MurphyA/hacker-news huggingface dataset:
by Jordan-117 | 2025-10-23 18:09:56+00:00
Yeah, that and Gemini 2.5. They actually were able to help identify a handful based on context clues, or at least narrow it down enough that I could find it myself. But there were three I couldn't crack -- even a forum dedicated to solving GE puzzles came up empty:

https://googleearthcommunity.proboards.com/thread/10731/ulti...
by dabockster | 2025-10-23 18:10:08+00:00
Depends on what VMware product you’re using. I’m still stuck on Workstation Pro because Hyper-V takes over my computer and slows down anything virtualized that isn’t Windows.

For servers, there’s things like Proxmox that are super versatile and can be deployed to a 1U server in a few hours. And if whatever you’re virtualizing exists mostly in the application/user layer and doesn’t touch lower level APIs (eg raw TCP), Docker/Portainer is even better (no Kubernates required!).
by Jtsummers | 2025-10-23 18:10:09+00:00
That doesn't undermine their statement at all. They wrote hundreds or thousands, perhaps you misread it as hundreds of thousands? 67,000 killed per your link, assuming only 1% were LGBTQ, means around 670 LGBTQ people killed, which falls well within the standard definition of "hundreds". Even if they only make up 0.5% of the population, it's still hundreds. And to hit "tens" they only need to be about 0.1% of the Gazan population.
by pietz | 2025-10-23 18:10:30+00:00
It has been wild watching deta over the years.

They didn't pivot, they completely reinvented themselves. Twice.

I loved their first cloud offering, which they sadly abandoned.

Then they launched Space, which was kinda cool, but mostly weird and raised the question "why?". Also cancelled.

Surf looks mostly cool, although I also don't quite understand it. It seems like Notion with a different twist on AI. Not sure. Since I'm fairly happy with my Obsidian + Codex setup, I'll pass for now. The good news is, this one's open source!

I'd love to know how they're financing all of this. They have been around for years and users never even had the option to drop money in their lap. Now they're trying open source. Wild ride.

All the best!

PS: I would have paid for deta cloud Pro ;)
by pkolaczk | 2025-10-23 18:10:45+00:00
Oh, thanks, good to know. Now I feel more motivated. Because actually it’s not as easy as it looks from the text books. It’s like with drawing an owl. Yeah, pass the signal through a mixer and feed recovered carrier to its LO port and you’re done. Sure. Simple. Now just recover the carrier. So far I have built a PLL that locks to a clean signal but stops locking when the signal is modulated too much. Aargh.
by rayiner | 2025-10-23 18:10:47+00:00
> You should look at what gerrymandering has done / is doing.

What has it done? In 2024, Republicans got 50.5% of the seats and 51.3% of the two-party Congressional popular vote. The delta between a party’s share of the popular vote and its share of House seats is much smaller since 2000 than it was for most of the 20th century: https://upload.wikimedia.org/wikipedia/commons/thumb/e/e6/Po...

> The VRA is quite literally before SCOTUS right now

The VRA requires racially discriminatory gerrymandering and is probably unconstitutional in that respect. The VRA is the product of an era where white democrats would discriminate against black democrats even though they shared a party. Today, gerrymandering is based on political party, not race. If black people voted 80% republican, red states would happily gerrymander out affluent college-educated whites in their favor.
by mike_hearn | 2025-10-23 18:11:19+00:00
sandbox-exec isn't really deprecated. It's just a tiny wrapper around some semi-private undocumented APIs, it says that because it's not intended for public use. If it were actually deprecated Apple would have deleted it at some point, or using it would trigger a GUI warning, or it'd require a restricted entitlement.

The reason they don't do that is because some popular and necessary apps use it. Like Chrome.

However, I tried this approach too and it's the wrong way to go IMHO, quite beyond the use of undocumented APIs. What you actually want to do is virtualize, not sandbox.
by bodiekane | 2025-10-23 18:12:14+00:00
> with real world accountability

So the government can neutralize every journalist, political opponent, whistleblower or whoever by whatever means are most effective in their particular jurisdiction (China- disappear, Russia- jail, US- arrests, lawsuits, firing).

