MurphyA/hacker-news huggingface dataset:
by kossTKR | 2025-10-23 08:44:58+00:00
I'm beginning to seriously think we need a new internet, another protocol, other browsers just to break up the insane monopolies that has been formed, because the way things are going soon all discourse will be censored, and competitors will be blocked soon.

We need something that's good for small and medium businesses again, local news and get an actual marketplace going - you know what the internet actually promised.

Anyone working on something like this?
by matesz | 2025-10-23 08:46:51+00:00
Mind you I am hosting this just for about a week now - +100GB in total for all inboxes. Also I removed automatic daily purging so all spam and deleted items stay just to be safe.

Haven't looked into spam more closely yet. After first glance on most publicly shared email address - there is around 2 spam messages per hour.

Here is report prepared by llm which looked through the last 20 email headers found in spam. All of them were categorized correctly, however there were few emails in the past few days which went to spam where they shouldn't but I think this is fixable.

- Critical Authentication Failures: A large number of the messages failed basic email authentication. We see many instances of SPF_FAIL and VIOLATED_DIRECT_SPF, meaning the sending IP address was not authorized to send emails for that domain. This is a major red flag for spoofing.

- Poor Sender IP Reputation: Many senders were listed on well-known Real-time Blackhole Lists (RBLs). Rules like RBL_SPAMCOP, RBL_MAILSPIKE_VERYBAD, and RBL_VIRUSFREE_BOTNET indicate the sending IPs are known sources of spam or are part of botnets.

- Suspicious Content and Links: The spam filter identified content patterns statistically similar to known spam (BAYES_SPAM) and found links to malicious websites (ABUSE_SURBL, PHISHING).

- Fundamental Technical Misconfigurations: Many sending servers had no Reverse DNS (RDNS_NONE), a common trait of compromised machines used for spam.

There have been few messages which went to spam which didn't meet any of this spam criteria but actually they were cold marketing emails, so it's good too. In addition to this stalwart emits info log for each possible spam message ingested. Not sure if this can get any better than this.
by DanielHB | 2025-10-23 08:46:59+00:00
I don't get what you mean, electric scooters are already a thing? At least in most countries in Europe they are classified the same type of vehicle as pedal-assisted e-bicycles and are capped at 25km/h and can ride in the bike lanes. If they go faster they are classified as full motorcycle and have to ride on the road with the cars and requires a license and a license plate (regardless if electric or non-electric).

https://dualwheeljourney.com/mopeds/swedish-moped-class-1-an...

> get rid of the vestigial pedals.

Pedal-assisted is very much not a vestigial category, plenty of people want to get exercise and not just ride a scooter. On top of that they massively increase the range of the bicycle and the bicycle is still usable when the battery runs out.
by immibis | 2025-10-23 08:47:04+00:00
Use one of the forks. librewolf, waterfox, zen. Firefox itself lost trust when Mozilla tried to push the new Terms of Use earlier this year. That was so aggressively user-hostile that nobody should trust Mozilla ever again. Using a fork puts an insulation layer between you and Mozilla.

Librewolf is just a directly de-mozillaed and privacy-enhanced Firefox, similar to Ungoogled Chromium. I've been trying to get in the habit of using Zen Browser, which has a bunch of UI changes.
by IanCal | 2025-10-23 08:47:09+00:00
> any platform that needs this functionality but would prefer not to leak any details publicly.

I’m not sure how you’d have this - it’s for the public facing side of user hosted content, surely that must be public?

> We already have the concept of a .well-known directory that you can use, when talking to a specific site.

