MurphyA/hacker-news huggingface dataset:
by thewebguyd | 2025-10-09 18:10:27+00:00
I'm of the opinion that most (not all) email phishing can be solved if we all just collectively admitted that HTML email was a mistake, and go back to text based only and enforce that everywhere.

No more logos, no more masked links (you have to acutally copy and paste the text, giving you a chance to review the URL), no more QR code phishing, no more realistic looking but fake DocuSigns. Get rid of attachments while we are at it, there are other, better ways to share files within an office environment (because ultimately, if we enforce text only, then all phishing would then arrive via attachment in the form of a PDF or rich word doc with the fake logos and a clickable link).
by motoboi | 2025-10-09 18:10:59+00:00
Maybe you can see this as more compelling evidence: https://consensus.app/search/does-ketonic-diet-improve-alzhe...

>Cognitive Effects and Clinical Outcomes > >Multiple systematic reviews and clinical trials report that ketogenic diets (KD) or ketone supplementation can lead to improvements in cognitive function, daily living activities, and quality of life in people with mild-to-moderate Alzheimer's disease 413141819. Chronic KD interventions (3–4 months) have been associated with increased cognitive test scores and improved memory performance 1418. Some studies also show positive changes in Alzheimer's biomarkers, such as reduced tau and increased amyloid-beta 42 in cerebrospinal fluid 7."
by OgsyedIE | 2025-10-09 18:11:14+00:00
I think it's because people no longer have the foundational belief that things ought to work. I read a long essay recently that agreed with my viewpoint that was written with far more literary effort than I muster for almost anything, so I'll link it:

https://aurelien2022.substack.com/p/the-cult-of-cant
by MentatOnMelange | 2025-10-09 18:12:00+00:00
Fascinating! It seems very far fetched to think this could lead to an ecosystem change, since deserts are very large and can't be covered in solar panels, and even a small layer of topsoil takes hundreds of years to build up.

I wonder if this could be a way to "halt" desert expansion though? Encroaching desertification is a real long-term problem in some places and while planting vegetation hasn't worked, maybe solar could!
Show HN: Non-intrusive compile_commands.json Extractor for Bazel
by Arech | 2025-10-09 18:12:30+00:00
Wanted to share a thing born out of my frustration from using hedronvision's compile-commands.json extractor for Bazel. I'm working on a medium sized Bazel project in my company, and the project doesn't have and will not have integration of a 3rd party unnecessary code into its build system. The intrusiveness required for hedronvision's extractor makes working with different checkouts a real pain, so I implemented a different approach based on supervising on what a bazel server is doing with strace. This works super well with my workloads, and is super convenient to use - basically prepend any build script eventually doing `bazel build` with prefix `yacce -- ` and run it. But due to strace use it has its own limitations: its Linux (strace) only and compilation must happen locally (so no RBE is supported). If that isn't a no-go for you, you might want to give it a try with `pip install yacce`. Source code and the docs are all on the github: https://github.com/Arech/yacce
by jasode | 2025-10-09 18:12:43+00:00
> - Part of the problem is just that a normal workflow is: receive email --> click on URL --> enter credentials into 3rd party website. ie, this is intentional and valid behavior for most white collar workers on a daily basis.

Here's a crazy history of that happening...

I had a friend who was an employee of a Fortune 100 corporation. Part of employee training was not to click on links in emails. In the 1990s and the rise of the internet, they had an internal security "red team" periodically send a fake phishing emails to employees. If the employee mistakenly clicked on a link in that email, the red team would send a notice to the employee's manager. It worked well because employees would not want to be embarrassed by a manager having to review the security policy with them to get their access back.

When she retired, all that training became useless and she was phished by a fake AT&T email. Why? Because with the rise of smartphones, every _legitimate_ company started sending emails that had useful tappable links. With the touchscreen, you can't hover your finger over the link to see what the underlying url is. People just normalize pressing on links in transactional emails as a convenient thing to do. E.g. Amazon sends an email with a link to the order status. A legit bank will send an email with a link for "Please review your security setting."

