MurphyA/hacker-news huggingface dataset:
by strcat | 2025-10-16 17:40:04+00:00
/e/ lacks privacy without taking exploits of unpatched security vulnerabilities into account due to having severe unpatched privacy vulnerabilities, lack of modern Android privacy protections and lack of important privacy features filling major gaps in Android privacy covered by iOS such as Contact Scopes and Storage Scopes. Some major gaps in privacy aren't covered by either Android or iOS such as a Sensors toggle, especially with how the sensors can be used to do rough recording of audio.

Taking advantage of privacy flaws in older versions of software is the norm and not treated as malware by most platforms, app stores, news sites or the public at large. Many widely used apps abuse privacy flaws in older Android versions. That happens both in the form of privacy bugs which were fixed in newer versions and weaknesses in the design addressed by newer OS versions. Only privacy patches for issues considered bugs which are assigned a High or Critical severity are backported. The severity is very subjective and they try to avoid adding a large number of backported patches since some OEMs struggle to keep up with it and adding more patches would make it harder. As an example, VPN leaks are only considered Low or Moderate severity issues by Android and don't get backported. Many other kinds of privacy issues are similarly only fixed for the latest OS releases. As another example, many important privacy improvements are not considered bug fixes at all and aren't candidates for being backported regardless of importance. Many privacy improvements require changing the APIs used by apps with new target API levels which can't be backported without breaking compatibility.

A large portion of the missing patches in /e/ we're referring to are privacy patches, not security patches. However, security patches are also needed to protect privacy. Many apps and services abuse the privacy vulnerabilities. The patches being referred to are a mix of both. A large subset are privacy patches, especially the Moderate and Low severity patches due to how they assign severity. Only certain particularly awful classes of privacy vulnerabilities can get considered High or Critical severity to be candidates for Android's backporting to older releases.

Apps exploiting security vulnerabilities to get code execution would be considered malware and is rare, but apps abusing many privacy flaws in older Android is the norm among mainstream apps. You're wrongly interpreting the regular stream of patches for vulnerabilities as only being for security issues when many are for privacy issues. With /e/, you aren't getting the bare minimum to protect privacy and security. Privacy also depends on security and is not an entirely separate thing as you're portraying it. We're not conflating them but rather they're very closely related. You're also disregarding privacy vulnerabilities and the steadily improving standard Android privacy protections.
by johnnyanmac | 2025-10-16 17:40:11+00:00
If I had to steelman it, people think the counting should be fast and the verification is based on your ability to attend a polling station on demand. The trust the machine, but not the person.

My charitable interpretation of that is that they have a huge blindside for people who need to work crazy hours, look after kids, or for disabled people who need to do a lot of planning to get to a physical location they don't frequent. Or simply people out of town or country that day (soldiers on tour are a big one, my parents are rarely in town to vote). They are so distrusting of mail they forget that people can't all be expected to be in a single spot for a single day.
by gnulinux | 2025-10-16 17:40:56+00:00
I agree with you, I consistently find Gemini 2.5 Pro better than Claude and GPT-5 for the following cases:

* Creative writing: Gemini is the unmatched winner here by a huge margin. I would personally go so far as to say Gemini 2.5 Pro is the only borderline kinda-sorta usable model for creative writing if you squint your eyes. I use it to criticize my creative writing (poetry, short stories) and no other model understands nuances as much as Gemini. Of course, all models are still pretty much terrible at this, especially in writing poetry.

* Complex reasoning (e.g. undergrad/grad level math): Gemini is the best here imho by a tiny margin. Claude Opus 4.1 and Sonnet 4.5 are pretty close but imho Gemini 2.5 writes more predictably correct answers. My bias is algebra stuff, I usually ask things about commutative algebra, linear algebra, category theory, group theory, algebraic geometry, algebraic topology etc.