But the point is to help identify dangerous sites, by definition you can’t just let the sites mark themselves as trustworthy and rotate around subdomains. If you have an approach that doesn’t have to trust the site, you also don’t need any definition at the top level you could just infer it.
by Capricorn2481 | 2025-10-23 08:47:18+00:00
> but plain Wireguard also cannot punch through NATs and firewalls without any open ports like Tailscale can, as far as I know

I could be wrong, but I think Tailscale just does what you can do on Wireguard, which is `PersistentKeepAlive`. It lets a wireguard client periodically ping another to keep the NAT mapping open.
by n4r9 | 2025-10-23 08:47:43+00:00
Enjoyable read. I was left wondering whether Cornell came to any conclusions after a life of studying the paranormal. Wikipedia has:

> [Cornell] believed that many sightings of ghosts, hauntings and poltergeists are products of the human mind.[3] Cornell estimated that of the 800 cases that he investigated, only twenty percent were difficult to explain and only a handful were paranormal.

https://en.wikipedia.org/wiki/Tony_Cornell

A "handful" is still extremely significant. I'm curious to know which events he felt could not be described naturally.

Going back to the original article, this raised a smile:

> I’m in the Special Collections room of the Cambridge University Library, waiting at the front desk a little nervously. It is my first time here and, hidden away on the top floor of the vast building, there is a peculiar sense of having entered a place where time does not quite pass as it should.

The UL is a forbidding and imposing building reminiscent of the library at the Unseen University (https://wiki.lspace.org/Library). Admittance to the Special Collections room is a rare privilege - I remember hearing rumours that all the best stuff is kept up in the "tower". Again, Wikipedia has a list of some of the really cool books there (https://en.wikipedia.org/wiki/Cambridge_University_Library#S...).
by lolive | 2025-10-23 08:47:43+00:00
My most important script has been to remap CapsLock as a kind of custom Meta key, that transforms (when pressed) the Space into Return, hjkl into arrows, io into PgUp/PgDn, and 1-9 into function keys. Now I have a 60% keyboard that takes 0 space on my desk. And I am reaaaally happy with this setup.

[that, plus LinkHint plugin for Firefox, and i3 for WM is my way to go for a better life]
by jacquesm | 2025-10-23 08:47:57+00:00
Google's services, especially their free services, are never really free. It's just that the price tag is so well hidden that ordinary users really believe this. But the HN audience is more technical than that and they see through the smokescreen.

Except for those that are making money off adds directly or indirectly, and who believe in their god given right to my attention and my data.

> I'm increasingly blown away by takes on here that are so dramatic and militant about things that barely even register to most people.

Things 'barely even registering to most people' is not as strong a position as you may think it is. Oxygen barely registers to most people. But take it away and they register it just fine (for a short while). The 'regular' people that you know have been steadily conditioned to an ever worsening experience to the point that they barely recognize the websites they visit when seeing the web with an adblocker for the first time.
by thomascountz | 2025-10-23 08:48:13+00:00
The set of open source code and verifiable code overlap, but one doesn't always imply the other. In either case, provenance needs to be established. I think it would be reasonable for Obsidian to ship signed checksums and a public transparency log (e.g., Sigstore) for builds (plugins authors could do the same?). A more granular plugin permissions system would be great too, even though most plugins are OSS.
by jillesvangurp | 2025-10-23 08:48:19+00:00
The video is demonstrably wrong if CATL is releasing what I just outlined in 2 months as they announced. You shouldn't believe anything you see on Youtube. There's a lot of anti EV nonsense floating around.

> $10 figure is completely made up and hyped up by hype influencers

I'm pretty sure there's more to that and do note the caveats I added. CATL is one of the largest battery producers in the world and they are basically calling BS on this in a big way that's hard to argue with (i.e. planning to ship product at scale in 2 months).

Also, second generation product. They already have sodium ion based battery powered EVs in the market with their first generation. Apparently quite cheap and competitive with LFP. This is their v2.

You shouldn't believe everything on Youtube.
by coldtea | 2025-10-23 08:48:26+00:00
>I think the increasingly widespread attitude that only open source software is good and trustworthy increasingly annoying and problematic.

If people put their notes in, only open source software is good.

At best, one can tolerate a very big closed source company, who is unlikely to just do whatever with the data and has some track record for privacy, like Apple.

But trusting all your notes to a closed source app from a small peanuts company?
by Ey7NFZ3P0nzAe | 2025-10-23 08:48:35+00:00
I apologize for my mistake it is lybia in fact and not syria.

