MurphyA/hacker-news huggingface dataset:
Show HN: Meds – lock-free Golang firewall using NFQUEUE (net healing)
by cnaize | 2025-10-24 16:06:37+00:00
Hello there!

I’ve built Meds, a high-performance Linux firewall written in Golang, integrating with Netfilter NFQUEUE. It inspects inbound packets in user space and blocks malicious traffic in real time — completely lock-free and built for speed.

Key features:

- NFQUEUE-based packet interception

- Lock-free packet pipeline using atomic ops only

- Per-IP token bucket rate limiting

- TLS SNI & JA3 fingerprint filtering

- Blacklist/whitelist (FireHOL, Spamhaus, Abuse.ch, StevenBlack)

- Prometheus metrics ready

- HTTP API for runtime configuration (add/remove IPs/domains)

Repo: https://github.com/cnaize/meds

Any feedback is very welcome!
by dimal | 2025-10-24 16:06:49+00:00
I don’t think this is new. I haven’t upgraded and I’ve regularly gotten similarly incomprehensible typos for a while.

What the hell is going on inside Apple right now? They are printing money, they have thousands of employees, but basic functionality is utterly broken, yet they decide to expend effort on delightful bullshit like Liquid Glass that actively makes things worse.

This feels like the beginning of the end of Tim Cook’s era. Reminds me of Microsoft at the end of Ballmer’s reign.
by pbronez | 2025-10-24 16:06:53+00:00
Yeah. I went down the rabbit hole with ASCIIdoc several years ago. I was looking for a text-only way to write complex documents like contracts with lots of nested sections and internal references. Markdown wasn't enough. ASCIIdoc was a solid language, but the ecosystem was too weak to commit to.

I'm taking another run at this with Typst. I'm getting a lot further!
by cjbgkagh | 2025-10-24 16:07:07+00:00
Sounds like what I said, a form of narrative control. A charge I made of both appeals to hypocrisy and appeals to whataboutism.

My personal preference would be logical and factual discussions only but I accept that’s not the world we live in.

The deleterious effect of the additional layers is ameliorated by the nesting of information on HN, you don’t have to keep digging if you don’t want to.
by jampa | 2025-10-24 16:07:21+00:00
LLMs are architected to aim toward the center of the bell curve of their training data. You shouldn't expect them to produce innovative ideas, but the upside is they also won't produce terrible ones.

The same applies to design. Most of the time, you get something that "doesn't suck", which is perfectly fine for projects where using a designer isn't worth it, like internal corporate pages. But consumer-facing pages require nuance to understand the client and their branding (which clients often struggle to articulate themselves), and that's not something current models can capture.
by bnreed | 2025-10-24 16:07:47+00:00
Samsung were also the ones who demonstrated a fatal flaw in C2PA: device manufacturers are explicitly trusted in implementation.

C2PA requires trust that manufacturers would not be materially modifying the scene using convolutional neural networks to detect objects and add/remove details[1]

1) https://www.samsung.com/uk/support/mobile-devices/how-galaxy...
by helterskelter | 2025-10-24 16:07:51+00:00
If you're in America, take a look at the strobe on top of school busses. I'm not sure if they still have them (they used to). It would flash at a specific frequency and trip a photovoltaic sensor connected to the traffic light, which would turn it green so the kids aren't late for class. If you had a bright enough strobe which flashed at the same frequency...you get the idea.
by danudey | 2025-10-24 16:07:53+00:00
This is just "change is bad" FUD.

Working on macOS for years taught me that most people are going to write code that supports what they can test even if there's a better way that works across more systems. Heck, even using 'sed -i' breaks if you go from macOS to Linux or vice-versa but if you don't have a Mac you wouldn't know.

Meanwhile, this is a rewrite of `date` (and other coreutils) with the goal of being perfectly compatible with GNU coreutils (even using the coreutils test cases), which means that differences between the two are going to reduce, not expand.

What you're complaining about here is "people only test on one platform" and your solution is that everything should stay the same and never change, and we should have homogeneity across all platforms forever so that you don't have to deal with a shell script that doesn't work. The actual solution is for more people to become aware of these differences and why best practices exist.

