MurphyA/hacker-news huggingface dataset:
by randycupertino | 2025-10-22 21:06:28+00:00
The NYTimes article has some interesting additional details about this case:

https://www.nytimes.com/2025/10/22/technology/reddit-data-sc...

> Reddit said it had set a trap for Perplexity by creating a “test post” on its site that could “only be crawled by Google’s search engine and was not otherwise accessible anywhere on the internet.” Within hours, Perplexity search results had surfaced the content of that test post, the lawsuit said.
by goku12 | 2025-10-22 21:06:50+00:00
> I'd argue that you're actually safer with open source software since you can pick up and keep running it, but that's not a trivial undertaking.

I agree with that. It's just that I find it very annoying that these companies turn against the OSS (user) community after they've gained enough market share by taking advantage of the community's trust and network. This discussion thread itself is full of people calling the users 'entitled'. That's some level of gaslighting! The real question is, how much would these projects have succeeded if they had started under the same terms as the ones they've now switched to? If the answer is 'not very much', then that means the community added significant value to the product, which these companies are now refusing to share and running away with. These companies are the entitled ones, besides being deceptive and dishonest.

The case with MinIO is not as egregious as the others we have seen - elastic, for example. MinIO is still under an open source license. But their decisions to let the community edition documentation rot and to remove the web ui make it very clear that they're trying to make the community edition as unviable as possible without having to take the heat for going all out proprietary or source available. Does this tactic seem familiar? This exactly what Google does with AOSP. Slowly remove and replace its OSS parts with proprietary software and gradually kill the project. Again, it's deceptive, dishonest and distasteful.

Both free software and open source software have a tradition of not excluding anybody from participating in the process, community and contributions. But looking at how much certain companies damage the trust and fracture the community for some extra profit, it might be a good idea to start asking if they should even be given the opportunity to do so.
by roman_soldier | 2025-10-22 21:07:17+00:00
If I had a dollar for every Elon/Tesla hater that said "This is their last profitable quarter..." I would be very rich. Yet they keep adding billions to their cash pile, another $4B this quarter to take the total to $40B+, double where is was a few years ago, they are literally a cash printing machine. And this is all before autonomy and robotics.
Show HN: Mazinger – AI that tries to break into your web app
by solosquad | 2025-10-22 21:07:33+00:00
I built Mazinger - an AI that actually hacks websites (with your permission, obviously).

Instead of just scanning and reporting "you might have SQLi here", it: • Finds the SQLi • Explains the vulnerability • Asks: "Want me to exploit it?" • Dumps the database • Shows you exactly what data was leaked • Writes a professional PDF report It runs real attacks using nmap, sqlmap, gobuster, XSS tools, etc. Talks like a pentester: "Found SQLi in login form. Classic mistake. We can dump the entire database with this."
by sebastiennight | 2025-10-22 21:07:37+00:00
> Who said continuity mattered? How would a copy or original know which they were? Does it even matter?

Continuity matters because I do not care if this imaginary (digital or physically reconstructed) artifact you came up with sometime in the future lives in a simulation of (your understanding of) my real life or in Sim city.

This thing is not "me", and I was replying to your assertion that

> Maybe it'll be eternal heaven - just gifted to us without reason or cause

This is not "us". This hypothetical is just a bunch of Sims characters running around in some virtual universe.
by CaptainOfCoit | 2025-10-22 21:07:38+00:00
Really happy to see it, after 25 years (https://www.bugcrowd.com/glossary/cross-site-scripting-xss/) of surviving without it. It always struck me as an obvious missing part of the DOM API, and I still don't know why it took this long time.

But mostly I'm just happy that it's finally here, I do appreciate all the hard work people been doing to get this live.
by nullc | 2025-10-22 21:08:33+00:00
A felon convicted of essentially same 'crime' his opponent in the prior election committed but was given a settlement and a fine instead.

Hilary Clinton funded the creation of the Steele dossier-- which was later shown to be generally false and unsupported-- but paid for it through one of her law firms and misclassified it as legal expenses in an effort to conceal its origins.

