MurphyA/hacker-news huggingface dataset:
by tsmango | 2025-10-14 16:47:44+00:00
Good question, because entropy is real. The teams I’ve seen do this well keep consistency with a mix of guardrails and culture.

Guardrails

- Size and complexity limits. Lints for max lines/ABC/branching. If a service starts growing branches, that’s a signal we may need to extract a new one.

- Naming and layout. Stable namespaces and file locations reduce drift and make the right home more obvious.

Culture / Habits

- Docs with real examples. Short “what / why / how” write-ups and a few canonical services to copy. Explain the composition rules, why services should do one unit of work, and why only orchestrators compose them. Point to real examples in the codebase. You want to describe and show the golden paths. That doesn’t mean new golden paths can’t appear later, but when they do, it should be discussed and intentional. I’ve heard this described as an “architecture menu”: choose from the menu, or explain why you need to do something off-menu and how it’ll work to get buy-in.

- Onboarding. As part of onboarding new engineers, go over the architecture and the patterns. Explain why the team does these things, walk through examples, and answer questions.

- PR templates with checklists. Reenforce golden paths / patterns. Ask: is this one responsibility or two? Is this becoming orchestration?

- Stewardship. Senior engineers model the pattern and call out deviations early.

- Fast-follow cleanups. If we cut a corner for a deadline, we open a follow-up ticket and actually do the cleanup right after shipping.

Linting rules can be overridden, so culture has to carry it in the end. People need to care, and new folks need to understand why they should care.

Engineering teams may also run up against the business side pushing back on time spent cleaning up or paying down tech debt. The key is showing that consistency and well-defined patterns reduce bugs and actually make the team faster over time (data helps prove the point here). A cut corner might seem harmless, but if you keep cutting them, the square product you thought you were shipping slowly becomes a circle that’s hard to keep in place.
by alfalfasprout | 2025-10-14 16:47:52+00:00
> New typecheckers don't need to be perfect. They need to be good enough, easy to integrate and have low false positives. Sure, they will improve with time, but if feels like a pain then no one will pick it up. Python users are famously averse to tools that slow down their dev cycles, even if it means better long term stability

I really don't agree. Sure, they don't need to be perfect but also keep in mind many codebases have already standardized on something like (based)pyright or mypy. So there's a migration cost. If your analysis has a lot of false positives or misses a lot of what those type checkers miss then there's little incentive to migrate. Sure, ty and pyrefly are much faster, but at the end of the day speed is only one consideration for a type checker.
by prein | 2025-10-14 16:48:30+00:00
I don't daily drive KDE, but when I set up our home media PC in the living room over the weekend, KDE was a no-brainier to pick for the DE.

Everything immediately just worked, it's familiar enough that someone not used to Linux can click around and get to things, and as a bonus, controlling it from the couch with our phones is trivial with KDE Connect.
by michaelt | 2025-10-14 16:48:40+00:00
In ~2020, it was:

Attacker sends an imessage containing a PDF

imessage, like most modern messaging apps, displays a preview - which means running the PDF loader.

The PDF loader has support for the obsolete-but-part-of-the-pdf-standard image codec 'JBIG2'

Apple's JBIG2 codec has an exploitable bug, giving the attacker remote code execution on the device.

This exploit was purchased by NSO, who sold it to a bunch of middle eastern dictatorships who promptly used it on journalists.

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
by Der_Einzige | 2025-10-14 16:48:42+00:00
Another thing not mentioned by this poor article (everything forbes does these days is hot garbage), is that vehicles which are heavier do damage quartically proportional to their weight - https://en.wikipedia.org/wiki/Fourth_power_law

So the ever increasing weight of cars, trucks, SUVs, and especially semi-trucks is also responsible for our roads being shit, full of potholes, and expensive to fix.
by PseudoComputer | 2025-10-14 16:49:16+00:00
Hey guys!