Note that recently Ubuntu and Debian switched /bin/sh to dash instead of bash, which then resulted in a lot of people having to fix their /bin/sh scripts to remove bashisms which then improves things for everyone across all platforms. Now Ubuntu switches to uutils and we find they have a bug in `date` because GNU coreutils didn't have a test for that either; now coreutils has a test for it too so that they don't have a regression in the future, and everyone's software gets better.
by lzaf | 2025-10-24 16:07:59+00:00
On a similar vein some time ago I had written a small toy lib that emulates the os.File interface for nmap backed files: https://github.com/zaf/yammap, It even handled bus errors without panicking: https://github.com/zaf/yammap/blob/186f714343906bb9304ad5f30...

Read and write performance was usually better especially with larger write sizes. Compared to os.File:

~/src/yammap$ go test -benchtime=4s -bench . goos: linux goarch: amd64 pkg: github.com/zaf/yammap cpu: AMD Ryzen 9 5900X 12-Core Processor BenchmarkWrite-24 29085 164744 ns/op 25459.52 MB/s BenchmarkOSWrite-24 22204 215131 ns/op 19496.54 MB/s BenchmarkRead-24 29113 166820 ns/op 25142.72 MB/s BenchmarkOSRead-24 27451 172685 ns/op 24288.69 MB/s
by lucideer | 2025-10-24 16:08:23+00:00
Acknowledging that a huge number of people (the vast majority) are going to use the only option they know rather than the best of a set of options they know, I still think that for a person who's fully versed in all available options, Websockets is a better option than you make out.

> they're barely more convenient as raw sockets

Honestly, raw sockets are pretty convenient - I'm not convinced Websockets are more convenient at all (assuming you already know both & there's no learning curves). Raw sockets might even be more convenient.

I think it's features rather than convenience that is more likely to drive Websocket usage when comparing the two.

> they also add a bunch of performance and complexity overhead over raw sockets

This is the part that I was getting at in my above comment. I agree in theory, but I just think that the "a bunch" quantifier is bit of an exaggeration. They really add very very little performance overhead in practice: a negligible amount in most cases.

So for a likely-negligible performance loss, & a likely-negligible convenience difference, you're getting a protocol with built-in encryption, widespread documentation & community support - especially important if you're writing code that other people will need to take over & maintain - & as you alluded to: extensibility (you may never need browser support or http proxying, but having the option is compelling when the trade-offs are so negligible).
by Ekaros | 2025-10-24 16:09:03+00:00
I doubt they will touch crates. There are hundreds to hundreds of thousands of transactions on each type each day. And they take their cut on each of those.

One example I checked was about 0.20 going to Valve on each sold on market. And they sold 280 thousand of them in last 24 hours. So 56 thousand in single day by minimal effort.
by philbe77 | 2025-10-24 16:09:18+00:00
Hi mosselman, GizmoEdge is not open-source. DeepSeek has "smallpond" however, which is open-source: https://github.com/deepseek-ai/smallpond

I plan on getting GizmoEdge to production-grade quality eventually so folks can use it as a service or licensed software. There is a lot of work to do, though :)
by monooso | 2025-10-24 16:09:46+00:00
Could you expand on your criticism?

OP stated that:

> Developers who use AI think they're quicker and better, but they're actually slower and worse.

You responded that this is a "gross overgeneralization of the content of the actual study", but the study appears to back up the original statement. To quote the summary:

> When developers are allowed to use AI tools, they take 19% longer to complete issues—a significant slowdown that goes against developer beliefs and expert forecasts. This gap between perception and reality is striking: developers expected AI to speed them up by 24%, and even after experiencing the slowdown, they still believed AI had sped them up by 20%.