On the other hand Gemini is significantly worse than Claude and GPT-5 when it comes to agentic behavior, such as searching a huge codebase to answer an open ended question and write a refactor. It seems like its tool calling behavior is buggy and doesn't work consistently in Copilot/Cursor.

Overall, I still think Gemini 2.5 Pro is the smartest overall model, but of course you need to use different models for different tasks.
Show HN: Coordable – Get better geocoding results with AI cleaning and analytics
by s-p-w_ | 2025-10-16 17:41:06+00:00
I’ve been working on a tool called Coordable, which helps analyze and improve geocoding results.

If you’ve ever dealt with geocoding at scale, you’ve probably hit two recurring problems:

Garbage in = garbage out. Addresses are often messy (“2nd floor”, “/”, abbreviations, multiple addresses in one line…). Most geocoders will fail or return incorrect matches if the input isn’t perfectly normalized.

A result isn’t always a correct result. Many providers return something even if it’s wrong — e.g. shifting a house number, or confusing similar street names. Assessing whether a geocoded result is actually right is surprisingly hard to automate.

Coordable tries to address both issues with AI and analytics:

Uses an LLM-based cleaner to normalize messy addresses (multi-country support).

Automatically evaluates geocoding accuracy by comparing input and output like a human would.

Lets you benchmark multiple providers (Google, HERE, Mapbox, Census, BAN, etc.) side by side.

Includes a dashboard to visualize results, quality metrics, and exports.

It’s not a new geocoder — it wraps existing APIs and focuses on data quality, comparison, and automation.

It’s currently in beta with free credits. If you work with geocoding or address data, I’d love to hear how you handle these challenges and what kind of analytics would be most useful to you.
by walterbell | 2025-10-16 17:41:08+00:00
> Uber Eats and Grubhub seem to match prices and charge exactly the same as Doordash.

https://www.ftc.gov/advice-guidance/competition-guidance/gui...

Price fixing is an agreement (written, verbal, or inferred from conduct) among competitors to raise, lower, maintain, or stabilize prices or price levels. Generally, the antitrust laws require that each company establish prices and other competitive terms on its own, without agreeing with a competitor. When purchasers make choices about what products and services to buy, they expect that the price has been determined on the basis of supply and demand, not by an agreement among competitors. When competitors agree to restrict competition, the result is often higher prices.
by nradov | 2025-10-16 17:41:18+00:00
I hope you recognize that your claims are deeply flawed and don't align with the reality that most middle-class grocery shoppers experience. Regardless of what you think makes "sense", major supermarkets throughout the country have rough assortment parity (with minor differences for regional consumer preferences). In some cases the long tail is actually longer in lower median income cities because labor is cheaper and stores are physically larger (cheaper real estate). That Publix where I shopped in Daytona Beach is enormous.

Instead of making things up you can just go look. Many supermarkets have online ordering now so you can see exactly what they stock at each local store.
by hedgehog | 2025-10-16 17:42:05+00:00
In my experience with Django the admin scaffolding saves a lot of work building UI for diagnostic and customer service workflows. Projects on other frameworks that I've been involved with end up rebuilding a lot of that stuff in their own codebase, more work and often not as good of a result. There are a lot of aspects of frameworks like Hyperflask that look attractive relative to Django but foregoing the admin framework is a high price to pay. Are there some alternate patterns other people are finding successful?
by kstrauser | 2025-10-16 17:42:18+00:00
I could've written much the same. I used Apache from the late nineties until around 2010, and I can manage it. I just don't want to anymore. It's not worth the pain.

As a side note, I see that Apache still describes it as "the most popular web server on the Internet", but that's probably not the case: https://w3techs.com/technologies/overview/web_server

To me, that has shades of XFree86 calling itself "the premier open source X11-based desktop infrastructure." Um...
by Dylan16807 | 2025-10-16 17:42:20+00:00
Well the wording is "Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer[...]"