We built a site called LuxPDF.com as an Open-Sourced, Free, Private alternative to FreeConvert/ILovePDF/PDFCandy. We offer almost 30 tools, all free, all completely private and open sourced.

We literally built this because one day I was helping my dads with FAFSA papers, and he didnt know how to convert his iPhone images (.HEIC) to PDF files. When he sent them to me I realized I couldn't trust any of these file converter websites with such sensitive files. They were all closed-sourced, paid, had ads written all over it, required logins, and some even stored the images on their servers. So I called a friend and we got to work, and built LuxPDF.com as a way to help students, small businesses, freelancers etc, to securely and freely convert and do basic PDF modifications.

The website is completely free with no logins/signups etc, we only make money through donations (BuyMeACoffee), and maybe sponsorships from bigger companies in the future (not as ads, but as a logo image with a link under the "Support Us" tab).

We really hope you enjoy it. We changed a lot over the past month, adding new tools, a different UI/color scheme to feel more professional, and more :)
by weavejester | 2025-10-14 16:49:27+00:00
>> You just go along with what the majority of society considers to be moral?

> As pertains to the law. Yes!

I'm interested in where you draw the line.

For instance, suppose a doctor is treating an underage rape victim whose pregnancy would put their life in danger, but the doctor practices in a state that outlaws abortion. The doctor decides to prescribe abortion pills anyway, breaking the law but following their oath to do no harm. Do you believe the doctor acted morally or immorally in this case?

To be clear, this isn't me attempting to catch you out - I'm just trying to understand what you personally believe. Are there any instances where you would agree that breaking the law is the right thing to do?

I'm also curious how you view changes to beliefs over time. Was it moral in 1950 to discriminate based on race and sex, because that was the majority opinion at the time? Or is it only today's majority opinion that matters? And if so, what happens in the future when the opinions of the majority shift further?

> No it isn't. All religions attempt to align society on a singular "higher" shared morality provided by the church, which throughout history represented their state and their justice system too.

Christians, Jews and Muslims would say that God is the highest moral authority. That's core to their faith.

How much society influences their interpretation of God's word is up for debate, but their belief is that morality does not stem from majority opinion; it stems from the word of God.

> I didn't say corrupt. But violent, yes. Unarmed protesters aren't breaking any laws.

Unarmed protesters certainly can break laws! You don't need a weapon to block off a highway, break into a building, or deface a wall with graffiti.

But if the police aren't corrupt, then why do you suggest that they're likely to shoot? Because they're stupid or under-trained?

> The law is the closest thing to a moral agreement of the majority. You're acting against that agreement when you break the law. Any amount of force used by police to protect that moral agreement becomes easy to justify in court. How many cops are sitting in jail? It's not a big number. That should tell you all you need to know.

Sure; it tells me that the law is unjust when it comes to punishing police officers who commit crimes.

> No individual agrees with all laws. But society must agree with that near moral agreement known as the law. It's the best we have.

I don't disagree that society needs laws to function, but there are also many laws that are unjust, and they won't change without societal pressure.

Obviously the safest way to change laws is through legal protest and democratic reform, but that isn't always the most effective way. Breaking the law is a good way to make headlines and spread awareness.

Another issue with democratic reform is that democracies are not all equally representative. A system like the USA is less representative than, say, Switzerland. In other words, its more difficult in the US to change laws than in some other democracies, even if the majority agree the law should be changed.
by e40 | 2025-10-14 16:49:34+00:00
The controlled burn in 1991 turned into the firestorm of 1991 that took out almost 3,000 homes and killed 25.

It seems firefighters are not conservative enough when it comes to putting out fires, at least in these 2 cases.

https://en.wikipedia.org/wiki/Oakland_firestorm_of_1991
by ndriscoll | 2025-10-14 16:49:47+00:00
> AWS takes that away and makes you focus on the product. Issues arising from AWS only requires you talking to support.