(I realise newer models have been released since the study, but you didn't claim that the findings have been superceded.)
by skeeter2020 | 2025-10-24 16:10:41+00:00
I'd get dirt on the sitting president, then leverage him to make decisions with obvious market implication. Examples: give me a day's notice that the federal government is going to invest in a dinky mining company, or tariffs are coming on foreign electronics... except next week <these companies> are exempt. You gotta believe people on the inside are making fortunes as the markets continue to make big swings up & down.
by mort96 | 2025-10-24 16:10:56+00:00
Completely depends on what you're doing. If you're working on GUI software for example, you need to run that on your local machine. This is much easier if you're compiling and running the software on the same machine.

Then there are non-development tasks, like 3D modelling or video editing.

Remote desktop is a kind of solution, but it's extremely sub par. Latency is not good unless you're on the same LAN in my experience.
by nineplay | 2025-10-24 16:11:06+00:00
I read an article about a similar WWII woman's service and more than anything these women's jobs were to be warm and friendly to a bunch of young scared solders who far from home and wondering if they'd make it back.

So they'd smile and they'd flirt and they'd charm and they'd dance and maybe the boys would feel less afraid or less homesick and maybe they'd have something to look forward to.

I'd bet just that was enough for some appreciative solders to give her a pin, if only to remember them by.
by dragonwriter | 2025-10-24 16:11:19+00:00
Biden issued sweeping pardons to expected targets of Trump's anticipated (and fairly explicitly signalled) partisan weaponization of DoJ, which is an effective and costly political punishment even if it never secured a conviction, but so long as a suitable pretext can be found.

As we now see that being executed after mass partisan purges and, in several cases (sone where this is already adjudicated, more where it is pending) illegal appointments because that was the only way yo get or keep willing hacks in position to carry out the prosecutions, its arguable the only thing Biden did wrong in that regard was not doing it widely enough.
by cubefox | 2025-10-24 16:11:23+00:00
> Steam provides payment processing,

Other services do the same for arbitrary online shops, at much lower fees. In fact, Valve likely doesn't even run it's own payment processing, but merely integrates other services.

> cloud saves, ratings, game tags, social integration, wishlisting and sale notification, search indexing, game discovery, a bunch of incredibly useful APIs including networking and input, Linux compatibility

The development cost of these features is likely no larger than of one single AAA game. Yet they charging 30% on hundreds or thousands of AAA games and other games.

> This is not only false, due to the above value-adds, but intentionally false because I never gave a definition - you made one up and attributed it to me to lie about my positions.

You clearly stated that Steam is fine because it is useful. But anything sold by a monopoly can be useful while still being massively overpriced. Which proves that mere usefulness of something doesn't mean the price of it is justified. Which refutes your original usefulness argument.

> And yes, there is competition

Yes, but the fact that there is theoretically competition doesn't mean it is working. Large platforms like Steam benefit from network effects which come from their size alone. People will simply stay at Steam because that's already were their other games are, and because they don't see the massive 30% fee, that Valve is keeping, as some cost they have to pay. Any other platform faces a "chicken and egg" style uphill battle against these effects, even if they charge a substantially lower fee.

> Your comments are false due to your total ignorance of reality, and your malicious lying

Rather than hurling insults at me consider the simple question: If Steam was so fairly priced, wasn't charging excessive fees, how can it be that they have an extremely high profit margin? Realistically, that can only be because Valve's revenue from Steam vastly exceeds the costs of running and maintaining it.
by cthalupa | 2025-10-24 16:11:46+00:00
Meanwhile I've had bare metal be a complete outage for over a day because a backhoe decided it wanted to eat the fiber line into our building. All I could do was twiddle my thumbs because we were stuck waiting on another company to fix that.

Could we have had an offsite location to fail over to? From a technical perspective, sure. Same as you could go multi-region or multi-cloud or turn on some servers at hetzner or whatever. There's nothing better or worse about the cloud here - you always have the ability to design with resilience for whatever happens short of the internet on the whole breaking somehow.
by Gormo | 2025-10-24 16:11:47+00:00
Jail is a great deterrent against criminal conduct. But natural persons are already risking jail when they engage in criminal conduct regardless of whether they're doing so within the scope of an organization or doing so on their own initiative.