If you want to read about it in english, mediapart (one of the leading investigative journal on that case) has translated many of its articles : https://www.mediapart.fr/journal/france/dossier/sarkozy-gadd...

I believe there is a complete recap somewhere but sadly can't find it
by lucideer | 2025-10-23 08:48:43+00:00
Unless I missed something in the article this seems like a different issue. The article is specifically about the domain "immich.cloud". If you're using your own domain, I'd check to ensure it hasn't been actually compromised by a bonnet or similar in some way you haven't noticed.

It may well be a false positive of Google's heuristics but home server security can be challenging - I would look at ruling out the possibility of it being real first.

It certainly sounds like a separate root issue to this article, even if the end result looks the same.
by rzerowan | 2025-10-23 08:48:58+00:00
Side effects should be predictably annoying from this. Even in opensource reminded of the fact that many Linux distros have instructions banning transfer to official US enemies , by virtue of being primarily US base entities. And with the recent expulsion of Russian maintainers from the kernel, if this goes on for much longer the new didgital iron wall is going up piece by piece. In the long run with isolated development interop is going to be a headache. Hopefully recognised standards are maintained , though with the last time where Huawei got kicked out of the Bluetooth working group and had to go solo on their Nearlink protocol , only time will tell.
by Jedd | 2025-10-23 08:49:29+00:00
If safety is a concern, why not flow storage?

I see enough reports of Li battery related unpleasantness to be slightly concerned on this front, and for fixed location storage I'm less concerned with density and more so with maintenance and life span.

TFA talks about (favourable) temperature tolerance of Na, at least at the low end, I didn't see high end figures.
by freefaler | 2025-10-23 08:49:33+00:00
It's a strange article. Yes it's not an open source, but based on what is the author suspicious? Any bad behaviours from the authors? Change of ownership? Plugin risks?

For me this is the least problematic non-open source software:

- non VC funded (like Mattermost enshitification after VC)

- open source formats

- community plugins with source code (it's JS)
by hu3 | 2025-10-23 08:51:19+00:00
LLMs are like vehicles.

They allow us to travel further and faster (my experience, but many disagree).

At the cost of walking/exercising less.

And just like cars, it's up to us to keep a healthy dose of thinkering about code to keep our neurons well connected.

So just don't blindly vibe code and you'll do fine. For now.
by coldtea | 2025-10-23 08:51:36+00:00
Closed source also keeps missing CVEs, only most of them you never know because they aren't even making it to an officially released CVE. You usually don't even know what libs it uses and at what versions, never mind the proprietary code.

And then there's the closed source's Cloud part and its holes as well, which is a whole other can of worms.
by skatsubo | 2025-10-23 08:51:37+00:00
> This allows any member of the public with a GitHub account to deploy any arbitrary code to that subdomain without any review or approval from the Immich team.

This part is not correct: the "preview" label can be set only by collaborators.

> a subdomain of a domain that they also use for production traffic

To clarify this part: the only production traffic that immich.cloud serves are static map tiles (tiles.immich.cloud)

Overall, I share your concerns, and as you already mentioned, a dedicated "immich.build" domain is the way to go.
by zimpenfish | 2025-10-23 08:52:04+00:00
Do you have a link to studies showing this?

I had a look and I found one[0] (cw: child abuse) which agrees but the direction is wrong - they discovered trauma leads to suggestibility.

[1] might be implying what you claim but, whilst I'm no expert, I'm reasonably sure "dissociative states"[2] isn't a simple "becoming miserable".

[0] https://www.mdpi.com/2076-0760/10/2/37 "Our results show that PTSD increases the levels of immediate and delayed suggestibility"

[1] https://pubmed.ncbi.nlm.nih.gov/30987544/ "These results suggest that high suggestibility confers vulnerability to dissociative states in individuals exposed to trauma and displaying an anxious attachment style."

[2] https://en.wikipedia.org/wiki/Dissociation_(psychology)
by jacquesm | 2025-10-23 08:52:44+00:00
Highly unlikely, but since you make the claim I think you also should present that whole system evidence. From what little I know as a once upon a time bit player in aviation I suspect that that will be a very hard sell.

