MurphyA/hacker-news huggingface dataset:
by noirscape | 2025-10-14 14:34:18+00:00
In general a lot of the modern HTTPS approach "feels" broken. Looking at it purely from a usability perspective, HTTPS combines two things when it really should only be doing one of them:

* Encryption is the first thing HTTPS does and the one I'd argue that actually matters the most. It prevents your ISP or other middle parties from snooping or modifying what packets end up being shown to the end user. This is something that fundamentally doesn't require a CA to work. A self signed certificate is just as secure as one issued by a certificate authority on the matter of encryption; you just run an openssl command and you have a certificate, no CA needed (although a CA could still be useful for ie. Trusting updated certificates in the same chain, there's little reason to demand this to be done through a third party from a security perspective.)

* The second one is identification. Basically, the certificate is meant to give the idea that the site you're visiting is trusted and verified to belong to somebody. This is what CAs provided... except in practice, CA identification guarantees basically doesn't exist anymore. Finding the entity a certificate is issued to is hard to do in modern browsers, ever since a security researcher proved that it's relatively trivial to do a name collision attack, so browser developers (aka Chrome and Mozilla) hide it behind click through windows and don't show them anymore by default. Since browsers mandate HTTPS for as many APIs as they can get away with, everyone including garden variety scammers just gets an HTTPS certificate, which utterly defeats the entire purpose. CAs are essentially sitting in the middle and unless a third party suddenly demands you get an OV/EV certificate, the argument to not just use the CA that gives literally anyone who asks a certificate after the barest minimum effort to prove they own a domain is pretty questionable. Your bank might use an OV/EV certificate, but your average person seeing the bank website will not visually see any difference between that and a scam site. Both got perfectly legitimate certificates; one just got them from LetsEncrypt instead, where they had to give no details on the certificate. Only nerds look at the difference when visiting sites, and more people than nerds use banks.

Since identification is utterly dead, the entire CA structure feels like it gives little security to a modern browser as opposed to just going with a TOFU scheme like we do for SSH. Functionally, a CA ran by a sysadmin has the exact same guarantee as a CA ran by LetsEncrypt on the open internet for encryption purposes, except LE gets to be in browser and OS root programs. They might as well have the same security standards once you bring in CAA records.

Final note: there's something backwards about how a plain HTTP connection just gets a small label in the browser to complain about it, while a HTTPS certificate that's a single minute out of date will lead to giant full screen red pages that you have to click through. For consistency, the HTTP page should be getting the same scare pages from an encryption perspective, but they don't.
by teekert | 2025-10-14 14:34:25+00:00
This Dutch article also adds a lot more context, what the Dutch government did starts to make more and more sense and would for sure be something the Chinese would have intervened in if the situation were reversed. [0]

Update: Looks like China has retaliated: [1]

[0] https://tweakers.net/nieuws/240304/nexperia-ceo-bevoordeelde...

[1] https://nos.nl/artikel/2586411-china-legt-chipfabrikant-nexp...
by macNchz | 2025-10-14 14:34:54+00:00
Working on various teams operating on infrastructure that ranged from a rack in the back of the office, a few beefy servers in a colo, a fleet of Chef-managed VMs, GKE, ECS, and various PaaSes, what I've liked the most about the cloud and containerized workflows is that they wind up being a forcing function for reproducibility, at least to a degree.

While it's absolutely 100% possible to have a "big beefy server architecture" that's reasonably portable, reproducible, and documented, it takes discipline and policy to avoid the "there's a small issue preventing {something important}, I can fix it over SSH with this one-liner and totally document it/add it to the config management tooling later once we've finished with {something else important}" pattern, and once people have been doing that for a while it's a total nightmare to unwind down the line.