Smartphones reversed 15 years of not clicking on email links.
by gruez | 2025-10-09 18:13:20+00:00
>We really need to close large ccorporate tax dodges as well. [...] There's apparently plenty enough corporation money sloshing around to spend trillions on GPUs for AI in the US.

This does not follow. The figures for "trillions" come from estimates for what will be spent in the next few years, not amount actually spent. Moreover while tech companies have initially funded their AI investments from their cash piles, they're now tapping debt markets to fund that growth, so the fact they're spending "trillions" doesn't imply they're evading taxes.
by red-iron-pine | 2025-10-09 18:13:45+00:00
> Russia: starts a war to prevent it from having a much longer land border with NATO.

woefully reductive. Russia sees Ukraine and Slavic Orthodox populations as their dominion -- Ukraine was under the Tsar and the USSR, and it should be theirs again.

it would be like if the US has a minor collapse and Alaska gets independent, and later the US invades; "this was our state, has been our state, and everyone there speaks something like our language and religion"

this is also why Putin won't back down on it.
by hwagh511 | 2025-10-09 18:14:00+00:00
Location: MI (USA)

Remote: Open to remote and hybrid roles

Willing to relocate: Yes — fully willing to relocate to U.S. locations for onsite work

Technologies: Python, PyTorch, TensorFlow, Diffusion Models, CNNs, Vision Transformers, 2D-to-3D Reconstruction, Model Optimization, Quantization, Docker, FastAPI, AWS, MLflow, LangChain, Generative AI

Resume/CV: https://drive.google.com/file/d/1Kw-dz6iXjAXFNzbwWzSKEya3xCy...

Email: waghhimanshu@gmail.com
by mullingitover | 2025-10-09 18:14:00+00:00
The tariffs don't actually bring in money, they just move money from one place (US taxpayers, who'd otherwise use it productively) and put it elsewhere (the treasury).

Now normally this might be put to some sensible use, perhaps building infrastructure, but since this revenue is being used to offset huge tax cuts for a tiny group of people determined to turn around and use the capital for (let's be real here) speculation it's a net negative.

In the end we're going to look back at this chapter of 'Devil Take the Hindmost: A History of Financial Speculation' and say "Well obviously those idiots should've see that coming."
by svara | 2025-10-09 18:14:02+00:00
I believe I heard that argument since before jupyter became popular.

Usually it was accompanied by saying that the time needed to write code is often more important than the time it takes to run, which is also often true.

All that said, jupyter is probably part of python's success, although I'm not the only one who actively avoids it and views it as a bit of a code smell.
by benrutter | 2025-10-09 18:14:04+00:00
I am as confident as possible that it's not- a lot of the guests are fairly known figures in the open source world (Wes McKinney, Charlie Marsh, Ned Batchelder) and video footage of the podcasts are available.

The podcast has also been going for several years, before it would have been possible to generate audio podcasts with AI.
by jjtheblunt | 2025-10-09 18:14:05+00:00
Apple paid corporate tax rate of 24.1 % in 2024, which is higher than the corporate statutory rate.

In 2023 it was something like 16 %, with variations due to moving money across country boundaries if i read that correctly.

https://www.sec.gov/Archives/edgar/data/320193/0000320193240...
by sl-1 | 2025-10-09 18:14:09+00:00
Could you elaborate? Or link some source? I could quickly find this pointing towards them running their own servers https://github.com/orgs/community/discussions/27606

If the current state of GH availability is without Azure-induced additional unreliability, I truly fear what it will be on Azure

Edit: Found the discussion about this https://news.ycombinator.com/item?id=45517173
by jerf | 2025-10-09 18:14:17+00:00
If the Go compiler was twice as fast, I wouldn't really notice.

If the Go linker was twice as fast, that would be a minor convenience, sometimes.

I wouldn't expect much more that twice, maybe thrice at the very outside. And it'd be a long journey to get there with bugs and such to work through. The blow-your-socks-off improvements come from when you start with scripting languages. Go may be among the slower compiled languages, but it's still a compiled language with performance in the compiled-language class; there's not a factor of 10 or 20 sitting on the table.