Jail isn't on the table for financial liability or civil torts in the first place, and since pretty much all the forms of liability involving commercial conduct we're discussing here are financial liability or civil torts, it's not really relevant to the discussion.
by rewqaz555 | 2025-10-24 16:11:48+00:00
I get why they wanted to do this, but I don't get why they made it this way, I mean yeah it makes a bit money in short term, but creates terrible problems long term.

First of all having 3 billions less in economy means we are 3 billions closer to recession. Worth keeping in mind that games are not essential.

Second thing is trust, without it whole steam can implode. Whole business is based on infinite purchases.

Third thing is people may do harm to themselves and this usually brings eye of Sauron.
by hanikesn | 2025-10-24 16:11:59+00:00
>I'm not really sure what to do. Maybe this MacBook Pro was just a one-off, and I have to go back to buying Windows laptops and putting Linux on them. But they just aren't as nice.

Why would you think that? They're working hard on upstreaming all patches ATM, adding new hardware support will be much easier afterwards.
by xpe | 2025-10-24 16:12:17+00:00
> ... a decent fraction of humanity ... can't easily distinguish between "Claude told me how it got its answer" and "the statistical model made up some text that looks like reasons but have nothing to do with what the model does".

Yes, I also think this is common and a problem. / Thanks for stating it clearly! ... Though I'm not sure if it maps to what others on the thread were trying to convey.
by mnhnthrow34 | 2025-10-24 16:12:39+00:00
Not necessarily.

You know that it's true that stealing is against the ten commandments, so when the LLM says something to that effect based on the internal processing of your input in relation to its training data, YOU can determine the truth of that.

> The training data contains all kinds of truths.

There is also noise, fiction, satire, and lies in the training data. And the recombination of true data can lead to false outputs - attributing a real statement to the wrong person is false, even if the statement and the speaker are both real.

But you are not talking about simple factual information, you're talking about finding uncomfortable truths through conversation with an LLM.

The LLM is not telling you things that it understands to be truth. It is generating ink blots for you to interpret following a set of hints and guidance about relationships between tokens & some probabilistic noise for good measure.

If you find truth in what the LLM says, that comes from YOU, it's not because the LLM in some way can knows what is true and give it to you straight.

Personifying the LLM as being capable of knowing truths seems like a risky pattern to me. If you ever (intentionally or not) find yourself "trusting" the LLM to where you end up believing something is true based purely on it telling you, you are polluting your own mental training data with unverified technohaikus. The downstream effects of this don't seem very good to me.

Of course, we internalize lies all the time, but chatbots have such a person-like way of interacting that I think they can end run around some of our usual defenses in ways we haven't really figured out yet.
by danudey | 2025-10-24 16:12:42+00:00
One great way you can make things more secure is by reducing attack surface. sudo is huge and old, and has tons of functionality that almost no one uses (like --chroot). A from-scratch rewrite with a focus on the 5% of features that 99% of users use means less code to test and audit. Also a newer codebase that hasn't grown and mutated over the course of 35 years is going to be a lot more focused and easier to reason about.
by pessimizer | 2025-10-24 16:12:42+00:00
> considering the geopolitical pressures on huge companies like this.

This seems backwards. The reason they can't be broken up is because of the pressure that huge companies like this put on individuals in government.

No different than why a small town mayor can't jail the organized crime ring that runs his town. If he tries anything, they will shoot him; or at least put up posters all over town accusing him of being a pedophile (and pay somebody to file charges against him that will eventually be dismissed for lack of evidence.) He wouldn't have become mayor in the first place if they hadn't supported him and attacked his potential competitors.
by bryanlarsen | 2025-10-24 16:12:42+00:00
> Unfortunately for the West every good river has already been damed so we can't follow them there.

You don't need a river for hydro power storage. All you need are two reservoirs with a height difference between them. Typically one of the two reservoirs is preexisting and the second is constructed. ANU identified ~1 million potential sites.

https://re100.eng.anu.edu.au/global/
by tencentshill | 2025-10-24 16:13:08+00:00
It just looks really bad when that one in a million death is caused by something stupid a human would never do. So far these Waymos are only replacing taxi and Uber drivers, which have a lower rate of accidents than the general population.