Trump was criminally charged with falsification of business records because he paid Stormy Daniels hush money (to get her to deny her earlier claim that they had an affair) via his lawyer, and classified it as legal expenses. A visible hush money payment would have made it ineffective, just at the Steele dossier being known to be a campaigned paid hit piece would have made it ineffective.

There are plenty of things to ding Trump on, but I think if you're trying to persuade someone that the legal system wasn't weaponized unfairly against him this is a particularly poor example.

Even an argument that the facts make him worse here (e.g. maybe you say concealing an accusation of an affair says more about his integrity than paying for a false report says about hers)-- wouldn't change that this is just not a good example.

Particularly because there was nothing unlawful about the hush money payment itself-- the crime was an obscure accounting violation resulting from it... and in any other circumstance nothing would happen at all or at most, as seen with Clinton, a nominal fine would result. Sure, it's true that random details (like what state the acts in) will often decide if an act is technically illegal or not, but that's hardly an argument for the fairness of the justice system or that it was fairly applied to him.

I don't even hope to convince you of this-- but only to convince you that your example is unlikely to convince others, and is easily exploited to wrongfully convince people opposite your intentions.
by constantcrying | 2025-10-22 21:08:45+00:00
The championing of a supposed openness, together with a radical culture of denouncing people with opinions not more extrem then the average American as fascists, is just so bizarre.

Here in Germany a similar anti-fascist hacker culture exists, but those people do not pretend that they want any kind of culture of openness, which would extend beyond their political lines.
by jayd16 | 2025-10-22 21:08:58+00:00
> one app can emit a lighting effect that will shade the other's rendering

I always felt this was such an outrageous burden to developers. Its cute and all but really, who cares? I don't need one desktop window to emit light on another window. Is that really worth having to remake or modify every asset?

That said, all the work they did around laundering click and gaze information for privacy was nice to see.
by quantified | 2025-10-22 21:08:59+00:00
Pictures vs words. Both break down at sufficient scale. The software developed with GraphQL is far more limited than that which was modeled by UML. But UML couldn't really do better than be a caricature of actual programming languages, either.

Sequence diagrams and state charts have stood the test of time, and I can give you a picture of the relationships between 10 different classes on a whiteboard far faster in UML than GraphQL.
by jcims | 2025-10-22 21:09:05+00:00
I build a fully automated ‘hand sanitizer factory’ back in the summer of 2020 out of boredom and a feeling that it could actually be useful at some point. It doesn’t exactly rot but some of the challenges are similar.

I found a really nice modular architecture in esp32 flashed with tasmota for all of the sensors and switching, they would talk via MQTT over Wi-Fi to a raspberry pi running node-red. It was responsible for all of the data integration, flows, process automation and dashboards.

Just made it super easy to add/remove features without rewiring things and allowed me to replace the esp32’s very easily.
Show HN: I Made Quantify AI – Co-Pilot for Trading Charts Analysis
by alexii05 | 2025-10-22 21:09:12+00:00
I built Quantify AI, a no-code SaaS that analyzes trading chart screenshots using GPT-based vision models.

You upload a chart — it returns patterns, trend interpretations, and potential trade scenarios. I’m a designer who got laid off 50 days ago and decided to learn how to build tools instead of just designing them.

100 hours later, Quantify AI was live. It’s not meant to replace analysts, but to assist traders in understanding market data visually and contextually.
by bitwize | 2025-10-22 21:10:04+00:00
I was thinking, it'll probably catch on like Omarchy did, except it's written in Rust, so... little chance of it being milkshake-ducked.

But as we say on Hackernews, there are two kinds of people with respect to jj: those who love it, and those who haven't tried it.

Doing the same thing, but with better usability, is immensely valuable. Remember, Hackernews thought Dropbox was "just" ssh+rsync, but they made a billion dollars making that easy.
by alexii05 | 2025-10-22 21:10:43+00:00
Hi HN, Alex here

This is my first time posting on HN. I built Quantify AI after being laid off — it’s a mix of design, AI, and trading curiosity.