But having another implementation could be useful on its own merits. I haven't heard much about gccgo lately, though the project [1] seems to be getting commits still. A highly-compatible Go compiler that also did a lot of compile-time optimizations, the sort of code that may be more fun and somewhat more safe to write in Rust (though I would perceive that the challenge of such code is for the optimizations themselves to be correct rather than the optimization process not crashing, and Rust's ability to help with that is marginal). The resulting compiler would be slower but might be able to create much faster executables.

[1]: https://github.com/golang/gofrontend
by anon291 | 2025-10-09 18:14:18+00:00
Oh please. Democrats opened the field to Republicans with their anti police rhetoric (and Republicans are now in the process of self destruction by being anti everyone but their preferred democratic). Polls show most people are pro police. I live in a liberal neighborhood of Portland and if you actually talked to Democrat voters, you'd know they actually want police.

Again, get offline. These extreme positions that have taken over both parties are the result of listening to twitter. Seriously that website is toxic. It causes fear and anxiety and governance by fear is terrible. Online democrats / left leaners seem to fear law enforcement. Meanwhile online Republicans / right leaners seem to fear everyone not exactly like them.

What ends up happening is that the political class ends up fielding candidates that are extreme since the online political class has disproportionate influence over that, and then normal people have to choose the best of two awful candidates.

No one can seriously say last election was a competition between America's best.
by thinkcontext | 2025-10-09 18:14:25+00:00
The only serious attempt I've seen to address US budget issues was the Simpson-Bowles Commission under Obama in 2010. It recommended a menu of tax increases and benefit reductions. It was promptly ignored by Congress which was not surprising. As an exercise it was useful just to demonstrate what a serious proposal would have to look like and the nature of compromise that would be needed.

Of course, in the 15 years since the fiscal situation has gotten worse, so any of the recommendations it made then would need to be more severe now.

https://en.wikipedia.org/wiki/National_Commission_on_Fiscal_...
by gus_massa | 2025-10-09 18:15:20+00:00
Usually technical post get more traction here. There is an old comment by dang that may help https://news.ycombinator.com/item?id=22336638

Also, an interesting blog post about an interesting problem you solved with your software or while building your software may be a good post. Let's suppose you meet an old technical friend, which anecdote would you tell?
by qrios | 2025-10-09 18:16:14+00:00
> They are SaaS and not consumer products. They have no side gig like amazon or google - they have a single product in a tight market.

Like Databricks with no consumer products, no side gig, single product, but 100 billion valuation[1]?

[1] https://www.forbes.com/sites/sasirekhasubramanian/2025/10/07...
by thewebguyd | 2025-10-09 18:16:20+00:00
> If somebody gets access to internal documentation, HR lists, etc,

It's hard to be resistant to phishing at that point and you have bigger problems.

What if Susan in HR falls victim to token theft (let's say conditional access/MDM policies don't catch it or aren't configured, which many businesses don't bother with). Her email account is now pwned, and the company gets an email from her, it passes all verification checks because it's actually from her account.

It's still phishing, but the users have no way to know that. They don't know Susan just got compromised and the email they got from her isn't real. If this is a human attacker and not just bots, they can really target the attack based on the info in her inbox/past emails and anything else she has access to.

So there's no way for the organization to be resistant at that point until IT/security can see thea account compromise and stop it. Ideally, it's real-time and there's an SOC ready to respond. In practice, most companies don't invest that much into security, or they are too small and don't have the budget for a huge security operation like that.

It's a really hard problem to solve
by aeon_ai | 2025-10-09 18:16:52+00:00
I didn't (and don't) believe that to be an exaggeration -- My confidence in that number may not be released sales reports, but I see a very clear pattern of people reporting buying Frameworks for the move to Omarchy (the server has also grown 5-10x in the last two months), and have seen the Framework team's reciprocal enthusiasm.

What's your estimate, if you think mine is exaggerated? 10? A material difference?
by mrsilencedogood | 2025-10-09 18:17:06+00:00
Yeah I really will give people a pass here. The state of email is one of the worst collective mistakes I think we've made.

You can literally be an expert in everything relevant - and your mail will still not get delivered just because you're not google/mailgun/etc.