We need better tools for filtering out the bad actors, not just throwing the baby out with the bath water and accepting totalitarian control from a handful of dictators and wannabe-dictators.
by cogman10 | 2025-10-23 18:12:15+00:00
Yup, and I really hate it. Monopolies and oligopolies are really terrible in just about every way imaginable. Everyone that isn't an oligopoly gets screwed.

This is also simply the natural end state of free market capitalism. Every one of these giant businesses knows that by swallowing up smaller competitors they can ultimately improve their revenue without improving quality or actually innovating/competing.

Companies like sysco should have never been allowed to merge with other distributors and they should absolutely be broken up.
by javcasas | 2025-10-23 18:12:46+00:00
My bad, this is open telemetry stuff to check the status of your servers, not for vendors to extract as much data as they can from you.

> I'm trying to find how they implemented the "use workflow" thing, and before I could find it I already found https://github.com/vercel/workflow/blob/main/packages/core/s...

> Telemetry is part of the core.

> Yuck.
by Jeslijar | 2025-10-23 18:13:21+00:00
So that's not the same thing. Docker "official images" are a category of curated docker images. Minio is not one of them. The official curated images are here: https://hub.docker.com/u/library

The minio image is basically a community one that anyone could have created, but still shows in overall docker hub. It's created by minio themselves. I'm kind of surprised they haven't removed it, but with over a billion downloads they are easily in the top ten of whatever category they fall under creating substantial free advertisement.
by ta1243 | 2025-10-23 18:13:23+00:00
archive.org resolves to 207.241.224.2 using cf, google and quad9

This is just tcp to 207.241.224.2 port 80 (delivered via curl) or from a router.

SYN goes out, nothing comes back.

I can't reach it from AS16509 (AWS eu-west-2), AS17547 (MOne in Singapore), AS18106 (Viewquest Singapore), AS20712 (UK), or AS4755 (Tata in India)

I can reach it from AS23674 (Nayatel Pakistan), AS174 (Cogent in US), AS3356 (Level3 in US), AS46887 (Crown Castle in US) and AS7545 (TPG Sydney)

I can also reach it via mozillavpn on AS39351 (London) and presumably other sites

Multiple machines, multiple ISPs, multiple ways to the internet. Very odd.

Thanks for confirming it's not fully broken though
by vladms | 2025-10-23 18:13:29+00:00
I think the idea of financial transparency should be more discussed at any level. Yes, there will be loopholes, but now the default is "money is secret, how dare you!".

I would claim that democracy was an ideal at any point in time. Most people have/had insufficient education to understand all the topics. Even in more advanced countries (with better education on average) the discourse gets focused on petty issues. The societies that will be able to focus on the longer term will be the next centuries winners!
by palmotea | 2025-10-23 18:13:32+00:00
>> I would think email is a lot easier than a webform.

> why

Because email is a well-honed tool with lots of excellent implementations. You've got formatting, attachments, a text-entry region bigger than a peephole, etc.

A "contact us" webform is a crappy tool, usually quickly thrown together, that probably just sends an email anyway.
by Supermancho | 2025-10-23 18:14:28+00:00
This is the painful period of time where the US would have to collectively realize they are missing controls on the branches, in the form of amendments. Unfortunately, it looks like the people are lazy. They rather lose the union, before agreeing there really is a problem to be solved. Otherwise, there's no way to know there's a problem.

Modern crisis planning in action. Wait till the fuel is on fire, before putting out the fire, assessing the loss and assigning blame.
by umanwizard | 2025-10-23 18:14:32+00:00
> without actually making off with all of the gold

This is the key difference. The comment I was replying to implied that the transaction was actually completed, or at least I thought it did.

If the guy[0] didn't indeed actually benefit from the vulnerability then that is a very different story, and I don't think he should be arrested in that case.

0: not "kid" -- he is 18 which I assume is above the age of criminal responsibility in Hungary.
by ndriscoll | 2025-10-23 18:14:41+00:00
> Best to get insecure and vulnerable software out of the hands of those who may not be familiar with this CVE or their change in policy that has not gotten a press release in any way.

Why is that the best? MinIO is not the type of thing that people ought to be directly making available on the Internet anyway, so CVEs are mostly irrelevant unless you are an organization that has to keep on top of them, in which case you certainly have a process in place to do so already.