Starting with no trickery, there's a lot of circumstances where you could buy software from a vendor and confidently declare you didn't modify it. And that should be true even if you ask for certain features just for you. So there's probably a way to make the separation work.
by tredre3 | 2025-10-16 17:42:32+00:00
> I’m pretty sure DoorDash is the one who increases the price on their end, not the business

That is not correct. Doordash takes a 20-30% commission on each sale, so businesses preemptively increase the prices to offset that. They're not forced to and doordash isn't doing it for them. But, you know, they're still effectively "forced" to if their in-store prices don't have great margins to begin with...
by kulahan | 2025-10-16 17:42:54+00:00
Absolutely nothing I've seen anywhere justifies the idea that access to food is the problem. In most cultures, you don't need cooking classes because the food is ingrained into their culture, and recipes are passed down. Americans have a much weaker link to their heritage. You might know a few dishes, but in my experience, absolutely nobody knows how to cook.

By cook, I don't mean "can add one box of prepared goods to another box of prepared goods with a can of prepared goods on the side", I mean buying meat, veggies, fruit, and grains and cooking a dish from home, mostly from scratch.

edit: 13 million Americans are in food deserts. If the problem were that small, it'd be similar in size to people who are addicted to substances other than alcohol. This is affecting almost everyone. There MUST be another, bigger solution.
by Qwuke | 2025-10-16 17:44:04+00:00
>1. It's important for people to understand how OSI co-opted the goodwill and some of the ideas from the Free Software movement.

Okay I don't understand why this is happening in the same breath you're suggesting that OSI is responsible for making everyone in the free software movement believe freedom of use (even in commercial cases) is required otherwise things are source available. GNU foundation, OSI, and even source available license writers basically agree on this part. Can you be specific here?

Because otherwise you're just reinforcing the perception I explained above, since largely the disagreement between OSI and the original free software people is that OSI supports too _permissive_ and too many non-copyleft licenses, not that the permissive or copyleft licenses need to enshrine certain license holders or disenfranchise others, or block commercialization or competitors. That's deeply antithetical to the idea of free or open software, regardless of the camp.

>2. I think they have some good ideas even if I don't agree with all of them.

AGPL, despite achieving all of your goals to prevent hyperscalers from free riding, is not one of them?

>I'm just a guy with 3 kids under 5 and not enough time to run any kind of rebranding project. I'm just angry that whenever someone launches a project that is more free than proprietary software but that isn't OSI approved, 90% of the comments are about why it isn't free or isn't open source.

Because the community has largely agreed on the principles codified by OSI. The principles you propose seem to betray the larger movement's intentions significantly, which is much bigger in scope than OSI.

>-1: You can't distribute this software if your name ends in "ezos".

>0-4 same as the rest.

That's a lot different than source available licenses actually, which usually declares enshrines the original license holder, even though it's not technically free under the other principles. I think if you thought up of a new consistent principle that didn't enshrine a single distributor or disenfranchise entire classes of other distributors, people would be open to the idea of a variant of free software.

But I think the bigger issue is that you think AGPL is failing somehow in not being restrictive enough compared to source available licenses. Maybe you could articulate that more clearly, and _that_ would gather more mind share. Merely stating that OSI is bad doesn't really change people's opinion of source available. Mostly reinforcing free software/copyleft maxi's ideas and insinuating GPL needs to be more common.
by toast0 | 2025-10-16 17:44:18+00:00
> I am not joking that I cared more about and paid more attention [...] than I care about or pay attention to at least half of the 30-45 minute final battles in Marvel movies.