For instance: I know of an invention that will spin up the wheels of a landing aircraft just before touchdown. This saves on the wear of the tires (right now it is mostly the runway that spins them up, as a result of which you see these nice rubber deposits on the touchdown areas). But it would add a few kg to the weight of the wheels so it's a complete non-starter.
by asQuirreL | 2025-10-23 08:53:40+00:00
I think what's more important than the character count is the fact that you can add #p with two key strokes.

Inserting parentheses requires moving your cursor around or invoking some shortcut in your editor if you use paredit, vim-surround, or a similar plugin. Applies equally for removing the invocation (although paredit makes that part easy).
by redraiment | 2025-10-23 08:54:43+00:00
[rusty-sheet](https://github.com/redraiment/rusty-sheet) is a DuckDB extension written in Rust:

* File Formats: Excel, WPS, OpenDocument. * Remote Access: HTTP(S), S3, GCS, Hugging Face. * Batch Reading: Multiple files & sheets. * Schema Merging: By name or by position. * Type Inference: Automatic + manual override. * Excel Range: `range=’C3:E10'` syntax. * Provenance: File & sheet tracking. * Performance: Optimized Rust core.
by petepete | 2025-10-23 08:55:09+00:00
I write a couple of libraries for creating GOV.UK services and Google has flagged one of them as dangerous. I've appealed the decision several times but it's like screaming into a void.

https://govuk-components.netlify.app/

I use Google Workspace for my company email, so that's the only way for me to get in contact with a human, but they refuse to go off script and won't help me contact the actual department responsible in any way.

It's now on a proper domain, https://govuk-components.x-govuk.org/ - but other than moving, there's still not much anyone can do if they're incorrectly targeted.
by pm215 | 2025-10-23 08:55:32+00:00
As an stgit user, this seems like a weird workflow to me. I never want to have that many uncommitted changes just floating around that will eventually belong to multiple commits. If I'm halfway through something and realise "oh, it would be good to do xyz first" I don't want to have xyz's changes and my half-way-through changes all mixed up -- I want to pop the half-way-through stuff, do the xyz stuff and commit it, then re-push the half-way-through stuff to keep working. If I'm looking at a diff and picking out parts of it then I've done something wrong -- I have a tool for doing it but I only need to use it every couple of months...

I end up with "neatly separated does-one-thing commits" but I get there by building them up as I go along, not by writing a ton of code and then trying to split it up afterwards.
by jacquesm | 2025-10-23 08:55:40+00:00
Extraordinary claims and all that. Of course you can simulate it. If you are this surprised by the outcome of an experimental setup the first thing you should do is distrust the data. Figure out where the discrepancy is. Fix it, re-run the simulation and the experiment until the two are in agreement. Then publish.

The normal scientific reflex is not to hit the marketing guy and say 'we've got a winner, go write it up'.
by nsomani | 2025-10-23 08:55:41+00:00
Oh really? I can't find anything about the memory model online. I'm not sure what's the best way to do this, but if there's a way for us to get in contact, I'd be interested in adjusting the project so it's developed in the most ergonomic way possible. I'm chatting with a couple of universities and I might issue a research grant for this project to be further fleshed out, so would be keen to hear your insights prior to kicking this off. My email is neel[at]berkeley.edu.
by rkuodys | 2025-10-23 08:55:44+00:00
I think it highly depends on your perception on what is your job.

If programmer is only the code-writer - then it is reasonable to agree with the post.

If on the other hand the developer is problem solver - well it just changes what problems you're solving. Somehow I don't see the future where CEO of any respectable company would sit with AI and ask Agent to develop features. You hire people who solves problems for you.
by Nextgrid | 2025-10-23 08:56:37+00:00
According to the article the system was developed by a regional subsidiary of a German mobile telco, which already tells you everything you need to know about its quality, but on top of that it was rushed to launch in time for some sporting event and thus even less testing was done that would normally happen.

Here's a better article: https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-... - it seems like this was good faith security research (he disclosed the issue after testing it) and he couldn't use the transport pass he "stole" because he didn't even live in their service area anyway.