People straight pulling an image off Dockerhub (so not a particularly sophisticated use-case) to run seem like they'd be the least likely to be impacted by a CVE like this. The impact is apparently "[it] allows the attacker to access buckets and objects beyond their intended restrictions and modify, delete, or create objects outside their authorized scope". Are people pulling from Dockerhub even setting up anything but the absolute most basic (Allow All) ACL?
by drak0n1c | 2025-10-23 18:14:49+00:00
They're the main open source privacy-preserving video models that VeniceAI has started offering with a convenient frontend. Ovi is one with image to video and there is also Wan 2.1 image to video, Wan 2.2 text to video. Wan 2.5 is available but it's routed in an anonymized fashion to the official provider. They're also much more affordable compared to the routed Kling, Veo, and Sora options.
by fenomas | 2025-10-23 18:14:54+00:00
Funny, just yesterday I found myself casting in a way I'd never seen before:

const arr = ['foo'] as ['foo']

This wound up being useful in a situation that boiled down to:

type SomeObj = { foo: string, bar: string } export const someFn = (props: (keyof SomeObj)[]) => {} // elsewhere const props = ['foo'] as ['foo'] someFn(props)

In a case like that `as const` doesn't work, since the function doesn't expect a readonly argument. Of course there are several other ways to do it, but in my case the call site didn't currently import the SomeObj type, so casting "X as X" seemed like the simplest fix.
by nradov | 2025-10-23 18:14:56+00:00
The pro sports leagues made a Faustian bargain when they partnered with sports books like FanDuel and BetMGM. Those deals brought in licensing revenue and drove up short term fan engagement because the punters betting on games watch the whole thing without switching channels. But long term I think it's going to burn their business model. The temptation for players to take a bribe is huge and now every time fans see something happen on the field that seems unexpected they start to doubt whether it's real. If the leagues don't get a handle on this then in a few decades they'll be seen as jokes: anyone still watching will be doing it for campy or ironic entertainment like professional wrestling.
by duxup | 2025-10-23 18:15:14+00:00
>Omnilert later admitted the incident was a “false positive” but claimed the system “functioned as intended,” saying its purpose is to “prioritize safety and awareness through rapid human verification.”

It's ok everyone, you're safer now that police are pointing a gun at you, because of a bag of chips ... just to be safe.

/s

Absolutely ridiculous. We're living "computer said you did it, prove otherwise, at gunpoint".
by mlsu | 2025-10-23 18:15:21+00:00
Yeah, of course. But the argument is, at this future point, you must adjust policy to meet your obligations: either you can print more money, or you can cut services. But you must choose one or the other of those things.

The issue I think most people are correctly pointing out is that our current debt is unreasonable -- that it constrains our future policies way too much. Cutting services is effectively impossible in our politics, which leaves only inflation on the table. That's pretty much the same as default. That is where we're headed.
by tennysont | 2025-10-23 18:15:32+00:00
I recently noticed an issue where tailscale was placing its iptables rules above my system firewall (`ts-input all -- anywhere anywhere` before `nixos-fw`). The tailscale input chain looked like this:

Chain ts-input (1 references) target prot opt source destination ACCEPT all -- pan anywhere RETURN all -- 100.115.92.0/23 anywhere DROP all -- 100.64.0.0/10 anywhere ACCEPT all -- anywhere anywhere

That seemed bad, but I'm not super familiar with iptables, so I ask Claude 4.5 Sonnet through Kagi. It gives me:

No, nixos-fw IS run on most packets. Let me explain the iptables chain flow: How the Chain Processing Works In iptables, when a user-defined chain (like ts-input) is called: - ACCEPT: Accepts the packet within that chain and returns to the calling chain (INPUT), where processing continues with the next rule - RETURN: Simply returns to the calling chain and continues processing - DROP: Drops the packet entirely (no further processing anywhere)

Which is very very wrong. I highlighted the similarity between ACCEPT and RETURN in its explanation, not even with that much conviction or forcefulness, and it turned on a dime.

You're absolutely right to question that - I made an error! Let me correct it: ... Most packets DON'T reach nixos-fw because: ...