Not my experience at all. e.g. NLBs don't support ICMP which has broken some clients of the application I work on. When we tried to turn on preserve-client-ip so we could get past the ephemeral port limit, it started causing issues with MSS negotiation, breaking some small fraction of clients. This stuff is insanely hard to debug because you can't get onto the loadbalancer to do packet captures (nor can AWS support). Loadbalancing for long-lived connections works poorly.

Lambda runs into performance issues immediately for a web application server because it's just an entirely broken architecture for that use-case (it's basically the exact opposite of user-mode threads to scale: let's use an entire VM per request!). For some reason they encourage people to do it anyway. Lord help you if you have someone with some political capital in your org that wants to push for that.

RDS also runs into performance issues the moment you actually have some traffic. A baremetal server is orders of magnitude more capable.

ipv6 support is still randomly full of gaps (or has only very recently been fixed, except you might have to do things like recreate your production EKS cluster, oops) which leads to random problems that you have to architect around. Taken with NAT gateway being absurdly expensive, you end up having to invert sensible architectures or go through extra proxy layers that just complicate things.

AWS takes basic skills around how to build/maintain backend systems and makes half of your knowledge useless/impossible to apply, instead upgrading all of your simple tuning tasks into architectural design problems. The summary of my last few years has basically been working around problems that almost entirely originate from trying to move software into EKS and dealing with random constraints that would take minutes to fix baremetal.
Show HN: I made a Frame.io alternative for teams tired of per-seat pricing
by alextahanchin | 2025-10-14 16:49:49+00:00
Hey HN! I built KROCK.io, a video collaboration tool made for animation and video production teams.

I used to run an animation studio where managing Frame.io seats was a nightmare: constantly adding/removing freelancers, limiting client access, and watching per-user costs pile up.

KROCK.io fixes that. It’s built around one simple idea: unlimited seats, unlimited projects. Pay for storage and features, not for people.

You can comment on frames, track versions, set approvals, and collaborate not just on file sharing, but through the entire production workflow.

Highlights:

- Unlimited team & client seats

- Frame-accurate comments and markup

- Approval workflows made for animation and creativagencies

- Version control for every stage

- Cloud-based and fast worldwide

Would love feedback from folks in animation, motion graphics, or video production.

Try free plan → https://krock.io
by Dylan16807 | 2025-10-14 16:49:59+00:00
> That article is being disingenuous and wrong. It's comparing the lightest possible Civic configuration with the heaviest possible Accord of a different body type.

Good to know.

> So yes, the Civic compared to an older car of similar size did get heavier.

If the minimum is 1% heavier and the maximum is 2% lighter then I would not say "did get heavier".
by fosco | 2025-10-14 16:50:14+00:00
I was hoping that was case but the problem is the message id of the email appears as if google generated it from mx.google.com

Perhaps I don’t know enough here? This would not be the first time a google account was stolen and I’d like to protect what I have, despite having repeatedly tried and having facility members with threads and emails as proof google offered zero help to resolve or even close the account from the their so senders would at least be notified I didn’t get it
by nradov | 2025-10-14 16:50:42+00:00
China has had major internal violent conflicts many times: in 1967, 1960, 1937, 1916, 1856, and so on. Another civil war probably isn't imminent but based on historical patterns it's entirely possible in our lifetimes. There could be an external shock in terms of a severe disruption in food or energy imports, or an internal power struggle between CCP factions. Xi Jinping isn't immortal and no one can predict what might happen when he leaves power.
by surgical_fire | 2025-10-14 16:50:54+00:00
Because I think social media is inherently evil, and by creating and account (even a dummy one as you described) I would still be feeding a beast that I would rather see dead.

It does help with self control - I intentionally hamstring my ability to see Instagram (and other social media) content by following a slightly cumbersome procedure on Telegram that also makes it impossible for me to search or view any related content. But that is a second-order benefit.
by HeyLaughingBoy | 2025-10-14 16:51:16+00:00
Something newer. The reason that 50-year-old machine tools are still around isn't that they can't be replaced. It's that there's often no reason to.

