MurphyA/hacker-news huggingface dataset:
by Esophagus4 | 2025-10-15 12:10:31+00:00
Interesting. You didn’t give specifics on what anti-bot measures sites implemented, so I’ll add:

Bot prevention measures can be good, but the more hoops you make your users jump though (CAPTCHA etc), the more legitimate users will drop off. Those have significant impacts on conversion rates.

I would think fixing this should involve the analytics and attribution side rather than adding friction to your e commerce flow.

Especially as bot tech continues to get better and more indistinguishable from real traffic.
by noname120 | 2025-10-15 12:11:17+00:00
Note that for TOTP the attack is only feasible if the font and pixel-perfect positions on the screen are known:

> The attacks described in Section 5 take hours to steal sensitive screen regions—placing certain categories of ephemeral secrets out of reach for the attacker app. Consider for example 2FA codes. By default, these 6-digit codes are refreshed every 30 seconds [38]. This imposes a strict time limit on the attack: if the attacker cannot leak the 6 digits within 30 seconds, they disappear from the screen

> Instead, assuming the font is known to the attacker, each secret digit can be differentiated by leaking just a few carefully chosen pixels
by viraptor | 2025-10-15 12:12:04+00:00
Yeah, their list of recommendations could use another point: expose the public data in a simple, structured way.

I'm working right now on an inventory management system for a clinic which would really benefit from pulling the prices and availability from a very specialised online shop. I wish I could just get a large, fully cached status of all items in a json/CSV/whatever format. But they're extremely not interested, so I'm scraping the html from 50 separate categories instead. They'll get a few daily bot hits and neither of us will be happy about it.

If people are scraping data that you're not selling, they're not going to stop - just make it trivially accessible instead in a way that doesn't waste resources and destroy metrics.
by kjreact | 2025-10-15 12:13:03+00:00
The YouTube video in your link refers to a single Veritasium video regarding their coverage of Waymo autonomous driving. But I feel the entire video is invalidated by the fact that Veritasium clearly mentions that their video is sponsored by Waymo. As a viewer I already know that there will be bias because of this declaration. Veritasium isn’t hiding it, so what’s the issue?

On HN I’d hope to read insightful comments instead of ones making strong statements without justification and asking others to Google for examples. If you’re too lazy to type out them out it’s probably better not to post at all; this is not Reddit.
by souvik3333 | 2025-10-15 12:13:18+00:00
We have developed DocStrange to create LLM-ready data from images and PDFs. We have open-sourced a 3B finetuned model also. You can try both the open-sourced and private models from the demo.

HF: https://huggingface.co/nanonets/Nanonets-OCR2-3B Demo: https://docstrange.nanonets.com/ Blog: https://nanonets.com/research/nanonets-ocr-2/

This model is an improvement over our last open-source model. We have fixed some of the issues that the community faced and some of the features that were requested (handwritten, multi-lingual).

The models are trained on 3 million documents, including handwritten documents, financial reports, complex tables, documents with watermarks, and stamps. Feel free to try it and share feedback.
by alephnerd | 2025-10-15 12:13:34+00:00
All those industries were fostered by individual countries with little-to-no transnational support from the EU.

On top of that, traditional European industries like Automotive have not kept up with challengers, the financial industry across Europe itself is morose in comparison to similar markets in the US or China, and European Pharma itself is overwhelmingly clustered in Switzerland which is not an EU member.

Nokia itself was at the brink of collapse in the early 2010s, and Siemens and Bosch have faced increasing stress at the bottom market from Chinese players and at the upper market by American players, plus states like the US and India required significant firewalls between those companies operations in their countries and Europe.

Long story short, while individual European states may have been able to build innovative companies, that muscle has largely atrophied over the past 20 years.
by baobun | 2025-10-15 12:13:46+00:00
Would like to see the script. From reading it's impossible to tell if the methodology is sound. Would legitimate users with adblockers or disabling JS get counted is false positives, for example?

That said, 73% doesn't come as a surprise. If anything I expect it to be higher.