I also had another incident where it looked over a backup script, and gave it an ok, but failed to alert me that `gpg -as --encrypt-to <ID>` requires `-e` to actually do the encryption. By that point I was wiser, and had o3-pro look over the script, which caught it right away.

I'm not sure why AI is so completely trash at security. In fairness, the average software dev is also worse at security compared to writing code, and the answer to many stackoverflow questions is "add --insecure --no-check --bypass-tsl", but I'm still a little shocked at how bad AI is.
by lnxg33k1 | 2025-10-23 18:16:12+00:00
Since the whole docker thing where people were complaining about having to pay 10USD, I am happy when OSS projects pull the rug, tech bros you're paid to solve your company's issues, nobody in OSS owes you anything, go earn your salary and build the docker image that fix the CVE, or stfu

We all know you don't care about loyalty correctness or anything, you just someone to do the work you're paid for
by palmotea | 2025-10-23 18:17:09+00:00
> Is "mandatory" spending actually fundamentally mandatory? Characterizing it as such feels like a sleight of hand that prevents us from discussing whether that spend is truly necessary.

> In an overspending crisis of such magnitude I wish there was more urgency in the culture to cut spending across every budget segment regardless of whether it's "mandatory" or not.

I'm betting it includes stuff like Social Security payments, Medicare, etc. So it's fundamentally mandatory as real people's lives were planned around its availability.
by rolph | 2025-10-23 18:17:11+00:00
Omnilert later admitted the incident was a “false positive” but claimed the system “functioned as intended,” saying its purpose is to “prioritize safety and awareness through rapid human verification.”

prioritize your own safety by not attending any location fitted with such a system, or deemed to be such a dangerous environment that such a system is desired.

the AI "swatted" someone.
by president_zippy | 2025-10-23 18:17:25+00:00
When you put it that way, I think whether culture is upstream of business or vice versa and whether people have free will or are merely conduits for things their senses receive are unanswerable questions. All I know is this:

"If you treat people as they are, they will become worse. If you treat them as they could be, they will become better.

If we treat people as if they were what they ought to be, we help them become what they are capable of becoming."

-Johann Wolfgang von Goethe, Wilhelm Meister’s Apprenticeship

I'm convinced that treating most people as if they have free will is more likely to get them to at least consider my ways.
by yndoendo | 2025-10-23 18:17:57+00:00
The city I live in has number of locally owned restaurants that easily compete against McDonalds and Wendys price point. I find the quality of food to be better.

Lack of communication to outsiders and visitors about those that compete against such establishments is key. The larger organizations have more capital to advertise and help capture that economic arena.

Personally, when I travel, I go out of my way to find local establishments over large franchises because the former slowly siphons out the local economy to some CEO that gets paid millions. The latter helps keep the competition local economy health. I haven't given Starbucks a penny in over 7 years and plan to never fund their organization ever again.
by Retric | 2025-10-23 18:18:40+00:00
> This assumes 'we' (ie societies) are in a position to stop it

There’s major advantages to understanding the world as it is independent anything else. People make tradeoffs around harm all the time, pretending it doesn’t exist is pointless.

We can mitigate harm from earthquakes and blizzards independently from our ability to prevent such events. That comes from understanding such events as more than just acts of gods who would happily use other means should we try to mitigate the harm from earthquakes etc.
by constantcrying | 2025-10-23 18:19:17+00:00
Who cares? This is not even close to the actual harmful use of AI.

Zero people are harmed by this. The idea that this is more worthy of attention, than e.g. the creation of humiliating or pornographic images of real people is absurd.

I get that this is "whataboutism", but to be honest this seems to be such a petty and minor complaint that it feels absurd to even consider this a real problem.

And on a final note. These images are used to invoke a sense of guilt in prospective donors, so that people donate to charities. I agree that these images are distasteful and should not be shown, real or fake.
by Spivak | 2025-10-23 18:19:33+00:00
Step 1: I made this thing and am freely giving it away for the benefit of everyone. Come join the party!

Step 2: Wow, because this is a community project I can depend on it continuing to exist freely thanks to a large base of diverse parties invested in its continued growth and availability.

Step 3: Just kidding, I'm taking back the thing I made. Sorry if you were depending on it, migrate to something else or pay me.

Step 4: WTF dude?!

