MurphyA/hacker-news huggingface dataset:
by pfannkuchen | 2025-10-23 08:05:50+00:00
This sounds like moving the goalposts. Sorry, I don’t intend to move the goalposts.

What I mean is - yes, the document you linked seems quite plausible, I hadn’t read about that before. But, based on the reaction I see to January 6th from the public, I have trouble believing that the public reaction is driven by an understanding of the alleged plot and not from media driven hysteria. Are we saying that the media is drumming up hysteria based on the actual plot, but since the common man doesn’t actually understand such things typically that the media doing so is justified?

Like to me an authentic negative reaction to reading about the plot would be something like disappointment that the type of legal strategizing that happens in courtrooms has made its way into politics. And I think even you personally are using the language “insurrection” and “attack”, which doesn’t really line up with the alleged plot at all, does it? This is what I’m confused about.
by ycjcl868 | 2025-10-23 08:06:01+00:00
Most "AI Agents" today are limited by fragmented environments: a browser here, a shell there, some ephemeral code sandbox in the cloud — each isolated, slow, and brittle.

AIO Sandbox is our attempt to fix that. It’s a unified, containerized environment where an Agent can: - Use a browser (via CDP or GUI) - Run code (Python/Node) - Execute shell commands - Manipulate files - Handle network and proxy routing - Integrate with MCP tools - Be safely observed or taken over via VNC or VSCode

All in one sandboxed instance.

You can think of it as “a computer built for AI Agents” — with consistent file systems, secure network isolation, and an extensible SDK for custom tools.

Docs: https://sandbox.agent-infra.com GitHub: https://github.com/agent-infra/sandbox
by ZeroGravitas | 2025-10-23 08:07:00+00:00
A parallel worth bearing in mind is that LFP batteries became super popular over the last few years and are now 50% of all EV batteries worldwide, but are still rare in the US.

This is partly because the US is a richer market with higher end desires but it might mislead people in that geography into thinking that the battery mass manufacturing world moves slowly.

Meanwhile in the storage market it's gone to 90% LFP as the big deployments take advantage of the cost reductions available.

In fact the biggest impediment to sodium being rolled out was continuing reductions in LFP cost which made people less enhusiastic for alternatives.

It appears they've managed to drive costs down even further, prompting its graduation into mass scale manufacture.
by 1718627440 | 2025-10-23 08:08:00+00:00
> There's no need for staging or stashes in jj.

What the JJ developer seam to misunderstand is, that the index and stashes are a feature to improve the users workflow. You can bypass the index with commit -a, giving you JJ behaviour and you can commit just fine instead of using the stash. The stash is like some backlog of temporary commits and also supports saving the index separately. When you don't care about this, you don't need to use it, these features are purely additive.
by joshvm | 2025-10-23 08:08:10+00:00
> Also even if it is open source, who really verifies the binary is built from the source published?

Apple notarization is usually the way for non Store downloads. Non-notarized apps present a warning and require overriding security settings to run (with admin privilege). There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub, only that some sanity checks have been performed and the binary is not a known threat (or has been modified).

https://developer.apple.com/documentation/security/notarizin...
by Nextgrid | 2025-10-23 08:09:05+00:00
What he did there could indeed be legally risky.

Remember that while for a lot of us this kind of security research & remediation is “fun”, “the right thing to do”, etc there are also people in our industry that are completely incompetent, don’t care about the quality of their work or whether it puts anyone at risk. They lucked their way into their position and are now moving up the ranks.

To such a person, your little “security research” adventure is the difference between a great day pretending to look busy and a terrible day actually being busy explaining themselves to higher ups (and potentially regulators) and get a bunch of unplanned work to rectify the issue (while they don’t care personally whether the site is vulnerable - otherwise they wouldn’t have let such a basic vulnerability slip through - now that there is a paper trail they have to act). They absolutely have a reason and incentive to blame you and attempt legal action to distract everyone from their incompetence.

The only way to be safe against such retaliation is to operate anonymously like an actual attacker. You can always reveal your identity later if you desire, but it gives you an effectively bulletproof shield for cases where you do get a hostile response.
by BartjeD | 2025-10-23 08:10:10+00:00
In what country hasn't the legal system caught up?