Sometimes I want to smash my face into my monitor the 37th time I push an update to some CI code and wait 5 minutes for it to error out, wishing I could just make that band-aid fix, but at the end of the day I can't forget to write down what I did, since it's in my Dockerfile or deploy.yaml or entrypoint.sh or Terraform or whatever.
by backwardsmoo | 2025-10-14 14:35:16+00:00
I had the absolute pleasure during my engineering undergraduate (Oxford) to take a biomedical module. One of my 'labs' was on nonlinear acoustics, specifically ultrasound applied for therapeutic uses. It was very captivating seeing a very focused point within a block of gel become ablated. A part I found particularly exciting was realising that it was a phased array of ultrasonic emitters, so that the point where the ablation occurred could in fact be placed anywhere you desired in the gel.

They showed us results of HIFU applied to real patients to non-invasively ablate tumours and treat prostate issues. As far as I can tell the probe creating the ultrasonic waves needs to be relatively close.

A thought I had at the time was if you knew all of the material properties of all of the tissues inside someone and their locations (say with an MRI) you could in theory apply this even deeper in someone than is currently possible - with a larger stick-on patch of actuators as a phased array.

Finally, another memorable thing that was discussed was what another researcher was doing with ultrasonics. Stride (who I am delighted to say was a fantastic lecturer) was very interested in bubbles. She would construct tiny bubbles where the surface (or interior?) was made of a chemotherapy drug. These bubbles could then be injected into someone's blood stream and would be ruptured using ultrasound to allow for extremely targeted application of chemotherapy (the jet formed from rupture would be so strong it would inject the drug into nearby tissue).

Fascinating, fascinating stuff but of course developed over many years of hard work.
by brightball | 2025-10-14 14:35:23+00:00
I don't know what the official name for the phenomena is where you widely experience a huge problem, the market reacts to fix the problem almost completely, people who never experienced the problem in the first place because the world before them solved it begin to complain about the solution, people defending the solution are mocked by people who have no context, the solution is rolled back and all the people who did it are happy with their win for a brief moment in time, then the original problem comes back in force but all of the walls put up to tear down the original solution make it 1000x harder to fix.

I feel like there needs to be a name for this. For now, "Those who do not learn from history are doomed to repeat it." is the most apt I think.

Happens constantly when you're essentially born on 3rd base. Maybe that's the proper name. Born on 3rd Base Syndrome.
by jillesvangurp | 2025-10-14 14:35:40+00:00
Messing around with certificates is indeed a bit of dreary busywork that just is the way it is because nobody seems to be around anymore to fix things properly in terms of standards.

I agree with much of this article. IMHO certificates signed by a certificate certbot are only marginally more secure than a self signed certificate. Basically you can prove your domain is yours with a certificate ... by proving your domain is yours to let's encrypt via a DNS check. That sounds a bit recursive. At this point there is not a lot being checked or verified by signing authorities.

IMHO the current focus on shortening certificate validity periods just highlights how inadequate certificates are and helps exactly noone stay safe. This is 100% certified a website. With a domain. Owned by somebody random on the internet. That's all that the certificate guarantees.

Any scammer learned years ago how to get certificates for their scam domains. Short of blocking those domains faster than they pop up (good luck), there's no way to derive any more meaning from those certificates than "this is a website".

It would help for there to be more authorities. And also to have longer expiry periods. I don't need this busywork in my life whether it's worrying about automating, monitoring, etc. or just about paying off some gate keeper for some meaningless check + bureaucracy. Longer expiry enables more strict/expensive checks to happen and browsers should be checking specific certificates against blacklists. Rotating certificates frequently makes both those things less practical and devalues the whole notion of a certificate. Any scammer will just use the same services to get the same kind of certificates.

Also, the reason we can't rely on the DNS yet, is that there is still a lot of legacy software relying on non secure ways to talk to the DNS. And that being a bit of infrastructure that predates the whole notion of having certificates also means that the biggest risk is a lot of legacy insecure DNS infrastructure that is easy to spoof and can't be trusted. Anyone see a problem with that and how certificates are issued? Otherwise, we could just stick our public keys in there and self sign our own certificates. But secure DNS is a prerequisite.
by runako | 2025-10-14 14:35:54+00:00
Scale matters.

