is impossible to get people along with organizing the company along software architecture division lines, thus creating a lot of political problems.
by mschuster91 | 2025-10-15 10:15:11+00:00
> As for corona, it's more or less common knowledge by now that unless you're 60+ a common cold is more dangerous.

That's a lie. The reality is that Covid-19 is massively more fatal than the ordinary flu [1]:

> We take the comparison between Covid-19 and flu seriously by asking how many years of influenza and pneumonia deaths are needed for cumulative deaths to those two causes to equal the cumulative toll of the Covid-19 pandemic between March 2020 and February 2023—that is, three years of pandemic deaths. We find that in one state alone—Hawaii—three years of Covid-19 mortality is equivalent to influenza and pneumonia mortality in the three years preceding the Covid-19 pandemic. For all other states, at least nine years of flu and pneumonia are needed to match Covid-19; for the United States as a whole, seventeen years are needed; and for four states, more than 21 years (the maximum observable) are needed.

The reduction in CFR since 2022-ish can mostly be attributed to vaccines [2], but unfortunately it turns out that said vaccine protection only lasts for about 6 months - that is why we are seeing COVID "summer waves" [3] which hasn't been a thing for influenza... people get vaccinated in autumn and winter, which lessens the impact of Covid during the winter time, but once that partial immunity expires cases go up again.

[1] https://pmc.ncbi.nlm.nih.gov/articles/PMC10168500/

[2] https://www.rsm.ac.uk/media-releases/2023/risk-of-death-redu...

[3] https://www.npr.org/2025/07/22/nx-s1-5453516/summer-surge-in...
by RagingCactus | 2025-10-15 10:15:44+00:00
I work as a pentester. CSRF is not a problem of the user proving their identity, but instead a problem of the browser as a confused deputy. CSRF makes it so the browser proves the identity of the user to the application server without the user's consent.

You do need a rigid authentication and authorization scheme just as you described. However, this is completely orthogonal to CSRF issues. Some authentication schemes (such as bearer tokens in the authorization header) are not susceptible to CSRF, some are (such as cookies). The reason for that is just how they are implemented in browsers.

I don't mean to be rude, but I urge you to follow the recommendation of the other commenters and read up on what CSRF is and why it is not the same issue as authentication in general.

Clearly knowledgeable people not knowing about the intricacies of (web) security is actually an issue that comes up a lot in my pentesting when I try to explain issues to customers or their developers. While they often know a lot about programming or technology, they frequently don't know enough about (web) security to conceptualize the attack vector, even after we explain it. Web security is a little special because of lots of little details in browser behavior. You truly need to engage your suspension of disbelief sometimes and just accept how things are to navigate that space. And on top of that, things tend to change a lot over the years.
by thefz | 2025-10-15 10:17:54+00:00
Brightball's comment here is relevant in this context as well. https://news.ycombinator.com/item?id=45579968

We build robust encryption, then comes the naive-ignorant wave of "why do we need this? let's remove it" because policymakers don't grasp the extent of it, nor have any clue how it works and why.
by ookdatnog | 2025-10-15 10:18:27+00:00
Your statement is wrong in two distinct ways:

- Fundamentalists never hijacked the FSF, they founded it: Stallman is about as fundamentalist as possible about free software.

- In the case of the FSF, the fundamentalists are absolutely walking the walk, both in terms of contributing software, and in terms of going out of their way to not use proprietary software.
by scandox | 2025-10-15 10:18:34+00:00
> Perhaps some people do but that's their problem, it shouldn't be mine.

In aggregate most people do need leadership. The kind of technocratic/managerial approach you suggest has led to the current societal problems we have: a vacuum of real leadership being filled by people willing to do it.

Whether it "should" or "shouldn't" be your problem is irrelevant to the reality.
by brushfoot | 2025-10-15 10:18:55+00:00
I'm a solopreneur. Yesterday, in 90 minutes, I developed an enhancement that would have taken a full day before. I did it by writing a detailed Markdown spec and feeding it to Copilot Agents running Sonnet 4.5. Copilot worked on it on a server somewhere while I ate lunch.

When I returned, I reviewed the PR. It wasn't perfect; one of the dozen or so tests that Copilot had generated didn't actually test what it purported to. So, I fixed that by hand. It wasn't a big deal. It was still quicker and took less cognitive effort than writing the entire PR myself.

I'll confess that part of me is pleased to be dismissed with epithets like "AI-pilled," because properly using LLMs is an enormous competitive advantage. The more negative sentiment around them there is, the less likely the competition is to be inclined to learn and master them.
by laser | 2025-10-15 10:18:58+00:00
With the recent insane moves in quantum stocks almost makes me wonder if there’s a possibility the NSA or other USG agency is far enough ahead of publicly known capabilities in quantum computing to brute force private keys/break encryption and this info is leaking into markets.

Of course the more likely explanation is that this was a sophisticated albeit classical hack (infrastructure, social engineering, surveillance, whatever) and the quantum run-up is unrelated retail investor hysteria, but have to consider the possibility the market knows something I don’t. If the government stays far ahead enough of private industry at some point in the coming years (or decades) the USG will break encryption without public disclosure unless quantum resistant algs are put in place before that capability is achieved. Hopefully this more exotic implausibility isn’t the explanation, but entertaining to consider, and history is bizarre enough for it to be true.
by momo_hn2025 | 2025-10-15 10:19:11+00:00
Any concrete examples?

I’ve always wondered how a company that fully controls its tech and can leave a country at anytime can be “forced” to transfer its core tech. From what I’ve seen, what gets transferred is usually older, commoditized or even out dated tech because it’s profitable to license.

Yes, copying happens. But I would call it as a common pattern in developing markets: entrepreneurs imitate to get a foothold, then iterate. It’s messy, but it’s also how a lot of industries bootstrap.