That's probably because all the Marvel movies are professionals churning out the same green screen crap. Skibidi is not in my tastes, but it has the chance of being interesting because it's not an industry professional making it (afaik), at least until Michael Bay takes over.
by itsnowandnever | 2025-10-16 17:44:36+00:00
I made the switch from FastAPI + Jinja + HTMX to Go and embedding the HTML into the Go binary directly... it's very nice being able to run the apps without an interpreter. I'm able to make ~5MB sized containers to run the full stack

there's a performance increase too, but these apps I'm talking about are so simple it's not enough to really notice. objectively FastAPI is really good and makes running a simple site so easy, I'd still recommend to most people using that.
by AlexandrB | 2025-10-16 17:44:41+00:00
There's a difference between professional warmth and "we're a family". The latter usually comes top-down, from management and is fundamentally disingenuous. It's often a self-serving way of trying to get you to treat the company as your family, while company leadership still won't hesitate to lay you off in a mass zoom meeting. It's fine to be friends with co-workers or managers, but don't let companies obscure the fundamental nature of the relationship.
by like_any_other | 2025-10-16 17:44:54+00:00
> The whole point of hiding their names and faces is to make prosecuting individual bad actors borderline impossible.

There is at least one other reason:

Keffiyeh-clad anti-ICE protester threatens to stab agent, harm family in San Francisco mob attack; Four ICE agents were injured as protesters punched, pepper-sprayed and ambushed them outside the courthouse - https://www.foxnews.com/us/keffiyeh-clad-anti-ice-protester-...

Yes, ICE agents and their families have been extensively doxxed. Multiple Department of Homeland Security sources confirm that ICE officers and their family members have had their personal information, photos, and locations posted online, putting them in grave danger. - https://factually.co/fact-checks/justice/ice-agents-doxxed-8...
by WorldMaker | 2025-10-16 17:45:29+00:00
Microsoft isn't Apple or Google, so assuming their intent here is a bit of an "all your friends are jumping off the bridge so you must want to jump off the bridge" fallacy.

Stated primary intent by Microsoft for TPM is Passkeys (because Microsoft has key incentives to kill Passwords and reduce Phishing) and Netflix-class DRM (because people want to still be able to watch Netflix on their PCs).

Sure, Microsoft has also tried locked down "Store-only" versions of Windows (partly to appease Educators who moved to Chrome OS for that need/compliance requirement), but also has heard loud and clear that isn't the version of Windows that will drive sales from the market at every one of those attempts. At this point there should be no way that Microsoft still thinks they can lock down Windows as much as Apple and Google lock down their phones. If anything Android moving even more locked down seems to be a marketing opportunity for Windows to point out that they generally won't.

Microsoft isn't perfect, and isn't a monolith (I'm sure there are executives that wish Microsoft was in the position of Apple or Google right now), but the flip side, Microsoft is a company with products to sell and the market tells it doesn't want locked down Windows and for the most part Microsoft is incentivized still to not lock down Windows. Basic greed is an easier explanation for their past and future behavior than imagining some conspiracy where Apple, Google, and Microsoft are all in it together to kill the unlocked computer.
by kulahan | 2025-10-16 17:45:34+00:00
I couldn't possibly disagree with your last point harder. What's with people and blindly trusting that the pharma companies found a holy grail medicine and didn't rush it to market well before the necessary research is in?

Even more than that, dosing hundreds of millions of Americans for life is one insanely expensive and ridiculous solution.

Side note, is there good research on the effects of microplastics on the body? I'm holding out adding that to my plate of concerns until this is the case, and last I heard we were pretty in-the-dark on the topic.
by umanwizard | 2025-10-16 17:46:53+00:00
> The point of my comment is that in my experience, incompetently written, overly-cautious code tends to be more safe at the expense of maintainability and/or performance

Well, yes, but that's the whole value of Rust: you don't need to use these overly-cautious defensive constructs, (at least not to prevent data races), because the language prevents them for you automatically.
by kbolino | 2025-10-16 17:47:07+00:00
This has been a very informative discussion, so thank you for that.

I did want to point out, though, that both languages have other (compound) value types than just structs. Go has value-based arrays, and C# has value-based tuples. It looks like C# may gain value-based discriminated unions as well, though it's not settled yet: https://github.com/dotnet/csharplang/blob/main/proposals/uni...
by Kim_Bruning | 2025-10-16 17:47:09+00:00
You elided the word "Empirical". Say his wife made it empirically as water-tight as she can: for instance she hires a PI who follows him 24/7. The PI finds nothing out of the ordinary. How is this even still cheating?