From TFA:

> pushed the company's market capitalization to $72.13 billion

This, on annual revenue of ~$19B.

Apple today is closing in on 2x that revenue every month now. Quarterly net profit exceeds annual revenue in 2006. The Apple Watch group is roughly half the size of the whole company in 2006.

At some point, it became clear that the business throws off vastly more cash than can be productively used in R&D (here I will note that Apple's recent profit gusher is already net of investments in things like the Titan car project, Vision, and all the other stuff they work on but never release).
by cmontella | 2025-10-14 14:35:56+00:00
I think it's the exact opposite -- LLMs have revealed the precise utility of programming languages. For decades the "English as programming language" has been the holy grail of language designers. From COBOL to SQL to AppleScript, it was the hope that one day we'll be able to program a computer just as easily as we can instruct a person.

Well LLMs finally offer that, and what they are proving is what programmers have known for decades -- natural language is a terrible way to specify a program to a computer. So what is happening in the LLM world is they are reinventing programming languages and software engineering. They're just calling it "prompt engineering" and "context engineering".

What this tell us is that natural languages are not only not sufficient for the task of programming, to make them sufficient you need to bring back all the properties you lost by ditching the programming language. Things like reliability, reproducibility, determinism, unambiguity are thrown away when you use an LLM, and context engineering / prompt engineering are ways of trying to get that back. They won't work well. What you really want is a programming language.
by bluGill | 2025-10-14 14:36:24+00:00
> Unions should do a better job of marketing to employers that they can supply a trained work force.

Unions need to quit their management is evil message as well. Unions can do good, but when they call all management evil and breed resentment I can't blame companies for not wanting unions around.

The above is US centrist - in other countries the Unions don't do this.
by thesmtsolver | 2025-10-14 14:36:29+00:00
Well, it is much worse elsewhere.

You should look at other countries where pay is much less and real estate is at similar levels of cost: from Europe, Canada, China, Australia and India.

Condos in Mumbai are priced similar to those in the major cities in the US.

https://www.reddit.com/r/mumbai/comments/zxsl8l/mumbai_real_...

And Mumbai is one of the more affordable cities globally.
by dunham | 2025-10-14 14:36:53+00:00
I remember the Sun monitors (21" I think) were about 80 lbs. I've read that part of that was a metal frame to hold all of the wires in front of the screen.

They were fun monitors - we had a lab full of them, they would degauss on startup, and the degausser would induct into the monitor next to it (and a little bit into the monitor after that).
by NoahZuniga | 2025-10-14 14:36:58+00:00
This is not true! CAB is a place where CAs and browsers agree on what the rules for CAs should be. Google, Mozilla, Microsoft and Apple all administrate their own root stores which individually decide what CAs are trusted on their platforms. Individual root stores decide on the rules for inclusion in their stores themselves, but these rules are essentially: You follow CAB rules + a few extra things. Mozilla for example requires (besides CAB rules) that whenever a CA becomes aware of an issue, they post a bug to bugzilla and get their shit together pretty quickly and keep mozilla up to date on what they're doing.
by jeroenhd | 2025-10-14 14:37:43+00:00
HTTPS is hardly required for websites. Web applications may restrict sensitive actions to HTTPS, but websites over HTTP still work fine.

I try to avoid them because they allow sketchy ISPs to inject ads and other weirdness into my browser, but normal browsers will still accept HTTP by default.

If you don't want people to know you're visiting EmbarrassingFetish.com, EmbarrassingFetish.com also needs to implement ECH (eSNI's replacement) and your browser must have it enabled, otherwise anyone can on the line can still sniff out what domain you're connecting to.

I don't think site authentication is practical, though. For some use cases it works (i.e. validating the origin before firing off a request to a U2F/FIDO2 authenticator), but for normal users, mybank.com and securemybank.com may as well be equivalent (and some shitty important services actually use fake sounding domains like that, like PayPal for instance). Unless you remember the country and state and town your bank is registered in, even EV certificates can't help you because there can be multiple companies with the name Apple Inc. that all deserve a certificate for their website.
by grepex | 2025-10-14 14:37:44+00:00
I understand what sideloading means, as I'm sure the rest of HN knows. But to the layman non-techie, it has indeed been marketed as a boogeyman.