I’d really appreciate feedback on: -Whether the results feel accurate or useful -How clear the UX and output are -What kind of traders (beginner, pro, algo) you think would benefit most

I’m here to learn — and improve it based on your feedback. Thanks for reading!
by collinmanderson | 2025-10-22 21:10:57+00:00
Yes, that's pretty typical. I think there's a general assumption if you're using older python you'll probably stick to Django LTS 5.2 from this April which still supports Python 3.10.

They only drop python versions right after LTS (which is part of why they increase the major version at that point). https://docs.djangoproject.com/en/dev/faq/install/#what-pyth...

Also Django LTS 5.2 is supported a year longer than Ubuntu 22.04. (April 2028 vs April 2027)
by andrewaylett | 2025-10-22 21:11:16+00:00
Changesets, the op log, first class conflicts, no staging area.

JJ might produce commits that can be stored in Git, but the affordances are different. If Git wants to adopt them, it becomes no longer Git.

On the other hand, I'm happily using JJ while everyone I collaborate with is using Git. JJ doesn't need to "win" to be useful, it just needs to be useful enough that the people who maintain it continue to maintain it.
by NoboruWataya | 2025-10-22 21:13:24+00:00
> They are robust, widely adopted, and battle-tested. Yet, their XML-based design is notoriously verbose, inconsistent, and difficult to implement correctly. Information is scattered across HTTP headers, XML payloads, and even embedded iCalendar data, creating endless compatibility and interoperability challenges between clients and servers.

Can others confirm if these problems are widespread? I get that these protocols are probably a pain to develop for but given they are "robust, widely adopted and battle-tested" it seems that is probably a solved problem. It's better to have one standard that is used everywhere than to have to choose between two standards.
by moralestapia | 2025-10-22 21:13:49+00:00
>The penalties for violating Canada’s anti money-laundering laws come ten months after KrebsOnSecurity noted that Cryptomus’s Vancouver street address was home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges — none of which were physically located there.

If I was Brian (Krebs) I would greatly increase my own personal security after this. I'm absolutely not expecting something to happen to him but $176M is no joke and these guys not particularly lawful.
by debugnik | 2025-10-22 21:14:02+00:00
> uses the correct expression "code point"

Actually no, these are Unicode scalars, not code points; they exclude the surrogate category.

I agree that rune is a very poor name for it. It both mistakes what runes actually are and clashes with the runic block. But C# has adopted the Rune name for some reason.

Rust simply calls these char, and OCaml uchar (unicode char), which are much better choices.
by AnthonyMouse | 2025-10-22 21:14:22+00:00
> This is a fiction and just an excuse conservative justices use to make conservative rulings when they don't like a law.

Isn't this the other way around? If you cite "the spirit of the law" then you're ignoring the text in order to do whatever you want.

Finding a "conservative" judge who does the latter is evidence that the particular judge is hypocrite rather than any argument that ignoring what the law actually says is the right thing to do.

But you also picked kind of a bad example, because that wasn't a case about how to interpret the law, it was about whether the law was unconstitutional.
by heavyset_go | 2025-10-22 21:14:42+00:00
It's one tiny binary that does everything you could possibly need for hosting a mail server, including an admin UI, and you get a bunch of modern and convenient features for free.

For example, it automatically handles Let's Encrypt certs for you. You get JMAP, CalDAV, WebDAV, CardDAV, IMAP4rev2, DKIM/SPF/DMARC, MTA-STS, DANE, spam filtering, SQL+blob+object storage backends, search, clustering, OpenTelemetry, etc all in one tiny binary.

Downsides: some features are gated behind an enterprise version and I think the dev team is one guy, or at least it was a while ago.

Having ran both for a long time, I'm sticking with Stalwart from now on as long as development continues.
by ThrowMeAway1618 | 2025-10-22 21:15:34+00:00
>But science is about questions demanding proof and rigor, verification, reproducible results. It's not about blindly saying "Yeah my questioning makes a bunch of unsupported claims equally valid".