Maybe he was cheating before or after, sure, but not during. No court would buy that.

...At least, that's how I interpret 'empirical consequence' - something observable or detectable, at very least in principle. Do you mean something different?

(Right this minute I'm coming from an empiricist framework where acts require consequences. If you're approaching this from a realist or rationalist view -which I suspect-, I'd be interested to hear it!)
by vee-kay | 2025-10-16 17:47:12+00:00
The difference is that Mozilla is directly and significantly funded by its biggest competitor, yet its venerated Firefox browser barely has a 2% market share.

(Which leads me to a ponderous question: if I had the wherewithal to pour hundreds of millions of dollars of my money into a non-Chromium FOSS browser, supported by 1700+ staff and 1000+ volunteers, would that browser have merely a ~2.17% market share? Hmmm... As a comparative analogy, Samsung Internet browser has barely had any improvements in years and it is surviving due to it being the default browser on the millions of Samsung smartphones & tablets worldwide, but its market share is ~1.86%. I don't think Samsung is spending half a billion a year keeping this browser alive, nor paying its browser departmental heads millions of dollars to keep the browsing chugging along.)

Since it is evident that Mozilla is a for-profit organisation funded by its biggest competitor, then we must wonder: do the Mozilla volunteers get their fair share of all that profit? If not, why not?

But since we all know Mozilla is always crying for more money, then where are the hundreds of millions of revenue going every year? I suspect it is neither going deep for improvements to the Firefox browser (I mean, come on! "tab groups" are relatively new feature in Firefox, but Firefox users have been demanding this feature for years, and Firefox's major rivals have had tab grouping feature for years, so what took Firefox so long to to do this bare needful?!), or to the many hardworking volunteers doing their best for a supposedly good (but losing) cause (Firefox's market share is eroding, and I assume Google is not sad about that trend).
by javawizard | 2025-10-16 17:48:23+00:00
That's not what that quote is about.

If you owe the bank $100 and don't pay, that's your problem: you'll get in trouble for it, and the bank isn't going to be unduly harmed.

If you owe the bank $100 million and don't pay, that's the bank's problem: the loss of that $100 million is going to hit the bank hard, whether or not they're the ones who are in the right and regardless of how much trouble you get in over it.

Likewise, if you're a small time app developer and you use a private method that gets yanked and your app breaks, that's your problem: your users are going to be pissed at you, you'll take the reputational damage, and even if your users are also pissed at the OS vendor they represent such a small group of individuals that the OS vendor isn't going to be unduly harmed by that.

If, on the other hand, you develop one of the most widely used frameworks and you use a private method that gets yanked and your app breaks, that's the OS vendor's problem: the number of people who are pissed off at them (rightly or wrongly) is now much larger and they're going to take some reputational damage over it, whether or not they're the ones who have the moral high ground and regardless of how much reputational damage you also take.

And that's exactly what we're seeing here: it doesn't matter that Electron used an API they weren't supposed to, people are pissed at Apple about this and Apple, rightly or wrongly, has to contend with that reputational damage if they don't take steps to prevent this sort of thing before it happens (like letting the developers know that private-on-paper API is going to be yanked in advance, or making it mechanically impossible for anyone outside of Apple's own code to invoke that API long before someone depends on it).
by brailsafe | 2025-10-16 17:48:36+00:00
Ya, it's an easy mistake though, very subtle difference between general dismissal/firing/layoff. They're interpreting layoff to mean the same as "firing" or general dismissal, but as far as I understand it's more like a shortage of work thing due to lack of income on the company side, compared to insufficient productivity on the worker's side.

A subtle difference in terminology, but a bit difference in terms of outcome. In a layoff you'll likely have no issues getting severance if it was ever on the table to begin with, employment insurance, it's not a mark against you on a resume necessarily or socially.