I guess this quote sums up the situation

> When I tried to bring this up with a few major ad platforms, the conversation always followed a predictable script. The sales reps were incredibly friendly until I mentioned click fraud or bot traffic. Then, the tone shifted instantly to corporate-speak: "Our AI detection is industry leading" and "We take ad fraud very seriously." It was a polite but firm wall, a clear signal to stop asking questions.

> One rep I had known for years finally admitted the truth off the record. "Dude, we know," he said. "Everyone knows. But if we filtered it all out properly, our revenue would drop 40% overnight, and investors would have a meltdown."
by ajross | 2025-10-15 12:13:53+00:00
> Side channel attack is not a novel idea

Yes, but "side channel attack" isn't much of a description, is it? You can't just declare "I make a side channel attack!"[1], you need to invent one.

In this case it turns out that the hardware rendering of the zoom animation in the blur effect of stacked activities on the screen left crumbs that can be detected in the alien context. I certainly didn't know that. Did you know that? I don't think anyone knew that! It's "novel".

[1] Shades of Michael Scott declaring bankruptcy.
by grumpy-de-sre | 2025-10-15 12:14:20+00:00
Yeh I'm about 2km from a large wind park, it's the least obnoxious thing imaginable. Jogging through them at night with their dim red blinking strobes or watching them work overtime on a windy winter day is great and gives you a sorely needed feeling of optimism and hope for the future.

Yes directly underneath them there is some gentle swooshing noises but I think beyond 500m it's basically imperceptible. Nothing I'd call offensive, car traffic is easily 10x worse.

The young folks that I've talked to locally, overwhelming share the same perspective.

The opposition has to come from folks who cannot see the bigger picture and just view them as some kind of excessive ugly infrastructure. Not properly recognizing / or caring about the societal benefit of clean abundant energy or the future.

I kind of find it interesting that a lot of historical landscape art from northern Europe featured windmills. Nobody viewed them as a blight back then.
by cmsefton | 2025-10-15 12:14:27+00:00
The craziest thing about UK energy is that it uses marginal pricing, where the price of energy is dictated by the most expensive generator to meet demand i.e. gas. Doesn't matter if your energy is coming from wind or solar, you're still going to be charged according to the price of gas. Until this can change, consumers are always going to suffer and think green energy isn't cheaper.
by otoolep | 2025-10-15 12:15:01+00:00
rqlite[1] author here. Just to be clear, rqlite is not SQLite but rewritten in Go. rqlite uses the vanilla C code, and calls it from Go[2]. I consider that an important advantage over other approaches -- rqlite gets all the benefits of rock-solid[3] SQLite. As result there are no questions about the quality of the database engine.

[1] https://rqlite.io

[2] https://rqlite.io/docs/design/

[3] https://www.sqlite.org/testing.html
by tootie | 2025-10-15 12:15:12+00:00
The water erosion theory is poorly supported and the orthodoxy is supported by an absolute mountain of corroborating evidence. Remember the great sphinx is part of a massive mortuary complex and we have decades of scholarship documenting all of it. Including the quarry that sourced the building material and written records of the dynasties that produced the work. The notion that it was somehow preexisting from a culture that the Egyptians knew nothing about and who left absolutely no other traces despite having the sophistication to organizing a massive public artwork strains credulity. It's not fully impossible but it's an extraordinary claim and it requires extraordinary proof and what we have is the opinion of a few self-promoters.
by CuriouslyC | 2025-10-15 12:15:36+00:00
Ironically, I really like cloudflare but actively dislike workers and avoid them when possible. R2/KV/D1 are all fantastic and being able to shard customer data via DOs is huge, but I find myself fighting workers when I use them for non-trivial cases. Now that Cloudflare has containers I'm pushing people that way.
by chrismorgan | 2025-10-15 12:15:54+00:00
I’m puzzled by this: I thought it was well-understood, at least in the industry, that traffic numbers were at least mostly nonsense, and that ad click metrics especially were suuuper shady, typically more than half fraud; yet OP, in the business of “accurate ad spend analytics”, only just discovered this!?