The point I raise is that the internet is international. There are N legal systems that are going to deal with this. And in 99% of them this isn't going to end well for Google if plaintiff can show there are damages to a reasonable degree.

It's bonkers in terms of risk management.

If you want to make this a workable system you have to make it very clear this isn't necessarily dangerous at all, or criminal. And that a third party list was used, in part, to flag it. And even then you're impeding visitors to a website with warnings without any evidence that there is in fact something wrong.

If this happens to a political party hosting blogs, it's hunting season.
by lan321 | 2025-10-23 08:10:10+00:00
His point is that it's significantly easier to go way over the maintenance calories compared to making up with exercise if you just eat whatever you feel like. Essentially that you can consume X calories much easier than you can exercise it out.

With proper diet I'm pretty sure the limit would be like 160kg for a healthy (TBD) body. Strongmen, when I watched regularly, were 160-185kg, with somewhat unhealthy bodies. If you eat junk, that limit comes lower since you can't exercise as efficiently. If you work 40hrs a week, that limit goes down further, since you can't live in the gym and hospital/sport clinic.

Of course, realistically, the sweet spot is IMO in the middle. Don't replace water with blended ice cream but also don't live in the gym or focus too much on it. Dry scooping teacups of some sketchy preworkout called "eXTREME PsYcHo SUPREME ViOlEnCe" with a bunch of other sketchy pills that make your third leg point at people all day and make your skin itch probably isn't worth it.
by sim7c00 | 2025-10-23 08:10:28+00:00
interesting stuff. I love Yamaha for audio stuff for sure, didn't know they owned Steinberg though.

Their speakers i think are lovely examples of their engineering quality. Great and honest sound, some of the best out there, and they are not super over-priced. Also ,they are super repairable. Had some really bad experiences with other brands which were, more expensive for a more biassed sound, had 'black gunk' over the PCBs as some kind of anti-repair mechanism. (overheats the boards too! ew!) and other crappy issues.

Cool to hear there's such a story behind the quality. Makes sense!
by dustypotato | 2025-10-23 08:10:39+00:00
The posted link says: >The new interactive shell is enabled by default in Gemini CLI as of v0.9.0.

but https://geminicli.com/docs/tools/shell/#enabling-interactive... > To enable interactive commands, you need to set the tools.shell.enableInteractiveShell setting to true.

Seems contradictory. I can't get it to work in either case .
by tetha | 2025-10-23 08:10:51+00:00
Obsidian also has affordable commercial pricing. By now I very much try to pay support contracts or give back to projects in other ways at work.

The problem is that quite a few open core companies immediately go from $0 / year to low to medium 6-digit-figures per year. This escalates the entire project sky-high in levels of internal scrutiny with a high chance of it not happening.

On the other hand, it was simple to argue why this is easily providing us with $50 in value per year. Now it is integrated with our normal license handling and it's actually slowly and steadily growing internally. We're up another 4-5 users from the last time I looked.
by pfannkuchen | 2025-10-23 08:11:18+00:00
Why do things have to change constantly? Like the Model Y was insanely different to any other car I’d ever driven not long ago, and Tesla was first to market on actually good electric cars. Why do they have to operate using the same strategy as legacy auto makers? Like a design refresh every 3 years to drive excitement feels manipulative to me, not like something that is absolutely necessary. Are you saying that competitor electric cars are outcompeting them by a wide margin now? I’m not really aware of which ones if so, at least in the American market. AFAIK the electric car program for all of the legacy auto makers is still a money pit for them, is it not?
by mad_tortoise | 2025-10-23 08:12:00+00:00
So you don't have links to back up your claims.

What is also hilarious is ad hominem trying to call me a communist (which I am not), and shouldn't matter either way. But what is funny is how you decry the state of things currently, which is happening under capitalism, yet the extent of your criticism of the society can't reach to the system within which it exists. However you create a nebulous hypothetical in trying to plaster me with an insult that another system would be so much worse, when according to you the state of how things is bad as it is.