Asimov's take[0] on stuff like this is just as relevant as ever:

“Anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that 'my ignorance is just as good as your knowledge.'” ― Isaac Asimov

Although it seems to concisely describe more and more (and far too much, IMHO) of our public discourse these days. And more's the pity.

[0] https://www.goodreads.com/quotes/84250-anti-intellectualism-...
by AshamedCaptain | 2025-10-22 21:15:51+00:00
> Devices will come and go, but the OS will be the core that stays and grows and evolves over time.

Say that to my Google Cardboard SDK programs, or the Google VR SDK ones, or Google Daydream ones.

You couldn't have chosen a worse topic on which to dump a generic "ranting about Google abandoning projects is low effort cheap shot", because Google does abandon VR projects (including OSes and APIs, not just devices) every 5 years, almost like clockwork. What I would call "a cheap shot" is to think that this new fancy "OS" will be any different. In fact, I pity the people who still consider jumping on this particular bus _again_.
by ishouldbework | 2025-10-22 21:16:09+00:00
> It then removes any HTML entities that aren't allowed by the sanitizer configuration, and further removes any XSS-unsafe elements or attributes — whether or not they are allowed by the sanitizer configuration.

Emphasis mine. I do not understand this design choice. If I explicitly allow `script` tag, why should it be stripped?

If the method was called setXSSSafeSubsetOfHTML sure I guess, but feels weird for setHTML to have impossible-to-override filter.
by impossiblefork | 2025-10-22 21:17:16+00:00
Yes, but the problems with processing human writing are huge, so even if this article is bad something like the problem they claim exists is very real. LLMs misunderstanding individual sentences, losing track of who said what etc. happen in best models, including GPT-5 when they're asked to analyze normal human-written discussions like those we have here.

Much of this is probably solvable, but it very much not solved.
by general1465 | 2025-10-22 21:17:21+00:00
Russia has nowhere to escalate, it can only start dropping nukes, but that will piss off China and India. Not because they would be so worried about Ukrainians, but because Russia would degrade nuclear weapons from strategic asset into a tactical weapons on level of Iskander.

And Russian war industry very much stands on Chinese dual use imports. Without them, their capacity to produce drones would be non existent - Shaheds are using parts from China, fiber spools are coming from China....
by svieira | 2025-10-22 21:17:37+00:00
It's not inherently self-contradictory for us to say "Jesus revealed Himself as the Son of God and the Son of Man ... how can we properly speak about that?" https://www.newadvent.org/summa/4002.htm#article2 - now that requires a lot of extra distinctions that we don't normally think about when thinking about being and essence, but it's certainly not impossible.

"Mr. Archibald Potterfarthing is at the same time the Chair of the Committee and at the same time its most senior ranking member". Accidents, naturally, but co-existing in the same space-of-being. It turns out that "person" and "nature" are distinct (who knew?) and that it is possible for there to be one person with two natures just as well as there can be one person with two titles. But that presumes you believe the authority of the one who told you this - if not, it's useless to talk about it, because why would you ever need to distinguish person and nature unless you had encountered the reality of Christ? Nothing else we have encountered in the universe has (as far as we are aware) two natures. But nothing else behaves like a singularity either - uniqueness is not a proof of non-existence.
by cormorant | 2025-10-22 21:18:07+00:00
Classically, spies are motivated by: money, ideology, coercion, or ego [1]. I wonder which it is. A Russian woman "marrying a target, having kids with a target — and conducting a lifelong collection operation" on an "aerospace company" in the "military-space innovation community".

I'd guess it has to be ego.

[1] https://www.cia.gov/resources/csi/static/9ccc45dc156271d1176...
by MangoToupe | 2025-10-22 21:18:15+00:00
> Reporter error is somewhat orthogonal to AI assistants' accuracy.

It is not at all. Journalists are wrong all the time, but you still treat news like record and not a sample. In fact I'd put money that AI mischaracterizes events at a LOWER rate than AI does: narratives shift over time, and journalists are more likely to succumb to this shift.
by heavyset_go | 2025-10-22 21:18:35+00:00
They make breaking changes to settings (and possibly data stores, but I forget) between versions, so to go from, for example, x.y.1 to x.z.5 might involve doing migrations between x.y.2 through x.z.5 just to use the latest version.