It just doesn’t ring true. That aspect of the story isn’t novel at all, and someone in that line of work should surely have known all this, right?

Now the section on categorising different bot patterns, that’s more interesting, and I haven’t seen so much said about it.
Show HN: Scriber Pro – Offline AI transcription for macOS
by rezivor | 2025-10-15 12:16:16+00:00
Hey HN! Built this because I was tired of waiting hours for transcription services and didn't want to upload sensitive recordings to the cloud.

Real metrics from my M1 Max: 4.5hr video file transcribed in 3 minutes 32 seconds. Works completely offline. First 5 HN users who click the button on the page get it free. Literally promo code straight to the app sore Key differences vs Rev/Otter: - No 2-hour file limits (handles any length) - Timecodes stay accurate on long files (no drift from chunking) - Supports MP3, WAV, MP4, MOV, M4A, FLAC - Exports to SRT, VTT, JSON, PDF, DOCX, CSV, Markdown Built for macOS. Happy to answer questions!
by powerapple | 2025-10-15 12:16:18+00:00
China does not have a way to deal with crime in Cambodia. It does not have anti-terrorism law to operate in other countries, also it does not want to upset Cambodia or Myanmar government when not necessary. These Chinese operates in Cambodia are mostly on the wanted list anyway, they don't plan to go back to China. In fact, a person leaving China to Cambodia and Myanmar will be checked and make sure their trip is innocent. Personally I hate these scammers, they have ruined so many people's lives. It seems that it will never go away. Too much money involved. I wish we can launch drone attacks on these places.
by Cthulhu_ | 2025-10-15 12:16:19+00:00
Personally, homes and freezers should have a consistent temperature; if there's ways to store the excess heat / cold somehow that'd be neat. But for homes, the best ways to store excess energy would be batteries and electric cars, or worst case sink heat into underground storage.

The electric water heaters are a good idea, but you'd need the space for extra storage. There's existing heat exchanger systems with e.g. rooftop / sunlight water heating systems, if excess cheap energy could be used to also heat that storage you'd have something.
by joshkel | 2025-10-15 12:16:20+00:00
The way you know is by running the full SQLite test suite, with 100% MC/DC coverage (slightly stricter than 100% branch coverage), on each new compiler, version, and set of flags you intend to support. It's my understanding that this is the approach taken by the SQLite team.

Dr. Hipp's position is paraphrased as, “I cannot trust the compilers, so I test the binaries; the source code may have UBs or run into compiler bugs, but I know the binaries I distribute are correct because they were thoroughly tested" at https://blog.regehr.org/archives/1292. There, Dr. John Regehr, a researcher in undefined behavior, found some undefined behavior in the SQLite source code, which kicked off a discussion of the implications of UB given 100% MC/DC coverage of the binaries of every supported platform.

(I suppose the argument at this point is, "Users may use a new compiler, flag, or version that creates untested code, but that's not nearly as bad as _all_ releases and platforms containing untested code.")
by intended | 2025-10-15 12:16:35+00:00
Then There are NO options. We will have to live with that world and having no future.

I’m aware that this level of nihilism is difficult for many to stomach - but it’s only nihilism if you believe in fairy tales.

If we are talking about reality then we have to deal with the impossible challenges we are facing.

The fact is that retraining will not work - nor is this the first time it’s been named as a hope up in the past 25 years. (“teaching miners how to code” comes from the last time this was a big hope in America.)

If it helps you feel better - I said unmodified MOOCs.

With some changes, you can increase MOOC completion rates - but there isn’t enough lift even after that.

I used to be a champion for education initiatives to up skill workers - from a time before MOOCs.

The failure of MOOCs was the end of that hope because it showed there was a gape between the ideal and reality.

People simply can’t retrain like that.
by curiousObject | 2025-10-15 12:16:42+00:00
if you have a lot of fake traffic then ads on your site will have an even worse conversion rate than normal?

Yes, if you only count purchase/sale conversions

Maybe no, if you also count clickthrough and view conversions, perhaps even lead conversions sometimes (because fake sign ups are possible).