"Uber reported 0.87 fatalities per 100 million vehicle miles traveled (VMT) in 2021–2022"

https://insurify.com/car-insurance/insights/rideshare-driver...
by ratelimitsteve | 2025-10-24 16:13:34+00:00
the problem is that since 1911 the house has also been a compromise for smaller states to have leverage because it's capped at 435 total members regardless of population. we've gone from a system of dynamic tension between popular rule and representation for smaller populaces to a system where both houses are on the side of the "underrepresented" to an extent where they're actually vastly overrepresented. Combine that with the electoral college (which again allows a ruling elite to overrule the populace and advantages smaller states) and the fact that the elitist president and elitist senate pick the supreme court and you can see where the so-called "underrepresented" populations are actually the ones in charge of every branch of government.

This is, of course, exactly what the founding fathers intended. They disliked kings but they feared rule by common people and always intended there to be a privileged class of citizenry that does the actual ruling because people like you and me are just too ignorant to be trusted with that. That's why they excluded the vast majority of people from voting at all and those that were allowed to vote had their power diluted by various mechanistic means like capping the senate, flooring the house (and later capping it as well), using the electoral college to make sure that those precious few who vote at all don't vote incorrectly and having the least representative members of the executive and legislative branch select the judicial branch so that they're not swayed by "politics" (read: what the governed actually want).

And that's how we have a system that claims to be a democracy but where what people want is actually completely disconnected from what happens, and where "The opinions of 90% of Americans have essentially no impact at all" (https://act.represent.us/sign/problempoll-fba/).
by rayiner | 2025-10-24 16:13:53+00:00
No, because then you’re just centralizing power in the hands of a specific group of people—Ivy League law school graduates—that have distinctive cultural and class interests. Maybe you think that’s a good idea today. But in the mid-20th century these institutions were the bastion of WASPs, long after that group lost electoral control of the country due to immigration. (Watch the movie The Good Shepherd.) Your system would’ve given the FBI/CIA/DOJ powerful tools to destroy the presidencies of FDR and JFK. There’s a reason the conspiracy theory exists that the CIA assassinated the first catholic president.

The founders were right that nobody can be trusted to neutrally enforce “the law.” If you could trust Harvard graduates as a class to do that, there would be no reason for checks and balances or separation of powers.
by notepad0x90 | 2025-10-24 16:13:59+00:00
From personal experience, laptops that cost $30000+ (yes, USD) still come nowhere close to even a macbook air in terms of build quality. They have much better specs, but if you run Windows on it, the effects are much less pronounced. I have moved from a new Dell to a macbook with half the cpu and ram and for me t least it "feels" like the macbook is twice as fast and as responsive. I don't know if it is just better architecture or fine tuned software, but that's my experience.

Apple used the whole "economy of scale" effect to invest in specialized tooling/machining that would be too costly to recover the ROI for other OEMs. Keep in mind that consumer laptop makers to the most part don't make a profit (or have a low profit margin - last i checked at least) on laptops and printers. No one else has made the economics of using quality material, top of the line design, and specialized machining/tooling work like Apple.
by divan | 2025-10-24 16:14:08+00:00
That's actually working technique in sports psychology – one version of it called VSM (Video Self-Modelling), where edited video shows athlete performing correct/advanced technique. It tricks brain to belive in "future self". I'm not surprised it works with photos that well, but I think it's not studied yet. These AI photos I make a very different from, say, photoshopped faced. I tried it on myself too, and can confirm that it does have psychological effect.
by gxonatano | 2025-10-24 16:14:28+00:00
I've used dozens of notetaking tools over the years. Some cloud-based, some markdown-based, some flashy apps, some plain-text, some open-source, and some closed-source. My takeaway from years of jumping between them is this: don't use closed-source notetaking software. Just don't do it. Even if your data is in markdown files, on your own computer, you're still probably stuck with proprietary markdown extensions, and at the very least, you're stuck with muscle memory for the app's UI that you'd have to translate to some new system eventually. Startup companies come and go, on a monthly basis. Developers move on to shiny new projects. You can't take that risk, or any other security risks, with your personal notes.