This is not the case for all versions, but I've found it to be common enough that I have to read all of the release notes between point versions when upgrading.

It can definitely be improved.
by wolrah | 2025-10-22 21:19:06+00:00
> Why bother logging them at all? What is this doing for you?

Logging both successful and failed requests is important for troubleshooting my systems, especially the client-facing ones (a subset of which are the only ones that are accessible to the open internet), and failed authentication attempts are just one sort of request failure. Sometimes those failures are legitimate client systems where someone misconfigured something, and the logs allow me to troubleshoot that after the fact. That it can also be fed to fail2ban to block attackers is just another benefit.

> You can't meaningfully characterize attacker traffic this way. They'll come from any AS they want to.

Obviously in a world full of botted computers, IoT devices, etc. it's true that an attacker can hypothetically come from anywhere, but in practice at least from the perspective of a small service provider I just don't see that happen. I'm aware that you are involved with much larger scale operations than I'm likely to ever touch so perhaps that's where our experiences differ. No one's targeting my services specifically, they're just scanning the internet for whatever's out there and occasionally happen to stumble upon one of my systems that needs to be accessible to wherever my clients happen to bring their devices.

Sure, I see random domestic residential ISP addresses get banned from individual servers from time to time, but I never see the organized attacks I see which are usually coming from small hosting providers half way around the world from my clients. I have on multiple occasions seen fail2ban fire off rapidly sequential IP addresses like xxx.xxx.xxx.1 followed by xxx.xxx.xxx.2 then xxx.xxx.xxx.3, or in other cases a series of semi-random addresses all in the same subnet, which then triggers my network block and magically they're stopped instead of just moving on to another network. If I were to be packet sniffing on the outside of the relevant firewall I'm sure I'd see another address in the blocked network trying to do its thing but I've never looked.
by dylan604 | 2025-10-22 21:19:18+00:00
Do you honestly feel that we will ever be in a place for the server to not need to sanitize data from the client? Really? I don't. Any suggestion to me of "not needing to sanitize data from client" will immediately have me thinking the person doing the suggesting is not very good at their job, really new, or trying to scam me.

There's no reason to not sanitize data from the client, yet every reason to sanitize it.
by naikrovek | 2025-10-22 21:19:28+00:00
I think even 50 years ago, that most people started businesses because they had a skill and could use it to help others meet their needs.

HP started (more than 50 years ago) with two friends who wanted to make better electronic test equipment. Profit was not forefront in their mind like it is to an MBA graduate today. Hewlett and Packard wanted to provide quality test equipment to people, because a lot of the test equipment of the day was subpar to them.

By the time the 80s rolled around, they paid 100% of an employee's college education (no matter how high they wanted to go with that) and paid them 75% of their salary while they were away at school. College was cheaper then, but zero employers today would even briefly consider paying people any amount at all to not be at work while also paying for the thing keeping them away from work.

corner stores in crowded neighborhoods are not started to maximize profit potential for shareholders. corner stores are started because someone saw the need for a corner store and wanted to make a living running it; they wanted that to be their job.

Until the invention of the MBA I don't think most people who started businesses did so purely for money. There are many easier ways to make money. Today people can start shitting mobile games with pay to win mechanics and they will be rich when the first one takes off. No one creates mobile games with pay to win mechanics because they want people to experience the joy of microtransactions.

Every business today (certainly every tech business) is designed to find out what people want via market research, pick the thing that looks the most profitable, then through a very well developed process, turn that business into a source of retirement money for the founder(s) and a source of return for the investors. It is literally a photocopy model of business creation. "Follow the process and you will succeed."

No one is opening shops today to help their neighbor. No one is opening new bakeries because their town needs one. No one is doing anything that one used to see people doing everywhere they went. Profit-driven motivation ruins everything it touches. Everything.

Everything is profit driven, now. Everything. The MBA is the most disasterous degree ever devised. It makes people think that starting a business purely to make money is a perfectly normal and healthy thing to do, and it simply isn't.