I was trying to do a very simple email-to-self use-case. I was sending mail from my VPS (residential IP not even allowed at all) which was an IPv4 i'd had for literally 2+ years to exactly only myself - my personal gmail. I had it all set up - SPF, DKIM, TLS, etc etc. And I was STILL randomly getting emails sent directly to spam / showing up with the annoying ! icon (grates on my sensibilities). I ended up determining - after tremendous, tremendous pain in researching / debugging - that my DKIM sigs and SPF were all indeed perfect (I had been doubting myself until I realized I could just check what gmail thought about SPF/DKIM/etc. It all passed). And my only sin was just not being in the in-crowd.

Incredibly frustrating. The only winning move is not to play. I ended up just switching from emails-to-self to using a discord webhook to @ myself in my private discord server, so I get a push notification.

And this was just me, sending to myself! Low volume (0-2 emails per WEEK). Literally not even trying to actually send emails to other people.
by nomilk | 2025-10-09 18:17:16+00:00
Good advice about locking versions. I can literally see

uses: browser-actions/setup-chrome@latest

in my discarded yml file.

Regarding containers, nope, I know and love docker, but it's unnecessary complexity for a one person project. IME, projects that use docker move at half the pace of the projects that don't. (similar to Actions - lots of fun, feels like 'best practice', but velocity suffers - i.e. it steals time that should be spent talking to users and building).
by andrewmcwatters | 2025-10-09 18:17:43+00:00
Ethical and legal boundaries? RubyGems Privacy Notice already tells you that they share information with a number of large firms and notably ClickHouse... for "Customer Data Processing."

All this proposal does is request from one of the maintainers/on-call providers? another entry in this Privacy Notice as a part of a payment deal.

This is a mess, but it also unnecessary smears both sides. It calls out that RubyCentral had poor cloud management in place, and it trashes an on-call provider.

This is a terrible postmortem and all it does is advertise to users that RubyCentral doesn't know what it's doing.
by walkabout | 2025-10-09 18:17:54+00:00
Social security doesn't contribute to the general budget deficit. Its funding source is totally distinct. It doesn't and can't (under current laws) borrow to fund itself—if nothing changes, then as the fund runs low, payments will be reduced.

Mention of Social Security as a major driver of the budget deficit is a red flag you're reading something by someone who's ill-informed on the topic, or else they're deliberately bullshitting you.
by hatthew | 2025-10-09 18:17:57+00:00
It's harder than measuring CPU load, and depends a lot on context. For example, often 90% of a GPU's available flops are exclusively for low-precision matrix multiply-add operations. If you're doing full precision multiply-add operations at full speed, do you count that as 10% or 100% load? If you're doing lots of small operations and your warps are only 50% full, do you count that as 50% or 100% load? Unfortunately, there isn't really a shortcut to understanding how a GPU works and knowing how you're using it.
by ryandrake | 2025-10-09 18:18:09+00:00
r/Conservative is a very special case.

If you're at the point where you have been vetted and allowed to post on r/Conservative, you've gone way past mere "association." This isn't like some board game forum where you can just create an account and start posting. r/Conservative (probably with good reason) has a long and very active vetting process before you're allowed to post there, and only posts that conform to their ideology stay up. So getting banned for participating is a little more than just "guilt by association."
by alganet | 2025-10-09 18:18:11+00:00
The way I see it, world has too many GPUs, and they're too expensive, and it doesn't make sense by any measure.

It started with crypto, which inflated the value GPUs actually have. Now, LLMs are doing that. It's still the same thing, and I think it will transform again.

In a similar post in the past (3mo ago) I mentioned that this (ultra fancy GPUs) either evolves towards AR (augmented reality) or war (cyberwarfare), which are the most obvious next steps for "something-that-uses-fancy-GPUs".

Let's see some recent developments:

Apple dropping their AR glasses. This points towards a disinterest in augmented reality. It seems that's not a viable way to scale silicon supply chains.

Sora stays right in the middle of these two possibilities, being a proto-holodeck of some sorts ("hey, help create a new simulated world with you in the middle"), and also possibly a cyberwarfare platform ("hey, look, we could produce misinformation in levels previously unseen!").

It could be that these are not exactly organic market bubbles, but instead, stealthy cyberwarfare spending, dating back to the crypto days (possibly earlier!).