But you’re right. Purchase conversions are one incentive
by neciudan | 2025-10-15 12:17:00+00:00
Ever wondered how big engineering orgs actually scale UI development across dozens of teams — without breaking the product or each other’s deployments?

In the latest episode of Señors @ Scale, I spoke with Erik Grijzen, Principal Software Engineer at New Relic, about how they built one of the earliest micro-frontend architectures (before the term even existed) — and how observability became a key part of scaling both systems and teams.

We covered:

How New Relic unified 20+ SPAs into a single extensible platform

Why observability isn’t just about logs and metrics anymore — it’s a business reliability layer

How to organize frontend teams by domain, not feature

The hidden challenges of runtime composition, dependency duplication, and iframes at scale

Why writing RFCs and POCs before coding improves architecture quality

How senior engineers lead through influence instead of authority

Watch or listen here: YouTube: https://www.youtube.com/watch?v=7zuEgUnaAEk

Spotify: https://open.spotify.com/episode/7L33Zb4rr1KvBIeYmCan7u

Apple: https://podcasts.apple.com/us/podcast/overvability-at-scale-...

Curious to hear from others working in large engineering orgs — how are you handling observability or micro-frontends at scale? What’s worked well (or gone horribly wrong)?
by vfclists | 2025-10-15 12:17:10+00:00
The FSF has never been a solid act.

For years they have studiously ignored the fact that the mobile phone is the place where many people engage with IT and have been faffing about in the desktop and server space.

Instead of leading they have always trailed behind. What they should have been doing was focusing on the software vision which they will most definitely screw up.

Focus on the software vision and wait for the deblobblable hardware to emerge or commission their own hardware from scratch.

I'm sorry but these guys have and will always be useless, much like the Wayland project.

How many years has that crew taken to create something fully capable of replacing X11?
by vel0city | 2025-10-15 12:17:12+00:00
I made a point to use the number of shootings resulting in injury or fatality. So no, you're wrong.

There have been over 90 instances of reported discharges around school grounds so far in 2025. Around 30 resulted in injury or fatality. Which, remember, we're still have a good bit of school for 2025 left.

I don't know where you're getting the 90s comparison from. Everywhere I look the statistics show it's worse now than it was then. There was a leak around '92 but it leveled off for a while.

https://ballotpedia.org/United_States_school_shootings_and_f...

Even then, it's an extremely weak argument to me. You might as well be arguing "we've had lead in the gasoline for decades". It happened in the past as well, so why change it. Maybe we should do something to address the issue instead of just continuing to accept it.
by Phil_Latio | 2025-10-15 12:17:17+00:00
> In this case, there is no "increased subsidies for less feasible regions"

https://energiewende.bundeswirtschaftsministerium.de/EWD/Red...

> The price actually paid is the bid price, which is adjusted up or down by a correction factor. This is higher in low-wind locations and lower in high-wind locations. Put simply, this means that where there is a lot of wind and yields are high, there is slightly less money per kilowatt hour fed into the grid. Where the wind is weaker, the subsidy increases.

Now why do they do this? Because the goal is to do _everything_ with renewables. Which means: Since it's not so easy to route electricity from the north to the south, the south needs it's own plants, even if they are unprofitable.
by danaris | 2025-10-15 12:18:37+00:00
I think this paints it as more black-and-white, more set in stone, than it really is.

True, the EU has not shown such an interest in the past. But that was when it could mostly trust that the US would, y'know, act like a sane and vaguely reasonable nation. It's been less than a year since the orange menace was re-elected, and the wheels often take a while to turn.
by carlosjobim | 2025-10-15 12:18:51+00:00
I guess it depends on how atomized you are. Where I live, knowing who and where are the drug dealers and what people are involved in homicide have very real consequences for families and the choices you make for your children.

I think it's very lame of you and other people to try to call it "living in fear". Wouldn't you like to know about for example a wave of robberies or burglaries happening near to where you live? Living in fear is when you are worried about things on the other side of the world, and such. Local news is not fear mongering. It is structured delivery of information which would have been delivered as gossip anyway.