Even in the Android developers blog post:

> We’ve seen how malicious actors hide behind anonymity to harm users by impersonating developers and using their brand image to create convincing fake apps. The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play.

The research paper that shows their methodology for discovering these results AHS not been published by Google, to my knowledge. Just a mere "trust me, bro".

Edit to include link to source: https://android-developers.googleblog.com/2025/08/elevating-...
by queenkjuul | 2025-10-14 14:38:00+00:00
Thompson is wrong, and saying anything to try and make things go away, which is extremely disappointing, but there's still no evidence of the protestors being violent. Nearly all charges against all protestors have been dropped in court, and the extent of "violent" charges are one count of "assault of an officer" because a geriatric air force vet allowed his arm to brush an agent.

Meanwhile ICE teargassed my block yesterday while my neighbors were doing nothing but standing on the corner filming.

I know who's being violent and it isn't protestors. Beyond that, even the ICE behavior at Broadview isn't especially extreme. The protestors are almost all senior citizens. Nobody is rioting, starting fires, assaulting officers. Do you have evidence of such in Portland? Because if you do you should show me.

Look, i asked you a simple question. "Is there evidence that parts of Portland are being burned to the ground, as the administration claims." The answer is very obviously no.

So between "the sitting president outright lying about the state of reality as an excuse to federalize the national guard and violate civil liberties" and "people who are peacefully going about their lives insisting they're simply going about their lives," I'm glad you've decided both are equally dishonest and similarly motivated.
by jesprenj | 2025-10-14 14:38:32+00:00
I agree that HTTPS is not needed in most cases but ACME challenge to obtain a LE cert can be done securely:

* domain has DNSSEC * domain has CAA records only allowing DNS challenge and disallowing insecure HTTP challenge

but if we rely on DNSSEC we can just use DANE/TLSA and don't need the mess of CA/PKI
by djoldman | 2025-10-14 14:38:37+00:00
I've often wondered about where the lines would be for a similar issue in the USA:

> CFIUS oversees transactions that might give foreign entities control of U.S. businesses. This includes mergers, acquisitions, or takeovers. It also reviews investments in critical technologies, infrastructure, sensitive data, and specific real estate deals. At CFIUS' recommendation, the President may suspend or prohibit transactions deemed threatening to U.S. national security.[0]

If a US company is blocked from being acquired, presumably the CFIUS considers the company to be "nationally strategic."

In an unlikely hypothetical, I'm curious what the US would try to do in this scenario:

1. US company A agrees to be acquired by foreign company B.

2. CFIUS recommends blocking the acquisition under nation security grounds and the US president executes the block.

3a. US company A threatens to shut down all operations if the block is not lifted.

3b. US company A immediately destroys all assets irrevocably in spite.

In 3a, my guess is that the US would cook up or find some legal scheme to take over the company.

In 3b, the US has no warning and the company succeeds in denying the US something the US considers a strategic asset, although to its demise.

It reminds me of the Invention Secrecy Act.

In a nation that holds private property to be more sacrosanct than most nations, it's super interesting when the the government forcibly takes property. Things like eminent domain never feel natural in the US.

[0] https://en.wikipedia.org/wiki/Committee_on_Foreign_Investmen...

[1] https://en.wikipedia.org/wiki/Invention_Secrecy_Act
by JohnFen | 2025-10-14 14:38:44+00:00
The charging situation is the #1 reason why I won't consider buying an EV. It's dismal. I can't charge at home, so would be entirely reliant on commercial charging stations -- which is, right at the start, a sacrifice because of the amount of time charging takes.

But if you disregard Musk's charging stations (which I do because I'm not going to willingly give a single dime to any Musk company), then the commercial charging situation is simply unworkable.
by wredcoll | 2025-10-14 14:38:47+00:00
> country who entered the country illegally

Why does the legality only matter when it applies to a minority we're demonizing?