A burst, in this scenario, is just a way of moving money to these more shady goals without being too obvious about it.

In this scenario, the burst is also somehow a controlled burst. It means performance numbers are likely to be not that predictive of what happens.

I could also be wrong, but I don't think I am (it all circles back to silicon and geopolitical movements).
by emporas | 2025-10-09 18:18:26+00:00
The era of intelligent robots is the end of washing machines and many other specialized machines, even tractors.

Two kinds of machinery are needed.

One very basic and cheap robot to go around the neighborhood and gather clothes in some boxes, and transfer them in a designated room to wash them.

Two state of the art robotic hands mounted on the wall, and connected to AC (no batteries). The two arms are going to be controlled by computers even a whole rack of them, with many GPUs in them. The whole setup might use 10KW of energy, it will wash clothes by hand, it will be fast, dexterous and accurate. Expensive as well. In 3 minutes it will wash 100 t-shirts much better than the best human on the planet, or any other non-intelligent machine.

Then the small basic robot returns the clothes to the house.

Same with cooking. Same with many other things.
by tadfisher | 2025-10-09 18:18:46+00:00
Wordpress is just low-hanging fruit for attackers. Ideally the default behavior should be to expose /wp-admin on a completely separate network, behind a VPN, but no one does that, so you have to run fail2ban or similar to stop the flood of /wp-admin/admin.php requests in your logs, and deal with Wordpress CVEs and updates.

More ideal: don't run Wordpress. A static site doesn't execute code on your server and can't be used as an attack vector. They are also perfectly cacheable via your CDN of choice (Cloudflare, whatever).
by tracker1 | 2025-10-09 18:18:49+00:00
I like React a lot... but tbf, I never really quite agreed with the RSC push in general. I think most web-based apps are fine with client-render against an API/GraphQL/WebSocket backend. RSC is just a few steps too far in both Pure-Fucking-Magic (PFM) and rigidity in approach.

If there was a component library as complete as MUI for Yew/Dioxus/Leptos I'd have likely already switched to Rust/WASM.
by nerdjon | 2025-10-09 18:19:03+00:00
> In 2025 there's no reason for anyone to be logging into an AWS account via the root credentials and this should have been addressed in the preventative measures.

I am curious what preventative measures you expect in this situation? To my knowledge it is not actually possible to disable the root account. They also had it restricted to only 3 people with MFA which also seems pretty reasonable.

It is not unheard of that there could be a situation where your ability to login through normal means (like lets say it relies on Okta and Okta goes down) and you need to get into the account, root may be your only option in a disaster situation. Given this was specifically for oncall someone having that makes sense.

Not saying there were not failures because there clearly are, but there have been times I have had to use root when I had no other option to get into an account.
by AtlasBarfed | 2025-10-09 18:19:29+00:00
Increase of "supply" was met with "demand"

They didn't say in the abstract, but it's labor supply? So we are desperate for a class of near-homeless people to work drudge jobs that all of the immigration was sucked up in our economy?

Why was there a hypothesis of immigration == inflation in the first place? Is that some right wing policy meme for absolving tariffs from inflation?
by phoronixrly | 2025-10-09 18:19:32+00:00
So we have DHH with his unhinged posts on one side, and Arko wanting to sell PII on the other. Great!

I think we need an f-droid-like project for Rubygems that builds the gems from source, and takes care of signing, and is backed by a non-profit that is independent from Rails/Shopify
by rorroart-17 | 2025-10-09 18:19:34+00:00
Location: Chicago (USA)

Remote: Ideally no

Willing to relocate: Yes

Technologies: Python, Pytorch, Jax, Rust, Lean, Ocaml

Resume: https://drive.google.com/file/d/1X_Kmuee644SuKaXTQtPOuh6JRY5...

Email: rorroarturo@uchicago.edu
by vkoskiv | 2025-10-09 18:19:38+00:00
Thanks! I haven't, but I probably should, since you're the second person asking about it. The site is built with Zola[0], and it's using the Radion[1] theme, with small modifications.

[0]: https://www.getzola.org/ [1]: https://github.com/micahkepe/radion