So where is your critique of capitalism?
by d3Xt3r | 2025-10-23 08:12:31+00:00
It's trivial for any Tom, Dick and Harry to fork an opensource project and "extend" it - but none have so far actually extended the engine - have they implemented any new W3C standards or fixed any compliance bugs? Have they made any improvements to the rendering engine? I'm not aware of any of the forks doing anything significant, besides just superficial UI features and preventing merging certain pieces of code (like Manifest V3). If any of the forks have deviated in any significant way (like how Blink deviated from Webkit), please do enlighten me, because otherwise they're just copies dependent largely on Google for all the core improvements.
by dpe82 | 2025-10-23 08:13:03+00:00
IMHO Meta should be investing/inventing AI. When the AI org was younger it was doing some impressive open source work. Then it bloated and we got Llama 3 and not much since. I don't know if they can recover that earlier magic or if the ship has sailed; there's a good chance the super effective early folks got fed up and left or are burned out by the bureaucracy, but if I were in charge my first move would also be to cut half the department.
by masklinn | 2025-10-23 08:13:09+00:00
1. Because you commonly are not.

2. Because it’s really easy to fuck up and leak attacker controlled content in markup, especially when the environment provides tons of tools to do things wrong and none to do things right. IME even when the environment provides tons of tools to do things right it’s an uphill battle (universe, idiots, yadda yadda).
by sergeyprokhoren | 2025-10-23 08:15:56+00:00
The PostgreSQL uuidv7() developers are leaning toward a different approach to solving timestamp leaks, similar to FHSS (https://en.wikipedia.org/wiki/Frequency-hopping_spread_spect...). This is currently possible manually using the parameter "shift" (https://postgrespro.ru/docs/postgresql/18/functions-uuid), but could be automated in the near future
by geistlos | 2025-10-23 08:17:03+00:00
I think they could easily make Obsidian open source without losing out on profits. The app itself is free anyway. They could keep the sync backend closed source and make people pay to use the sync feature.

Lots of apps have open-source clients (for trust/auditability) but backends that are closed/locked somehow, e.g., Logseq.
by bandrami | 2025-10-23 08:17:16+00:00
All the commercial ones I've bought in the past year or so do, and ever since I think JUCE 7 there have been good libraries for open source projects that want to add the format.

I think there's still a lot of bad feeling about the fact that there are many VST2 plugins that are open source but nonetheless illegal (or at least tortious) to build.
by brettkromkamp | 2025-10-23 08:17:41+00:00
It's a mixed bag. It depends on your problem domain, the problem you are trying to solve (within that domain), the context you provide the LLM, the output it generates (you are using libraries to coerce the output into predictable (JSON) structures, right?). What's more, based on what you are trying to do, the LLM you are using might have sufficient training data, but not necessarily so (resulting in possible hallucinations/confabulations). So, there's that. Also, LLMs are not deterministic, they can (and will) generate a different response every time you call them (even if the context you provided is the same). So, yeah... sometimes these things really deliver and other times, it's just... meh!
by Lutger | 2025-10-23 08:18:29+00:00
You make a claim without a source and refuse to back it up when asked, yet you are doubling down on your confidence in the initial statement. There's an interesting discussion to be had, but this is not it.

There are several factors to be considered: the actual risk of older and newer systems, the impact, how to mitigate a fire and avoid the worst consequences, and weighing against the alternatives. Especially the latter is somehow always absent in denialist narratives. However, when the alternative is basically heating the planet into a dystopian hellscape, we may accept some negatives of any kind of technology that doesn't put our whole existence at risk.

We need to be real about the downsides yes, but let's also be real and accept we don't have any choice but push forward.

Here is my 1 minute AI powered 'research' btw:

"The fire risk for battery plant storage is not a single, universally agreed-upon percentage, but available data suggests a low and decreasing risk, especially for properly maintained and installed systems. For example, one study found the 2023 risk for home battery systems to be \(0.0049\%\), while another source reports a \(97\%\) drop in large-scale system failures between 2018 and 2023. The risk is influenced by factors like manufacturing quality, installation, and maintenance."