Not to mention that news exposure helps the police finding dangerous criminals or finding more witnesses. For example serial rapists commonly use the same method with various random victims who are not aware of each other. Once the police and prosecution can connect several victims to the same perpetrator, they will have a very strong case.

Of course you will scoff at all this, since you personally might not have been the victim of violent crime, and therefore couldn't care less. But other people haven't reached that level of rational elevation yet.
by stinkbeetle | 2025-10-15 12:18:54+00:00
> Value prediction and address prediction are very different things.

Both are classes of data prediction, and Apple CPUs do both.

> Address prediction for loads and stores, by detecting various kinds of strides and access patterns, is done by most CPUs designed during the last 25 years and it is used for prefetching the corresponding data. This is as important for loads and stores as branch prediction for branches.

That is not what is known as load/store address prediction. That is cache prefetching, which of course has to predict addresses in some manner too.

> On the other hand, value prediction for loads is done by very few CPUs and for very restricted use cases, because in general it is too costly in comparison with meager benefits. Unlike for branch direction prediction and branch target prediction, where the set from which the predicted value must be chosen is small, the set from which to choose the value that will be returned by a load is huge, except for very specific applications, e.g. which repeatedly load values from a small table.

I'm talking about load address prediction specifically. Apple has both, but load value prediction would not trigger here because I don't think it does pattern/stride detection like load address, but rather is value based and you'd have to see the same values coming from the load. Their load address predictor does do strides though.

I don't know if it needs cache misses or other long latency sources to kick in and start training or not, so I'm not entirely sure if it would capture this pattern. But it can capture similar for sure. I have an M4 somewhere, I should dig it out and try.

> The application from the parent article is such a very special case, because the value returned by the load can be computed without loading it, except for exceptional cases, which are detected when the loaded value is different from the pre-computed value.
by todotask2 | 2025-10-15 12:19:22+00:00
It still depends on the target audience. Some websites or apps are single-page applications (SPAs), can older devices handle that? For example, my mum’s Android phone was too slow to even load a page.

Secondly, users should upgrade their devices to stay safe online, since vulnerabile people are often scammed or tricked into downloading apps that contain malware.

So we should not cater to outdated browsers when they could pose a risk.
by cruffle_duffle | 2025-10-15 12:19:28+00:00
Have any of these no-bs articles described how they handle schema changes? Are they even using a “real” DB or is it all local, single user sqllite? Because I can see a disaster looming letting a vibe coder’s agent loose on a database.

And does it require auth? How is that spec’d out and validated? What about RBAC or anything? How would you even get the LLM to constantly follow rules for that?

Don’t get me wrong these tools are pretty cool but the old adage “if it sounds too good to be true, it probably is” always applies.
by toredash | 2025-10-15 12:19:45+00:00
> If you have the setup on 3 AZs how would you route traffic only to the AZ where your RDS resides?

So specifically for RDS, AWS will provide two endpoint for the client application: A writer and a reader endpoint. Similar to this: mydbcluster.cluster-c7tj4example.us-east-1.rds.amazonaws.com : Writer endpoint mydbcluster.cluster-ro-c7tj4example.us-east-1.rds.amazonaws.com : Reader endpoint (notice -ro part).

The writer endpoint will always resolve to the active master, which is what the client application is configured to use, and thats the hostname my lookup service will use as input to determine the current location of the Writer instance.

My solution works only for hostnames that returns a single IP address, so it won't work for the Reader endpoints. As I wrote in the repository, a requirement for this is that "The FQDN needs to return a single A record for the external resource".
by netsharc | 2025-10-15 12:20:09+00:00
Huh, I wonder why... maybe they noticed they have a lot of gamers as employees? Maybe the work in the railway business attracts gamers in particular?

To kill the mood, maybe it's a bad idea considering one DB signalman was distracted by a phone game and let 2 trains into one train segment heading into each other: https://www.bbc.com/news/world-europe-36025951