This arrest had nothing to do with stealing and all to do with putting well-connected, incompetent people in a very uncomfortable position.
by Doxin | 2025-10-23 08:56:42+00:00
Those would output absolutely blisteringly hot water as well. Almost boiling. As I recall they'd often also have the tap directly attached to them. We kept the pilot light on ours always lit, though I can totally see people turning them off fully when not in use for a bit. The fancy ones had a button to light them. The less fancy ones involved a match and a startle as the gas caught fire.

Thanks for the trip down memory lane. I had forgotten all about those!
by amunozo | 2025-10-23 08:57:19+00:00
Industrial machinery is only making workers weak, lazy and prone to replacement.

Jokes aside, as any tool, it depends on how you use it. I think the problem is not AI assistance but the ever existing urgency and lack of patience of nowadays, which leads to everything to be done as fast as possible with no toleration to any waiting time. This plus language models is a really band combination that would lead to a disaster way before AGI or anything like that is remotely close.
by Kbelicius | 2025-10-23 08:57:46+00:00
> How long have these laws been out and we are still dealing with these issues. They seem to have gotten worse, not better.

No, they have gotten better. Earlier reject all was barely seen on the internet. Now it is on the majority of places or at least in much more places. How is that getting worse? Can you please explain how it has gotten worse or why you think it has gotten worse?

> People build services that don't track others and people pay for those services. It's pretty simple.

How would an average individual know that a service is tracking them if the service doesn't need their consent for it?

> If it was so illegal it would be stopped, but apparently businesses are indeed complying with the law.

GDPR art. 7.3:

"The data subject shall have the right to withdraw his or her consent at any time. 2The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 3Prior to giving consent, the data subject shall be informed thereof. 4It shall be as easy to withdraw as to give consent."

So the law states that it must be as easy to reject cookies as to accept. That means that it is illegal to hide reject all.

In the parent post of this thread there is even a link about a court case:

https://www.techspot.com/news/108043-german-court-takes-stan...

So has your opinion with this information changed on who is to blame for the bad UX? If not, why not?

> It's well known that cookies track you across sites and some people choose not to use those sites. The sites are required to disclose this information, so users are definitely aware.

Maybe now, because of GDPR forcing site operators for asking consent to being tracked. But you said that it would happen organically without GDPR. I'm confused, even you, in the last sentence say that sites are required to disclose information but that is because of GDPR. It isn't the market somehow reaching that point organically. So which is it because you seem to agree that GDPR is needed but at the same time you are saying that it isn't needed and the market would sort it out. I'm really confused now.
by lazarie | 2025-10-23 08:57:55+00:00
Trying to use Gemini CLI is one of the most frustrating experiences with any tool I've had in over two decades of working with software.

It's seemingly very hard to understand how it should be configured at all if you don't have a personal Google account. Rather than just using your credentials to login and start, you need to find some forum posts of people that have reversed engineered that you need to use a Google Cloud environment variable, even if you are operating without a "Code Assist License" on a Google Business account.

No matter what I do on my paid subscription through Google Business with a Google Cloud project provided in the environment configured, which I had to explicitly set up just to test the CLI even though I have access to the Models through my subscription and AI Studio, I always get error 429 after one to five messages. The limits that Google claim on Gemini seem to be just a fraction of what is claimed in my case, No clearly stated reason as to why, not in the cloud console and not when using the tool itself, except for the HTTP error message.

These are not big prompts or anything of that nature. It's simple things like review a readme file or double check a single file for errors. It's been like this from the very beginning.

Even now just to verify it, I havent used Gemini for over a week, I ask it to review 3 files that are in git diff, the files are between 50-100 lines long, after checking the first file it's already on 429, on a PAID subscription, and it even states "99%" context left. So my paid subscription lets me use less than 1% of the context window and I get locked out for a unknown amount of time.

Contrasting this to both Codex and Claue Code, where you just log in and go, it's really a night and day difference. The user experience of the paid version of Gemini CLI is just utterly terrible.