Trump's current wife very famously entered the US illegally, not to mention the dozens of other crimes trump has publically committed recently.

People in these conversations very frequently bring up laws and legality but fail to recognize that laws only work when they apply to everyone equally.
by raw_anon_1111 | 2025-10-14 14:39:05+00:00
And this type of naïveté is why the left always loses. If the last election doesn’t wake people up nothing will. People want someone to represent them that hates the same people they hate. Who shares their grievances and punishes people who don’t look or think like them. That’s at least the case of 40%% of Americans who still support everything the current administration does.

This has always been “who we are” despite what Michelle Obama says.

Then people reply about “what about the other 60%”. If you have 10 friends and ask them what they want to eat for dinner and 6 say let’s get Mexican and the other 4 say let’s kill Bob and eat him. You still need to be concerned about your friend group.
by itsnowandnever | 2025-10-14 14:39:10+00:00
but it is strange that people have bought into the Sam Altman AGI marketing so much that this moderately useful but (in my opinion) not revolutionary tech we're calling AI is so controversial. it'll all good and well to talk about pros and cons of industry initiatives but we've gotten to a stage of hyperbolic paranoia right now that's coming from this, in my opinion, duality of anti-tech broader society contrasting with the carpetbagger AGI hype
by jcgrillo | 2025-10-14 14:39:31+00:00
Agreed, but the root cause of the issue the emergency vehicle operator are noticing isn't sound deadening or infotainment gizmos, it's inattentive distracted drivers. Probably playing with their cell phones instead of driving. Similarly, in a manufacturing situation playing with your phone or watching tv is likely to cause problems. Inattention and inability to focus on the job is the problem. You can't solve that with technology, but you can with education.
by hedora | 2025-10-14 14:39:36+00:00
Also, instead of having a small team of people to fight scalable infrastructure configuration, you could put 1-2 full time engineers on performance engineering. They'd find big-O and constant factor problems way before they mattered in production.

Of course, those people's weekly status reports would always be "we spent all week tracking down a dumb mistake, wrote one line of code and solved a scaling problem we'd hit at 100x our current scale".

That's equivalent to waving a "fire me" flag at the bean counters and any borderline engineering managers.
by tombert | 2025-10-14 14:40:15+00:00
Ted Cruz said that Galileo was persecuted because he claimed that the earth isn’t flat, and used that as justification about denying climate change. This is a lie at best, but more likely just idiocy because he never paid attention in history classes.

I do not agree that Ted Cruz is smarter than nearly all of us.

I guess I just want politicians who can make the most basic logical inferences and do the most rudimentary reasoning, and importantly it would be great to have politicians who don’t think that they already know everything.
by ux266478 | 2025-10-14 14:40:27+00:00
It was not linear growth. The 70s and 80s were essentially write-offs. Things began to move in the mid-1990s and it has been a continual evolution and process over the last 30 years. Jiang Zemin, Hu Jintao and Xi Jinping's teams all did wildly different things for China. The vertical integration you mention was basically non-existent prior to 2020, it came about as part of the New Development Pattern (新发展格局) for the Inner Loop (国内双循环)

China today is virtually unrecognizable compared to even 10 years ago, though.
by names_are_hard | 2025-10-14 14:40:28+00:00
Can you explain how you reached that conclusion? If I'm reading the order book correctly, you'd need much more than 10k to remove all the opposing liquidity. And of course you can't assume that other participants will stand by idly, when you put in enough money to move the market away from what they believe is correct you might discover a lot more contra liquidity appears. So it might not stay where you want it for more than a moment.
by cruffle_duffle | 2025-10-14 14:40:31+00:00
Hah. I love the name. It implies that whatever the original “pyright” was doing wasn’t keepin’ it real. This new version, it’s “based” so it must be somehow more “real” and “grounded” and “legit”.

All I know is it is much more strict about stuff than pylance was.

Also a me problem!