Step 5: Why are you all so entitled?
by wasmperson | 2025-10-23 18:19:59+00:00
I interpreted your question as "do I now no longer need to escape user-generated data in the HTML sent by the server in response to requests by HTMX?" The short answer is no, you still need to escape it:

- HTMX adds extra significance to HTML attributes which aren't accounted for by the built-in sanitizer

- HTMX can't add a custom sanitizer because it wouldn't be able to distinguish between intentional and malicious uses of those attributes

- Even if the HTMX client library sanitized all of the HTML from the server, you can't guarantee that all requests to the server will come from HTMX: browsers can navigate to your "back-end" URLs directly. While you can protect yourself from this using HTTP headers, that's not something I'd feel comfortable relying on since it would be easy to not notice when you've accidentally gotten it wrong.

The HTMX website has a longer explainer on how to protect yourself from XSS when using the library:

https://htmx.org/essays/web-security-basics-with-htmx/
by eadmund | 2025-10-23 18:20:17+00:00
> I have never once thought Visual Studio needs some way to edit its own source code on the fly... whats [sic] the actual use case?

Writing Visual Studio, for example. Debugging Visual Studio. Extending Visual Studio in more than the ways it has already provided.

It means not being constrained to do only those things someone else had seen fit to permit you to do. It means freedom.
by dheera | 2025-10-23 18:20:27+00:00
I once did an internship in a small town in Germany. There were 2 bakeries in this town. One closed for all of July as vacation, the other took all of August as vacation. They had coordinated this with each other so that everyone could always buy bread and pastries, but the bakers could also get their vacations. They would even put signs on their doors letting people know that the other bakery was open during their vacation.

I feel like in the US or Asia this would never happen. In these hyper-capitalist and competitive societies, both bakeries would jump on the opportunity of extra business, sacrifice their family and fun time, and neither would take any vacation. Two bakeries in a town would see each other as mortal competitors instead of collaborators and take every opportunity to eat into the others' business.
by reconnecting | 2025-10-23 18:20:44+00:00
OK, have a look at GitHub contributors metric. 404 today, 405 yesterday.

Just to clarify, I'm not affiliated with or protecting MinIO, I don't know anything about this software. But it seems to me that there's some overreaction about Docker here, and in reality it is highly possible that this decision might not affect the product the way it's being discussed these days.
by jorvi | 2025-10-23 18:20:48+00:00
Quick slaptogether. I'm decidedly mediocre at web so if anyone has improvements, please post them :)

// ==UserScript== // @name HN OP highlight // @version 0.1 // @description Find OP username and change username color to blue // @match https://news.ycombinator.com/item?id=* // @grant none // @run-at document-end // ==/UserScript== (function() { 'use strict'; // get OP 'userid' from class 'hnuser' in post subtext const opUsername = document.querySelector('span.subline a.hnuser')?.getAttribute('href'); // Match other instances of same 'userid' in 'hnuser' class elsewhere in page if (opUsername) { const opHighlight = document.createElement('style'); opHighlight.textContent = ` /* Post header username */ span.subline a.hnuser[href="${opUsername}"], /* Comment header username */ span.comhead a.hnuser[href="${opUsername}"] { color: #2749F5 !important; } `; document.head.appendChild(opHighlight); } })();
by sedatk | 2025-10-23 18:20:52+00:00
There's a Turkish saying, "a human will [use] this, a human!", to signify that the thing is so abnormal/out-of-proportion that it doesn't seem to be made for people. The verb changes based on the context. If you had made too much food for example, the verb would be "eat". I think it's a great motto for design.

Remember the Game of Thrones quote, "the man who passes the sentence should swing the sword"? I think it should also be applied to specs. Anyone who comes up with a spec must be the first responsible party to develop a parser for it. The spec doesn't get ratified unless it comes with working parser code with unit tests.

That kind of requirement might actually improve specs.
by sebasvisser | 2025-10-23 18:20:53+00:00
Sure, hate on the person pointing at the fire instead of the people holding the matches.

If you aren’t prepared to face criticism after a failure, you shouldn’t participate in a professional environment. Without people pointing out where it went wrong you’ll never j ow what to improve upon. Because if you knew, and chose not to act..now that would be a whole new level of incompetence.