Doesn't seem all that alarming yet.
by colesantiago | 2025-10-23 08:19:12+00:00
Would it be best to be closed source and pay to get the source code with 1 year updates, (except say license server unless you're enterprise)?

That way the author can still keep the source closed and those who want code can pay for it.

I very rarely see OSS being monetized successfully without a community fork destroying the original project.

OSS still requires money to maintain the project and sparse donations really don't really cut it.
by heeen2 | 2025-10-23 08:19:30+00:00
I made a mcp that would use a pty lib to allow claude to debug a TUI app I was writing with ok-ish results. ultimately I wanted to see what was happening myself so when I need interactive I just tell it to use tmux-cli to capture the neighboring pane. https://github.com/pchalasani/claude-code-tools/blob/main/do... maybe turning that into a mcp with more guardrails and integrated guide to the agent would make it more popwerful
by Jorus120 | 2025-10-23 08:19:47+00:00
Hi HN,

I’ve released a small open-source project introducing the Compression Scaling Law (CSL): A method for detecting hidden order in time series using compression and surrogate tests.

Idea:

Slice the series into windows

Quantize + losslessly compress

Compare to spectrum-preserving surrogates (IAAFT)

If real data compresses better, and that advantage scales with window size as a power law,

The slope (α) becomes a hidden structure index.

Why it matters: CSL acts as a guardrail. It flags when systems are unstable (forecasts or controls likely to fail) rather than predicting exact events.

Applications so far:

Finance (BTC, VIX, spreads)

Climate (ENSO, sunspots, rainfall)

Risk governance (adaptive retraining, anomaly gating) https://github.com/Jorus120/Compression-Scale-Law Repo (MIT license): Includes methods PDF, plain-language explainer, toy data, and compact guide.

Would love feedback from the HN community:

Where would you apply this?

Are there domains where surrogate-based compression might reveal structure we usually miss?
by dd_xplore | 2025-10-23 08:19:57+00:00
To get an idea about radios, I made a crystal radio when I was in 7th grade, I only had few components. The only component I had difficulty in getting was the crystal oscillator (I was living in a rural town).

It was mind blowing when I first heard the audio through IEMs ! It felt magical that this contraption was working without any battery source.
by tuyiown | 2025-10-23 08:20:13+00:00
Depends on people, but for most it's mainly because Stallman says so.

You still have ethics ground if you think it the same way as repairability, actively blocking ways to repairs things you bought yourself is questionable, and keeping things closed source can be seen as a way to artificially prolonge a strict dependance on your vendor by impairing your ability to resolve issues by yourself.
by skatsubo | 2025-10-23 08:21:54+00:00
Add a custom "welcome message" in Server Settings (https://my.immich.app/admin/system-settings?isOpen=server) to make your login page look different compared to all other default Immich login pages. This is probably the easiest non-intrusive tweak to work around the repeated flagging by Safe Browsing, still no 100% guarantee. I agree that strict access blocking (with extra auth or IP ACL) can work better. Though I've seen in this thread https://news.ycombinator.com/item?id=45676712 and over the Internet that purely internal/private domains get flagged too. Can it be some Chrome + G Safe Browsing integration, e.g. reporting hashes of visited pages?

Btw, folks in the Jellyfin thread tried blocking specifically Google bot / IP ranges (ASNs?) https://github.com/jellyfin/jellyfin-web/issues/4076#issueco... with varying success.

And go through your domain registration/re-review in G Search Console of course.
by pcthrowaway | 2025-10-23 08:22:04+00:00
I'm not sure how this is relevant? The code is signed but that doesn't mean it doesn't contain backdoors. Without it being open source or at the very least source-available, we can't know

This is of course true of many other apps we run on Mac (though I suspect a non-zero number of common apps have backdoors); Obsidian also runs without sandboxing though, is used by many to record their innermost thoughts, and as the author mentioned, there's also the potential for data to leak via compromised extensions.