To use OP as an example, in a lot of places, you'll find an ancient milling machine or a lathe that's dedicated to running a single job a few times a year. The machine was depreciated decades ago, but it can still do that job and there's no reason to get rid of it.

What modern tools give you is speed and flexibility. Many shops need neither.
by stego-tech | 2025-10-14 16:51:49+00:00
A really good post that captures the IT perspective of infrastructure change and modernization over my career. They also hit the nail on the head that one of today's problems is itself automation, where we've built tools that let us create sprawling estates with no accountability for cost other than an opaque monthly bill, though I'd also chip in that said automation is often restricted to whoever your chief cloud provider is (AWS, Azure, etc).

Where I find myself advocating today is very much a "rational check" on infrastructure, and curtailing accordingly. We have the tooling to ensure high availability, but does everything need to be HA? Do our SLAs for enterprise tooling really need five-nines of availability, or can we knock some applications down to a limited schedule? Does dev/test need to be live 24/7, or can we power it off when not in use? Why are we only focusing on availability and not scalability? The list goes on, but they're also not popular in enterprises with entrenched politics, which admittedly is where I find myself struggling against the current. If my social chops were better, I suspect I'd thrive in consultancy doing just that.

All that being said, I do like containers that are done right (properly documented, secure-by-default, ready for scaling), and I continue driving more applications towards containerization in the enterprise where possible. They're the right solution for ~60-80% of enterprise use cases, with the difficulty being getting vendors on board with the idea that their software won't have a dedicated VM or hardware anymore (which everyone fiercely resists, because container-based licensing can be a PITA to them). For the rest, VMs are more than fine, and we have a growing number of ways for both to exist peacefully in the same environment. As this area of technology matures (along with "backporting" from hyperscalers to private cloud again) further, I'm really looking forward to managing global estates in smaller teams for bigger firms - things that VMs, Containers, and Infrastructure-as-Code allow.
by meekins | 2025-10-14 16:52:22+00:00
The 4.x series was the one where the ideas still making Plasma so powerful were seeded. While I loved KDE 3 the design for 4 seemed revolutionary. Too bad it was alpha/beta quality up until the 4.6 release years later. I fared through all the bugs, crashes and performance issues with a young student's determination (while running Fluxbox on the side) but I can very well understand people doing serious work had limited patience for the issues.

Anyhow, happy anniversary from a long-time KDE user!
by indymike | 2025-10-14 16:52:53+00:00
KDE has been my daily driver since 2008. The upgrade from KDE2 to KDE3 was a nightmare, but once the dust settled, KDE became quite good... One of my favorite things about KDE is how they have left the user a wide berth to customize their experience. After almost 20 years of tweaking, I find moving to other desktop GUIs to be very painful. And to this day Dolphin is the gold standard for file managers.

Thanks, KDE team!
Show HN: Get a PMF score for your website, based on simulated user data
by jtewright | 2025-10-14 16:53:11+00:00
Hey HN,

This B2B PMF Scorer takes a website URL and generates a PMF analysis with a score /100, specific recommendations, and simulated user research findings.

Note: it takes ~5 minutes to run! Sample: https://semilattice.ai/pmf-report-1760452680406.pdf

It's a demo of what you can do with Semilattice (simulated user research), but we hope it's useful in itself.

It parses the marketing messages from the website to match one of our audience models, then uses that model to predict 12 PMF-related research questions around the product, the messaging, and the audience generally. With that simulated data, it generates the PDF (markdown available too.)

About Semilattice: we're building user insights as infrastructure. Our API can predict how specific target audiences answer arbitrary questions, i.e. near-instant surveys. We build audience models using real ground truth data and have eval tools so there's always an estimated accuracy (currently >87% on average). Docs here: https://docs.semilattice.ai

We want to be the API layer better decisions and more personalised UX/content. Reach out if you’d like to build with us.
by kinto | 2025-10-14 16:53:22+00:00
Hey, Pyrefly developer here, thanks for trying us out!

We're dedicated to providing a great IDE experience, though it does take some time. Please bother us on github / our discord if you have features you want - bug reports / community asks are our biggest priority.

- auto import is implemented in Pyrefly: it uses your pyrefly.toml project structure or falls back to your VSCode workspace (up to the first 2500 files). we're happy to fix it for your situation if you want to provide a reproduction

- signature/doc when selecting autocomplete options is a known bug [here](https://github.com/facebook/pyrefly/issues/1090)

- go to declaration: I've created an issue for that [here](https://github.com/facebook/pyrefly/issues/1291), it should be quick.

- speed: by far the biggest issue. your problem is likely related to [this](https://github.com/facebook/pyrefly/issues/360) but we need more information to speed it up. we're happy to work with you to to improve this if you're willing to provide a project structure
by Andrex | 2025-10-14 16:53:31+00:00
> It's really hard to describe why it's inevitable (there are a lot of factors).

I think there's a lot of small factors, but of those the biggest on (IMO) is the fallacy that throwing people at a problem gets it done faster. For some situations: yes, for all situations: no. And you need experience or some kind of sharp intuition to know when to expand and when not to expand.

Add more and more people to a job and they'll find ways to justify their value at the expense of efficiency. And there's a snowball effect from there as an org adds people who believe adding people is always good.

Then the corpo runs into layoffs and everyone throws their hands up and says "How could we have avoided this?" By not overhiring in the first place.

(All IMO naturally.)
by jazzejeff1 | 2025-10-14 16:54:15+00:00
I suspect enforcement will come in two major forms: 1) Valid enforcement against popular software that has real, demonstrated risk (ahem…ROBLOX, YouTube), and they will fight 2) Lawfare against smaller services that might represent a competitive risk and who may be a target for those in camp #1

I would never suggest that we ignore the law. I would suggest, however, that my vibe-coded tool that lets people track time and create invoices does not need to gather the age of anyone.

Common sense should be an emergent property of this new systemic regulation, and we should all aim for that.
by Ajedi32 | 2025-10-14 16:55:00+00:00
MPIC is good but not foolproof if the website itself is being MITMd. DNSSEC validation is better but not required, as you said, and even if it were HTTP-01 would just immediately become the new weak point.

I think you're wrong about DANE's flaws applying to "any similar protocol". The ossification problem could be solved by DNS over HTTPS cutting out the middle boxes, though I agree adoption of that will take time; much as adoption of HTTPS itself has. The game theory problem has been solved by CT; as you noted. You just need to subject certificates issued through the new system to the same process.

Remember that any actor capable of siezing control of DNS can already compromise the existing PKI by fulfilling DNS-01 challenges. You're not going to be able to solve that problem without completely replacing DNS with a self-sovereign system similar to Namecoin, though I can't imagine that happening anytime soon.
by bigyabai | 2025-10-14 16:55:01+00:00
I guess I should defend my point! I actually really like Hyprland (despite it's controversy) and really have no interest in re-hashing DHH's ragebait. My larger point is that we've seen this happen before, hundreds of times, and these distros always end up breaking and making people blame Linux instead of their maintainer. I don't think DHH is addressing this concern, and he's basically teeing-up a catastrophic system update with zero rollbacks by choosing Arch as the base systen.

If you search the web for "Manjaro broken update" or "LARBS error" you're just flooded with myriad tech issues that don't exist on normal systems. It's a genuine handicap to rely on someone else's opinionated dotfiles when you don't understand why they made each decision. I think people using Omarchy long-term will end up fighting the distro more than they fight Linux.
by jkaplowitz | 2025-10-14 16:55:18+00:00
Or at least you have to automatically destroy and recreate all nodes / VMs / similar every N days, so that nobody can pretend that any truly unavoidable hand-edits during emergency situations will persist. Possibly also control access to the ability to do hand edits behind a break-glass feature that also notifies executives or schedules a postmortem meeting about why it was necessary to do that.