Am I missing something, or does the fact that it's signed tell us nothing except that the Obsidian company signed off on it? If so, I'd really like to understand if you had a purpose of sharing this... is there a tacit implication that "surely a company can be trusted"?
by bobertdowney | 2025-10-23 08:22:35+00:00
> There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub

Sorry what if the open source project made their CI/CD pipeline public? So users could exercise it, produce their own build, and then compare that to the notarized one? Would I then be able to verify that what I downloaded from the developer’s website is identical to what is built with the open source code? Just curious.
by aniviacat | 2025-10-23 08:22:39+00:00
It may be dangerous but it is an established pattern. There are many cases (like Cloudflare Pages) of others doing the same, hosting strangers' sites on subdomains of a dedicated domain (pages.dev for Cloudflare, immich.cloud for Immich).

By preventing newcomers from using this pattern, Google's system is flawed, severely stifling competition.

Of course, this is perfectly fine for Google.
by Kaibu | 2025-10-23 08:22:43+00:00
In Germany, the case of a company called "Modern Solution" has gained quite a bit of traction. An IT guy found a password, tried it on the company's phpmyadmin and reported that he could access their data. They sued him and the case went up to the highest German court, which acknowledged the lower court's decision to rule with the company. The IT guy got fined.

https://www.heise.de/news/Bundesverfassungsgericht-lehnt-Bes... (German article)
by jjav | 2025-10-23 08:23:22+00:00
> You are making things up out of thin air.

Not OP but not really. Recalls are pretty rare in most cars.

I own lots of cars and I've only had two recalls in the last 33 years. One for a Mazda minivan to replace a rear hatch shock (i.e. nothing safety related) and one for a Dodge truck (I don't remember what it was).
by kevalpadia | 2025-10-23 08:24:09+00:00
AI is reshaping how apps are built in 2025 by making development faster, smarter, and more efficient. From coding assistants like GitHub Copilot to no-code platforms like FlutterFlow and Bubble, and advanced testing tools like Testim and Applitools, this blog explores the top 11 AI tools transforming each phase of app development. Whether you’re a developer or a startup founder, discover how AI can accelerate innovation, enhance security, and streamline your app-building process.
by miggol | 2025-10-23 08:24:10+00:00
The author dedicates an entire paragraph to how much they trust the Obsidian team. It isn't open source purism, they are warning users that good intentions don't prevent a developer from writing software containing vulnerabilities.

Usage of user-created plugins and access to cloud accounts aggravates the risk posed by a vulnerability.

Open source reduces vulnerabilities over time, so those who want to heed the author's warning may indeed want to switch to an open-source Markdown editor. Just not because the Obsidian team is Evil.
by Carlseymanh | 2025-10-23 08:24:10+00:00
It really does not work like that, you start mixing everything and everyone up in a depressing blob after a while. I can't even remember the names of people i thought I loved or at least cared about. Compared with my last five years in a serious, committed relationship, its a night and day difference. To the next five years, and the ten after that hopefully.
by deafpolygon | 2025-10-23 08:25:27+00:00
I know this may go against the ethos of some folks on HN, but I switched to Apple Notes and haven't looked back. At the end of the day, you either use the tool or the tool uses you.

For diagrams, mindmaps, etc... I just use Freeform now -- screen capture or export the board as PDF to paste into my notes. It's deceptively flexible and more powerful than it would appear.
by elric | 2025-10-23 08:26:18+00:00
Note that if you already have an Obsidian vault, suddenly jailing it might break things. Obsidian stores a bunch of state in ~/.config/obsidian which will no longer be valid. And amusingly/frustratingly, the GTK file picker doesn't take the jail into account and seems to produce invalid paths.

And because --private mounts some bits as temporary filesystems, you might end up losing state. Try before you buy.
by actionfromafar | 2025-10-23 08:26:45+00:00
That's an uncharitable reading. Citing the "the spirit of the law" is not automatically ignoring the text in order to do whatever you want. It can be "how do I apply this archaic text about oxen (or whatever) to current events". Maybe the meaning is that stealing stuff in general is frowned upon, not just oxen. Or should we focus on how a Chevrolet Corvette is definitely not an ox?